diff --git a/browsers/edge/group-policies/index.yml b/browsers/edge/group-policies/index.yml index 0b2aef014b..0f970282ed 100644 --- a/browsers/edge/group-policies/index.yml +++ b/browsers/edge/group-policies/index.yml @@ -9,7 +9,7 @@ metadata: keywords: Microsoft Edge Legacy, Windows 10 ms.localizationpriority: medium ms.prod: edge - author: shortpatti + author: dougeby ms.author: pashort ms.topic: landing-page ms.devlang: na diff --git a/browsers/edge/index.yml b/browsers/edge/index.yml index 04b23cd56e..accbb0e679 100644 --- a/browsers/edge/index.yml +++ b/browsers/edge/index.yml @@ -11,7 +11,7 @@ metadata: ms.localizationpriority: medium ms.topic: landing-page # Required ms.collection: collection # Optional; Remove if no collection is used. - author: shortpatti #Required; your GitHub user alias, with correct capitalization. + author: dougeby #Required; your GitHub user alias, with correct capitalization. ms.author: pashort #Required; microsoft alias of author; optional team alias. ms.date: 07/07/2020 #Required; mm/dd/yyyy format. diff --git a/browsers/edge/microsoft-edge-faq.yml b/browsers/edge/microsoft-edge-faq.yml index 96038bd4ce..bfb48a3544 100644 --- a/browsers/edge/microsoft-edge-faq.yml +++ b/browsers/edge/microsoft-edge-faq.yml @@ -62,7 +62,7 @@ sections: - question: Will Internet Explorer 11 continue to receive updates? answer: | - We're committed to keeping Internet Explorer a supported, reliable, and safe browser. Internet Explorer is still a component of Windows and follows the support lifecycle of the OS on which it's installed. For details, see [Lifecycle FAQ - Internet Explorer](https://support.microsoft.com/help/17454/). While we continue to support and update Internet Explorer, the latest features and platform updates will only be available in Microsoft Edge. + We're committed to keeping Internet Explorer a supported, reliable, and safe browser. Internet Explorer is still a component of Windows and follows the support lifecycle of the OS on which it's installed. For details, see [Lifecycle FAQ - Internet Explorer](/lifecycle/faq/internet-explorer-microsoft-edge). While we continue to support and update Internet Explorer, the latest features and platform updates will only be available in Microsoft Edge. - question: How do I find out which version of Microsoft Edge I have? answer: | diff --git a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md b/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md index a285c99103..ca1542a952 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md +++ b/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md @@ -14,9 +14,7 @@ ms.author: dansimp [!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] -Return to: [Deprecated document modes and Internet Explorer 11](deprecated-document-modes.md)
+Return to: [Deprecated document modes and Internet Explorer 11](deprecated-document-modes.md) -

- Full-sized flowchart detailing how document modes are chosen in IE11 -

+:::image type="content" source="images/docmode-decisions-lg.png" alt-text="Full-sized flowchart detailing how document modes are chosen in IE11" lightbox="images/docmode-decisions-lg.png"::: diff --git a/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md b/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md index 66b29a20c4..58a2d5298b 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md +++ b/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md @@ -36,11 +36,4 @@ Use the topics in this section to learn about how to auto detect your settings, |------|------------| |[Auto detect settings Internet Explorer 11](auto-detect-settings-for-ie11.md) |Guidance about how to update your automatic detection of DHCP and DNS servers. | |[Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md) |Guidance about how to add, update and lock your auto configuration settings. | -|[Auto proxy configuration settings for Internet Explorer 11](auto-proxy-configuration-settings-for-ie11.md) |Guidance about how to add, update, and lock your auto-proxy settings. |  - - - - - - - +|[Auto proxy configuration settings for Internet Explorer 11](auto-proxy-configuration-settings-for-ie11.md) |Guidance about how to add, update, and lock your auto-proxy settings. | diff --git a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.yml b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.yml index b025aa3409..4f545f92d9 100644 --- a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.yml +++ b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.yml @@ -24,9 +24,6 @@ summary: | sections: - name: Ignored questions: - - question: | - Frequently Asked Questions - answer: | - question: | What operating system does IE11 run on? answer: | @@ -250,4 +247,4 @@ additionalContent: | - [Microsoft Edge - Deployment Guide for IT Pros](/microsoft-edge/deploy/) - [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md) - - [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md) \ No newline at end of file + - [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md) diff --git a/browsers/internet-explorer/kb-support/ie-edge-faqs.yml b/browsers/internet-explorer/kb-support/ie-edge-faqs.yml index 50862d688d..f7f8874d78 100644 --- a/browsers/internet-explorer/kb-support/ie-edge-faqs.yml +++ b/browsers/internet-explorer/kb-support/ie-edge-faqs.yml @@ -148,7 +148,7 @@ sections: - question: | Where to find Internet Explorer security zones registry entries answer: | - Most of the Internet Zone entries can be found in [Internet Explorer security zones registry entries for advanced users](https://support.microsoft.com/help/182569/internet-explorer-security-zones-registry-entries-for-advanced-users). + Most of the Internet Zone entries can be found in [Internet Explorer security zones registry entries for advanced users](/troubleshoot/browsers/ie-security-zones-registry-entries). This article was written for Internet Explorer 6 but is still applicable to Internet Explorer 11. @@ -193,7 +193,7 @@ sections: answer: | Internet Explorer 11 is the last major version of Internet Explorer. Internet Explorer 11 will continue receiving security updates and technical support for the lifecycle of the version of Windows on which it is installed. - For more information, see [Lifecycle FAQ — Internet Explorer and Edge](https://support.microsoft.com/help/17454/lifecycle-faq-internet-explorer). + For more information, see [Lifecycle FAQ — Internet Explorer and Edge](/lifecycle/faq/internet-explorer-microsoft-edge). - question: | How to configure TLS (SSL) for Internet Explorer diff --git a/education/includes/education-content-updates.md b/education/includes/education-content-updates.md index 227cfc8a46..ba848193c2 100644 --- a/education/includes/education-content-updates.md +++ b/education/includes/education-content-updates.md @@ -2,6 +2,15 @@ +## Week of November 29, 2021 + + +| Published On |Topic title | Change | +|------|------------|--------| +| 11/29/2021 | [What is Windows 11 SE](/education/windows/windows-11-se-overview) | added | +| 11/29/2021 | [Windows 11 SE settings list](/education/windows/windows-11-se-settings-list) | added | + + ## Week of November 15, 2021 @@ -12,13 +21,3 @@ | 11/18/2021 | [Deploy Windows 10 in a school district (Windows 10)](/education/windows/deploy-windows-10-in-a-school-district) | modified | | 11/18/2021 | [Deploy Windows 10 in a school (Windows 10)](/education/windows/deploy-windows-10-in-a-school) | modified | | 11/18/2021 | [For IT administrators get Minecraft Education Edition](/education/windows/school-get-minecraft) | modified | - - -## Week of October 25, 2021 - - -| Published On |Topic title | Change | -|------|------------|--------| -| 10/28/2021 | [Deploy Windows 10 in a school district (Windows 10)](/education/windows/deploy-windows-10-in-a-school-district) | modified | -| 10/28/2021 | [Deploy Windows 10 in a school (Windows 10)](/education/windows/deploy-windows-10-in-a-school) | modified | -| 10/28/2021 | [Windows 10 for Education (Windows 10)](/education/windows/index) | modified | diff --git a/education/windows/windows-11-se-overview.md b/education/windows/windows-11-se-overview.md index 342ce437b3..32f5f7795d 100644 --- a/education/windows/windows-11-se-overview.md +++ b/education/windows/windows-11-se-overview.md @@ -20,7 +20,7 @@ ms.topic: article - Windows 11 SE - Microsoft Intune for Education -Windows 11 SE is a new edition of Windows that's designed for education. It runs on web-first devices that use essential education apps. Microsoft Office 365 is preinstalled. +Windows 11 SE is a new edition of Windows that's designed for education. It runs on web-first devices that use essential education apps. Microsoft Office 365 is preinstalled (subscription sold separately). For education customers seeking cost-effective devices, Microsoft Windows 11 SE is a great choice. Windows 11 SE includes the following benefits: diff --git a/education/windows/windows-11-se-settings-list.md b/education/windows/windows-11-se-settings-list.md index 0c7227041a..4de2367a08 100644 --- a/education/windows/windows-11-se-settings-list.md +++ b/education/windows/windows-11-se-settings-list.md @@ -62,6 +62,45 @@ The following settings can't be changed. | Administrative tools | Administrative tools, such as the command prompt and Windows PowerShell, can't be opened. Windows PowerShell scripts deployed using Microsoft Endpoint Manager can run. | | Apps | Only certain apps are allowed to run on Windows 11 SE. For more info on what apps can run on Windows 11 SE, see [Windows 11 SE for Education overview](windows-11-se-overview.md). | +## What's available in the Settings app + +On Windows 11 SE devices, the Settings app shows the following setting pages. Depending on the hardware, some setting pages might not be shown. + +- Accessibility + +- Accounts + - Email & accounts + +- Apps + +- Bluetooth & devices + - Bluetooth + - Printers & scanners + - Mouse + - Touchpad + - Typing + - Pen + - AutoPlay + +- Network & internet + - WiFi + - VPN + +- Personalization + - Taskbar + +- Privacy & security + +- System + - Display + - Notifications + - Tablet mode + - Multitasking + - Projecting to this PC + +- Time & Language + - Language & region + ## Next steps [Windows 11 SE for Education overview](windows-11-se-overview.md) diff --git a/smb/cloud-mode-business-setup.md b/smb/cloud-mode-business-setup.md index 50f1527699..67a2d8f5cb 100644 --- a/smb/cloud-mode-business-setup.md +++ b/smb/cloud-mode-business-setup.md @@ -34,7 +34,7 @@ In this walkthrough, we'll show you how to deploy and manage a full cloud IT sol - Create policies and app deployment rules - Log in as a user and start using your Windows device -Go to the Microsoft Business site and select **Products** to learn more about pricing and purchasing options for your business. +Go to [Microsoft 365 for business](https://www.microsoft.com/microsoft-365/business) to learn more about pricing and purchasing options for your business. ## Prerequisites @@ -50,16 +50,17 @@ Here's a few things to keep in mind before you get started: To set up a cloud infrastructure for your organization, follow the steps in this section. ### 1.1 Set up Office 365 for business -See Set up Office 365 for business to learn more about the setup steps for businesses and nonprofits who have Office 365. You can watch video and learn how to: + +See [Microsoft 365 admin center for business](/microsoft-365/admin) and [Microsoft 365 resources for nonprofits](https://www.microsoft.com/nonprofits/microsoft-365) to learn more about the setup steps for businesses and nonprofits who have Office 365. You can learn how to: - Plan your setup - Create Office 365 accounts and how to add your domain. - Install Office -To set up your Microsoft 365 for business tenant, see Get Started with Microsoft 365 for business. +To set up your Microsoft 365 for business tenant, see [Get Started with Microsoft 365 for business](/microsoft-365/business-video/what-is-microsoft-365). If you're new at setting up Office 365, and you'd like to see how it's done, you can follow these steps to get started: -1. Go to the Office 365 page in the Microsoft Business site. Select **Try now** to use the Microsoft 365 Business Standard Trial or select **Buy now** to sign up for Microsoft 365 Business Standard. In this walkthrough, we'll select **Try now**. +1. Go to [Try or buy a Microsoft 365 for business subscription](/microsoft-365/commerce/try-or-buy-microsoft-365). In this walkthrough, we'll select **Try now**. **Figure 1** - Try or buy Office 365 @@ -68,7 +69,7 @@ If you're new at setting up Office 365, and you'd like to see how it's done, you 2. Fill out the sign up form and provide information about you and your company. 3. Create a user ID and password to use to sign into your account. - This step creates an onmicrosoft.com email address. You can use this email address to sign in to the various admin centers. Save your sign-in info so you can use it to sign into https://portal.office.com (the admin portal). + This step creates an `onmicrosoft.com` email address. You can use this email address to sign in to the various admin centers. Save your sign-in info so you can use it to sign into [https://portal.office.com](https://portal.office.com) (the admin portal). 4. Select **Create my account** and then enter the phone number you used in step 2 to verify your identity. You'll be asked to enter your verification code. 5. Select **You're ready to go...** which will take you to the Microsoft 365 admin center. @@ -78,7 +79,7 @@ If you're new at setting up Office 365, and you'd like to see how it's done, you **Figure 2** - Microsoft 365 admin center - ![Opens the Microsoft 365 admin center.](images/office365_portal.png) + :::image type="content" alt-text="Opens the Microsoft 365 admin center." source="images/office365_portal.png"::: 6. Select the **Admin** tile to go to the admin center. @@ -88,22 +89,22 @@ If you're new at setting up Office 365, and you'd like to see how it's done, you **Figure 3** - Admin center - ![Complete the Office 365 setup in the Microsoft 365 admin center.](images/office365_admin_portal.png) + :::image type="content" alt-text="Complete the Office 365 setup in the Microsoft 365 admin center." source="images/office365_admin_portal.png"::: -8. Go back to the admin center to add or buy a domain. +8. Go back to the [admin center](https://portal.office.com/adminportal/home#/homepage) to add or buy a domain. 1. Select the **Domains** option. **Figure 4** - Option to add or buy a domain - ![Add or buy a domain in admin center.](images/office365_buy_domain.png) + :::image type="content" alt-text="Add or buy a domain in admin center." source="images/office365_buy_domain.png"::: 2. In the **Home > Domains** page, you will see the Microsoft-provided domain, such as `fabrikamdesign.onmicrosoft.com`. **Figure 5** - Microsoft-provided domain - ![Microsoft-provided domain.](images/office365_ms_provided_domain.png) + :::image type="content" alt-text="Microsoft-provided domain." source="images/office365_ms_provided_domain.png"::: - If you already have a domain, select **+ Add domain** to add your existing domain. If you select this option, you'll be required to verify that you own the domain. Follow the steps in the wizard to verify your domain. - If you don't already own a domain, select **+ Buy domain**. If you're using a trial plan, you'll be required to upgrade your trial plan in order to buy a domain. Choose the subscription plan to use for your business and provide the details to complete your order. @@ -112,7 +113,7 @@ If you're new at setting up Office 365, and you'd like to see how it's done, you **Figure 6** - Domains - ![Verify your domains in the admin center.](images/office365_additional_domain.png) + :::image type="content" alt-text="Verify your domains in the admin center." source="images/office365_additional_domain.png"::: ### 1.2 Add users and assign product licenses Once you've set up Office and added your domain, it's time to add users so they have access to Office 365. People in your organization need an account before they can sign in and access Office 365. The easiest way to add users is to add them one at a time in the Microsoft 365 admin center. @@ -121,55 +122,55 @@ When adding users, you can also assign admin privileges to certain users in your **To add users and assign product licenses** -1. In the admin center, select **Users > Active users**. +1. In the [admin center](https://portal.office.com/adminportal/home#/homepage), select **Users > Active users**. **Figure 7** - Add users - ![Add Office 365 users.](images/office365_users.png) + :::image type="content" alt-text="Add Office 365 users." source="images/office365_users.png"::: 2. In the **Home > Active users** page, add users individually or in bulk. - To add users one at a time, select **+ Add a user**. - If you select this option, you'll see the **New user** screen and you can add details about the new user including their name, user name, role, and so on. You also have the opportunity to assign **Product licenses**. For detailed step-by-step info on adding a user account, see *Add a user account in the admin center* in Add users individually or in bulk to Office 365 - Admin Help. + If you select this option, you'll see the **New user** screen and you can add details about the new user including their name, user name, role, and so on. You also have the opportunity to assign **Product licenses**. For detailed step-by-step info on adding a user account, see [Add users and assign licenses at the same time](/microsoft-365/admin/add-users/add-users). **Figure 8** - Add an individual user - ![Add an individual user.](images/office365_add_individual_user.png) + :::image type="content" alt-text="Add an individual user." source="images/office365_add_individual_user.png"::: - To add multiple users at once, select **More** and then choose **+ Import multiple users**. If you select this option, you'll need to create and upload a CSV file containing the list of users. - The **Import multiple users** screen includes a link where you can learn more about importing multiple users and also links for downloading a sample CSV file (one with headers only and another with headers and sample user information). For detailed step-by-step info on adding multiple users to Office 365, see Add several users at the same time to Office 365 - Admin Help. Once you've added all the users, don't forget to assign **Product licenses** to the new users. + The **Import multiple users** screen includes a link where you can learn more about importing multiple users and also links for downloading a sample CSV file (one with headers only and another with headers and sample user information). For detailed step-by-step info on adding multiple users to Office 365, see [Add users and assign licenses at the same time](/microsoft-365/admin/add-users/add-users). Once you've added all the users, don't forget to assign **Product licenses** to the new users. **Figure 9** - Import multiple users - ![Import multiple users.](images/office365_import_multiple_users.png) + :::image type="content" alt-text="Import multiple users." source="images/office365_import_multiple_users.png"::: 3. Verify that all the users you added appear in the list of **Active users**. The **Status** should indicate the product licenses that were assigned to them. **Figure 10** - List of active users - ![Verify users and assigned product licenses.](images/o365_active_users.png) + :::image type="content" alt-text="Verify users and assigned product licenses." source="images/o365_active_users.png"::: ### 1.3 Add Microsoft Intune -Microsoft Intune provides mobile device management, app management, and PC management capabilities from the cloud. Using Intune, organizations can provide their employees with access to apps, data, and corporate resources from anywhere on almost any device while helping to keep corporate information secure. To learn more, see What is Intune? +Microsoft Intune provides mobile device management, app management, and PC management capabilities from the cloud. Using Intune, organizations can provide their employees with access to apps, data, and corporate resources from anywhere on almost any device while helping to keep corporate information secure. To learn more, see [Microsoft Intune is an MDM and MAM provider](/mem/intune/fundamentals/what-is-intune). **To add Microsoft Intune to your tenant** -1. In the admin center, select **Billing > Purchase services**. +1. In the [admin center](https://portal.office.com/adminportal/home#/homepage), select **Billing > Purchase services**. 2. In the **Home > Purchase services** screen, search for **Microsoft Intune**. Hover over **Microsoft Intune** to see the options to start a free 30-day trial or to buy now. 3. Confirm your order to enable access to Microsoft Intune. 4. In the admin center, the Intune licenses will show as available and ready to be assigned to users. Select **Users > Active users** and then edit the product licenses assigned to the users to turn on **Intune A Direct**. **Figure 11** - Assign Intune licenses - ![Assign Microsoft Intune licenses to users.](images/o365_assign_intune_license.png) + :::image type="content" alt-text="Assign Microsoft Intune licenses to users." source="images/o365_assign_intune_license.png"::: 5. In the admin center, confirm that **Intune** shows up in the list under **Admin centers**. If it doesn't, sign out and then sign back in and then check again. 6. Select **Intune**. This step opens the Endpoint Manager admin center. **Figure 12** - Microsoft Intune management portal - ![Microsoft Intune management portal.](images/intune_portal_home.png) + :::image type="content" alt-text="Microsoft Intune management portal." source="images/intune_portal_home.png"::: Intune should now be added to your tenant. We'll come back to Intune later when we [Configure Microsoft Store for Business for app distribution](#17-configure-microsoft-store-for-business-for-app-distribution). @@ -178,7 +179,7 @@ Microsoft Azure is an open and flexible cloud platform that enables you to quick **To add Azure AD to your domain** -1. In the admin center, select **Admin centers > Azure AD**. +1. In the [admin center](https://portal.office.com/adminportal/home#/homepage), select **Admin centers > Azure AD**. > [!NOTE] > You will need Azure AD Premium to configure automatic MDM enrollment with Intune. @@ -187,57 +188,57 @@ Microsoft Azure is an open and flexible cloud platform that enables you to quick **Figure 13** - Access to Azure AD is not available - ![Access to Azure AD not available.](images/azure_ad_access_not_available.png) + :::image type="content" alt-text="Access to Azure AD not available." source="images/azure_ad_access_not_available.png"::: 3. From the error message, select the country/region for your business. The region should match with the location you specified when you signed up for Office 365. 4. Select **Azure subscription**. This step will take you to a free trial sign up screen. **Figure 14** - Sign up for Microsoft Azure - ![Sign up for Microsoft Azure.](images/azure_ad_sign_up_screen.png) + :::image type="content" alt-text="Sign up for Microsoft Azure." source="images/azure_ad_sign_up_screen.png"::: 5. In the **Free trial sign up** screen, fill in the required information and then click **Sign up**. 6. After you sign up, you should see the message that your subscription is ready. Click **Start managing my service**. **Figure 15** - Start managing your Azure subscription - ![Start managing your Azure subscription.](images/azure_ad_successful_signup.png) + :::image type="content" alt-text="Start managing your Azure subscription." source="images/azure_ad_successful_signup.png"::: - This step will take you to the Microsoft Azure portal. + This step will take you to the [Microsoft Azure portal](https://portal.azure.com). ### 1.5 Add groups in Azure AD -This section is the walkthrough is optional. However, we recommend that you create groups in Azure AD to manage access to corporate resources, such as apps, policies and settings, and so on. For more information, see Managing access to resources with Azure Active Directory groups. +This section is the walkthrough is optional. However, we recommend that you create groups in Azure AD to manage access to corporate resources, such as apps, policies and settings, and so on. For more information, see [Managing access to resources with Azure Active Directory groups](/azure/active-directory/active-directory-manage-groups. -To add Azure AD group(s), we will use the classic Azure portal (https://manage.windowsazure.com). See Managing groups in Azure Active Directory for more information about managing groups. +To add Azure AD group(s), use the [Microsoft Azure portal](https://portal.azure.com). See [Managing groups in Azure Active Directory](/azure/active-directory/active-directory-accessmanagement-manage-groups) for more information about managing groups. **To add groups in Azure AD** -1. If this is the first time you're setting up your directory, when you navigate to the **Azure Active Directory** node in the classic Azure portal, you will see a screen informing you that your directory is ready for use. +1. If this is the first time you're setting up your directory, when you navigate to the **Azure Active Directory** node, you will see a screen informing you that your directory is ready for use. Afterwards, you should see a list of active directories. In the following example, **Fabrikam Design** is the active directory. **Figure 16** - Azure first sign-in screen - ![Select Azure AD.](images/azure_portal_classic_configure_directory.png) + :::image type="content" alt-text="Select Azure AD." source="images/azure_portal_classic_configure_directory.png"::: 2. Select the directory (such as Fabrikam Design) to go to the directory's home page. **Figure 17** - Directory home page - ![Directory home page.](images/azure_portal_classic_directory_ready.png) + :::image type="content" alt-text="Directory home page." source="images/azure_portal_classic_directory_ready.png"::: 3. From the menu options on top, select **Groups**. **Figure 18** - Azure AD groups - ![Add groups in Azure AD.](images/azure_portal_classic_groups.png) + :::image type="content" alt-text="Add groups in Azure AD." source="images/azure_portal_classic_groups.png"::: 4. Select **Add a group** (from the top) or **Add group** at the bottom. 5. In the **Add Group** window, add a name, group type, and description for the group and click the checkmark to save your changes. The new group will appear on the groups list. **Figure 19** - Newly added group in Azure AD - ![Verify the new group appears on the list.](images/azure_portal_classic_all_users_group.png) + :::image type="content" alt-text="Verify the new group appears on the list." source="images/azure_portal_classic_all_users_group.png"::: 6. In the **Groups** tab, select the arrow next to the group (such as **All users**), add members to the group, and then save your changes. @@ -245,34 +246,34 @@ To add Azure AD group(s), we will use the this blog post to learn how you can combine login, Azure AD Join, and Intune MDM enrollment into an easy step so that you can bring your devices into a managed state that complies with the policies for your organization. We will use this blog post as our guide for this part of the walkthrough. +You can read the [Windows 10, Azure AD and Microsoft Intune blog post](https://blogs.technet.microsoft.com/enterprisemobility/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/) to learn how you can combine login, Azure AD Join, and Intune MDM enrollment into an easy step so that you can bring your devices into a managed state that complies with the policies for your organization. We will use this blog post as our guide for this part of the walkthrough. > [!IMPORTANT] > We will use the classic Azure portal instead of the new portal to configure automatic MDM enrollment with Intune. **To enable automatic MDM enrollment** -1. In the classic Azure portal, click on your company's Azure Active Directory to go back to the main window. Select **Applications** from the list of directory menu options. +1. In the Azure portal, click on your company's Azure Active Directory to go back to the main window. Select **Applications** from the list of directory menu options. The list of applications for your company will appear. **Microsoft Intune** will be one of the applications on the list. **Figure 21** - List of applications for your company - ![List of applications for your company.](images/azure_portal_classic_applications.png) + :::image type="content" alt-text="List of applications for your company." source="images/azure_portal_classic_applications.png"::: 2. Select **Microsoft Intune** to configure the application. 3. In the Microsoft Intune configuration page, click **Configure** to start automatic MDM enrollment configuration with Intune. **Figure 22** - Configure Microsoft Intune in Azure - ![Configure Microsoft Intune in Azure.](images/azure_portal_classic_configure_intune_app.png) + :::image type="content" alt-text="Configure Microsoft Intune in Azure." source="images/azure_portal_classic_configure_intune_app.png"::: 4. In the Microsoft Intune configuration page: - In the **Properties** section, you should see a list of URLs for MDM discovery, MDM terms of use, and MDM compliance. @@ -291,66 +292,66 @@ You can read Microsoft Intune management portal and Microsoft Store for Business. +In this part of the walkthrough, use the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and [Microsoft Store for Business](https://businessstore.microsoft.com/Store/Apps). **To associate your Store account with Intune and configure synchronization** -1. From the Microsoft Intune management portal, select **Admin**. +1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 2. In the **Administration** workspace, click **Mobile Device Management**. If this is the first item you're using the portal, click **manage mobile devices** in the **Mobile Device Management** window. The page will refresh and you'll have new options under **Mobile Device Management**. **Figure 24** - Mobile device management - ![Set up mobile device management in Intune.](images/intune_admin_mdm_configure.png) + :::image type="content" alt-text="Set up mobile device management in Intune." source="images/intune_admin_mdm_configure.png"::: -3. Sign into Microsoft Store for Business using the same tenant account that you used to sign into Intune. +3. Sign into [Microsoft Store for Business](https://businessstore.microsoft.com/Store/Apps) using the same tenant account that you used to sign into Intune. 4. Accept the EULA. 5. In the Store portal, select **Settings > Management tools** to go to the management tools page. 6. In the **Management tools** page, find **Microsoft Intune** on the list and click **Activate** to get Intune ready to use with Microsoft Store for Business. **Figure 25** - Activate Intune as the Store management tool - ![Activate Intune from the Store portal.](images/wsfb_management_tools_activate.png) + :::image type="content" alt-text="Activate Intune from the Store portal." source="images/wsfb_management_tools_activate.png"::: -7. Go back to the Intune management portal, select **Admin > Mobile Device Management**, expand **Windows**, and then choose **Store for Business**. +7. Go back to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Admin > Mobile Device Management**, expand **Windows**, and then choose **Store for Business**. 8. In the **Microsoft Store for Business** page, select **Configure Sync** to sync your Store for Business volume-purchased apps with Intune. **Figure 26** - Configure Store for Business sync in Intune - ![Configure Store for Business sync in Intune.](images/intune_admin_mdm_store_sync.png) + :::image type="content" alt-text="Configure Store for Business sync in Intune." source="images/intune_admin_mdm_store_sync.png"::: 9. In the **Configure Microsoft Store for Business app sync** dialog box, check **Enable Microsoft Store for Business sync**. In the **Language** dropdown list, choose the language in which you want apps from the Store to be displayed in the Intune console and then click **OK**. **Figure 27** - Enable Microsoft Store for Business sync in Intune - ![Enable Store for Business sync in Intune.](images/intune_configure_store_app_sync_dialog.png) + :::image type="content" alt-text="Enable Store for Business sync in Intune." source="images/intune_configure_store_app_sync_dialog.png"::: The **Microsoft Store for Business** page will refresh and it will show the details from the sync. **To buy apps from the Store** -In your Microsoft Store for Business portal, you can see the list of apps that you own by going to **Manage > Inventory**. You should see the following apps in your inventory: +In your [Microsoft Store for Business portal](https://businessstore.microsoft.com/Store/Apps), you can see the list of apps that you own by going to **Manage > Inventory**. You should see the following apps in your inventory: - Sway - OneNote - PowerPoint Mobile - Excel Mobile - Word Mobile -In the Intune management portal, select **Apps > Apps > Volume-Purchased Apps** and verify that you can see the same list of apps appear on Intune. +In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Apps > Apps > Volume-Purchased Apps** and verify that you can see the same list of apps appear on Intune. In the following example, we'll show you how to buy apps through the Microsoft Store for Business and then make sure the apps appear on Intune. **Example 1 - Add other apps like Reader and InstaNote** -1. In the Microsoft Store for Business portal, click **Shop**, scroll down to the **Made by Microsoft** category, and click **Show all** to see all the Microsoft apps in the list. +1. In the [Microsoft Store for Business portal](https://businessstore.microsoft.com/Store/Apps), click **Shop**, scroll down to the **Made by Microsoft** category, and click **Show all** to see all the Microsoft apps in the list. **Figure 28** - Shop for Store apps - ![Shop for Store apps.](images/wsfb_shop_microsoft_apps.png) + :::image type="content" alt-text="Shop for Store apps." source="images/wsfb_shop_microsoft_apps.png"::: 2. Click to select an app, such as **Reader**. This opens the app page. 3. In the app's Store page, click **Get the app**. You should see a dialog that confirms your order. Click **Close**. This will refresh the app's Store page. @@ -360,7 +361,7 @@ In the following example, we'll show you how to buy apps through the Microsoft S **Figure 29** - App inventory shows the purchased apps - ![Confirm that your inventory shows purchased apps.](images/wsfb_manage_inventory_newapps.png) + :::image type="content" alt-text="Confirm that your inventory shows purchased apps." source="images/wsfb_manage_inventory_newapps.png"::: > [!NOTE] > Sync happens automatically, but it may take up to 24 hours for your organization's private store and 12 hours for Intune to sync all your purchased apps. You can force a sync to make this process happen faster. For more info, see [To sync recently purchased apps](#forceappsync). @@ -369,18 +370,18 @@ In the following example, we'll show you how to buy apps through the Microsoft S If you need to sync your most recently purchased apps and have it appear in your catalog, you can do this by forcing a sync. -1. In the Intune management portal, select **Admin > Mobile Device Management > Windows > Store for Business**. +1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Admin > Mobile Device Management > Windows > Store for Business**. 2. In the **Microsoft Store for Business** page, click **Sync now** to force a sync. **Figure 30** - Force a sync in Intune - ![Force a sync in Intune.](images/intune_admin_mdm_forcesync.png) + :::image type="content" alt-text="Force a sync in Intune." source="images/intune_admin_mdm_forcesync.png"::: **To view purchased apps** -- In the Intune management portal, select **Apps > Apps** and then choose **Volume-Purchased Apps** to see the list of available apps. Verify that the apps you purchased were imported correctly. +- In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Apps > Apps** and then choose **Volume-Purchased Apps** to see the list of available apps. Verify that the apps you purchased were imported correctly. **To add more apps** -- If you have other apps that you want to deploy or manage, you must add it to Microsoft Intune. To deploy Win32 apps and Web links, see Add apps for enrolled devices to Intune for more info on how to do this. +- If you have other apps that you want to deploy or manage, you must add it to Microsoft Intune. To deploy Win32 apps and Web links, see [Add apps to Microsoft Intune](/mem/intune/apps/apps-add) for more info on how to do this. ## 2. Set up devices @@ -395,7 +396,7 @@ To set up new Windows devices, go through the Windows initial device setup or fi **Figure 31** - First screen in Windows device setup - ![First screen in Windows device setup.](images/win10_hithere.png) + :::image type="content" alt-text="First screen in Windows device setup." source="images/win10_hithere.png"::: > [!NOTE] > During setup, if you don't have a Wi-Fi network configured, make sure you connect the device to the Internet through a wired/Ethernet connection. @@ -405,13 +406,13 @@ To set up new Windows devices, go through the Windows initial device setup or fi **Figure 32** - Choose how you'll connect your Windows device - ![Choose how you'll connect the Windows device.](images/win10_choosehowtoconnect.png) + :::image type="content" alt-text="Choose how you'll connect the Windows device." source="images/win10_choosehowtoconnect.png"::: 4. In the **Let's get you signed in** screen, sign in using a user account you added in section [1.2 Add users and assign product licenses](#12-add-users-and-assign-product-licenses). We suggest signing in as one of the global administrators. Later, sign in on another device using one of the non-admin accounts. **Figure 33** - Sign in using one of the accounts you added - ![Sign in using one of the accounts you added.](images/win10_signin_admin_account.png) + :::image type="content" alt-text="Sign in using one of the accounts you added." source="images/win10_signin_admin_account.png"::: 5. If this is the first time you're signing in, you will be asked to update your password. Update the password and continue with sign-in and setup. @@ -425,16 +426,16 @@ Verify that the device is set up correctly and boots without any issues. 2. Confirm that the Store and built-in apps are working. ### 2.3 Verify the device is Azure AD joined -In the Intune management portal, verify that the device is joined to Azure AD and shows up as being managed in Microsoft Intune. +In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), verify that the device is joined to Azure AD and shows up as being managed in Microsoft Intune. **To verify if the device is joined to Azure AD** 1. Check the device name on your PC. On your Windows PC, select **Settings > System > About** and then check **PC name**. **Figure 34** - Check the PC name on your device - ![Check the PC name on your device.](images/win10_settings_pcname.png) + :::image type="content" alt-text="Check the PC name on your device." source="images/win10_settings_pcname.png"::: -2. Log in to the Intune management portal. +2. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 3. Select **Groups** and then go to **Devices**. 4. In the **All Devices** page, look at the list of devices and select the entry that matches the name of your PC. - Check that the device name appears in the list. Select the device and it will also show the current logged-in user in the **General Information** section. @@ -443,7 +444,7 @@ In the Intune management **Figure 35** - Check that the device appears in Intune - ![Check that the device appears in Intune.](images/intune_groups_devices_list.png) + :::image type="content" alt-text="Check that the device appears in Intune." source="images/intune_groups_devices_list.png"::: ## 3. Manage device settings and features You can use Microsoft Intune admin settings and policies to manage features on your organization's mobile devices and computers. For more info, see [Manage settings and features on your devices with Microsoft Intune policies](/intune/deploy-use/manage-settings-and-features-on-your-devices-with-microsoft-intune-policies). @@ -454,7 +455,7 @@ In this section, we'll show you how to reconfigure app deployment settings and a In some cases, if an app is missing from the device, you need to reconfigure the deployment settings for the app and set the app to require installation as soon as possible. **To reconfigure app deployment settings** -1. In the Intune management portal, select **Apps** and go to **Apps > Volume-Purchased Apps**. +1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Apps** and go to **Apps > Volume-Purchased Apps**. 2. Select the app, right-click, then select **Manage Deployment...**. 3. Select the group(s) whose apps will be managed, and then click **Add** to add the group. 4. Click **Next** at the bottom of the app deployment settings window or select **Deployment Action** on the left column to check the deployment settings for the app. @@ -462,7 +463,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 36** - Reconfigure an app's deployment setting in Intune - ![Reconfigure app deployment settings in Intune.](images/intune_apps_deploymentaction.png) + :::image type="content" alt-text="Reconfigure app deployment settings in Intune." source="images/intune_apps_deploymentaction.png"::: 6. Click **Finish**. 7. Repeat steps 2-6 for other apps that you want to deploy to the device(s) as soon as possible. @@ -472,12 +473,12 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 37** - Confirm that additional apps were deployed to the device - ![Confirm that additional apps were deployed to the device.](images/win10_deploy_apps_immediately.png) + :::image type="content" alt-text="Confirm that additional apps were deployed to the device." source="images/win10_deploy_apps_immediately.png"::: ### 3.2 Configure other settings in Intune **To disable the camera** -1. In the Intune management portal, select **Policy > Configuration Policies**. +1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices > Configuration Policies**. 2. In the **Policies** window, click **Add** to create a new policy. 3. On the **Create a New Policy** page, click **Windows** to expand the group, select **General Configuration (Windows 10 Desktop and Mobile and later)**, choose **Create and Deploy a Custom Policy**, and then click **Create Policy**. 4. On the **Create Policy** page, select **Device Capabilities**. @@ -488,7 +489,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 38** - Add a configuration policy - ![Add a configuration policy.](images/intune_policy_disablecamera.png) + :::image type="content" alt-text="Add a configuration policy." source="images/intune_policy_disablecamera.png"::: 7. Click **Save Policy**. A confirmation window will pop up. 8. On the **Deploy Policy** confirmation window, select **Yes** to deploy the policy now. @@ -497,16 +498,16 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 39** - The new policy should appear in the **Policies** list. - ![New policy appears on the list.](images/intune_policies_newpolicy_deployed.png) + :::image type="content" alt-text="New policy appears on the list." source="images/intune_policies_newpolicy_deployed.png"::: **To turn off Windows Hello and PINs during device setup** -1. In the Intune management portal, select **Admin**. +1. Go to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 2. Go to **Mobile Device Management > Windows > Windows Hello for Business**. 3. In the **Windows Hello for Business** page, select **Disable Windows Hello for Business on enrolled devices**. **Figure 40** - Policy to disable Windows Hello for Business - ![Disable Windows Hello for Business.](images/intune_policy_disable_windowshello.png) + :::image type="content" alt-text="Disable Windows Hello for Business." source="images/intune_policy_disable_windowshello.png"::: 4. Click **Save**. @@ -533,49 +534,49 @@ For other devices, such as those personally-owned by employees who need to conne **Figure 41** - Add an Azure AD account to the device - ![Add an Azure AD account to the device.](images/win10_add_new_user_join_aad.png) + :::image type="content" alt-text="Add an Azure AD account to the device." source="images/win10_add_new_user_join_aad.png"::: 4. In the **Let's get you signed in** window, enter the work credentials for the account and then click **Sign in** to authenticate the user. **Figure 42** - Enter the account details - ![Enter the account details.](images/win10_add_new_user_account_aadwork.png) + :::image type="content" alt-text="Enter the account details." source="images/win10_add_new_user_account_aadwork.png"::: 5. You will be asked to update the password so enter a new password. 6. Verify the details to make sure you're connecting to the right organization and then click **Join**. **Figure 43** - Make sure this is your organization - ![Make sure this is your organization.](images/win10_confirm_organization_details.png) + :::image type="content" alt-text="Make sure this is your organization." source="images/win10_confirm_organization_details.png"::: 7. You will see a confirmation window that says the device is now connected to your organization. Click **Done**. **Figure 44** - Confirmation that the device is now connected - ![Confirmation that the device is now connected.](images/win10_confirm_device_connected_to_org.png) + :::image type="content" alt-text="Confirmation that the device is now connected." source="images/win10_confirm_device_connected_to_org.png"::: 8. The **Connect to work or school** window will refresh and will now include an entry that shows you're connected to your organization's Azure AD. This means the device is now registered in Azure AD and enrolled in MDM and the account should have access to the organization's resources. **Figure 45** - Device is now enrolled in Azure AD - ![Device is enrolled in Azure AD.](images/win10_device_enrolled_in_aad.png) + :::image type="content" alt-text="Device is enrolled in Azure AD." source="images/win10_device_enrolled_in_aad.png"::: -9. You can confirm that the new device and user are showing up as Intune-managed by going to the Intune management portal and following the steps in [2.3 Verify the device is Azure AD joined](#23-verify-the-device-is-azure-ad-joined). It may take several minutes before the new device shows up so check again later. +9. You can confirm that the new device and user are showing up as Intune-managed by going to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and following the steps in [2.3 Verify the device is Azure AD joined](#23-verify-the-device-is-azure-ad-joined). It may take several minutes before the new device shows up so check again later. ### 4.2 Add a new user You can add new users to your tenant simply by adding them to the Microsoft 365 groups. Adding new users to Microsoft 365 groups automatically adds them to the corresponding groups in Microsoft Intune. -See [Add users to Office 365](/microsoft-365/admin/add-users/add-users) to learn more. Once you're done adding new users, go to the Intune management portal and verify that the same users were added to the Intune groups as well. +See [Add users to Office 365](/microsoft-365/admin/add-users/add-users) to learn more. Once you're done adding new users, go to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and verify that the same users were added to the Intune groups as well. ## Get more info ### For IT admins To learn more about the services and tools mentioned in this walkthrough, and learn what other tasks you can do, follow these links: -- Set up Office 365 for business -- Common admin tasks in Office 365 including email and OneDrive in Manage Office 365 -- More info about managing devices, apps, data, troubleshooting, and more in Intune documentation +- [Set up Office 365 for business](/microsoft-365/admin/setup) +- Common admin tasks in Office 365 including email and OneDrive in [Manage Office 365](/microsoft-365/admin/) +- More info about managing devices, apps, data, troubleshooting, and more in the [/mem/intune/](/mem/intune/) - Learn more about Windows client in the [Windows client documentation for IT Pros](/windows/resources/). -- Info about distributing apps to your employees, managing apps, managing settings, and more in Microsoft Store for Business +- Info about distributing apps to your employees, managing apps, managing settings, and more in [Microsoft Store for Business](/microsoft-store/) ### For information workers Whether it's in the classroom, getting the most out of your devices, or learning some of the cool things you can do, we've got teachers covered. Follow these links for more info: diff --git a/store-for-business/manage-users-and-groups-microsoft-store-for-business.md b/store-for-business/manage-users-and-groups-microsoft-store-for-business.md index a417157bc2..717074d334 100644 --- a/store-for-business/manage-users-and-groups-microsoft-store-for-business.md +++ b/store-for-business/manage-users-and-groups-microsoft-store-for-business.md @@ -44,5 +44,5 @@ If you created a new Azure AD directory when you signed up for Store for Busines You can use the [Office 365 admin dashboard](https://portal.office.com/adminportal) or [Azure management portal](https://go.microsoft.com/fwlink/p/?LinkId=691086) to add user accounts to your Azure AD directory. If you'll be using Azure management portal, you'll need an active subscription to [Azure management portal](https://go.microsoft.com/fwlink/p/?LinkId=708617). For more information, see: -- [Add user accounts using Office 365 admin dashboard](https://support.office.com/en-us/article/add-users-individually-or-in-bulk-to-office-365-admin-help-1970f7d6-03b5-442f-b385-5880b9c256ec) +- [Add user accounts using Office 365 admin dashboard](/microsoft-365/admin/add-users) - [Add user accounts using Azure management portal](/azure/active-directory/fundamentals/add-users-azure-active-directory) \ No newline at end of file diff --git a/store-for-business/release-history-microsoft-store-business-education.md b/store-for-business/release-history-microsoft-store-business-education.md index 962ec31ffd..a4f1f93a78 100644 --- a/store-for-business/release-history-microsoft-store-business-education.md +++ b/store-for-business/release-history-microsoft-store-business-education.md @@ -1,6 +1,6 @@ --- -title: Whats new in Microsoft Store for Business and Education -description: Learn about newest features in Microsoft Store for Business and Microsoft Store for Education. +title: Microsoft Store for Business and Education release history +description: Know the release history of Microsoft Store for Business and Microsoft Store for Education. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -18,7 +18,7 @@ manager: dansimp > [!IMPORTANT] > Microsoft Store for Business and Microsoft Store for Education will be retired in the first quarter of 2023. You can continue to use the current capabilities of free apps until that time. For more information about this change, see [Evolving the Microsoft Store for Business and Education](https://aka.ms/windows/msfb_evolution). -Microsoft Store for Business and Education regularly releases new and improved features. Here's a summary of new or updated features in previous releases. +Microsoft Store for Business and Education regularly releases new and improved features. Here's a summary of new or updated features in previous releases. Looking for info on the latest release? Check out [What's new in Microsoft Store for Business and Education](whats-new-microsoft-store-business-education.md) diff --git a/store-for-business/sfb-change-history.md b/store-for-business/sfb-change-history.md index f57695f277..08e7950bb0 100644 --- a/store-for-business/sfb-change-history.md +++ b/store-for-business/sfb-change-history.md @@ -76,6 +76,7 @@ ms.localizationpriority: medium | --- | --- | | [Microsoft Store for Business and Education PowerShell module - preview](microsoft-store-for-business-education-powershell-module.md) | New | | [Microsoft Store for Business and Education overview - supported markets](./microsoft-store-for-business-overview.md#supported-markets) | Updates for added market support. | +| [Manage Windows device deployment with Windows Autopilot Deployment](add-profile-to-devices.md) | New. Information about Windows Autopilot Deployment Program and how it is used in Microsoft Store for Business and Education. | ## June 2017 @@ -84,10 +85,3 @@ ms.localizationpriority: medium | [Notifications in Microsoft Store for Business and Education](notifications-microsoft-store-business.md) | New. Information about notification model in Microsoft Store for Business and Education. | | [Get Minecraft: Education Edition with Windows 10 device promotion](/education/windows/get-minecraft-device-promotion) | New. Information about redeeming Minecraft: Education Edition licenses with qualifying purchases of Windows 10 devices. | | [Microsoft Store for Business and Education overview - supported markets](./microsoft-store-for-business-overview.md#supported-markets) | Updates for added market support. | - -## July 2017 - -| New or changed topic | Description | -| -------------------- | ----------- | -| [Manage Windows device deployment with Windows Autopilot Deployment](add-profile-to-devices.md) | New. Information about Windows Autopilot Deployment Program and how it is used in Microsoft Store for Business and Education. | -| [Microsoft Store for Business and Education overview - supported markets](./microsoft-store-for-business-overview.md#supported-markets) | Updates for added market support. | \ No newline at end of file diff --git a/store-for-business/troubleshoot-microsoft-store-for-business.md b/store-for-business/troubleshoot-microsoft-store-for-business.md index f54b676866..febe7110b0 100644 --- a/store-for-business/troubleshoot-microsoft-store-for-business.md +++ b/store-for-business/troubleshoot-microsoft-store-for-business.md @@ -56,7 +56,7 @@ The private store for your organization is a page in Microsoft Store app that co ## Troubleshooting Microsoft Store for Business integration with Microsoft Endpoint Configuration Manager -If you encounter any problems when integrating Microsoft Store for Business with Configuration Manager, use the [troubleshooting guide](https://support.microsoft.com/help/4010214/understand-and-troubleshoot-microsoft-store-for-business-integration-w). +If you encounter any problems when integrating Microsoft Store for Business with Configuration Manager, use the [troubleshooting guide](/troubleshoot/mem/configmgr/troubleshoot-microsoft-store-for-business-integration). ## Still having trouble? diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md index cbe270cf7d..6899ee3213 100644 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md +++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md @@ -63,7 +63,7 @@ The computer on which you are installing the Office Deployment Tool must have th | Prerequisite | Description | |----------------------|--------------------| -| Prerequisite software | .Net Framework 4 | +| Prerequisite software | .NET Framework 4 | | Supported operating systems | 64-bit version of Windows 10/11
64-bit version of Windows 8 or 8.1
64-bit version of Windows 7 | >[!NOTE] @@ -120,7 +120,7 @@ The XML file included in the Office Deployment Tool specifies the product detail |--------------|----------------------------|----------------| | Add element | Specifies which products and languages the package will include. | N/A | | **OfficeClientEdition** (attribute of **Add** element) | Specifies whether Office 2016 32-bit or 64-bit edition will be used. **OfficeClientEdition**  must be set to a valid value for the operation to succeed. | `OfficeClientEdition="32"`
`OfficeClientEdition="64"` | - | Product element | Specifies the application. Project 2016 and Visio 2016 must be specified here as added products to include them in the applications.
For more information about Product IDs, see [Product IDs that are supported by the Office Deployment Tool for Click-to-Run](https://support.microsoft.com/kb/2842297). | `Product ID ="O365ProPlusRetail"`
`Product ID ="VisioProRetail"`
`Product ID ="ProjectProRetail"` | + | Product element | Specifies the application. Project 2016 and Visio 2016 must be specified here as added products to include them in the applications.
For more information about Product IDs, see [Product IDs that are supported by the Office Deployment Tool for Click-to-Run](/office365/troubleshoot/installation). | `Product ID ="O365ProPlusRetail"`
`Product ID ="VisioProRetail"`
`Product ID ="ProjectProRetail"` | | Language element | Specifies which language the applications support. | `Language ID="en-us"` | | Version (attribute of **Add** element) | Optional. Specifies which build the package will use.
Defaults to latest advertised build (as defined in v32.CAB at the Office source). | `16.1.2.3` | | SourcePath (attribute of **Add** element) | Specifies the location the applications will be saved to. | `Sourcepath = "\\Server\Office2016"` | diff --git a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md index 8765ba9fa6..4f5424f963 100644 --- a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md +++ b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md @@ -19,90 +19,81 @@ ms.author: greglin The following are known issues and workarounds for Application Virtualization (App-V) running on Windows 10 version 1703 and later - - - - - - - - - - - - - - - - - - - - - - - -
ProblemWorkaround
Unable to manually create a system-owned folder needed for the set-AppVClientConfiguration PowerShell cmdlet when using the PackageInstallationRoot, IntegrationRootUser, or IntegrationRootGlobal parameters.Don't create this file manually, instead let the Add-AppVClientPackage cmdlet auto-generate it.
Failure to update an App-V package from App-V 5.x to the latest in-box version, by using the PowerShell sequencing commands.Make sure you have the complete App-V package or the MSI file from the original app.
Unable to modify the locale for auto-sequencing.Open the C:\Program Files (x86)\Windows Kits\10\Microsoft Application Virtualization\AutoSequencer\Unattend_Sequencer_User_Setup_Template.xml file and include the language code for your locale. For example, if you wanted Spanish (Spain), you'd use: es-ES.
Filetype and protocol handlers aren't registering properly with the Google Chrome browser, causing you to not see App-V packages as an option for default apps from the Settings > Apps> Default Apps area.The recommended workaround is to add the following code to the AppXManifest.xml file, underneath the <appv:Extensions> tag: -

-<appv:Extension Category="AppV.URLProtocol">
-    <appv:URLProtocol>
-        <appv:Name>ftp</appv:Name>
-        <appv:ApplicationURLProtocol>
-            <appv:DefaultIcon>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe,0</appv:DefaultIcon>
-            <appv:ShellCommands>
-                <appv:DefaultCommand>open</appv:DefaultCommand>
-                <appv:ShellCommand>
-                    <appv:ApplicationId>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe</appv:ApplicationId>
-                    <appv:Name>open</appv:Name>
-                    <appv:CommandLine>"[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe" -- "%1"</appv:CommandLine>
-                    <appv:DdeExec>
-                        <appv:DdeCommand />
-                    </appv:DdeExec>
-                </appv:ShellCommand>
-            </appv:ShellCommands>
-        </appv:ApplicationURLProtocol>
-    </appv:URLProtocol>
-</appv:Extension>
-<appv:Extension Category="AppV.URLProtocol">
-    <appv:URLProtocol>
-        <appv:Name>http</appv:Name>
-        <appv:ApplicationURLProtocol>
-            <appv:DefaultIcon>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe,0</appv:DefaultIcon>
-            <appv:ShellCommands>
-                <appv:DefaultCommand>open</appv:DefaultCommand>
-                <appv:ShellCommand>
-                    <appv:ApplicationId>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe</appv:ApplicationId>
-                    <appv:Name>open</appv:Name>
-                    <appv:CommandLine>"[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe" -- "%1"</appv:CommandLine>
-                    <appv:DdeExec>
-                        <appv:DdeCommand />
-                    </appv:DdeExec>
-                </appv:ShellCommand>
-            </appv:ShellCommands>
-        </appv:ApplicationURLProtocol>
-    </appv:URLProtocol>
-</appv:Extension>
-<appv:Extension Category="AppV.URLProtocol">
-    <appv:URLProtocol>
-        <appv:Name>https</appv:Name>
-        <appv:ApplicationURLProtocol>
-            <appv:DefaultIcon>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe,0</appv:DefaultIcon>
-            <appv:ShellCommands>
-                <appv:DefaultCommand>open</appv:DefaultCommand>
-                <appv:ShellCommand>
-                    <appv:ApplicationId>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe</appv:ApplicationId>
-                    <appv:Name>open</appv:Name>
-                    <appv:CommandLine>"[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe" -- "%1"</appv:CommandLine>
-                    <appv:DdeExec>
-                        <appv:DdeCommand />
-                    </appv:DdeExec>
-                </appv:ShellCommand>
-            </appv:ShellCommands>
-        </appv:ApplicationURLProtocol>
-    </appv:URLProtocol>
-</appv:Extension>
-

+- **Problem**: Unable to manually create a system-owned folder needed for the `set-AppVClientConfiguration` PowerShell cmdlet when using the PackageInstallationRoot, IntegrationRootUser, or IntegrationRootGlobal parameters. + **Workaround**: Don't create this file manually, instead let the `Add-AppVClientPackage` cmdlet auto-generate it. + +- **Problem**: Failure to update an App-V package from App-V 5.x to the latest in-box version, by using the PowerShell sequencing commands. + + **Workaround**: Make sure you have the complete App-V package or the MSI file from the original app. + +- **Problem**: Unable to modify the locale for auto-sequencing. + + **Workaround**: Open the `C:\Program Files (x86)\Windows Kits\10\Microsoft Application Virtualization\AutoSequencer\Unattend_Sequencer_User_Setup_Template.xml` file and include the language code for your locale. For example, if you wanted Spanish (Spain), you'd use: es-ES. + +- **Problem**: Filetype and protocol handlers aren't registering properly with the Google Chrome browser, causing you to not see App-V packages as an option for default apps from the Settings > Apps> Default Apps area. + + **Workaround**: The recommended workaround is to add the following code to the AppXManifest.xml file, underneath the `` tag: + + ```xml + + + ftp + + [{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe,0 + + open + + [{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe + open + "[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe" -- "%1" + + + + + + + + + + + http + + [{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe,0 + + open + + [{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe + open + "[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe" -- "%1" + + + + + + + + + + + https + + [{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe,0 + + open + + [{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe + open + "[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe" -- "%1" + + + + + + + + + ``` ## Related resources list For information that can help with troubleshooting App-V for Windows client, see: @@ -120,4 +111,4 @@ For information that can help with troubleshooting App-V for Windows client, see ## Related topics - [What's new in App-V for Windows client](appv-about-appv.md) -- [Release Notes for App-V for Windows 10, version 1607](appv-release-notes-for-appv-for-windows-1703.md) \ No newline at end of file +- [Release Notes for App-V for Windows 10, version 1607](appv-release-notes-for-appv-for-windows-1703.md) diff --git a/windows/client-management/advanced-troubleshooting-boot-problems.md b/windows/client-management/advanced-troubleshooting-boot-problems.md index 49d851c6f6..8a7c060339 100644 --- a/windows/client-management/advanced-troubleshooting-boot-problems.md +++ b/windows/client-management/advanced-troubleshooting-boot-problems.md @@ -231,7 +231,7 @@ If Windows cannot load the system registry hive into memory, you must restore th If the problem persists, you may want to restore the system state backup to an alternative location, and then retrieve the registry hives to be replaced. > [!NOTE] -> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](https://support.microsoft.com/en-us/help/4509719/the-system-registry-is-no-longer-backed-up-to-the-regback-folder-start). +> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](/troubleshoot/windows-client/deployment/system-registry-no-backed-up-regback-folder) ## Kernel Phase @@ -414,4 +414,4 @@ If the dump file shows an error that is related to a driver (for example, window 5. Copy all the hives from the Regback folder, paste them in the Config folder, and then try to start the computer in Normal mode. > [!NOTE] -> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](https://support.microsoft.com/en-us/help/4509719/the-system-registry-is-no-longer-backed-up-to-the-regback-folder-start). +> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](/troubleshoot/windows-client/deployment/system-registry-no-backed-up-regback-folder). diff --git a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md index 043d6d76df..49d26516fa 100644 --- a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md +++ b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md @@ -37,9 +37,8 @@ It is important to understand the different Wi-Fi components involved, their exp The intention of this troubleshooter is to show how to find a starting point in the verbosity of wireless_dbg ETW and home in on the responsible components that are causing the connection problem. ### Known Issues and fixes -** ** -| **OS version** | **Fixed in** | +| OS version | Fixed in | | --- | --- | | **Windows 10, version 1803** | [KB4284848](https://support.microsoft.com/help/4284848) | | **Windows 10, version 1709** | [KB4284822](https://support.microsoft.com/help/4284822) | @@ -54,13 +53,13 @@ Make sure that you install the latest Windows updates, cumulative updates, and r - [Windows 10 version 1511](https://support.microsoft.com/help/4000824) - [Windows 8.1 and Windows Server 2012 R2](https://support.microsoft.com/help/4009470) - [Windows Server 2012](https://support.microsoft.com/help/4009471) -- [Windows 7 SP1 and Windows Server 2008 R2 SP1](https://support.microsoft.com/help/40009469) +- [Windows 7 SP1 and Windows Server 2008 R2 SP1](https://support.microsoft.com/help/4009469) ## Data Collection 1. Network Capture with ETW. Enter the following at an elevated command prompt: - ```cmd + ```console netsh trace start wireless_dbg capture=yes overwrite=yes maxsize=4096 tracefile=c:\tmp\wireless.etl ``` 2. Reproduce the issue. @@ -70,12 +69,12 @@ Make sure that you install the latest Windows updates, cumulative updates, and r - If intermittent connection drops trigger stop command on a script (ping or test network constantly until fail, then netsh trace stop). 3. Stop the trace by entering the following command: - ```cmd + ```console netsh trace stop ``` 4. To convert the output file to text format: - ```cmd + ```console netsh trace convert c:\tmp\wireless.etl ``` @@ -105,39 +104,39 @@ The wifi connection state machine has the following states: Standard wifi connections tend to transition between states such as: -**Connecting** +- Connecting -Reset --> Ihv_Configuring --> Configuring --> Associating --> Authenticating --> Connected + Reset --> Ihv_Configuring --> Configuring --> Associating --> Authenticating --> Connected -**Disconnecting** +- Disconnecting -Connected --> Roaming --> Wait_For_Disconnected --> Disconnected --> Reset + Connected --> Roaming --> Wait_For_Disconnected --> Disconnected --> Reset ->Filtering the ETW trace with the [TextAnalysisTool](https://github.com/TextAnalysisTool/Releases) (TAT) is an easy first step to determine where a failed connection setup is breaking down. A useful [wifi filter file](#wifi-filter-file) is included at the bottom of this article. +Filtering the ETW trace with the [TextAnalysisTool](https://github.com/TextAnalysisTool/Releases) (TAT) is an easy first step to determine where a failed connection setup is breaking down. A useful [wifi filter file](#wifi-filter-file) is included at the bottom of this article. Use the **FSM transition** trace filter to see the connection state machine. You can see [an example](#textanalysistool-example) of this filter applied in the TAT at the bottom of this page. The following is an example of a good connection setup: -
+```console
 44676 [2]0F24.1020::‎2018‎-‎09‎-‎17 10:22:14.658 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Disconnected to State: Reset
 45473 [1]0F24.1020::‎2018‎-‎09‎-‎17 10:22:14.667 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Reset to State: Ihv_Configuring
 45597 [3]0F24.1020::‎2018‎-‎09‎-‎17 10:22:14.708 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Ihv_Configuring to State: Configuring
 46085 [2]0F24.17E0::‎2018‎-‎09‎-‎17 10:22:14.710 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Configuring to State: Associating
 47393 [1]0F24.1020::‎2018‎-‎09‎-‎17 10:22:14.879 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Associating to State: Authenticating
 49465 [2]0F24.17E0::‎2018‎-‎09‎-‎17 10:22:14.990 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Authenticating to State: Connected
-
+``` The following is an example of a failed connection setup: -
+```console
 44676 [2]0F24.1020::‎2018‎-‎09‎-‎17 10:22:14.658 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Disconnected to State: Reset
 45473 [1]0F24.1020::‎2018‎-‎09‎-‎17 10:22:14.667 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Reset to State: Ihv_Configuring
 45597 [3]0F24.1020::‎2018‎-‎09‎-‎17 10:22:14.708 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Ihv_Configuring to State: Configuring
 46085 [2]0F24.17E0::‎2018‎-‎09‎-‎17 10:22:14.710 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Configuring to State: Associating
 47393 [1]0F24.1020::‎2018‎-‎09‎-‎17 10:22:14.879 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Associating to State: Authenticating
 49465 [2]0F24.17E0::‎2018‎-‎09‎-‎17 10:22:14.990 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Authenticating to State: Roaming
-
+``` By identifying the state at which the connection fails, one can focus more specifically in the trace on logs just prior to the last known good state. @@ -155,7 +154,7 @@ Enable the **FSM transition, SecMgr Transition,** and **AuthMgr Transition** fil Continuing with the example above, the combined filters look like this: -
+```console
 [2] 0C34.2FF0::08/28/17-13:24:28.693 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: 
 Reset to State: Ihv_Configuring
 [2] 0C34.2FF0::08/28/17-13:24:28.693 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: 
@@ -173,7 +172,7 @@ Associating to State: Authenticating
 [2] 0C34.2FF0::08/28/17-13:24:29.7512788 [Microsoft-Windows-WLAN-AutoConfig]Port[13] Peer 8A:15:14:B6:25:10 SecMgr Transition DEACTIVATE (11) --> INACTIVE (1)
 [2] 0C34.2FF0::08/28/17-13:24:29.7513404 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: 
 Authenticating to State: Roaming
-
+``` > [!NOTE] > In the next to last line the SecMgr transition is suddenly deactivating:
@@ -182,7 +181,7 @@ Authenticating to State: Roaming Enabling the **Microsoft-Windows-WLAN-AutoConfig** filter will show more detail leading to the DEACTIVATE transition: -
+```console
 [3] 0C34.2FE8::08/28/17-13:24:28.902 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: 
 Associating to State: Authenticating
 [1] 0C34.275C::08/28/17-13:24:28.960 [Microsoft-Windows-WLAN-AutoConfig]Port[13] Peer 8A:15:14:B6:25:10 SecMgr Transition START AUTH (3) --> WAIT FOR AUTH SUCCESS (4)
@@ -196,7 +195,7 @@ Associating to State: Authenticating
  [2] 0C34.2FF0::08/28/17-13:24:29.7512788 [Microsoft-Windows-WLAN-AutoConfig]Port[13] Peer 8A:15:14:B6:25:10 SecMgr Transition DEACTIVATE (11) --> INACTIVE (1)
 [2] 0C34.2FF0::08/28/17-13:24:29.7513404 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: 
 Authenticating to State: Roaming
-
+``` The trail backwards reveals a **Port Down** notification: @@ -208,7 +207,7 @@ Below, the MSM is the native wifi stack. These are Windows native wifi drivers w Enable trace filter for **[Microsoft-Windows-NWifi]:** -
+```console
 [3] 0C34.2FE8::08/28/17-13:24:28.902 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: 
 Associating to State: Authenticating
 [1] 0C34.275C::08/28/17-13:24:28.960 [Microsoft-Windows-WLAN-AutoConfig]Port[13] Peer 8A:15:14:B6:25:10 SecMgr Transition START AUTH (3) --> WAIT FOR AUTH SUCCESS (4)
@@ -222,12 +221,14 @@ Associating to State: Authenticating
 [2] 0C34.2FF0::08/28/17-13:24:29.751 [Microsoft-Windows-WLAN-AutoConfig]Port[13] Peer 8A:15:14:B6:25:10 SecMgr Transition WAIT FOR AUTH SUCCESS (7) --> DEACTIVATE (11)
  [2] 0C34.2FF0::08/28/17-13:24:29.7512788 [Microsoft-Windows-WLAN-AutoConfig]Port[13] Peer 8A:15:14:B6:25:10 SecMgr Transition DEACTIVATE (11) --> INACTIVE (1)
 [2] 0C34.2FF0::08/28/17-13:24:29.7513404 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: 
-Authenticating to State: Roaming
+Authenticating to State: Roaming +``` In the trace above, we see the line: -
-[0]0000.0000::‎08/28/17-13:24:29.127 [Microsoft-Windows-NWiFi]DisAssoc: 0x8A1514B62510 Reason: 0x4
+```console +[0]0000.0000::‎08/28/17-13:24:29.127 [Microsoft-Windows-NWiFi]DisAssoc: 0x8A1514B62510 Reason: 0x4 +``` This is followed by **PHY_STATE_CHANGE** and **PORT_DOWN** events due to a disassociate coming from the Access Point (AP), as an indication to deny the connection. This could be due to invalid credentials, connection parameters, loss of signal/roaming, and various other reasons for aborting a connection. The action here would be to examine the reason for the disassociate sent from the indicated AP MAC (8A:15:14:B6:25:10). This would be done by examining internal logging/tracing from the AP. @@ -238,7 +239,7 @@ This is followed by **PHY_STATE_CHANGE** and **PORT_DOWN** events due to a disas ## Example ETW capture -
+```console
 C:\tmp>netsh trace start wireless_dbg capture=yes overwrite=yes maxsize=4096 tracefile=c:\tmp\wireless.etl
 
 Trace configuration:
@@ -279,7 +280,7 @@ C:\tmp>dir
 01/09/2019  02:59 PM         2,786,540 wireless.txt
                3 File(s)     10,395,004 bytes
                2 Dir(s)  46,648,332,288 bytes free
-
+``` ## Wifi filter file diff --git a/windows/client-management/change-default-removal-policy-external-storage-media.md b/windows/client-management/change-default-removal-policy-external-storage-media.md index d59710d70b..8b0e587b74 100644 --- a/windows/client-management/change-default-removal-policy-external-storage-media.md +++ b/windows/client-management/change-default-removal-policy-external-storage-media.md @@ -3,7 +3,7 @@ title: Windows 10 default media removal policy description: In Windows 10, version 1809, the default removal policy for external storage media changed from "Better performance" to "Quick removal." ms.prod: w10 author: Teresa-Motiv -ms.author: v-tea +ms.author: dougeby ms.date: 11/25/2020 ms.topic: article ms.custom: diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index 5a346bc6b9..5c5047248c 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -73,7 +73,7 @@ Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-gu > When you connect to the remote PC, enter your account name in this format: AzureAD\yourloginid@domain.com. > [!NOTE] - > If you cannot connect using Remote Desktop Connection 6.0, you must turn off the new features of RDP 6.0 and revert back to RDP 5.0 by making a few changes in the RDP file. See the details in this [support article](https://support.microsoft.com/help/941641/remote-desktop-connection-6-0-prompts-you-for-credentials-before-you-e). + > If you cannot connect using Remote Desktop Connection 6.0, you must turn off the new features of RDP 6.0 and revert back to RDP 5.0 by making a few changes in the RDP file. See the details in this [support article](/troubleshoot/windows-server/remote/remote-desktop-connection-6-prompts-credentials). ## Supported configurations diff --git a/windows/client-management/determine-appropriate-page-file-size.md b/windows/client-management/determine-appropriate-page-file-size.md index 31f5c16b75..be28170923 100644 --- a/windows/client-management/determine-appropriate-page-file-size.md +++ b/windows/client-management/determine-appropriate-page-file-size.md @@ -67,7 +67,7 @@ Kernel memory crash dumps require enough page file space or dedicated dump file Computers that are running Microsoft Windows or Microsoft Windows Server usually must have a page file to support a system crash dump. System administrators now have the option to create a dedicated dump file instead. -A dedicated dump file is a page file that is not used for paging. Instead, it is “dedicated” to back a system crash dump file (Memory.dmp) when a system crash occurs. Dedicated dump files can be put on any disk volume that can support a page file. We recommend that you use a dedicated dump file if you want a system crash dump but you do not want a page file. +A dedicated dump file is a page file that is not used for paging. Instead, it is “dedicated” to back a system crash dump file (Memory.dmp) when a system crash occurs. Dedicated dump files can be put on any disk volume that can support a page file. We recommend that you use a dedicated dump file if you want a system crash dump but you do not want a page file. To learn how to create it, see [Overview of memory dump file options for Windows](/troubleshoot/windows-server/performance/memory-dump-file-options). ## System-managed page files diff --git a/windows/client-management/group-policies-for-enterprise-and-education-editions.md b/windows/client-management/group-policies-for-enterprise-and-education-editions.md index c9150ce005..3d50f1d30a 100644 --- a/windows/client-management/group-policies-for-enterprise-and-education-editions.md +++ b/windows/client-management/group-policies-for-enterprise-and-education-editions.md @@ -32,7 +32,7 @@ In Windows 10, version 1607, the following Group Policy settings apply only to W | **Do not show Windows Tips** | Computer Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight) | | **Force a specific default lock screen image** | Computer Configuration > Administrative Templates > Control Panel > Personalization | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight) | | **Start layout** | User Configuration\Administrative Templates\Start Menu and Taskbar | In Windows 10, version 1703, this policy setting can be applied to Windows 10 Pro. For more info, see [Manage Windows 10 Start layout options and policies](/windows/configuration/windows-10-start-layout-options-and-policies) | -| **Turn off the Store application** | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application

User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application | For more info, see [Knowledge Base article# 3135657](https://support.microsoft.com/kb/3135657). | +| **Turn off the Store application** | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application

User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application | For more info, see [Knowledge Base article# 3135657](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store). | | **Only display the private store within the Microsoft Store app** | Computer Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Microsoft Store app

User Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Microsoft Store app | For more info, see [Manage access to private store](/microsoft-store/manage-access-to-private-store) | | **Don't search the web or display web results** | Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results | For more info, see [Cortana integration in your enterprise](/windows/configuration/cortana-at-work/cortana-at-work-overview) | diff --git a/windows/client-management/manage-settings-app-with-group-policy.md b/windows/client-management/manage-settings-app-with-group-policy.md index 4e6bcdad77..56a3adc040 100644 --- a/windows/client-management/manage-settings-app-with-group-policy.md +++ b/windows/client-management/manage-settings-app-with-group-policy.md @@ -26,7 +26,7 @@ To make use of the Settings App group policies on Windows server 2016, install f >[!Note] >Each server that you want to manage access to the Settings App must be patched. -If your company uses one or the PolicyDefinitions folder of the Domain Controllers used for Group Policy management, to centrally manage the new policies, copy the ControlPanel.admx and ControlPanel.adml file to [Central Store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra). +If your company uses one or the PolicyDefinitions folder of the Domain Controllers used for Group Policy management, to centrally manage the new policies, copy the ControlPanel.admx and ControlPanel.adml file to [Central Store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store). This policy is available for both User and Computer depending on the version of the OS. Windows Server 2016 with KB 4457127 applied will have both User and Computer policy. Windows 10, version 1703, added Computer policy for the Settings app. Windows 10, version 1809, added User policy for the Settings app. diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md index 2bfc3e5170..d45e85d719 100644 --- a/windows/client-management/mandatory-user-profile.md +++ b/windows/client-management/mandatory-user-profile.md @@ -42,7 +42,7 @@ The name of the folder in which you store the mandatory profile must use the cor | Windows 10, versions 1507 and 1511 | N/A | v5 | | Windows 10, versions 1607, 1703, 1709, 1803, 1809, 1903 and 1909 | Windows Server 2016 and Windows Server 2019 | v6 | -For more information, see [Deploy Roaming User Profiles, Appendix B](/windows-server/storage/folder-redirection/deploy-roaming-user-profiles#appendix-b-profile-version-reference-information) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](https://support.microsoft.com/kb/3056198). +For more information, see [Deploy Roaming User Profiles, Appendix B](/windows-server/storage/folder-redirection/deploy-roaming-user-profiles#appendix-b-profile-version-reference-information) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](/troubleshoot/windows-server/user-profiles-and-logon/roaming-user-profiles-versioning). ## Mandatory user profile diff --git a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md index 64394a6989..740ad8289d 100644 --- a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md +++ b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md @@ -39,11 +39,11 @@ Here's a step-by-step guide to adding an Azure Active Directory tenant, adding a If you don't have a paid subscription to any Microsoft service, you can purchase an Azure AD premium subscription. Go to the Office 356 portal at https://portal.office.com/, and then sign in using the admin account that you created in Step 4 (for example, user1@contosoltd.onmicrosoftcom). - ![login to office 365.](images/azure-ad-add-tenant4.png) + ![login to office 365](images/azure-ad-add-tenant4.png) 6. Select **Install software**. - ![login to office 365.](images/azure-ad-add-tenant5.png) + ![login to office 365 portal](images/azure-ad-add-tenant5.png) 7. In the Microsoft 365 admin center, select **Purchase Services** from the left navigation. @@ -69,27 +69,27 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent 1. Sign in to the Microsoft 365 admin center at using your organization's account. - ![register azuread.](images/azure-ad-add-tenant10.png) + ![register in azuread.](images/azure-ad-add-tenant10.png) 2. On the **Home** page, select on the Admin tools icon. - ![register azuread.](images/azure-ad-add-tenant11.png) + ![register in azure-ad.](images/azure-ad-add-tenant11.png) 3. On the **Admin center** page, hover your mouse over the Admin tools icon on the left and then click **Azure AD**. This will take you to the Azure Active Directory sign-up page and brings up your existing Office 365 organization account information. - ![register azuread.](images/azure-ad-add-tenant12.png) + ![register azuread](images/azure-ad-add-tenant12.png) 4. On the **Sign up** page, make sure to enter a valid phone number and then click **Sign up**. - ![register azuread.](images/azure-ad-add-tenant13.png) + ![registration in azure-ad](images/azure-ad-add-tenant13.png) 5. It may take a few minutes to process the request. - ![register azuread.](images/azure-ad-add-tenant14.png) + ![registration in azuread.](images/azure-ad-add-tenant14.png) 6. You will see a welcome page when the process completes. - ![register azuread.](images/azure-ad-add-tenant15.png) + ![register screen of azuread](images/azure-ad-add-tenant15.png) diff --git a/windows/client-management/mdm/applicationcontrol-csp-ddf.md b/windows/client-management/mdm/applicationcontrol-csp-ddf.md index f6d3ef7a2f..5c44ba2dc1 100644 --- a/windows/client-management/mdm/applicationcontrol-csp-ddf.md +++ b/windows/client-management/mdm/applicationcontrol-csp-ddf.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: ManikaDhiman +author: dansimp ms.date: 07/10/2019 --- diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md index 4a4b41b531..648d9c245f 100644 --- a/windows/client-management/mdm/applicationcontrol-csp.md +++ b/windows/client-management/mdm/applicationcontrol-csp.md @@ -6,7 +6,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: ManikaDhiman +author: dansimp ms.reviewer: jsuther1974 ms.date: 09/10/2020 --- diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 456fbbd28c..96b516b939 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -28,7 +28,7 @@ For RequireDeviceEncryption and RequireStorageCardEncryption, the Get operation The following shows the BitLocker configuration service provider in tree format. -``` +```console ./Device/Vendor/MSFT BitLocker ----RequireStorageCardEncryption @@ -63,85 +63,21 @@ BitLocker **./Device/Vendor/MSFT/BitLocker** Defines the root node for the BitLocker configuration service provider. -**RequireStorageCardEncryption** - -Allows the administrator to require storage card encryption on the device. This policy is valid only for a mobile SKU. - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcross markcross markcross markcross markcheck mark
- -Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the storage card, but the user will no longer be prompted to turn it on. - -- 0 (default) – Storage cards do not need to be encrypted. -- 1 – Require storage cards to be encrypted. - -Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on. - -If you want to disable this policy use the following SyncML: - -```xml - - - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/RequireStorageCardEncryption - - - int - - 0 - - - - -``` - -Data type is integer. Supported operations are Add, Get, Replace, and Delete. - - **RequireDeviceEncryption** Allows the administrator to require encryption to be turned on by using BitLocker\Device Encryption. - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcheck mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + Data type is integer. Sample value for this node to enable this policy: 1. Supported operations are Add, Get, Replace, and Delete. @@ -193,24 +129,15 @@ If you want to disable this policy, use the following SyncML: Allows you to set the default encryption method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system, and recovery partitions are skipped from encryption. This setting is a direct mapping to the BitLocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)". - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -276,26 +203,15 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. Allows you to associate unique organizational identifiers to a new drive that is enabled with BitLocker. - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -347,26 +263,15 @@ If you disable or do not configure this setting, the identification field is not Allows users on devices that are compliant with InstantGo or the Microsoft Hardware Security Test Interface (HSTI) to not have a PIN for preboot authentication. - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -400,26 +305,15 @@ If this policy is disabled, the options of "Require additional authentication at Allows users to configure whether or not enhanced startup PINs are used with BitLocker. - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -456,26 +350,15 @@ If you disable or do not configure this policy setting, enhanced PINs will not b Allows you to configure whether standard users are allowed to change BitLocker PIN or password that is used to protect the operating system drive. - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -512,26 +395,15 @@ Sample value for this node to disable this policy is: Allows users to enable authentication options that require user input from the preboot environment, even if the platform indicates a lack of preboot input capability. - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -574,26 +446,15 @@ When the Windows Recovery Environment is not enabled and this policy is not enab Allows you to configure the encryption type that is used by BitLocker. - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -633,26 +494,15 @@ For more information about the tool to manage BitLocker, see [Manage-bde](/windo This setting is a direct mapping to the BitLocker Group Policy "Require additional authentication at startup". - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -741,26 +591,15 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. This setting is a direct mapping to the BitLocker Group Policy "Configure minimum PIN length for startup". - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -818,26 +657,15 @@ This setting is a direct mapping to the BitLocker Group Policy "Configure pre-bo (PrebootRecoveryInfo_Name). - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -907,26 +735,15 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. This setting is a direct mapping to the BitLocker Group Policy "Choose how BitLocker-protected operating system drives can be recovered" (OSRecoveryUsage_Name). - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -1004,26 +821,15 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. This setting is a direct mapping to the BitLocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" (). - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -1110,26 +916,15 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. This setting is a direct mapping to the BitLocker Group Policy "Deny write access to fixed drives not protected by BitLocker" (FDVDenyWriteAccess_Name). - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -1179,26 +974,15 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. Allows you to configure the encryption type on fixed data drives that is used by BitLocker. - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -1240,26 +1024,15 @@ For more information about the tool to manage BitLocker, see [Manage-bde](/windo This setting is a direct mapping to the BitLocker Group Policy "Deny write access to removable drives not protected by BitLocker" (RDVDenyWriteAccess_Name). - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -1320,26 +1093,15 @@ Disabling the policy will let the system choose the default behaviors. If you wa Allows you to configure the encryption type that is used by BitLocker. - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -1375,26 +1137,15 @@ If this policy is disabled or not configured, the BitLocker Setup Wizard asks th Allows you to control the use of BitLocker on removable data drives. - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + ADMX Info: @@ -1445,26 +1196,15 @@ Allows the admin to disable the warning prompt for other disk encryption on the > [!Warning] > When you enable BitLocker on a device with third-party encryption, it may render the device unusable and require you to reinstall Windows. - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + The following list shows the supported values: @@ -1509,26 +1249,15 @@ Allows Admin to enforce "RequireDeviceEncryption" policy for scenarios where pol If "AllowWarningForOtherDiskEncryption" is not set, or is set to "1", "RequireDeviceEncryption" policy will not try to encrypt drive(s) if a standard user is the current logged on user in the system. - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + The expected values for this policy are: @@ -1564,26 +1293,15 @@ This setting initiates a client-driven recovery password refresh after an OS dri - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + Value type is int. Supported operations are Add, Delete, Get, and Replace. @@ -1619,26 +1337,15 @@ Each server-side recovery key rotation is represented by a request ID. The serve - RotateRecoveryPasswordsRequestID: Returns request ID of last request processed. - RotateRecoveryPasswordsRotationStatus: Returns status of last request processed. - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + Value type is string. Supported operation is Execute. Request ID is expected as a parameter. @@ -1664,26 +1371,15 @@ Interior node. Supported operation is Get. This node reports compliance state of device encryption on the system. - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + @@ -1732,26 +1428,15 @@ Status code can be one of the following: - 0 - Pass - Any other code - Failure HRESULT - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + Value type is int. Supported operation is Get. @@ -1767,26 +1452,14 @@ This node reports the RequestID corresponding to RotateRecoveryPasswordsStatus. This node needs to be queried in synchronization with RotateRecoveryPasswordsStatus to ensure the status is correctly matched to the request ID. - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobile
cross markcheck markcheck markcheck markcheck markcross mark
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| diff --git a/windows/client-management/mdm/browserfavorite-csp.md b/windows/client-management/mdm/browserfavorite-csp.md index e4564b7aa4..fa29e87d8d 100644 --- a/windows/client-management/mdm/browserfavorite-csp.md +++ b/windows/client-management/mdm/browserfavorite-csp.md @@ -9,7 +9,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: dansimp -ms.date: 06/26/2017 +ms.date: 10/25/2021 --- # BrowserFavorite CSP diff --git a/windows/client-management/mdm/change-history-for-mdm-documentation.md b/windows/client-management/mdm/change-history-for-mdm-documentation.md index e016a7676e..089b3868fd 100644 --- a/windows/client-management/mdm/change-history-for-mdm-documentation.md +++ b/windows/client-management/mdm/change-history-for-mdm-documentation.md @@ -7,7 +7,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 10/19/2020 --- @@ -179,907 +179,141 @@ This article lists new and updated articles for the Mobile Device Management (MD ## August 2018 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
New or updated articleDescription
BitLocker CSP

Added support for Windows 10 Pro starting in the version 1809.

-
Office CSP

Added FinalStatus setting in Windows 10, version 1809.

-
RemoteWipe CSP

Added new settings in Windows 10, version 1809.

-
TenantLockdown CSP

Added new CSP in Windows 10, version 1809.

-
WindowsDefenderApplicationGuard CSP

Added new settings in Windows 10, version 1809.

-
Policy DDF file

Posted an updated version of the Policy DDF for Windows 10, version 1809.

-
Policy CSP

Added the following new policies in Windows 10, version 1809:

-
    -
  • Browser/AllowFullScreenMode
    • -
  • Browser/AllowPrelaunch
    • -
  • Browser/AllowPrinting
    • -
  • Browser/AllowSavingHistory
    • -
  • Browser/AllowSideloadingOfExtensions
    • -
  • Browser/AllowTabPreloading
    • -
  • Browser/AllowWebContentOnNewTabPage
    • -
  • Browser/ConfigureFavoritesBar
    • -
  • Browser/ConfigureHomeButton
    • -
  • Browser/ConfigureKioskMode
    • -
  • Browser/ConfigureKioskResetAfterIdleTimeout
    • -
  • Browser/ConfigureOpenMicrosoftEdgeWith
    • -
  • Browser/ConfigureTelemetryForMicrosoft365Analytics
    • -
  • Browser/PreventCertErrorOverrides
    • -
  • Browser/SetHomeButtonURL
    • -
  • Browser/SetNewTabPageURL
    • -
  • Browser/UnlockHomeButton
    • -
  • Experience/DoNotSyncBrowserSettings
    • -
  • Experience/PreventUsersFromTurningOnBrowserSyncing
    • -
  • Kerberos/UPNNameHints
    • -
  • Privacy/AllowCrossDeviceClipboard
    • -
  • Privacy/DisablePrivacyExperience
    • -
  • Privacy/UploadUserActivities
    • -
  • System/AllowDeviceNameInDiagnosticData
    • -
  • System/ConfigureMicrosoft365UploadEndpoint
    • -
  • System/DisableDeviceDelete
    • -
  • System/DisableDiagnosticDataViewer
    • -
  • Storage/RemovableDiskDenyWriteAccess
    • -
  • Update/UpdateNotificationLevel
    • -
-

Start/DisableContextMenus - added in Windows 10, version 1803.

-

RestrictedGroups/ConfigureGroupMembership - added new schema to apply and retrieve the policy.

-
+|New or updated article|Description| +|--- |--- | +|[BitLocker CSP](bitlocker-csp.md)|Added support for Windows 10 Pro starting in the version 1809.| +|[Office CSP](office-csp.md)|Added FinalStatus setting in Windows 10, version 1809.| +|[RemoteWipe CSP](remotewipe-csp.md)|Added new settings in Windows 10, version 1809.| +|[TenantLockdown CSP](tenantlockdown-csp.md)|Added new CSP in Windows 10, version 1809.| +|[WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md)|Added new settings in Windows 10, version 1809.| +|[Policy DDF file](policy-ddf-file.md)|Posted an updated version of the Policy DDF for Windows 10, version 1809.| +|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies in Windows 10, version 1809:
  • Browser/AllowFullScreenMode
  • Browser/AllowPrelaunch
  • Browser/AllowPrinting
  • Browser/AllowSavingHistory
  • Browser/AllowSideloadingOfExtensions
  • Browser/AllowTabPreloading
  • Browser/AllowWebContentOnNewTabPage
  • Browser/ConfigureFavoritesBar
  • Browser/ConfigureHomeButton
  • Browser/ConfigureKioskMode
  • Browser/ConfigureKioskResetAfterIdleTimeout
  • Browser/ConfigureOpenMicrosoftEdgeWith
  • Browser/ConfigureTelemetryForMicrosoft365Analytics
  • Browser/PreventCertErrorOverrides
  • Browser/SetHomeButtonURL
  • Browser/SetNewTabPageURL
  • Browser/UnlockHomeButton
  • Experience/DoNotSyncBrowserSettings
  • Experience/PreventUsersFromTurningOnBrowserSyncing
  • Kerberos/UPNNameHints
  • Privacy/AllowCrossDeviceClipboard
  • Privacy
  • DisablePrivacyExperience
  • Privacy/UploadUserActivities
  • System/AllowDeviceNameInDiagnosticData
  • System/ConfigureMicrosoft365UploadEndpoint
  • System/DisableDeviceDelete
  • System/DisableDiagnosticDataViewer
  • Storage/RemovableDiskDenyWriteAccess
  • Update/UpdateNotificationLevel

    Start/DisableContextMenus - added in Windows 10, version 1803.

    RestrictedGroups/ConfigureGroupMembership - added new schema to apply and retrieve the policy.| ## July 2018 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated articleDescription
    AssignedAccess CSP

    Added the following note:

    -
      -
    • You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.
      • -
    -
    PassportForWork CSP

    Added new settings in Windows 10, version 1809.

    -
    EnterpriseModernAppManagement CSP

    Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

    -
    Win32CompatibilityAppraiser CSP

    Added new configuration service provider in Windows 10, version 1809.

    -
    WindowsLicensing CSP

    Added S mode settings and SyncML examples in Windows 10, version 1809.

    -
    SUPL CSP

    Added 3 new certificate nodes in Windows 10, version 1809.

    -
    Defender CSP

    Added a new node Health/ProductStatus in Windows 10, version 1809.

    -
    BitLocker CSP

    Added a new node AllowStandardUserEncryption in Windows 10, version 1809.

    -
    DevDetail CSP

    Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

    -
    Policy CSP

    Added the following new policies in Windows 10, version 1809:

    -
      -
    • ApplicationManagement/LaunchAppAfterLogOn
      • -
    • ApplicationManagement/ScheduleForceRestartForUpdateFailures
      • -
    • Authentication/EnableFastFirstSignIn (Preview mode only)
      • -
    • Authentication/EnableWebSignIn (Preview mode only)
      • -
    • Authentication/PreferredAadTenantDomainName
      • -
    • Defender/CheckForSignaturesBeforeRunningScan
      • -
    • Defender/DisableCatchupFullScan
      • -
    • Defender/DisableCatchupQuickScan
      • -
    • Defender/EnableLowCPUPriority
      • -
    • Defender/SignatureUpdateFallbackOrder
      • -
    • Defender/SignatureUpdateFileSharesSources
      • -
    • DeviceGuard/ConfigureSystemGuardLaunch
      • -
    • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
      • -
    • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
      • -
    • DeviceInstallation/PreventDeviceMetadataFromNetwork
      • -
    • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
      • -
    • DmaGuard/DeviceEnumerationPolicy
      • -
    • Experience/AllowClipboardHistory
      • -
    • Security/RecoveryEnvironmentAuthentication
      • -
    • TaskManager/AllowEndTask
      • -
    • WindowsDefenderSecurityCenter/DisableClearTpmButton
      • -
    • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
      • -
    • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
      • -
    • WindowsLogon/DontDisplayNetworkSelectionUI
      • -
    -

    Recent changes:

    -
      -
    • DataUsage/SetCost3G - deprecated in Windows 10, version 1809.
      • -
    -
    +|New or updated article|Description| +|--- |--- | +|[AssignedAccess CSP](assignedaccess-csp.md)|Added the following note:

    You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.| +|[PassportForWork CSP](passportforwork-csp.md)|Added new settings in Windows 10, version 1809.| +|[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)|Added NonRemovable setting under AppManagement node in Windows 10, version 1809.| +|[Win32CompatibilityAppraiser CSP](win32compatibilityappraiser-csp.md)|Added new configuration service provider in Windows 10, version 1809.| +|[WindowsLicensing CSP](windowslicensing-csp.md)|Added S mode settings and SyncML examples in Windows 10, version 1809.| +|[SUPL CSP](supl-csp.md)|Added 3 new certificate nodes in Windows 10, version 1809.| +|[Defender CSP](defender-csp.md)|Added a new node Health/ProductStatus in Windows 10, version 1809.| +|[BitLocker CSP](bitlocker-csp.md)|Added a new node AllowStandardUserEncryption in Windows 10, version 1809.| +|[DevDetail CSP](devdetail-csp.md)|Added a new node SMBIOSSerialNumber in Windows 10, version 1809.| +|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies in Windows 10, version 1809:
  • ApplicationManagement/LaunchAppAfterLogOn
  • ApplicationManagement/ScheduleForceRestartForUpdateFailures
  • Authentication/EnableFastFirstSignIn (Preview mode only)
  • Authentication/EnableWebSignIn (Preview mode only)
  • Authentication/PreferredAadTenantDomainName
  • Defender/CheckForSignaturesBeforeRunningScan
  • Defender/DisableCatchupFullScan
  • Defender/DisableCatchupQuickScan
  • Defender/EnableLowCPUPriority
  • Defender/SignatureUpdateFallbackOrder
  • Defender/SignatureUpdateFileSharesSources
  • DeviceGuard/ConfigureSystemGuardLaunch
  • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
  • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
  • DeviceInstallation/PreventDeviceMetadataFromNetwork
  • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
  • DmaGuard/DeviceEnumerationPolicy
  • Experience/AllowClipboardHistory
  • Security/RecoveryEnvironmentAuthentication
  • TaskManager/AllowEndTask
  • WindowsDefenderSecurityCenter/DisableClearTpmButton
  • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
  • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
  • WindowsLogon/DontDisplayNetworkSelectionUI

    Recent changes:
  • DataUsage/SetCost3G - deprecated in Windows 10, version 1809.| ## June 2018 - ---- - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated articleDescription
    Wifi CSP

    Added a new node WifiCost in Windows 10, version 1809.

    -
    Diagnose MDM failures in Windows 10

    Recent changes:

    -
      -
    • Added procedure for collecting logs remotely from Windows 10 Holographic.
      • -
    • Added procedure for downloading the MDM Diagnostic Information log.
      • -
    -
    BitLocker CSP

    Added new node AllowStandardUserEncryption in Windows 10, version 1809.

    -
    Policy CSP

    Recent changes:

    -
      -
    • AccountPoliciesAccountLockoutPolicy/AccountLockoutDuration - removed from docs. Not supported.
      • -
    • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
      • -
    • AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter - removed from docs. Not supported.
      • -
    • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers - removed from docs. Not supported.
      • -
    • System/AllowFontProviders is not supported in HoloLens (1st gen) Commercial Suite.
      • -
    • Security/RequireDeviceEncryption is supported in the Home SKU.
      • -
    • Start/StartLayout - added a table of SKU support information.
      • -
    • Start/ImportEdgeAssets - added a table of SKU support information.
      • -
    -

    Added the following new policies in Windows 10, version 1809:

    -
      -
    • Update/EngagedRestartDeadlineForFeatureUpdates
      • -
    • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
      • -
    • Update/EngagedRestartTransitionScheduleForFeatureUpdates
      • -
    • Update/SetDisablePauseUXAccess
      • -
    • Update/SetDisableUXWUAccess
      • -
    -
    WiredNetwork CSPNew CSP added in Windows 10, version 1809. -
    +|New or updated article|Description| +|--- |--- | +|[Wifi CSP](wifi-csp.md)|Added a new node WifiCost in Windows 10, version 1809.| +|[Diagnose MDM failures in Windows 10](diagnose-mdm-failures-in-windows-10.md)|Recent changes:
  • Added procedure for collecting logs remotely from Windows 10 Holographic.
  • Added procedure for downloading the MDM Diagnostic Information log.| +|[BitLocker CSP](bitlocker-csp.md)|Added new node AllowStandardUserEncryption in Windows 10, version 1809.| +|[Policy CSP](policy-configuration-service-provider.md)|Recent changes:
  • AccountPoliciesAccountLockoutPolicy
  • AccountLockoutDuration - removed from docs. Not supported.
  • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
  • AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter - removed from docs. Not supported.
  • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers - removed from docs. Not supported.
  • System/AllowFontProviders is not supported in HoloLens (1st gen) Commercial Suite.
  • Security/RequireDeviceEncryption is supported in the Home SKU.
  • Start/StartLayout - added a table of SKU support information.
  • Start/ImportEdgeAssets - added a table of SKU support information.

    Added the following new policies in Windows 10, version 1809:
  • Update/EngagedRestartDeadlineForFeatureUpdates
  • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
  • Update/EngagedRestartTransitionScheduleForFeatureUpdates
  • Update/SetDisablePauseUXAccess
  • Update/SetDisableUXWUAccess| +|[WiredNetwork CSP](wirednetwork-csp.md)|New CSP added in Windows 10, version 1809.| ## May 2018 - ---- - - - - - - - - - - - -
    New or updated articleDescription
    Policy DDF file

    Updated the DDF files in the Windows 10 version 1703 and 1709.

    - -
    +|New or updated article|Description| +|--- |--- | +|[Policy DDF file](policy-ddf-file.md)|Updated the DDF files in the Windows 10 version 1703 and 1709.
  • [Download the Policy DDF file for Windows 10, version 1709](https://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml)
  • [Download the Policy DDF file for Windows 10, version 1703](https://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml)| ## April 2018 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated articleDescription
    WindowsDefenderApplicationGuard CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • Settings/AllowVirtualGPU
      • -
    • Settings/SaveFilesToHost
      • -
    -
    NetworkProxy CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • ProxySettingsPerUser
      • -
    -
    Accounts CSP

    Added a new CSP in Windows 10, version 1803.

    -
    MDM Migration Analysis Tool (MMAT)

    Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

    -
    CSP DDF files download

    Added the DDF download of Windows 10, version 1803 configuration service providers.

    -
    Policy CSP

    Added the following new policies for Windows 10, version 1803:

    -
      -
    • Bluetooth/AllowPromptedProximalConnections
      • -
    • KioskBrowser/EnableEndSessionButton
      • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
      • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
      • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
      • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
      • -
    -
    +|New or updated article|Description| +|--- |--- | +|[WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md)|Added the following node in Windows 10, version 1803:
  • Settings/AllowVirtualGPU
  • Settings/SaveFilesToHost| +|[NetworkProxy CSP](\networkproxy--csp.md)|Added the following node in Windows 10, version 1803:
  • ProxySettingsPerUser| +|[Accounts CSP](accounts-csp.md)|Added a new CSP in Windows 10, version 1803.| +|[MDM Migration Analysis Tool (MMAT)](https://aka.ms/mmat)|Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.| +|[CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download)|Added the DDF download of Windows 10, version 1803 configuration service providers.| +|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies for Windows 10, version 1803:
  • Bluetooth/AllowPromptedProximalConnections
  • KioskBrowser/EnableEndSessionButton
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers| ## March 2018 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated articleDescription
    eUICCs CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • IsEnabled
      • -
    -
    DeviceStatus CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • OS/Mode
      • -
    -
    Understanding ADMX-backed policies

    Added the following videos:

    - -
    AccountManagement CSP

    Added a new CSP in Windows 10, version 1803.

    -
    RootCATrustedCertificates CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • UntrustedCertificates
      • -
    -
    Policy CSP

    Added the following new policies for Windows 10, version 1803:

    -
      -
    • ApplicationDefaults/EnableAppUriHandlers
      • -
    • ApplicationManagement/MSIAllowUserControlOverInstall
      • -
    • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
      • -
    • Connectivity/AllowPhonePCLinking
      • -
    • Notifications/DisallowCloudNotification
      • -
    • Notifications/DisallowTileNotification
      • -
    • RestrictedGroups/ConfigureGroupMembership
      • -
    -

    The following existing policies were updated:

    -
      -
    • Browser/AllowCookies - updated the supported values. There are 3 values - 0, 1, 2.
      • -
    • InternetExplorer/AllowSiteToZoneAssignmentList - updated the description and added an example SyncML
      • -
    • TextInput/AllowIMENetworkAccess - introduced new suggestion services in Japanese IME in addition to cloud suggestion.
      • -
    -

    Added a new section:

    - -
    Policy CSP - Bluetooth

    Added new section ServicesAllowedList usage guide.

    -
    MultiSIM CSP

    Added SyncML examples and updated the settings descriptions.

    -
    RemoteWipe CSP

    Reverted back to Windows 10, version 1709. Removed previous draft documentation for version 1803.

    -
    +|New or updated article|Description| +|--- |--- | +|[eUICCs CSP](euiccs-csp.md)|Added the following node in Windows 10, version 1803:
  • IsEnabled| +|[DeviceStatus CSP](devicestatus-csp.md)|Added the following node in Windows 10, version 1803:
  • OS/Mode| +|[Understanding ADMX-backed policies](understanding-admx-backed-policies.md)|Added the following videos:
  • [How to create a custom xml to enable an ADMX-backed policy and deploy the XML in Intune](https://www.microsoft.com/showcase/video.aspx?uuid=bdc9b54b-11b0-4bdb-a022-c339d16e7121)
  • [How to import a custom ADMX file to a device using Intune](https://www.microsoft.com/showcase/video.aspx?uuid=a59888b1-429f-4a49-8570-c39a143d9a73)| +|[AccountManagement CSP](accountmanagement-csp.md)|Added a new CSP in Windows 10, version 1803.| +|[RootCATrustedCertificates CSP](rootcacertificates-csp.md)|Added the following node in Windows 10, version 1803:
  • UntrustedCertificates| +|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies for Windows 10, version 1803:
  • ApplicationDefaults/EnableAppUriHandlers
  • ApplicationManagement/MSIAllowUserControlOverInstall
  • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
  • Connectivity/AllowPhonePCLinking
  • Notifications/DisallowCloudNotification
  • Notifications/DisallowTileNotification
  • RestrictedGroups/ConfigureGroupMembership

    The following existing policies were updated:
  • Browser/AllowCookies - updated the supported values. There are 3 values - 0, 1, 2.
  • InternetExplorer/AllowSiteToZoneAssignmentList - updated the description and added an example SyncML
  • TextInput/AllowIMENetworkAccess - introduced new suggestion services in Japanese IME in addition to cloud suggestion.

    Added a new section:
  • [[Policies in Policy CSP supported by Group Policy](/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy) - list of policies in Policy CSP that has corresponding Group Policy. The policy description contains the GP information, such as GP policy name and variable name.| +|[Policy CSP - Bluetooth](policy-csp-bluetooth.md)|Added new section [ServicesAllowedList usage guide](policy-csp-bluetooth.md#servicesallowedlist-usage-guide).| +|[MultiSIM CSP](multisim-csp.md)|Added SyncML examples and updated the settings descriptions.| +|[RemoteWipe CSP](remotewipe-csp.md)|Reverted back to Windows 10, version 1709. Removed previous draft documentation for version 1803.| ## February 2018 - ---- - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated articleDescription
    Policy CSP

    Added the following new policies for Windows 10, version 1803:

    -
      -
    • Display/DisablePerProcessDpiForApps
      • -
    • Display/EnablePerProcessDpi
      • -
    • Display/EnablePerProcessDpiForApps
      • -
    • Experience/AllowWindowsSpotlightOnSettings
      • -
    • TextInput/ForceTouchKeyboardDockedState
      • -
    • TextInput/TouchKeyboardDictationButtonAvailability
      • -
    • TextInput/TouchKeyboardEmojiButtonAvailability
      • -
    • TextInput/TouchKeyboardFullModeAvailability
      • -
    • TextInput/TouchKeyboardHandwritingModeAvailability
      • -
    • TextInput/TouchKeyboardNarrowModeAvailability
      • -
    • TextInput/TouchKeyboardSplitModeAvailability
      • -
    • TextInput/TouchKeyboardWideModeAvailability
      • -
        -
    VPNv2 ProfileXML XSD

    Updated the XSD and Plug-in profile example for VPNv2 CSP.

    -
    AssignedAccess CSP

    Added the following nodes in Windows 10, version 1803:

    -
      -
    • Status
      • -
    • ShellLauncher
      • -
    • StatusConfiguration
      • -
    -

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

    -
    MultiSIM CSP

    Added a new CSP in Windows 10, version 1803.

    -
    EnterpriseModernAppManagement CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • MaintainProcessorArchitectureOnUpdate
      • -
    -
    +|New or updated article|Description| +|--- |--- | +|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies for Windows 10, version 1803:
  • Display/DisablePerProcessDpiForApps
  • Display/EnablePerProcessDpi
  • Display/EnablePerProcessDpiForApps
  • Experience/AllowWindowsSpotlightOnSettings
  • TextInput/ForceTouchKeyboardDockedState
  • TextInput/TouchKeyboardDictationButtonAvailability
  • TextInput/TouchKeyboardEmojiButtonAvailability
  • TextInput/TouchKeyboardFullModeAvailability
  • TextInput/TouchKeyboardHandwritingModeAvailability
  • TextInput/TouchKeyboardNarrowModeAvailability
  • TextInput/TouchKeyboardSplitModeAvailability
  • TextInput/TouchKeyboardWideModeAvailability| +|[VPNv2 ProfileXML XSD](vpnv2-profile-xsd.md)|Updated the XSD and Plug-in profile example for VPNv2 CSP.| +|[AssignedAccess CSP](assignedaccess-csp.md)|Added the following nodes in Windows 10, version 1803:
  • Status
  • ShellLauncher
  • StatusConfiguration

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.| +|[MultiSIM CSP](multisim-csp.md)|Added a new CSP in Windows 10, version 1803.| +|[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)|Added the following node in Windows 10, version 1803:
  • MaintainProcessorArchitectureOnUpdate| ## January 2018 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated articleDescription
    Policy CSP

    Added the following new policies for Windows 10, version 1803:

    -
      -
    • Browser/AllowConfigurationUpdateForBooksLibrary
      • -
    • Browser/AlwaysEnableBooksLibrary
      • -
    • Browser/EnableExtendedBooksTelemetry
      • -
    • Browser/UseSharedFolderForBooks
      • -
    • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
      • -
    • DeliveryOptimization/DODelayForegroundDownloadFromHttp
      • -
    • DeliveryOptimization/DOGroupIdSource
      • -
    • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
      • -
    • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
      • -
    • DeliveryOptimization/DORestrictPeerSelectionBy
      • -
    • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
      • -
    • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
      • -
    • KioskBrowser/BlockedUrlExceptions
      • -
    • KioskBrowser/BlockedUrls
      • -
    • KioskBrowser/DefaultURL
      • -
    • KioskBrowser/EnableHomeButton
      • -
    • KioskBrowser/EnableNavigationButtons
      • -
    • KioskBrowser/RestartOnIdleTime
      • -
    • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
      • -
    • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
      • -
    • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
      • -
    • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
      • -
    • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
      • -
    • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
      • -
    • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
      • -
    • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
      • -
    • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
      • -
    • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
      • -
    • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
      • -
    • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
      • -
    • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
      • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
      • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
      • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients
      • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
      • -
    • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
      • -
    • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
      • -
    • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
      • -
    • RestrictedGroups/ConfigureGroupMembership
      • -
    • Search/AllowCortanaInAAD
      • -
    • Search/DoNotUseWebResults
      • -
    • Security/ConfigureWindowsPasswords
      • -
    • System/FeedbackHubAlwaysSaveDiagnosticsLocally
      • -
    • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
      • -
    • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
      • -
    • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
      • -
    • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
      • -
    • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
      • -
    • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
      • -
    • TaskScheduler/EnableXboxGameSaveTask
      • -
    • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
      • -
    • Update/ConfigureFeatureUpdateUninstallPeriod
      • -
    • UserRights/AccessCredentialManagerAsTrustedCaller
      • -
    • UserRights/AccessFromNetwork
      • -
    • UserRights/ActAsPartOfTheOperatingSystem
      • -
    • UserRights/AllowLocalLogOn
      • -
    • UserRights/BackupFilesAndDirectories
      • -
    • UserRights/ChangeSystemTime
      • -
    • UserRights/CreateGlobalObjects
      • -
    • UserRights/CreatePageFile
      • -
    • UserRights/CreatePermanentSharedObjects
      • -
    • UserRights/CreateSymbolicLinks
      • -
    • UserRights/CreateToken
      • -
    • UserRights/DebugPrograms
      • -
    • UserRights/DenyAccessFromNetwork
      • -
    • UserRights/DenyLocalLogOn
      • -
    • UserRights/DenyRemoteDesktopServicesLogOn
      • -
    • UserRights/EnableDelegation
      • -
    • UserRights/GenerateSecurityAudits
      • -
    • UserRights/ImpersonateClient
      • -
    • UserRights/IncreaseSchedulingPriority
      • -
    • UserRights/LoadUnloadDeviceDrivers
      • -
    • UserRights/LockMemory
      • -
    • UserRights/ManageAuditingAndSecurityLog
      • -
    • UserRights/ManageVolume
      • -
    • UserRights/ModifyFirmwareEnvironment
      • -
    • UserRights/ModifyObjectLabel
      • -
    • UserRights/ProfileSingleProcess
      • -
    • UserRights/RemoteShutdown
      • -
    • UserRights/RestoreFilesAndDirectories
      • -
    • UserRights/TakeOwnership
      • -
    • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
      • -
    • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
      • -
    • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
      • -
    • WindowsDefenderSecurityCenter/HideSecureBoot
      • -
    • WindowsDefenderSecurityCenter/HideTPMTroubleshooting
      • -
    -

    Added the following policies the were added in Windows 10, version 1709

    -
      -
    • DeviceLock/MinimumPasswordAge
      • -
    • Settings/AllowOnlineTips
      • -
    • System/DisableEnterpriseAuthProxy
      • -
    -

    Security/RequireDeviceEncryption - updated to show it is supported in desktop.

    -
    BitLocker CSP

    Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

    -
    EnterpriseModernAppManagement CSP

    Added new node MaintainProcessorArchitectureOnUpdate in Windows 10, next major update.

    -
    DMClient CSP

    Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

    -
      -
    • AADSendDeviceToken
      • -
    • BlockInStatusPage
      • -
    • AllowCollectLogsButton
      • -
    • CustomErrorText
      • -
    • SkipDeviceStatusPage
      • -
    • SkipUserStatusPage
      • -
    -
    Defender CSP

    Added new node (OfflineScan) in Windows 10, version 1803.

    -
    UEFI CSP

    Added a new CSP in Windows 10, version 1803.

    -
    Update CSP

    Added the following nodes in Windows 10, version 1803:

    -
      -
    • Rollback
      • -
    • Rollback/FeatureUpdate
      • -
    • Rollback/QualityUpdateStatus
      • -
    • Rollback/FeatureUpdateStatus
      • -
    -
    +|New or updated article|Description| +|--- |--- | +|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies for Windows 10, version 1803:
  • Browser/AllowConfigurationUpdateForBooksLibrary
  • Browser/AlwaysEnableBooksLibrary
  • Browser/EnableExtendedBooksTelemetry
  • Browser/UseSharedFolderForBooks
  • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
  • DeliveryOptimization/DODelayForegroundDownloadFromHttp
  • DeliveryOptimization/DOGroupIdSource
  • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
  • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
  • DeliveryOptimization/DORestrictPeerSelectionBy
  • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
  • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
  • KioskBrowser/BlockedUrlExceptions
  • KioskBrowser/BlockedUrls
  • KioskBrowser/DefaultURL
  • KioskBrowser/EnableHomeButton
  • KioskBrowser/EnableNavigationButtons
  • KioskBrowser/RestartOnIdleTime
  • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
  • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
  • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
  • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
  • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
  • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
  • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
  • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
  • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
  • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients
  • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
  • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
  • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
  • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
  • RestrictedGroups/ConfigureGroupMembership
  • Search/AllowCortanaInAAD
  • Search/DoNotUseWebResults
  • Security/ConfigureWindowsPasswords
  • System/FeedbackHubAlwaysSaveDiagnosticsLocally
  • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
  • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
  • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
  • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
  • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
  • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
  • TaskScheduler/EnableXboxGameSaveTask
  • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
  • Update/ConfigureFeatureUpdateUninstallPeriod
  • UserRights/AccessCredentialManagerAsTrustedCaller
  • UserRights/AccessFromNetwork
  • UserRights/ActAsPartOfTheOperatingSystem
  • UserRights/AllowLocalLogOn
  • UserRights/BackupFilesAndDirectories
  • UserRights/ChangeSystemTime
  • UserRights/CreateGlobalObjects
  • UserRights/CreatePageFile
  • UserRights/CreatePermanentSharedObjects
  • UserRights/CreateSymbolicLinks
  • UserRights/CreateToken
  • UserRights/DebugPrograms
  • UserRights/DenyAccessFromNetwork
  • UserRights/DenyLocalLogOn
  • UserRights/DenyRemoteDesktopServicesLogOn
  • UserRights/EnableDelegation
  • UserRights/GenerateSecurityAudits
  • UserRights/ImpersonateClient
  • UserRights/IncreaseSchedulingPriority
  • UserRights/LoadUnloadDeviceDrivers
  • UserRights/LockMemory
  • UserRights/ManageAuditingAndSecurityLog
  • UserRights/ManageVolume
  • UserRights/ModifyFirmwareEnvironment
  • UserRights/ModifyObjectLabel
  • UserRights/ProfileSingleProcess
  • UserRights/RemoteShutdown
  • UserRights/RestoreFilesAndDirectories
  • UserRights/TakeOwnership
  • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
  • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
  • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
  • WindowsDefenderSecurityCenter/HideSecureBoot
  • WindowsDefenderSecurityCenter/HideTPMTroubleshooting

    Added the following policies the were added in Windows 10, version 1709
  • DeviceLock/MinimumPasswordAge
  • Settings/AllowOnlineTips
  • System/DisableEnterpriseAuthProxy

    Security/RequireDeviceEncryption - updated to show it is supported in desktop.| +|[BitLocker CSP](bitlocker-csp.md)|Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.| +|[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)|Added new node MaintainProcessorArchitectureOnUpdate in Windows 10, next major update.| +|[DMClient CSP](dmclient-csp.md)|Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:
  • AADSendDeviceToken
  • BlockInStatusPage
  • AllowCollectLogsButton
  • CustomErrorText
  • SkipDeviceStatusPage
  • SkipUserStatusPage| +|[Defender CSP](defender-csp.md)|Added new node (OfflineScan) in Windows 10, version 1803.| +|[UEFI CSP](uefi-csp.md)|Added a new CSP in Windows 10, version 1803.| +|[Update CSP](update-csp.md)|Added the following nodes in Windows 10, version 1803:
  • Rollback
  • Rollback/FeatureUpdate
  • Rollback/QualityUpdateStatus
  • Rollback/FeatureUpdateStatus| ## December 2017 - ---- - - - - - - - - - - - -
    New or updated articleDescription
    Configuration service provider reference

    Added new section CSP DDF files download

    -
    +|New or updated article|Description| +|--- |--- | +|[Configuration service provider reference](configuration-service-provider-reference.md)|Added new section [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download)| ## November 2017 - ---- - - - - - - - - - - - -
    New or updated articleDescription
    Policy CSP

    Added the following policies for Windows 10, version 1709:

    -
      -
    • Authentication/AllowFidoDeviceSignon
      • -
    • Cellular/LetAppsAccessCellularData
      • -
    • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
      • -
    • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
      • -
    • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
      • -
    • Start/HidePeopleBar
      • -
    • Storage/EnhancedStorageDevices
      • -
    • Update/ManagePreviewBuilds
      • -
    • WirelessDisplay/AllowMdnsAdvertisement
      • -
    • WirelessDisplay/AllowMdnsDiscovery
      • -
    -

    Added missing policies from previous releases:

    -
      -
    • Connectivity/DisallowNetworkConnectivityActiveTest
      • -
    • Search/AllowWindowsIndexer
      • -
    -
    +|New or updated article|Description| +|--- |--- | +|[Policy CSP](policy-configuration-service-provider.md)|Added the following policies for Windows 10, version 1709:
  • Authentication/AllowFidoDeviceSignon
  • Cellular/LetAppsAccessCellularData
  • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
  • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
  • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
  • Start/HidePeopleBar
  • Storage/EnhancedStorageDevices
  • Update/ManagePreviewBuilds
  • WirelessDisplay/AllowMdnsAdvertisement
  • WirelessDisplay/AllowMdnsDiscovery

    Added missing policies from previous releases:
  • Connectivity/DisallowNetworkConnectivityActiveTest
  • Search/AllowWindowsIndexer| ## October 2017 - ---- - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated articleDescription
    Policy DDF file

    Updated the DDF content for Windows 10 version 1709. Added a link to the download of Policy DDF for Windows 10, version 1709.

    -
    Policy CSP

    Updated the following policies:

    -
      -
    • Defender/ControlledFolderAccessAllowedApplications - string separator is |.
      • -
    • Defender/ControlledFolderAccessProtectedFolders - string separator is |.
      • -
    -
    eUICCs CSP

    Added new CSP in Windows 10, version 1709.

    -
    AssignedAccess CSP

    Added SyncML examples for the new Configuration node.

    -
    DMClient CSP

    Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

    -
    +| New or updated article | Description | +| --- | --- | +| [Policy DDF file](policy-ddf-file.md) | Updated the DDF content for Windows 10 version 1709. Added a link to the download of Policy DDF for Windows 10, version 1709. | +| [Policy CSP](policy-configuration-service-provider.md) | Updated the following policies:

    - Defender/ControlledFolderAccessAllowedApplications - string separator is `|`
    - Defender/ControlledFolderAccessProtectedFolders - string separator is `|` | +| [eUICCs CSP](euiccs-csp.md) | Added new CSP in Windows 10, version 1709. | +| [AssignedAccess CSP](assignedaccess-csp.md) | Added SyncML examples for the new Configuration node. | +| [DMClient CSP](dmclient-csp.md) | Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics. | ## September 2017 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated articleDescription
    Policy CSP

    Added the following new policies for Windows 10, version 1709:

    -
      -
    • Authentication/AllowAadPasswordReset
      • -
    • Handwriting/PanelDefaultModeDocked
      • -
    • Search/AllowCloudSearch
      • -
    • System/LimitEnhancedDiagnosticDataWindowsAnalytics
      • -
    -

    Added new settings to Update/BranchReadinessLevel policy in Windows 10 version 1709.

    -
    AssignedAccess CSP

    Starting in Windows 10, version 1709, AssignedAccess CSP is also supported in Windows 10 Pro.

    -
    Microsoft Store for Business and Microsoft Store

    Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

    -
    The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2

    The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

    -
      -
    • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
      • -
    • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
      • -
    • DomainName - fully qualified domain name if the device is domain-joined.
      • -
    -

    For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

    -
    EnterpriseAPN CSP

    Added a SyncML example.

    -
    VPNv2 CSP

    Added RegisterDNS setting in Windows 10, version 1709.

    -
    Enroll a Windows 10 device automatically using Group Policy

    Added new topic to introduce a new Group Policy for automatic MDM enrollment.

    -
    MDM enrollment of Windows-based devices

    New features in the Settings app:

    -
      -
    • User sees installation progress of critical policies during MDM enrollment.
      • -
    • User knows what policies, profiles, apps MDM has configured
      • -
    • IT helpdesk can get detailed MDM diagnostic information using client tools
      • -
    -

    For details, see Managing connections and Collecting diagnostic logs

    -
    +|New or updated article|Description| +|--- |--- | +|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies for Windows 10, version 1709:
  • Authentication/AllowAadPasswordReset
  • Handwriting/PanelDefaultModeDocked
  • Search/AllowCloudSearch
  • System/LimitEnhancedDiagnosticDataWindowsAnalytics

    Added new settings to Update/BranchReadinessLevel policy in Windows 10 version 1709.| +|[AssignedAccess CSP](assignedaccess-csp.md)|Starting in Windows 10, version 1709, AssignedAccess CSP is also supported in Windows 10 Pro.| +|Microsoft Store for Business and Microsoft Store|Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.| +|The [[MS-MDE2]: Mobile Device Enrollment Protocol Version 2](/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692)|The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:
  • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
  • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
  • DomainName - fully qualified domain name if the device is domain-joined.

    For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.| +|[EnterpriseAPN CSP](enterpriseapn-csp.md)|Added a SyncML example.| +|[VPNv2 CSP](vpnv2-csp.md)|Added RegisterDNS setting in Windows 10, version 1709.| +|[Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md)|Added new topic to introduce a new Group Policy for automatic MDM enrollment.| +|[MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md)|New features in the Settings app:
  • User sees installation progress of critical policies during MDM enrollment.
  • User knows what policies, profiles, apps MDM has configured
  • IT helpdesk can get detailed MDM diagnostic information using client tools

    For details, see [Managing connections](mdm-enrollment-of-windows-devices.md#manage-connections) and [Collecting diagnostic logs](mdm-enrollment-of-windows-devices.md#collecting-diagnostic-logs)| ## August 2017 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated articleDescription
    Enable ADMX-backed policies in MDM

    Added new step-by-step guide to enable ADMX-backed policies.

    -
    Mobile device enrollment

    Added the following statement:

    -
      -
    • Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in Settings. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device.
      • -
    -
    CM_CellularEntries CSP

    Updated the description of the PuposeGroups node to add the GUID for applications. This node is required instead of optional.

    -
    EnterpriseDataProtection CSP

    Updated the Settings/EDPEnforcementLevel values to the following:

    -
      -
    • 0 (default) – Off / No protection (decrypts previously protected data).
      • -
    • 1 – Silent mode (encrypt and audit only).
      • -
    • 2 – Allow override mode (encrypt, prompt and allow overrides, and audit).
      • -
    • 3 – Hides overrides (encrypt, prompt but hide overrides, and audit).
      • -
    -
    AppLocker CSP

    Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in Allow list examples.

    -
    DeviceManageability CSP

    Added the following settings in Windows 10, version 1709:

    -
      -
    • Provider/ProviderID/ConfigInfo
      • -
    • Provider/ProviderID/EnrollmentInfo
      • -
    -
    Office CSP

    Added the following setting in Windows 10, version 1709:

    -
      -
    • Installation/CurrentStatus
      • -
    -
    BitLocker CSPAdded information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709. -
    Firewall CSPUpdated the CSP and DDF topics. Here are the changes: -
      -
    • Removed the two settings - FirewallRules/FirewallRuleName/FriendlyName and FirewallRules/FirewallRuleName/IcmpTypesAndCodes.
      • -
    • Changed some data types from integer to bool.
      • -
    • Updated the list of supported operations for some settings.
      • -
    • Added default values.
      • -
    -
    Policy DDF fileAdded another Policy DDF file download for the 8C release of Windows 10, version 1607, which added the following policies: -
      -
    • Browser/AllowMicrosoftCompatibilityList
      • -
    • Update/DisableDualScan
      • -
    • Update/FillEmptyContentUrls
      • -
    -
    Policy CSP

    Added the following new policies for Windows 10, version 1709:

    -
      -
    • Browser/ProvisionFavorites
      • -
    • Browser/LockdownFavorites
      • -
    • ExploitGuard/ExploitProtectionSettings
      • -
    • Games/AllowAdvancedGamingServices
      • -
    • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
      • -
    • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
      • -
    • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
      • -
    • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
      • -
    • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
      • -
    • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
      • -
    • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
      • -
    • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
      • -
    • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
      • -
    • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
      • -
    • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
      • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
      • -
    • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
      • -
    • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
      • -
    • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
      • -
    • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
      • -
    • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
      • -
    • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
      • -
    • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
      • -
    • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
      • -
    • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
      • -
    • Privacy/EnableActivityFeed
      • -
    • Privacy/PublishUserActivities
      • -
    • Update/DisableDualScan
      • -
    • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
      • -
    -

    Changed the name of new policy to CredentialProviders/DisableAutomaticReDeploymentCredentials from CredentialProviders/EnableWindowsAutopilotResetCredentials.

    -

    Changed the names of the following policies:

    -
      -
    • Defender/GuardedFoldersAllowedApplications to Defender/ControlledFolderAccessAllowedApplications
      • -
    • Defender/GuardedFoldersList to Defender/ControlledFolderAccessProtectedFolders
      • -
    • Defender/EnableGuardMyFolders to Defender/EnableControlledFolderAccess
      • -
    -

    Added links to the additional ADMX-backed BitLocker policies.

    -

    There were issues reported with the previous release of the following policies. These issues were fixed in Windows 10, version 1709:

    -
      -
    • Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts
      • -
    • Start/HideAppList
      • -
    -
    \ No newline at end of file +|New or updated article|Description| +|--- |--- | +|[Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md)|Added new step-by-step guide to enable ADMX-backed policies.| +|[Mobile device enrollment](mobile-device-enrollment.md)|Added the following statement:

    Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in Settings. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device.| +|[CM_CellularEntries CSP](cm-cellularentries-csp.md)|Updated the description of the PuposeGroups node to add the GUID for applications. This node is required instead of optional.| +|[EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)|Updated the Settings/EDPEnforcementLevel values to the following:
  • 0 (default) – Off / No protection (decrypts previously protected data).
  • 1 – Silent mode (encrypt and audit only).
  • 2 – Allow override mode (encrypt, prompt and allow overrides, and audit).
  • 3 – Hides overrides (encrypt, prompt but hide overrides, and audit).| +|[AppLocker CSP](applocker-csp.md)|Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in [Allow list examples](applocker-csp.md#allow-list-examples).| +|[DeviceManageability CSP](devicemanageability-csp.md)|Added the following settings in Windows 10, version 1709:
  • Provider/ProviderID/ConfigInfo
  • Provider/ProviderID/EnrollmentInfo| +|[Office CSP](office-csp.md)|Added the following setting in Windows 10, version 1709:
  • Installation/CurrentStatus| +|[BitLocker CSP](bitlocker-csp.md)|Added information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709.| +|[Firewall CSP](firewall-csp.md)|Updated the CSP and DDF topics. Here are the changes:
  • Removed the two settings - FirewallRules/FirewallRuleName/FriendlyName and FirewallRules/FirewallRuleName/IcmpTypesAndCodes.
  • Changed some data types from integer to bool.
  • Updated the list of supported operations for some settings.
  • Added default values.| +|[Policy DDF file](policy-ddf-file.md)|Added another Policy DDF file [download](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) for the 8C release of Windows 10, version 1607, which added the following policies:
  • Browser/AllowMicrosoftCompatibilityList
  • Update/DisableDualScan
  • Update/FillEmptyContentUrls| +|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies for Windows 10, version 1709:
  • Browser/ProvisionFavorites
  • Browser/LockdownFavorites
  • ExploitGuard/ExploitProtectionSettings
  • Games/AllowAdvancedGamingServices
  • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
  • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
  • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
  • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
  • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
  • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
  • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
  • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
  • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
  • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
  • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
  • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
  • Privacy/EnableActivityFeed
  • Privacy/PublishUserActivities
  • Update/DisableDualScan
  • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork

    Changed the name of new policy to CredentialProviders/DisableAutomaticReDeploymentCredentials from CredentialProviders/EnableWindowsAutopilotResetCredentials.

    Changed the names of the following policies:
  • Defender/GuardedFoldersAllowedApplications to Defender/ControlledFolderAccessAllowedApplications
  • Defender/GuardedFoldersList to Defender/ControlledFolderAccessProtectedFolders
  • Defender/EnableGuardMyFolders to Defender/EnableControlledFolderAccess

    Added links to the additional [ADMX-backed BitLocker policies](policy-csp-bitlocker.md).

    There were issues reported with the previous release of the following policies. These issues were fixed in Windows 10, version 1709:
  • Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts
  • Start/HideAppList| diff --git a/windows/client-management/mdm/cleanpc-csp.md b/windows/client-management/mdm/cleanpc-csp.md index 437a1a48c2..9f6ac68165 100644 --- a/windows/client-management/mdm/cleanpc-csp.md +++ b/windows/client-management/mdm/cleanpc-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/cleanpc-ddf.md b/windows/client-management/mdm/cleanpc-ddf.md index 6b38990ac1..05259b7621 100644 --- a/windows/client-management/mdm/cleanpc-ddf.md +++ b/windows/client-management/mdm/cleanpc-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/clientcertificateinstall-csp.md b/windows/client-management/mdm/clientcertificateinstall-csp.md index ffb8f4fa5d..ba1e38a584 100644 --- a/windows/client-management/mdm/clientcertificateinstall-csp.md +++ b/windows/client-management/mdm/clientcertificateinstall-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 07/30/2021 --- diff --git a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md index ed787a3b0f..ad299e4113 100644 --- a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md +++ b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/cm-cellularentries-csp.md b/windows/client-management/mdm/cm-cellularentries-csp.md index c8c467fcc9..7886a382f6 100644 --- a/windows/client-management/mdm/cm-cellularentries-csp.md +++ b/windows/client-management/mdm/cm-cellularentries-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/02/2017 --- diff --git a/windows/client-management/mdm/cmpolicy-csp.md b/windows/client-management/mdm/cmpolicy-csp.md index b4008efbaf..a9652c71d0 100644 --- a/windows/client-management/mdm/cmpolicy-csp.md +++ b/windows/client-management/mdm/cmpolicy-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/cmpolicyenterprise-csp.md b/windows/client-management/mdm/cmpolicyenterprise-csp.md index 38f3483fda..d843207762 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-csp.md +++ b/windows/client-management/mdm/cmpolicyenterprise-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md b/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md index 5c1c136c23..d0ca95bb1d 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md +++ b/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index a20e1c38e5..4790193f0a 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2020 ms.collection: highpri --- diff --git a/windows/client-management/mdm/customdeviceui-csp.md b/windows/client-management/mdm/customdeviceui-csp.md index 2645a75e3f..7a4eb3b5e1 100644 --- a/windows/client-management/mdm/customdeviceui-csp.md +++ b/windows/client-management/mdm/customdeviceui-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/customdeviceui-ddf.md b/windows/client-management/mdm/customdeviceui-ddf.md index 7623b155f2..40621f8a86 100644 --- a/windows/client-management/mdm/customdeviceui-ddf.md +++ b/windows/client-management/mdm/customdeviceui-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/data-structures-windows-store-for-business.md b/windows/client-management/mdm/data-structures-windows-store-for-business.md index b20c4ce200..4621e9a56d 100644 --- a/windows/client-management/mdm/data-structures-windows-store-for-business.md +++ b/windows/client-management/mdm/data-structures-windows-store-for-business.md @@ -1,17 +1,17 @@ --- title: Data structures for Microsoft Store for Business +description: Learn about the various data structures for Microsoft Store for Business. MS-HAID: - 'p\_phdevicemgmt.business\_store\_data\_structures' - 'p\_phDeviceMgmt.data\_structures\_windows\_store\_for\_business' ms.assetid: ABE44EC8-CBE5-4775-BA8A-4564CB73531B ms.reviewer: manager: dansimp -description: Learn about data structures for Microsoft Store for Business. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2017 --- @@ -105,7 +105,7 @@ Specifies the properties of the alternate identifier. |lastModified|dateTime|Specifies the last modified date for an application. Modifications for an application include updated product details, updates to an application, and updates to the quantity of an application.| |licenseType|[LicenseType](#licensetype)|Indicates whether the set of seats for a given application supports online or offline licensing.| |distributionPolicy|[InventoryDistributionPolicy](#inventorydistributionpolicy)|| -|Status|[InventoryStatus](#inventorystatus)|| +|status|[InventoryStatus](#inventorystatus)|| ## InventoryResultSet @@ -191,20 +191,19 @@ Specifies the properties of the localized product. |packageFamilyName|String|| |supportedPlatforms|Collection of [ProductPlatform](#productplatform)|| - ## ProductImage Specifies the properties of the product image. |Name|Type|Description| |--- |--- |--- | -|Location|URI|Location of the download image.| -|Purpose|String|Tag for the purpose of the image, for example "screenshot" or "logo".| -|Height|String|Height of the image in pixels.| -|Width|String|Width of the image in pixels.| -|Caption|String|Unlimited length.| -|backgroundColor|String|Format "#RRGGBB"| -|foregroundColor|String|Format "#RRGGBB"| +|location|URI|Location of the download image.| +|purpose|string|Tag for the image, for example "screenshot" or "logo".| +|height|string|Height of the image in pixels.| +|width|string|Width of the image in pixels.| +|caption|string|Unlimited length.| +|backgroundColor|string|Format "#RRGGBB"| +|foregroundColor|string|Format "#RRGGBB"| |fileSize|integer-64|Size of the file.| ## ProductKey diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md index 0880239fe6..fe6514f5c2 100644 --- a/windows/client-management/mdm/defender-ddf.md +++ b/windows/client-management/mdm/defender-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 07/23/2021 --- diff --git a/windows/client-management/mdm/devdetail-csp.md b/windows/client-management/mdm/devdetail-csp.md index 9466edec32..788d14f999 100644 --- a/windows/client-management/mdm/devdetail-csp.md +++ b/windows/client-management/mdm/devdetail-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 03/27/2020 --- diff --git a/windows/client-management/mdm/devdetail-ddf-file.md b/windows/client-management/mdm/devdetail-ddf-file.md index de26ad8620..29a697c6d8 100644 --- a/windows/client-management/mdm/devdetail-ddf-file.md +++ b/windows/client-management/mdm/devdetail-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/03/2020 --- diff --git a/windows/client-management/mdm/developersetup-csp.md b/windows/client-management/mdm/developersetup-csp.md index f36f744684..b27c178d3c 100644 --- a/windows/client-management/mdm/developersetup-csp.md +++ b/windows/client-management/mdm/developersetup-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2018 --- diff --git a/windows/client-management/mdm/developersetup-ddf.md b/windows/client-management/mdm/developersetup-ddf.md index 21afb0f2a6..13d4a19b6a 100644 --- a/windows/client-management/mdm/developersetup-ddf.md +++ b/windows/client-management/mdm/developersetup-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/device-update-management.md b/windows/client-management/mdm/device-update-management.md index 7e608c8e07..22f1b88991 100644 --- a/windows/client-management/mdm/device-update-management.md +++ b/windows/client-management/mdm/device-update-management.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/15/2017 ms.collection: highpri --- diff --git a/windows/client-management/mdm/devicelock-csp.md b/windows/client-management/mdm/devicelock-csp.md index ac6286d7d6..48dcb6b5da 100644 --- a/windows/client-management/mdm/devicelock-csp.md +++ b/windows/client-management/mdm/devicelock-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/devicelock-ddf-file.md b/windows/client-management/mdm/devicelock-ddf-file.md index eb63ef11fe..32da74c5a2 100644 --- a/windows/client-management/mdm/devicelock-ddf-file.md +++ b/windows/client-management/mdm/devicelock-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/devicemanageability-csp.md b/windows/client-management/mdm/devicemanageability-csp.md index 99d2930eff..c964ed065c 100644 --- a/windows/client-management/mdm/devicemanageability-csp.md +++ b/windows/client-management/mdm/devicemanageability-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/01/2017 --- diff --git a/windows/client-management/mdm/devicemanageability-ddf.md b/windows/client-management/mdm/devicemanageability-ddf.md index 4cb0c7f58b..ca69075d3a 100644 --- a/windows/client-management/mdm/devicemanageability-ddf.md +++ b/windows/client-management/mdm/devicemanageability-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/devicestatus-csp.md b/windows/client-management/mdm/devicestatus-csp.md index 49ae03d4b5..f87acbed2e 100644 --- a/windows/client-management/mdm/devicestatus-csp.md +++ b/windows/client-management/mdm/devicestatus-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/25/2021 --- diff --git a/windows/client-management/mdm/devicestatus-ddf.md b/windows/client-management/mdm/devicestatus-ddf.md index fbdf08a6d0..4b820066f6 100644 --- a/windows/client-management/mdm/devicestatus-ddf.md +++ b/windows/client-management/mdm/devicestatus-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 03/12/2018 --- diff --git a/windows/client-management/mdm/devinfo-csp.md b/windows/client-management/mdm/devinfo-csp.md index e9c0979c67..670c0d736e 100644 --- a/windows/client-management/mdm/devinfo-csp.md +++ b/windows/client-management/mdm/devinfo-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/devinfo-ddf-file.md b/windows/client-management/mdm/devinfo-ddf-file.md index aec2b4cc91..3cf4154682 100644 --- a/windows/client-management/mdm/devinfo-ddf-file.md +++ b/windows/client-management/mdm/devinfo-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md index 9e5ca86509..5dc126771b 100644 --- a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md +++ b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/25/2018 ms.collection: highpri --- @@ -36,12 +36,12 @@ To help diagnose enrollment or device management issues in Windows 10 devices m You can also collect the MDM Diagnostic Information logs using the following command: ```xml -mdmdiagnosticstool.exe -area DeviceEnrollment;DeviceProvisioning;Autopilot -cab c:\users\public\documents\MDMDiagReport.cab +mdmdiagnosticstool.exe -area DeviceEnrollment;DeviceProvisioning;Autopilot -zip c:\users\public\documents\MDMDiagReport.zip ``` - In File Explorer, navigate to c:\Users\Public\Documents\MDMDiagnostics to see the report. -### Understanding cab structure -The cab file will have logs according to the areas that were used in the command. This explanation is based on DeviceEnrollment, DeviceProvisioning and Autopilot areas. It applies to the cab files collected via command line or Feedback Hub +### Understanding zip structure +The zip file will have logs according to the areas that were used in the command. This explanation is based on DeviceEnrollment, DeviceProvisioning and Autopilot areas. It applies to the zip files collected via command line or Feedback Hub - DiagnosticLogCSP_Collector_Autopilot_*: Autopilot etls - DiagnosticLogCSP_Collector_DeviceProvisioning_*: Provisioning etls (Microsoft-Windows-Provisioning-Diagnostics-Provider) diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index d232842e12..fb9c555681 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/19/2019 --- @@ -246,7 +246,15 @@ la--- 1/4/2021 2:45 PM 1 la--- 1/4/2021 2:45 PM 2 la--- 12/2/2020 6:27 PM 2701 results.xml ``` -Each data gathering directive from the original `Collection` XML corresponds to a folder in the output. For example, if the first directive was HKLM\Software\Policies then folder `1` will contain the corresponding `export.reg` file. +Each data gathering directive from the original `Collection` XML corresponds to a folder in the output. +For example, the first directive was: + +```xml + + HKLM\Software\Policies + +``` +then folder `1` will contain the corresponding `export.reg` file. The `results.xml` file is the authoritative map to the output. It includes a status code for each directive. The order of the directives in the file corresponds to the order of the output folders. Using `results.xml` the administrator can see what data was gathered, what failures may have occurred, and which folders contain which output. For example, the following `results.xml` content indicates that registry export of HKLM\Software\Policies was successful and the data can be found in folder `1`. It also indicates that `netsh.exe wlan show profiles` command failed. diff --git a/windows/client-management/mdm/diagnosticlog-ddf.md b/windows/client-management/mdm/diagnosticlog-ddf.md index f635ed44c6..0f25053a37 100644 --- a/windows/client-management/mdm/diagnosticlog-ddf.md +++ b/windows/client-management/mdm/diagnosticlog-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md index 5f48d033a0..a9e4996ee9 100644 --- a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md @@ -11,7 +11,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/dmacc-csp.md b/windows/client-management/mdm/dmacc-csp.md index e7e340552c..9b4f0785ff 100644 --- a/windows/client-management/mdm/dmacc-csp.md +++ b/windows/client-management/mdm/dmacc-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/dmacc-ddf-file.md b/windows/client-management/mdm/dmacc-ddf-file.md index b10dcad38a..2d1d256133 100644 --- a/windows/client-management/mdm/dmacc-ddf-file.md +++ b/windows/client-management/mdm/dmacc-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/dmclient-csp.md b/windows/client-management/mdm/dmclient-csp.md index 592daf59ec..7731b4fe08 100644 --- a/windows/client-management/mdm/dmclient-csp.md +++ b/windows/client-management/mdm/dmclient-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/01/2017 --- diff --git a/windows/client-management/mdm/dmclient-ddf-file.md b/windows/client-management/mdm/dmclient-ddf-file.md index c5ba87da90..9121cdc2b4 100644 --- a/windows/client-management/mdm/dmclient-ddf-file.md +++ b/windows/client-management/mdm/dmclient-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md index 1dbe4932a9..a13b3a0c7d 100644 --- a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md +++ b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md @@ -18,7 +18,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/dmsessionactions-csp.md b/windows/client-management/mdm/dmsessionactions-csp.md index ffdfc3e2b7..e37075e180 100644 --- a/windows/client-management/mdm/dmsessionactions-csp.md +++ b/windows/client-management/mdm/dmsessionactions-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/dmsessionactions-ddf.md b/windows/client-management/mdm/dmsessionactions-ddf.md index 61b4b4754a..7cebc030ce 100644 --- a/windows/client-management/mdm/dmsessionactions-ddf.md +++ b/windows/client-management/mdm/dmsessionactions-ddf.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md index ee45d74fff..37a56ed643 100644 --- a/windows/client-management/mdm/dynamicmanagement-csp.md +++ b/windows/client-management/mdm/dynamicmanagement-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/dynamicmanagement-ddf.md b/windows/client-management/mdm/dynamicmanagement-ddf.md index 2690fa4e23..5bf20a535b 100644 --- a/windows/client-management/mdm/dynamicmanagement-ddf.md +++ b/windows/client-management/mdm/dynamicmanagement-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index 2ef69ad6c3..37f0269edb 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/email2-csp.md b/windows/client-management/mdm/email2-csp.md index de7b12c65f..d84509518f 100644 --- a/windows/client-management/mdm/email2-csp.md +++ b/windows/client-management/mdm/email2-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/email2-ddf-file.md b/windows/client-management/mdm/email2-ddf-file.md index 4f11b5b64d..11c6ba0946 100644 --- a/windows/client-management/mdm/email2-ddf-file.md +++ b/windows/client-management/mdm/email2-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md index bf6cf8cc1e..2ab4830667 100644 --- a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 11/01/2017 ms.reviewer: diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 3159c1869f..c77b8f6df6 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: dansimp -ms.date: 10/14/2021 +ms.date: 12/03/2021 ms.reviewer: manager: dansimp ms.collection: highpri @@ -14,6 +14,10 @@ ms.collection: highpri # Enroll a Windows 10 device automatically using Group Policy +**Applies to:** + +- Windows 10 + Starting in Windows 10, version 1709, you can use a Group Policy to trigger auto-enrollment to MDM for Active Directory (AD) domain-joined devices. The enrollment into Intune is triggered by a group policy created on your local AD and happens without any user interaction. This means you can automatically mass-enroll a large number of domain-joined corporate devices into Microsoft Intune. The enrollment process starts in the background once you sign in to the device with your Azure AD account. @@ -45,9 +49,10 @@ For this policy to work, you must verify that the MDM service provider allows th ## Verify auto-enrollment requirements and settings To ensure that the auto-enrollment feature is working as expected, you must verify that various requirements and settings are configured correctly. The following steps demonstrate required settings using the Intune service: + 1. Verify that the user who is going to enroll the device has a valid Intune license. - ![Intune license verification.](images/auto-enrollment-intune-license-verification.png) + :::image type="content" alt-text="Intune license verification." source="images/auto-enrollment-intune-license-verification.png" lightbox="images/auto-enrollment-intune-license-verification.png"::: 2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](./azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). @@ -79,7 +84,7 @@ The following steps demonstrate required settings using the Intune service: 6. Some tenants might have both **Microsoft Intune** and **Microsoft Intune Enrollment** under **Mobility**. Make sure that your auto-enrollment settings are configured under **Microsoft Intune** instead of **Microsoft Intune Enrollment**. - ![Mobility setting MDM intune.](images/auto-enrollment-microsoft-intune-setting.png) + :::image type="content" alt-text="Mobility setting MDM intune." source="images/auto-enrollment-microsoft-intune-setting.png" lightbox="images/auto-enrollment-microsoft-intune-setting.png"::: 7. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices which should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. @@ -88,7 +93,7 @@ You may contact your domain administrators to verify if the group policy has bee 9. Verify that Microsoft Intune should allow enrollment of Windows devices. - ![Enrollment of Windows devices.](images/auto-enrollment-enrollment-of-windows-devices.png) + :::image type="content" alt-text="Enrollment of Windows devices." source="images/auto-enrollment-enrollment-of-windows-devices.png" lightbox="images/auto-enrollment-enrollment-of-windows-devices.png"::: ## Configure the auto-enrollment Group Policy for a single PC @@ -109,12 +114,11 @@ Requirements: 3. In **Local Computer Policy**, click **Administrative Templates** > **Windows Components** > **MDM**. - > [!div class="mx-imgBorder"] - > ![MDM policies.](images/autoenrollment-mdm-policies.png) + :::image type="content" alt-text="MDM policies." source="images/autoenrollment-mdm-policies.png" lightbox="images/autoenrollment-mdm-policies.png"::: 4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the Selected Credential Type to use. - ![MDM autoenrollment policy.](images/autoenrollment-policy.png) + :::image type="content" alt-text="MDM autoenrollment policy." source="images/autoenrollment-policy.png" lightbox="images/autoenrollment-policy.png"::: 5. Click **Enable**, and select **User Credential** from the dropdown **Select Credential Type to Use**, then click **OK**. @@ -155,7 +159,7 @@ Requirements: 3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**. - ![Auto-enrollment scheduled task.](images/autoenrollment-scheduled-task.png) + :::image type="content" alt-text="Auto-enrollment scheduled task." source="images/autoenrollment-scheduled-task.png" lightbox="images/autoenrollment-scheduled-task.png"::: To see the result of the task, move the scroll bar to the right to see the **Last Run Result**. Note that **0x80180026** is a failure message (MENROLL\_E_DEVICE\_MANAGEMENT_BLOCKED). You can see the logs in the **History** tab. @@ -191,6 +195,9 @@ Requirements: - 21H1 --> [Administrative Templates (.admx) for Windows 10 May 2021 Update (21H1)](https://www.microsoft.com/download/details.aspx?id=103124) + - 21H2 --> [Administrative Templates (.admx) for Windows 10 November 2021 Update (21H2)](https://www.microsoft.com/download/103667) + + 2. Install the package on the Domain Controller. 3. Navigate, depending on the version to the folder: @@ -209,11 +216,13 @@ Requirements: - 21H1 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2021 Update (21H1)** + - 21H2 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 November 2021 Update (21H2)** + 4. Rename the extracted Policy Definitions folder to **PolicyDefinitions**. -5. Copy PolicyDefinitions folder to **\\contoso.com\SYSVOL\contoso.com\policies\PolicyDefinitions**. +5. Copy PolicyDefinitions folder to **\\SYSVOL\contoso.com\policies\PolicyDefinitions**. - If this folder does not exist, then be aware that you will be switching to a [central policy store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) for your entire domain. + If this folder does not exist, then be aware that you will be switching to a [central policy store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) for your entire domain. 6. Wait for the SYSVOL DFSR replication to be completed for the policy to be available. @@ -240,21 +249,21 @@ To collect Event Viewer logs: 3. Search for event ID 75, which represents a successful auto-enrollment. Here is an example screenshot that shows the auto-enrollment completed successfully: - ![Event ID 75.](images/auto-enrollment-troubleshooting-event-id-75.png) + :::image type="content" alt-text="Event ID 75." source="images/auto-enrollment-troubleshooting-event-id-75.png" lightbox="images/auto-enrollment-troubleshooting-event-id-75.png"::: If you cannot find event ID 75 in the logs, it indicates that the auto-enrollment failed. This can happen because of the following reasons: - The enrollment failed with error. In this case, search for event ID 76, which represents failed auto-enrollment. Here is an example screenshot that shows that the auto-enrollment failed: - ![Event ID 76.](images/auto-enrollment-troubleshooting-event-id-76.png) + :::image type="content" alt-text="Event ID 76." source="images/auto-enrollment-troubleshooting-event-id-76.png" lightbox="images/auto-enrollment-troubleshooting-event-id-76.png"::: - To troubleshoot, check the error code that appears in the event. See [Troubleshooting Windows device enrollment problems in Microsoft Intune](https://support.microsoft.com/en-ph/help/4469913/troubleshooting-windows-device-enrollment-problems-in-microsoft-intune) for more information. + To troubleshoot, check the error code that appears in the event. See [Troubleshooting Windows device enrollment problems in Microsoft Intune](/troubleshoot/mem/intune/troubleshoot-windows-enrollment-errors) for more information. - The auto-enrollment did not trigger at all. In this case, you will not find either event ID 75 or event ID 76. To know the reason, you must understand the internal mechanisms happening on the device as described in the following section. The auto-enrollment process is triggered by a task (**Microsoft > Windows > EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is successfully deployed to the target machine as shown in the following screenshot: - ![Task scheduler.](images/auto-enrollment-task-scheduler.png) + :::image type="content" alt-text="Task scheduler." source="images/auto-enrollment-task-scheduler.png" lightbox="images/auto-enrollment-task-scheduler.png"::: > [!Note] > This task isn't visible to standard users - run Scheduled Tasks with administrative credentials to find the task. @@ -263,24 +272,24 @@ To collect Event Viewer logs: **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**. Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from AAD is triggered by event ID 107. - ![Event ID 107.](images/auto-enrollment-event-id-107.png) + :::image type="content" alt-text="Event ID 107." source="images/auto-enrollment-event-id-107.png" lightbox="images/auto-enrollment-event-id-107.png"::: When the task is completed, a new event ID 102 is logged. - ![Event ID 102.](images/auto-enrollment-event-id-102.png) + :::image type="content" alt-text="Event ID 102." source="images/auto-enrollment-event-id-102.png" lightbox="images/auto-enrollment-event-id-102.png"::: Note that the task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. This means that the task scheduler log is only useful to confirm if the auto-enrollment task is triggered or not. It does not indicate the success or failure of auto-enrollment. If you cannot see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from AAD is initiated, there is possibly issue with the group policy. Immediately run the command `gpupdate /force` in command prompt to get the GPO applied. If this still does not help, further troubleshooting on the Active Directory is required. One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen: - ![Outdated enrollment entries.](images/auto-enrollment-outdated-enrollment-entries.png) + :::image type="content" alt-text="Outdated enrollment entries." source="images/auto-enrollment-outdated-enrollment-entries.png" lightbox="images/auto-enrollment-outdated-enrollment-entries.png"::: By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational** event log file under event ID 7016. A resolution to this issue is to remove the registry key manually. If you do not know which registry key to remove, go for the key which displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot: - ![Manually deleted entries.](images/auto-enrollment-activation-verification-less-entries.png) + :::image type="content" alt-text="Manually deleted entries." source="images/auto-enrollment-activation-verification-less-entries.png" lightbox="images/auto-enrollment-activation-verification-less-entries.png"::: ### Related topics @@ -289,13 +298,14 @@ To collect Event Viewer logs: - [Link a Group Policy Object](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732979(v=ws.11)) - [Filter Using Security Groups](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc752992(v=ws.11)) - [Enforce a Group Policy Object Link](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753909(v=ws.11)) -- [Group Policy Central Store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) -- [Getting started with Cloud Native Windows Endpoints](https://docs.microsoft.com/mem/cloud-native-windows-endpoints) +- [Group Policy Central Store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) +- [Getting started with Cloud Native Windows Endpoints](/mem/cloud-native-windows-endpoints) - [A Framework for Windows endpoint management transformation](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/a-framework-for-windows-endpoint-management-transformation/ba-p/2460684) - [Success with remote Windows Autopilot and Hybrid Azure Active Director join](https://techcommunity.microsoft.com/t5/intune-customer-success/success-with-remote-windows-autopilot-and-hybrid-azure-active/ba-p/2749353) ### Useful Links +- [Windows 10 Administrative Templates for Windows 10 November 2021 Update 21H2](https://www.microsoft.com/download/103667) - [Windows 10 Administrative Templates for Windows 10 May 2021 Update 21H1](https://www.microsoft.com/download/details.aspx?id=103124) - [Windows 10 Administrative Templates for Windows 10 November 2019 Update 1909](https://www.microsoft.com/download/details.aspx?id=100591) - [Windows 10 Administrative Templates for Windows 10 May 2019 Update 1903](https://www.microsoft.com/download/details.aspx?id=58495) diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md index 98739efcb1..75870e43e0 100644 --- a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md +++ b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: ManikaDhiman +author: dansimp ms.date: 05/17/2019 --- diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp.md b/windows/client-management/mdm/enrollmentstatustracking-csp.md index 54e9da339c..3b4e865ccb 100644 --- a/windows/client-management/mdm/enrollmentstatustracking-csp.md +++ b/windows/client-management/mdm/enrollmentstatustracking-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: ManikaDhiman +author: dansimp ms.date: 05/21/2019 --- diff --git a/windows/client-management/mdm/enterpriseapn-csp.md b/windows/client-management/mdm/enterpriseapn-csp.md index f82e763f75..2b50af966e 100644 --- a/windows/client-management/mdm/enterpriseapn-csp.md +++ b/windows/client-management/mdm/enterpriseapn-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/22/2017 --- diff --git a/windows/client-management/mdm/enterpriseapn-ddf.md b/windows/client-management/mdm/enterpriseapn-ddf.md index 5e7af9b60d..60e6f5ba4a 100644 --- a/windows/client-management/mdm/enterpriseapn-ddf.md +++ b/windows/client-management/mdm/enterpriseapn-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/enterpriseappmanagement-csp.md b/windows/client-management/mdm/enterpriseappmanagement-csp.md index 1910df9821..2b9c043f7c 100644 --- a/windows/client-management/mdm/enterpriseappmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappmanagement-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/enterpriseappvmanagement-csp.md b/windows/client-management/mdm/enterpriseappvmanagement-csp.md index cb948488da..5833aa9062 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md index 8cf951cf55..1c18aff981 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseassignedaccess-csp.md b/windows/client-management/mdm/enterpriseassignedaccess-csp.md index db8f48e055..d13206d6cb 100644 --- a/windows/client-management/mdm/enterpriseassignedaccess-csp.md +++ b/windows/client-management/mdm/enterpriseassignedaccess-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 07/12/2017 --- diff --git a/windows/client-management/mdm/enterpriseassignedaccess-ddf.md b/windows/client-management/mdm/enterpriseassignedaccess-ddf.md index 5d0a19de74..07c553f82a 100644 --- a/windows/client-management/mdm/enterpriseassignedaccess-ddf.md +++ b/windows/client-management/mdm/enterpriseassignedaccess-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/enterpriseassignedaccess-xsd.md b/windows/client-management/mdm/enterpriseassignedaccess-xsd.md index 3ee96832c7..e92dc7393a 100644 --- a/windows/client-management/mdm/enterpriseassignedaccess-xsd.md +++ b/windows/client-management/mdm/enterpriseassignedaccess-xsd.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/enterprisedataprotection-csp.md b/windows/client-management/mdm/enterprisedataprotection-csp.md index 07388f0b79..75acd88843 100644 --- a/windows/client-management/mdm/enterprisedataprotection-csp.md +++ b/windows/client-management/mdm/enterprisedataprotection-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/09/2017 --- diff --git a/windows/client-management/mdm/enterprisedataprotection-ddf-file.md b/windows/client-management/mdm/enterprisedataprotection-ddf-file.md index f7551ccabc..88a7fa3127 100644 --- a/windows/client-management/mdm/enterprisedataprotection-ddf-file.md +++ b/windows/client-management/mdm/enterprisedataprotection-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md index 70beb72229..9be9cb8c8d 100644 --- a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 07/11/2017 --- diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md b/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md index f4bfca0010..329d5cb253 100644 --- a/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md +++ b/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement2-xsd.md b/windows/client-management/mdm/enterprisedesktopappmanagement2-xsd.md index 821ec27110..097a08b4f8 100644 --- a/windows/client-management/mdm/enterprisedesktopappmanagement2-xsd.md +++ b/windows/client-management/mdm/enterprisedesktopappmanagement2-xsd.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/enterpriseext-csp.md b/windows/client-management/mdm/enterpriseext-csp.md index 1cf7829f88..7f3b2f1e9e 100644 --- a/windows/client-management/mdm/enterpriseext-csp.md +++ b/windows/client-management/mdm/enterpriseext-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/enterpriseext-ddf.md b/windows/client-management/mdm/enterpriseext-ddf.md index 4b3d4b0afd..a5f3dfb274 100644 --- a/windows/client-management/mdm/enterpriseext-ddf.md +++ b/windows/client-management/mdm/enterpriseext-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/enterpriseextfilessystem-csp.md b/windows/client-management/mdm/enterpriseextfilessystem-csp.md index 58fdde76ab..335caebb7d 100644 --- a/windows/client-management/mdm/enterpriseextfilessystem-csp.md +++ b/windows/client-management/mdm/enterpriseextfilessystem-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/enterpriseextfilesystem-ddf.md b/windows/client-management/mdm/enterpriseextfilesystem-ddf.md index 7efb54af20..f910743b9b 100644 --- a/windows/client-management/mdm/enterpriseextfilesystem-ddf.md +++ b/windows/client-management/mdm/enterpriseextfilesystem-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md index 237000b2f0..4ffad48863 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/01/2019 --- diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md b/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md index f8b15504cc..53de7e899e 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/euiccs-csp.md b/windows/client-management/mdm/euiccs-csp.md index c9219f4340..3ac910ac33 100644 --- a/windows/client-management/mdm/euiccs-csp.md +++ b/windows/client-management/mdm/euiccs-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 03/02/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/euiccs-ddf-file.md b/windows/client-management/mdm/euiccs-ddf-file.md index f7d0851746..1649e9b5ca 100644 --- a/windows/client-management/mdm/euiccs-ddf-file.md +++ b/windows/client-management/mdm/euiccs-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 03/02/2018 --- diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md index b2dca22fe1..f55e50ff03 100644 --- a/windows/client-management/mdm/federated-authentication-device-enrollment.md +++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 07/28/2017 --- diff --git a/windows/client-management/mdm/filesystem-csp.md b/windows/client-management/mdm/filesystem-csp.md index 0b5579a5a6..5c9fd56269 100644 --- a/windows/client-management/mdm/filesystem-csp.md +++ b/windows/client-management/mdm/filesystem-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/firewall-ddf-file.md b/windows/client-management/mdm/firewall-ddf-file.md index 72829fc3a9..fa54a62a29 100644 --- a/windows/client-management/mdm/firewall-ddf-file.md +++ b/windows/client-management/mdm/firewall-ddf-file.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/get-inventory.md b/windows/client-management/mdm/get-inventory.md index 4c01145bb3..1528b38039 100644 --- a/windows/client-management/mdm/get-inventory.md +++ b/windows/client-management/mdm/get-inventory.md @@ -11,7 +11,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/get-localized-product-details.md b/windows/client-management/mdm/get-localized-product-details.md index 3e13a8f8e4..42e72419df 100644 --- a/windows/client-management/mdm/get-localized-product-details.md +++ b/windows/client-management/mdm/get-localized-product-details.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/07/2020 --- diff --git a/windows/client-management/mdm/get-offline-license.md b/windows/client-management/mdm/get-offline-license.md index 0f60251a1c..b75fe48a08 100644 --- a/windows/client-management/mdm/get-offline-license.md +++ b/windows/client-management/mdm/get-offline-license.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/get-product-details.md b/windows/client-management/mdm/get-product-details.md index 9b32395cbd..091c5884ce 100644 --- a/windows/client-management/mdm/get-product-details.md +++ b/windows/client-management/mdm/get-product-details.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/get-product-package.md b/windows/client-management/mdm/get-product-package.md index d08a8b434a..42061b81b9 100644 --- a/windows/client-management/mdm/get-product-package.md +++ b/windows/client-management/mdm/get-product-package.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/get-product-packages.md b/windows/client-management/mdm/get-product-packages.md index 6dede5eb3e..3cb5f24efe 100644 --- a/windows/client-management/mdm/get-product-packages.md +++ b/windows/client-management/mdm/get-product-packages.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/get-seat.md b/windows/client-management/mdm/get-seat.md index 920c40c4e5..b8b6aa4fa6 100644 --- a/windows/client-management/mdm/get-seat.md +++ b/windows/client-management/mdm/get-seat.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/get-seats-assigned-to-a-user.md b/windows/client-management/mdm/get-seats-assigned-to-a-user.md index 099ad10917..d7167f4626 100644 --- a/windows/client-management/mdm/get-seats-assigned-to-a-user.md +++ b/windows/client-management/mdm/get-seats-assigned-to-a-user.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/get-seats.md b/windows/client-management/mdm/get-seats.md index f58ed76669..8872ddf1ec 100644 --- a/windows/client-management/mdm/get-seats.md +++ b/windows/client-management/mdm/get-seats.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/healthattestation-ddf.md b/windows/client-management/mdm/healthattestation-ddf.md index 651900e2d8..6272e91bf1 100644 --- a/windows/client-management/mdm/healthattestation-ddf.md +++ b/windows/client-management/mdm/healthattestation-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/hotspot-csp.md b/windows/client-management/mdm/hotspot-csp.md index 897e8ee489..079281dcbe 100644 --- a/windows/client-management/mdm/hotspot-csp.md +++ b/windows/client-management/mdm/hotspot-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md index 6baab87be6..417d67f777 100644 --- a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md +++ b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md @@ -11,7 +11,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/27/2017 --- diff --git a/windows/client-management/mdm/maps-csp.md b/windows/client-management/mdm/maps-csp.md index 2fa6bccaa3..aa5eed4990 100644 --- a/windows/client-management/mdm/maps-csp.md +++ b/windows/client-management/mdm/maps-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/maps-ddf-file.md b/windows/client-management/mdm/maps-ddf-file.md index 517d02109c..0db7720713 100644 --- a/windows/client-management/mdm/maps-ddf-file.md +++ b/windows/client-management/mdm/maps-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md index e2764b718c..e475077509 100644 --- a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md @@ -41,11 +41,11 @@ Joining your device to an Active Directory domain during the out-of-box-experien 1. On the **Who Owns this PC?** page, select **My work or school owns it**. - ![oobe local account creation.](images/unifiedenrollment-rs1-2.png) + ![oobe creation of a local account](images/unifiedenrollment-rs1-2.png) 2. Next, select **Join a domain**. - ![select domain or azure ad.](images/unifiedenrollment-rs1-3.png) + ![select domain or azure-ad](images/unifiedenrollment-rs1-3.png) 3. You'll see a prompt to set up a local account on the device. Enter your local account details, and then select **Next** to continue. @@ -57,19 +57,19 @@ To create a local account and connect the device: 1. Launch the Settings app. - ![windows settings page.](images/unifiedenrollment-rs1-5.png) + ![windows settings screen](images/unifiedenrollment-rs1-5.png) 2. Next, select **Accounts**. - ![windows settings accounts select.](images/unifiedenrollment-rs1-6.png) + ![windows settings accounts chosen](images/unifiedenrollment-rs1-6.png) 3. Navigate to **Access work or school**. - ![select access work or school.](images/unifiedenrollment-rs1-7.png) + ![choose access work or school](images/unifiedenrollment-rs1-7.png) 4. Select **Connect**. - ![connect to work or school.](images/unifiedenrollment-rs1-8.png) + ![connect to work or to school](images/unifiedenrollment-rs1-8.png) 5. Under **Alternate actions**, select **Join this device to a local Active Directory domain**. @@ -102,11 +102,11 @@ To join a domain: 1. Select **My work or school owns it**, then select **Next.** - ![oobe local account creation.](images/unifiedenrollment-rs1-11.png) + ![oobe - local account creation](images/unifiedenrollment-rs1-11.png) 2. Select **Join Azure AD**, and then select **Next.** - ![select domain or azure ad.](images/unifiedenrollment-rs1-12.png) + ![choose the domain or azure ad](images/unifiedenrollment-rs1-12.png) 3. Type in your Azure AD username. This is the email address you use to log into Microsoft Office 365 and similar services. @@ -122,23 +122,23 @@ To create a local account and connect the device: 1. Launch the Settings app. - ![windows settings page.](images/unifiedenrollment-rs1-14.png) + ![screen displaying windows settings](images/unifiedenrollment-rs1-14.png) 2. Next, navigate to **Accounts**. - ![windows settings accounts select.](images/unifiedenrollment-rs1-15.png) + ![choose windows settings accounts](images/unifiedenrollment-rs1-15.png) 3. Navigate to **Access work or school**. - ![select access work or school.](images/unifiedenrollment-rs1-16.png) + ![choose option of access work or school](images/unifiedenrollment-rs1-16.png) 4. Select **Connect**. - ![connect to work or school.](images/unifiedenrollment-rs1-17.png) + ![Option of connect to work or school](images/unifiedenrollment-rs1-17.png) 5. Under **Alternate Actions**, selct **Join this device to Azure Active Directory**. - ![join work or school account to azure ad.](images/unifiedenrollment-rs1-18.png) + ![option to join work or school account to azure ad](images/unifiedenrollment-rs1-18.png) 6. Type in your Azure AD username. This is the email address you use to log into Office 365 and similar services. @@ -152,7 +152,7 @@ To create a local account and connect the device: After you reach the end of the flow, your device should be connected to your organization’s Azure AD domain. You may now log out of your current account and sign in using your Azure AD username. - ![corporate sign in.](images/unifiedenrollment-rs1-20.png) + ![corporate sign in screen](images/unifiedenrollment-rs1-20.png) ### Help with connecting to an Azure AD domain @@ -184,19 +184,19 @@ To create a local account and connect the device: 1. Launch the Settings app, and then select **Accounts** >**Start** > **Settings** > **Accounts**. - ![windows settings page.](images/unifiedenrollment-rs1-21-b.png) + ![screen of windows settings](images/unifiedenrollment-rs1-21-b.png) 2. Navigate to **Access work or school**. - ![select access work or school.](images/unifiedenrollment-rs1-23-b.png) + ![user's option of access work or school](images/unifiedenrollment-rs1-23-b.png) 3. Select **Connect**. - ![connect to work or school.](images/unifiedenrollment-rs1-24-b.png) + ![connect button to access the option of work or school.](images/unifiedenrollment-rs1-24-b.png) 4. Type in your Azure AD username. This is the email address you use to log into Office 365 and similar services. - ![join work or school account to azure ad.](images/unifiedenrollment-rs1-25-b.png) + ![sync work or school account to azure ad.](images/unifiedenrollment-rs1-25-b.png) 5. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and can enter your password directly into the page. If the tenant is part of a federated domain, you are redirected to the organization's on-premises federation server, such as AD FS, for authentication. @@ -206,7 +206,7 @@ To create a local account and connect the device: Starting in Windows 10, version 1709, you will see the status page that shows the progress of your device being set up. - ![corporate sign in.](images/unifiedenrollment-rs1-26.png) + ![corporate sign in - screen and option](images/unifiedenrollment-rs1-26.png) 6. After you complete the flow, your Microsoft account will be connected to your work or school account. @@ -222,7 +222,7 @@ To create a local account and connect the device: 1. Launch the Settings app. - ![windows settings page.](images/unifiedenrollment-rs1-28.png) + ![screen that displays windows settings](images/unifiedenrollment-rs1-28.png) 2. Next, navigate to **Accounts**. @@ -234,17 +234,17 @@ To create a local account and connect the device: 4. Select the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934). For older builds, see [Connect your Windows 10-based device to work using a deep link](mdm-enrollment-of-windows-devices.md#connect-your-windows-10-based-device-to-work-using-a-deep-link). - ![connect to work or school.](images/unifiedenrollment-rs1-31.png) + ![connect to work or school screen](images/unifiedenrollment-rs1-31.png) 5. Type in your work email address. - ![set up work or school account.](images/unifiedenrollment-rs1-32.png) + ![set up work or school account screen](images/unifiedenrollment-rs1-32.png) 6. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. Starting in Windows 10, version 1709, you will see the enrollment progress on screen. - ![corporate sign in.](images/unifiedenrollment-rs1-33-b.png) + ![screen to set up your device](images/unifiedenrollment-rs1-33-b.png) After you complete the flow, your device will be connected to your organization’s MDM. @@ -309,13 +309,13 @@ To connect your devices to MDM using deep links: Type in your work email address. - ![set up work or school account.](images/deeplinkenrollment3.png) + ![set up a work or school account screen](images/deeplinkenrollment3.png) 3. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. After you complete the flow, your device will be connected to your organization's MDM. - ![corporate sign in.](images/deeplinkenrollment4.png) + ![corporate sign-in screen](images/deeplinkenrollment4.png) ## Manage connections diff --git a/windows/client-management/mdm/messaging-csp.md b/windows/client-management/mdm/messaging-csp.md index 1e87fad908..b50647fabd 100644 --- a/windows/client-management/mdm/messaging-csp.md +++ b/windows/client-management/mdm/messaging-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/messaging-ddf.md b/windows/client-management/mdm/messaging-ddf.md index 22207f104b..efdad0e72a 100644 --- a/windows/client-management/mdm/messaging-ddf.md +++ b/windows/client-management/mdm/messaging-ddf.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/mobile-device-enrollment.md b/windows/client-management/mdm/mobile-device-enrollment.md index 740b3a834f..10c37d020b 100644 --- a/windows/client-management/mdm/mobile-device-enrollment.md +++ b/windows/client-management/mdm/mobile-device-enrollment.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/11/2017 ms.collection: highpri --- diff --git a/windows/client-management/mdm/multisim-csp.md b/windows/client-management/mdm/multisim-csp.md index 4436e52fc7..aa2284255f 100644 --- a/windows/client-management/mdm/multisim-csp.md +++ b/windows/client-management/mdm/multisim-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 03/22/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/multisim-ddf.md b/windows/client-management/mdm/multisim-ddf.md index cd958ba9e2..18b9586283 100644 --- a/windows/client-management/mdm/multisim-ddf.md +++ b/windows/client-management/mdm/multisim-ddf.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 02/27/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/nap-csp.md b/windows/client-management/mdm/nap-csp.md index 598e95c756..e3edb1b0d1 100644 --- a/windows/client-management/mdm/nap-csp.md +++ b/windows/client-management/mdm/nap-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/napdef-csp.md b/windows/client-management/mdm/napdef-csp.md index c145824e5c..341c72e038 100644 --- a/windows/client-management/mdm/napdef-csp.md +++ b/windows/client-management/mdm/napdef-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/networkproxy-csp.md b/windows/client-management/mdm/networkproxy-csp.md index 4fa1f6289f..b27fb3fd10 100644 --- a/windows/client-management/mdm/networkproxy-csp.md +++ b/windows/client-management/mdm/networkproxy-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/29/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/networkproxy-ddf.md b/windows/client-management/mdm/networkproxy-ddf.md index 226b6ca0ba..2b5f2798f2 100644 --- a/windows/client-management/mdm/networkproxy-ddf.md +++ b/windows/client-management/mdm/networkproxy-ddf.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/networkqospolicy-csp.md b/windows/client-management/mdm/networkqospolicy-csp.md index fe432fef92..464a920e6d 100644 --- a/windows/client-management/mdm/networkqospolicy-csp.md +++ b/windows/client-management/mdm/networkqospolicy-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 04/22/2021 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/networkqospolicy-ddf.md b/windows/client-management/mdm/networkqospolicy-ddf.md index c2d3ea4a5e..379f5051ca 100644 --- a/windows/client-management/mdm/networkqospolicy-ddf.md +++ b/windows/client-management/mdm/networkqospolicy-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index c21357f4a9..a982810497 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -11,7 +11,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 10/20/2020 --- diff --git a/windows/client-management/mdm/nodecache-csp.md b/windows/client-management/mdm/nodecache-csp.md index ff47aa238d..4ac44047b0 100644 --- a/windows/client-management/mdm/nodecache-csp.md +++ b/windows/client-management/mdm/nodecache-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/nodecache-ddf-file.md b/windows/client-management/mdm/nodecache-ddf-file.md index 06a74f2979..0e15800f30 100644 --- a/windows/client-management/mdm/nodecache-ddf-file.md +++ b/windows/client-management/mdm/nodecache-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/office-csp.md b/windows/client-management/mdm/office-csp.md index 280b16b2cf..79204c2935 100644 --- a/windows/client-management/mdm/office-csp.md +++ b/windows/client-management/mdm/office-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/15/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/office-ddf.md b/windows/client-management/mdm/office-ddf.md index 88e2b4dee5..dedda7070e 100644 --- a/windows/client-management/mdm/office-ddf.md +++ b/windows/client-management/mdm/office-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/15/2018 --- diff --git a/windows/client-management/mdm/oma-dm-protocol-support.md b/windows/client-management/mdm/oma-dm-protocol-support.md index 893ac1e192..eaf420e5e6 100644 --- a/windows/client-management/mdm/oma-dm-protocol-support.md +++ b/windows/client-management/mdm/oma-dm-protocol-support.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/on-premise-authentication-device-enrollment.md b/windows/client-management/mdm/on-premise-authentication-device-enrollment.md index 2ff94e841f..97f5528a43 100644 --- a/windows/client-management/mdm/on-premise-authentication-device-enrollment.md +++ b/windows/client-management/mdm/on-premise-authentication-device-enrollment.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index 028da43967..bea182054a 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 07/19/2019 --- diff --git a/windows/client-management/mdm/passportforwork-ddf.md b/windows/client-management/mdm/passportforwork-ddf.md index f5b345d7d6..c8bf22bdf1 100644 --- a/windows/client-management/mdm/passportforwork-ddf.md +++ b/windows/client-management/mdm/passportforwork-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 07/29/2019 --- diff --git a/windows/client-management/mdm/personalization-csp.md b/windows/client-management/mdm/personalization-csp.md index 7a1a41565d..67b7f88ce5 100644 --- a/windows/client-management/mdm/personalization-csp.md +++ b/windows/client-management/mdm/personalization-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/personalization-ddf.md b/windows/client-management/mdm/personalization-ddf.md index 5a9ac5cc69..bc7605048f 100644 --- a/windows/client-management/mdm/personalization-ddf.md +++ b/windows/client-management/mdm/personalization-ddf.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 6256ffe15a..deb8e8e4aa 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -7,7 +7,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 10/08/2020 --- diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md index d7d340e2b5..86d72e7cfe 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -7,7 +7,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 07/18/2019 --- diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md index 0c6853e5dd..c4bd9e3c6b 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md @@ -7,7 +7,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/17/2019 --- diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md index 564838b14a..f2ee79c529 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md @@ -7,7 +7,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 07/18/2019 --- diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md index b312ee27f9..debcf03dc5 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md @@ -7,7 +7,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 10/11/2021 --- diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md index bc1fef5bcc..c06fa67c0e 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md @@ -7,7 +7,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/16/2019 --- diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md index 57cbee7b16..c67e00367b 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -7,7 +7,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 07/22/2020 --- diff --git a/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md b/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md index 4fa3380c87..774b575293 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md +++ b/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md @@ -7,7 +7,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 07/18/2019 --- diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 727589929b..ad67838441 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 07/18/2019 ms.collection: highpri @@ -8359,6 +8359,12 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC
    System/FeedbackHubAlwaysSaveDiagnosticsLocally
    +
    + System/LimitDiagnosticLogCollection +
    +
    + System/LimitDumpCollection +
    System/LimitEnhancedDiagnosticDataWindowsAnalytics
    @@ -8448,6 +8454,9 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC
    TextInput/AllowLinguisticDataCollection
    +
    + TextInput/AllowTextInputSuggestionUpdate +
    TextInput/ConfigureJapaneseIMEVersion
    @@ -8498,9 +8507,18 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC ### TimeLanguageSettings policies
    +
    + TimeLanguageSettings/BlockCleanupOfUnusedPreinstalledLangPacks +
    TimeLanguageSettings/ConfigureTimeZone
    +
    + TimeLanguageSettings/MachineUILanguageOverwrite +
    +
    + TimeLanguageSettings/RestrictLanguagePacksAndFeaturesInstall +
    ### Troubleshooting policies @@ -8798,6 +8816,17 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC +### VirtualizationBasedTechnology policies + +
    +
    + VirtualizationBasedTechnology/HypervisorEnforcedCodeIntegrity +
    +
    + VirtualizationBasedTechnology/RequireUEFIMemoryAttributesTable +
    +
    + ### Wifi policies
    @@ -8980,6 +9009,9 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC
    WirelessDisplay/AllowMdnsDiscovery
    +
    + WirelessDisplay/AllowMovementDetectionOnInfrastructure +
    WirelessDisplay/AllowProjectionFromPC
    diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index b1b74f16be..53f46805cf 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/27/2019 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index 795f89e92c..eceea61bd6 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/27/2019 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index 60248d3ecc..352549f4d0 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/27/2019 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md index 0b63ffc56d..01c897def4 100644 --- a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md +++ b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/09/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md index de3506d5e5..cda9438358 100644 --- a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md +++ b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 08/13/2020 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-admx-admpwd.md b/windows/client-management/mdm/policy-csp-admx-admpwd.md index dbb231d5c5..4701b9088a 100644 --- a/windows/client-management/mdm/policy-csp-admx-admpwd.md +++ b/windows/client-management/mdm/policy-csp-admx-admpwd.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/09/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-appcompat.md b/windows/client-management/mdm/policy-csp-admx-appcompat.md index c25bbf261a..f77ed606ef 100644 --- a/windows/client-management/mdm/policy-csp-admx-appcompat.md +++ b/windows/client-management/mdm/policy-csp-admx-appcompat.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 08/20/2020 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md index b3a9d9197f..158948b963 100644 --- a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md +++ b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/10/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-appxruntime.md b/windows/client-management/mdm/policy-csp-admx-appxruntime.md index 7440cfbb70..4cc5ed5e0b 100644 --- a/windows/client-management/mdm/policy-csp-admx-appxruntime.md +++ b/windows/client-management/mdm/policy-csp-admx-appxruntime.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/10/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md index 60757b10f3..c73a012b15 100644 --- a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/10/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-auditsettings.md b/windows/client-management/mdm/policy-csp-admx-auditsettings.md index 4ade562c8f..c0329444bd 100644 --- a/windows/client-management/mdm/policy-csp-admx-auditsettings.md +++ b/windows/client-management/mdm/policy-csp-admx-auditsettings.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/13/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-bits.md b/windows/client-management/mdm/policy-csp-admx-bits.md index f14750b59c..db8592a2d7 100644 --- a/windows/client-management/mdm/policy-csp-admx-bits.md +++ b/windows/client-management/mdm/policy-csp-admx-bits.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/20/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md index 1aafb0d27a..d5f0761d38 100644 --- a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md +++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/17/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-com.md b/windows/client-management/mdm/policy-csp-admx-com.md index 6ddb16921c..7666143850 100644 --- a/windows/client-management/mdm/policy-csp-admx-com.md +++ b/windows/client-management/mdm/policy-csp-admx-com.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/18/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-controlpanel.md b/windows/client-management/mdm/policy-csp-admx-controlpanel.md index fd6ce7faed..4d63de3739 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpanel.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/05/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md index 8005489dba..4ffc124899 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/05/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-cpls.md b/windows/client-management/mdm/policy-csp-admx-cpls.md index 4e1d864337..19f04975a7 100644 --- a/windows/client-management/mdm/policy-csp-admx-cpls.md +++ b/windows/client-management/mdm/policy-csp-admx-cpls.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/26/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md index e7951df443..92381f92cc 100644 --- a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/11/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md index cb4c42d7af..6644992e57 100644 --- a/windows/client-management/mdm/policy-csp-admx-credssp.md +++ b/windows/client-management/mdm/policy-csp-admx-credssp.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/12/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-credui.md b/windows/client-management/mdm/policy-csp-admx-credui.md index 31ef959ed4..d6bc1bc1fd 100644 --- a/windows/client-management/mdm/policy-csp-admx-credui.md +++ b/windows/client-management/mdm/policy-csp-admx-credui.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/09/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md index ba59b9dd2d..7bdb85337f 100644 --- a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md +++ b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/26/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-datacollection.md b/windows/client-management/mdm/policy-csp-admx-datacollection.md index 823a56b05b..280a763699 100644 --- a/windows/client-management/mdm/policy-csp-admx-datacollection.md +++ b/windows/client-management/mdm/policy-csp-admx-datacollection.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/01/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-desktop.md b/windows/client-management/mdm/policy-csp-admx-desktop.md index 77a47cb92e..1a66b56054 100644 --- a/windows/client-management/mdm/policy-csp-admx-desktop.md +++ b/windows/client-management/mdm/policy-csp-admx-desktop.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/02/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-deviceguard.md b/windows/client-management/mdm/policy-csp-admx-deviceguard.md index 4740213341..6ef592107b 100644 --- a/windows/client-management/mdm/policy-csp-admx-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-admx-deviceguard.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/08/2021 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md index ff64f14635..596d4df2ed 100644 --- a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/19/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-devicesetup.md b/windows/client-management/mdm/policy-csp-admx-devicesetup.md index 512dd58e38..ae07cf6eb3 100644 --- a/windows/client-management/mdm/policy-csp-admx-devicesetup.md +++ b/windows/client-management/mdm/policy-csp-admx-devicesetup.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/19/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-digitallocker.md b/windows/client-management/mdm/policy-csp-admx-digitallocker.md index 4c11d25bbd..731f55b062 100644 --- a/windows/client-management/mdm/policy-csp-admx-digitallocker.md +++ b/windows/client-management/mdm/policy-csp-admx-digitallocker.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/31/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-disknvcache.md b/windows/client-management/mdm/policy-csp-admx-disknvcache.md index 9870b6aebc..87b9aee1a3 100644 --- a/windows/client-management/mdm/policy-csp-admx-disknvcache.md +++ b/windows/client-management/mdm/policy-csp-admx-disknvcache.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/12/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-diskquota.md b/windows/client-management/mdm/policy-csp-admx-diskquota.md index 1d103968db..cc4ff2f0b5 100644 --- a/windows/client-management/mdm/policy-csp-admx-diskquota.md +++ b/windows/client-management/mdm/policy-csp-admx-diskquota.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/12/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md b/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md index 89280b4e3d..5c192b7816 100644 --- a/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md +++ b/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 03/22/2021 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-dnsclient.md b/windows/client-management/mdm/policy-csp-admx-dnsclient.md index 1048f89d4f..89e960919b 100644 --- a/windows/client-management/mdm/policy-csp-admx-dnsclient.md +++ b/windows/client-management/mdm/policy-csp-admx-dnsclient.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/12/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-dwm.md b/windows/client-management/mdm/policy-csp-admx-dwm.md index f1be9bb199..94017ac6c2 100644 --- a/windows/client-management/mdm/policy-csp-admx-dwm.md +++ b/windows/client-management/mdm/policy-csp-admx-dwm.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/31/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-eaime.md b/windows/client-management/mdm/policy-csp-admx-eaime.md index cad865a77f..4a47e54126 100644 --- a/windows/client-management/mdm/policy-csp-admx-eaime.md +++ b/windows/client-management/mdm/policy-csp-admx-eaime.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/19/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md b/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md index 692228300f..00a8db9920 100644 --- a/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md +++ b/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/02/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md index c105cd1d14..6ac5c0d97c 100644 --- a/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md +++ b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/23/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-errorreporting.md b/windows/client-management/mdm/policy-csp-admx-errorreporting.md index 94c3b17642..6d41a7d0d3 100644 --- a/windows/client-management/mdm/policy-csp-admx-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-admx-errorreporting.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/23/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-eventforwarding.md b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md index a8280b059d..becd6119b7 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventforwarding.md +++ b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/17/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-eventlog.md b/windows/client-management/mdm/policy-csp-admx-eventlog.md index 6ecf8c9c31..81b5a76522 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventlog.md +++ b/windows/client-management/mdm/policy-csp-admx-eventlog.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/01/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-explorer.md b/windows/client-management/mdm/policy-csp-admx-explorer.md index 9989e26418..c77ca20992 100644 --- a/windows/client-management/mdm/policy-csp-admx-explorer.md +++ b/windows/client-management/mdm/policy-csp-admx-explorer.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/08/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-filerecovery.md b/windows/client-management/mdm/policy-csp-admx-filerecovery.md index a32fa9863a..74cc4f3f50 100644 --- a/windows/client-management/mdm/policy-csp-admx-filerecovery.md +++ b/windows/client-management/mdm/policy-csp-admx-filerecovery.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 03/24/2021 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md b/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md index 5fad886bbd..18ddd06906 100644 --- a/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md +++ b/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/02/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-filesys.md b/windows/client-management/mdm/policy-csp-admx-filesys.md index edfeb52c50..7564a4e11d 100644 --- a/windows/client-management/mdm/policy-csp-admx-filesys.md +++ b/windows/client-management/mdm/policy-csp-admx-filesys.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/02/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-folderredirection.md b/windows/client-management/mdm/policy-csp-admx-folderredirection.md index ef3ba9dc71..e37fe6b015 100644 --- a/windows/client-management/mdm/policy-csp-admx-folderredirection.md +++ b/windows/client-management/mdm/policy-csp-admx-folderredirection.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/02/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-globalization.md b/windows/client-management/mdm/policy-csp-admx-globalization.md index e33386dc04..c16cc7e02d 100644 --- a/windows/client-management/mdm/policy-csp-admx-globalization.md +++ b/windows/client-management/mdm/policy-csp-admx-globalization.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/14/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md index c48c954fb7..8213ae894c 100644 --- a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/21/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-help.md b/windows/client-management/mdm/policy-csp-admx-help.md index 910d8eb41d..647e532ec1 100644 --- a/windows/client-management/mdm/policy-csp-admx-help.md +++ b/windows/client-management/mdm/policy-csp-admx-help.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/03/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-helpandsupport.md b/windows/client-management/mdm/policy-csp-admx-helpandsupport.md index ee1c066857..806207275f 100644 --- a/windows/client-management/mdm/policy-csp-admx-helpandsupport.md +++ b/windows/client-management/mdm/policy-csp-admx-helpandsupport.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/03/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-icm.md b/windows/client-management/mdm/policy-csp-admx-icm.md index 9a09f8f2fa..bdd9118d02 100644 --- a/windows/client-management/mdm/policy-csp-admx-icm.md +++ b/windows/client-management/mdm/policy-csp-admx-icm.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/17/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-iscsi.md b/windows/client-management/mdm/policy-csp-admx-iscsi.md index 635700efc1..68a7623db7 100644 --- a/windows/client-management/mdm/policy-csp-admx-iscsi.md +++ b/windows/client-management/mdm/policy-csp-admx-iscsi.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/17/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-kdc.md b/windows/client-management/mdm/policy-csp-admx-kdc.md index 8dd5286694..e2de14a58e 100644 --- a/windows/client-management/mdm/policy-csp-admx-kdc.md +++ b/windows/client-management/mdm/policy-csp-admx-kdc.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/13/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-kerberos.md b/windows/client-management/mdm/policy-csp-admx-kerberos.md index 8148db9dd5..10bb3a7bdc 100644 --- a/windows/client-management/mdm/policy-csp-admx-kerberos.md +++ b/windows/client-management/mdm/policy-csp-admx-kerberos.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/12/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-lanmanserver.md b/windows/client-management/mdm/policy-csp-admx-lanmanserver.md index 18b9f6e543..a8b463fca0 100644 --- a/windows/client-management/mdm/policy-csp-admx-lanmanserver.md +++ b/windows/client-management/mdm/policy-csp-admx-lanmanserver.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/13/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md index b574242c37..8fe3f8ec35 100644 --- a/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/08/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md b/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md index ccfb70864f..1b54964f3c 100644 --- a/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md +++ b/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/04/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-logon.md b/windows/client-management/mdm/policy-csp-admx-logon.md index 442f1fc85b..8072aab286 100644 --- a/windows/client-management/mdm/policy-csp-admx-logon.md +++ b/windows/client-management/mdm/policy-csp-admx-logon.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/21/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md index e4c7cf5345..ea7d8bca47 100644 --- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/02/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-mmc.md b/windows/client-management/mdm/policy-csp-admx-mmc.md index 9eff49d85c..b7a4eabb21 100644 --- a/windows/client-management/mdm/policy-csp-admx-mmc.md +++ b/windows/client-management/mdm/policy-csp-admx-mmc.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/03/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md index 41e81ccde0..c1dbb2d4d9 100644 --- a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md +++ b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/13/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-msapolicy.md b/windows/client-management/mdm/policy-csp-admx-msapolicy.md index c99d918ce9..2e8a050a34 100644 --- a/windows/client-management/mdm/policy-csp-admx-msapolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-msapolicy.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/14/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-msched.md b/windows/client-management/mdm/policy-csp-admx-msched.md index f5fdba58e4..e302ab1e87 100644 --- a/windows/client-management/mdm/policy-csp-admx-msched.md +++ b/windows/client-management/mdm/policy-csp-admx-msched.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/08/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-msdt.md b/windows/client-management/mdm/policy-csp-admx-msdt.md index 06d2770f44..c5b5ff4f3f 100644 --- a/windows/client-management/mdm/policy-csp-admx-msdt.md +++ b/windows/client-management/mdm/policy-csp-admx-msdt.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/09/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-msi.md b/windows/client-management/mdm/policy-csp-admx-msi.md index e6c1aed15a..1292f4bf46 100644 --- a/windows/client-management/mdm/policy-csp-admx-msi.md +++ b/windows/client-management/mdm/policy-csp-admx-msi.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/16/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-nca.md b/windows/client-management/mdm/policy-csp-admx-nca.md index 986ec03798..78826d464b 100644 --- a/windows/client-management/mdm/policy-csp-admx-nca.md +++ b/windows/client-management/mdm/policy-csp-admx-nca.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/14/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-ncsi.md b/windows/client-management/mdm/policy-csp-admx-ncsi.md index 5184e91b8f..2560340dd7 100644 --- a/windows/client-management/mdm/policy-csp-admx-ncsi.md +++ b/windows/client-management/mdm/policy-csp-admx-ncsi.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/14/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-netlogon.md b/windows/client-management/mdm/policy-csp-admx-netlogon.md index e1964516d6..2b5699063f 100644 --- a/windows/client-management/mdm/policy-csp-admx-netlogon.md +++ b/windows/client-management/mdm/policy-csp-admx-netlogon.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/15/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-networkconnections.md b/windows/client-management/mdm/policy-csp-admx-networkconnections.md index d5d370ddd0..70691cee2e 100644 --- a/windows/client-management/mdm/policy-csp-admx-networkconnections.md +++ b/windows/client-management/mdm/policy-csp-admx-networkconnections.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/21/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md index 907a6c3faf..212028ab92 100644 --- a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md +++ b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/21/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md index 5c5de65322..3ca3837ece 100644 --- a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md +++ b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/16/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-pentraining.md b/windows/client-management/mdm/policy-csp-admx-pentraining.md index 739eadfa85..e3c4ae75b9 100644 --- a/windows/client-management/mdm/policy-csp-admx-pentraining.md +++ b/windows/client-management/mdm/policy-csp-admx-pentraining.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/22/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md b/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md index a30321f9d1..131f8068f9 100644 --- a/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md +++ b/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/16/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-power.md b/windows/client-management/mdm/policy-csp-admx-power.md index 577ab2817e..31a6511577 100644 --- a/windows/client-management/mdm/policy-csp-admx-power.md +++ b/windows/client-management/mdm/policy-csp-admx-power.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/22/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md b/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md index 4dda5ef6d7..f464f39c32 100644 --- a/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/26/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-previousversions.md b/windows/client-management/mdm/policy-csp-admx-previousversions.md index 0804272ef5..690fb95593 100644 --- a/windows/client-management/mdm/policy-csp-admx-previousversions.md +++ b/windows/client-management/mdm/policy-csp-admx-previousversions.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/01/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-printing.md b/windows/client-management/mdm/policy-csp-admx-printing.md index 00c721510d..5e99e594d1 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing.md +++ b/windows/client-management/mdm/policy-csp-admx-printing.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/15/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-printing2.md b/windows/client-management/mdm/policy-csp-admx-printing2.md index 7b1b95eb4c..5ba617c45b 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing2.md +++ b/windows/client-management/mdm/policy-csp-admx-printing2.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/15/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-programs.md b/windows/client-management/mdm/policy-csp-admx-programs.md index 990feee657..08c035bce0 100644 --- a/windows/client-management/mdm/policy-csp-admx-programs.md +++ b/windows/client-management/mdm/policy-csp-admx-programs.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/01/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md b/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md index 13b2e8ed2b..5339356365 100644 --- a/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md +++ b/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/01/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-radar.md b/windows/client-management/mdm/policy-csp-admx-radar.md index 3bba1e568c..a62022e062 100644 --- a/windows/client-management/mdm/policy-csp-admx-radar.md +++ b/windows/client-management/mdm/policy-csp-admx-radar.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/08/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-reliability.md b/windows/client-management/mdm/policy-csp-admx-reliability.md index 5d866e2c6e..b278ae8152 100644 --- a/windows/client-management/mdm/policy-csp-admx-reliability.md +++ b/windows/client-management/mdm/policy-csp-admx-reliability.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/13/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-remoteassistance.md b/windows/client-management/mdm/policy-csp-admx-remoteassistance.md index 2f26005e0b..bff298711a 100644 --- a/windows/client-management/mdm/policy-csp-admx-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-admx-remoteassistance.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/14/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-removablestorage.md b/windows/client-management/mdm/policy-csp-admx-removablestorage.md index 5dd7bfc49d..7ce8e84d8f 100644 --- a/windows/client-management/mdm/policy-csp-admx-removablestorage.md +++ b/windows/client-management/mdm/policy-csp-admx-removablestorage.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/10/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-rpc.md b/windows/client-management/mdm/policy-csp-admx-rpc.md index 7f1dfd0264..8d55a90e21 100644 --- a/windows/client-management/mdm/policy-csp-admx-rpc.md +++ b/windows/client-management/mdm/policy-csp-admx-rpc.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/08/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-scripts.md b/windows/client-management/mdm/policy-csp-admx-scripts.md index 2b2f31bea3..82a3cfd387 100644 --- a/windows/client-management/mdm/policy-csp-admx-scripts.md +++ b/windows/client-management/mdm/policy-csp-admx-scripts.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/17/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-sdiageng.md b/windows/client-management/mdm/policy-csp-admx-sdiageng.md index 361bd0cb3e..d2b7755488 100644 --- a/windows/client-management/mdm/policy-csp-admx-sdiageng.md +++ b/windows/client-management/mdm/policy-csp-admx-sdiageng.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-sdiagschd.md b/windows/client-management/mdm/policy-csp-admx-sdiagschd.md index 3a71e0ce34..3a414ed8e5 100644 --- a/windows/client-management/mdm/policy-csp-admx-sdiagschd.md +++ b/windows/client-management/mdm/policy-csp-admx-sdiagschd.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/17/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-securitycenter.md b/windows/client-management/mdm/policy-csp-admx-securitycenter.md index 0e995b2598..ae470ea353 100644 --- a/windows/client-management/mdm/policy-csp-admx-securitycenter.md +++ b/windows/client-management/mdm/policy-csp-admx-securitycenter.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-sensors.md b/windows/client-management/mdm/policy-csp-admx-sensors.md index ee2898372e..560b651c17 100644 --- a/windows/client-management/mdm/policy-csp-admx-sensors.md +++ b/windows/client-management/mdm/policy-csp-admx-sensors.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/22/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-servermanager.md b/windows/client-management/mdm/policy-csp-admx-servermanager.md index 4fc914d43c..ca95276d8d 100644 --- a/windows/client-management/mdm/policy-csp-admx-servermanager.md +++ b/windows/client-management/mdm/policy-csp-admx-servermanager.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-servicing.md b/windows/client-management/mdm/policy-csp-admx-servicing.md index 4fe82297b4..25ffa880c7 100644 --- a/windows/client-management/mdm/policy-csp-admx-servicing.md +++ b/windows/client-management/mdm/policy-csp-admx-servicing.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-settingsync.md b/windows/client-management/mdm/policy-csp-admx-settingsync.md index 37cbb7a110..fa9ac041c3 100644 --- a/windows/client-management/mdm/policy-csp-admx-settingsync.md +++ b/windows/client-management/mdm/policy-csp-admx-settingsync.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/01/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md index 245bfe99fe..08337cd9ac 100644 --- a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md +++ b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/21/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-sharing.md b/windows/client-management/mdm/policy-csp-admx-sharing.md index 3c27d491ac..dc1208a27c 100644 --- a/windows/client-management/mdm/policy-csp-admx-sharing.md +++ b/windows/client-management/mdm/policy-csp-admx-sharing.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/21/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md index 7191da7a5d..ac2a57d74f 100644 --- a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md +++ b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-smartcard.md b/windows/client-management/mdm/policy-csp-admx-smartcard.md index 5d3166d052..942b369753 100644 --- a/windows/client-management/mdm/policy-csp-admx-smartcard.md +++ b/windows/client-management/mdm/policy-csp-admx-smartcard.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/23/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-snmp.md b/windows/client-management/mdm/policy-csp-admx-snmp.md index b045f07a07..528ebac188 100644 --- a/windows/client-management/mdm/policy-csp-admx-snmp.md +++ b/windows/client-management/mdm/policy-csp-admx-snmp.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/24/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-soundrec.md b/windows/client-management/mdm/policy-csp-admx-soundrec.md index 6f02145c30..1609eb9c33 100644 --- a/windows/client-management/mdm/policy-csp-admx-soundrec.md +++ b/windows/client-management/mdm/policy-csp-admx-soundrec.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/01/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-srmfci.md b/windows/client-management/mdm/policy-csp-admx-srmfci.md index 97c22bb885..57d4c0e161 100644 --- a/windows/client-management/mdm/policy-csp-admx-srmfci.md +++ b/windows/client-management/mdm/policy-csp-admx-srmfci.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-startmenu.md b/windows/client-management/mdm/policy-csp-admx-startmenu.md index 3c8ce9c60b..5b8110067f 100644 --- a/windows/client-management/mdm/policy-csp-admx-startmenu.md +++ b/windows/client-management/mdm/policy-csp-admx-startmenu.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/20/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-systemrestore.md b/windows/client-management/mdm/policy-csp-admx-systemrestore.md index a927fcf7fa..b8c24f28ca 100644 --- a/windows/client-management/mdm/policy-csp-admx-systemrestore.md +++ b/windows/client-management/mdm/policy-csp-admx-systemrestore.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/13/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-tabletshell.md b/windows/client-management/mdm/policy-csp-admx-tabletshell.md index 2b10ad07df..5de634f174 100644 --- a/windows/client-management/mdm/policy-csp-admx-tabletshell.md +++ b/windows/client-management/mdm/policy-csp-admx-tabletshell.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/23/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-taskbar.md b/windows/client-management/mdm/policy-csp-admx-taskbar.md index 78c9fa82bc..a22e45d37f 100644 --- a/windows/client-management/mdm/policy-csp-admx-taskbar.md +++ b/windows/client-management/mdm/policy-csp-admx-taskbar.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/26/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-tcpip.md b/windows/client-management/mdm/policy-csp-admx-tcpip.md index c8906bdb4b..6a9bd7666d 100644 --- a/windows/client-management/mdm/policy-csp-admx-tcpip.md +++ b/windows/client-management/mdm/policy-csp-admx-tcpip.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/23/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index c20b703c9f..1181f4bd47 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/23/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-thumbnails.md b/windows/client-management/mdm/policy-csp-admx-thumbnails.md index 7be812e487..cad32638c6 100644 --- a/windows/client-management/mdm/policy-csp-admx-thumbnails.md +++ b/windows/client-management/mdm/policy-csp-admx-thumbnails.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/25/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-touchinput.md b/windows/client-management/mdm/policy-csp-admx-touchinput.md index f6add75f97..288b99a963 100644 --- a/windows/client-management/mdm/policy-csp-admx-touchinput.md +++ b/windows/client-management/mdm/policy-csp-admx-touchinput.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/23/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-tpm.md b/windows/client-management/mdm/policy-csp-admx-tpm.md index 4e93cfa758..7f8cb02e07 100644 --- a/windows/client-management/mdm/policy-csp-admx-tpm.md +++ b/windows/client-management/mdm/policy-csp-admx-tpm.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/25/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md index bd51ddd103..25e8620306 100644 --- a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md +++ b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/30/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-userprofiles.md b/windows/client-management/mdm/policy-csp-admx-userprofiles.md index c03e0b6c14..72e9a3ea84 100644 --- a/windows/client-management/mdm/policy-csp-admx-userprofiles.md +++ b/windows/client-management/mdm/policy-csp-admx-userprofiles.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/11/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-w32time.md b/windows/client-management/mdm/policy-csp-admx-w32time.md index c8820d8b10..f57fa5f258 100644 --- a/windows/client-management/mdm/policy-csp-admx-w32time.md +++ b/windows/client-management/mdm/policy-csp-admx-w32time.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/28/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-wcm.md b/windows/client-management/mdm/policy-csp-admx-wcm.md index 53dfbad981..a537a8e9f6 100644 --- a/windows/client-management/mdm/policy-csp-admx-wcm.md +++ b/windows/client-management/mdm/policy-csp-admx-wcm.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/22/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-wdi.md b/windows/client-management/mdm/policy-csp-admx-wdi.md index 2961e26280..b5b0b84748 100644 --- a/windows/client-management/mdm/policy-csp-admx-wdi.md +++ b/windows/client-management/mdm/policy-csp-admx-wdi.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/09/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-wincal.md b/windows/client-management/mdm/policy-csp-admx-wincal.md index 0e96abbae4..25ce545184 100644 --- a/windows/client-management/mdm/policy-csp-admx-wincal.md +++ b/windows/client-management/mdm/policy-csp-admx-wincal.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/28/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md b/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md index dcf9972d1f..807a4c84ff 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md +++ b/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/27/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md b/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md index df2b84a150..1922a73f28 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/28/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md index a5998a3a91..3046a4d8ab 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/29/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md b/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md index 2810e7487e..477a03bb2f 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/13/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md b/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md index a190657eb0..07a9a6b53d 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/09/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md b/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md index ab93210ca3..1d922a36c6 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/16/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-windowsstore.md b/windows/client-management/mdm/policy-csp-admx-windowsstore.md index 4563644d48..c1c177297f 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsstore.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsstore.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/26/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-wininit.md b/windows/client-management/mdm/policy-csp-admx-wininit.md index d3df0e2a26..c8dbb5219d 100644 --- a/windows/client-management/mdm/policy-csp-admx-wininit.md +++ b/windows/client-management/mdm/policy-csp-admx-wininit.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/29/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-winlogon.md b/windows/client-management/mdm/policy-csp-admx-winlogon.md index a7b7468815..629647238f 100644 --- a/windows/client-management/mdm/policy-csp-admx-winlogon.md +++ b/windows/client-management/mdm/policy-csp-admx-winlogon.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/09/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-winsrv.md b/windows/client-management/mdm/policy-csp-admx-winsrv.md index c716604db3..bbe441caa0 100644 --- a/windows/client-management/mdm/policy-csp-admx-winsrv.md +++ b/windows/client-management/mdm/policy-csp-admx-winsrv.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 02/25/2021 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-wlansvc.md b/windows/client-management/mdm/policy-csp-admx-wlansvc.md index c8bab4ac40..017e045dda 100644 --- a/windows/client-management/mdm/policy-csp-admx-wlansvc.md +++ b/windows/client-management/mdm/policy-csp-admx-wlansvc.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/27/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-admx-wpn.md b/windows/client-management/mdm/policy-csp-admx-wpn.md index 46da2329c9..de3ef506c6 100644 --- a/windows/client-management/mdm/policy-csp-admx-wpn.md +++ b/windows/client-management/mdm/policy-csp-admx-wpn.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/13/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index 3d3c39e25d..b27d78e274 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 85597822d9..2fdd8c06c8 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 02/11/2020 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-appruntime.md b/windows/client-management/mdm/policy-csp-appruntime.md index 63e2a6d554..c8db68a7e0 100644 --- a/windows/client-management/mdm/policy-csp-appruntime.md +++ b/windows/client-management/mdm/policy-csp-appruntime.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index 60f7cdadbe..70bb648c9b 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md index fdaf335e9e..3be1f15988 100644 --- a/windows/client-management/mdm/policy-csp-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index eb4083d56a..30473c76c3 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 --- diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index a407c890b7..78fee5443a 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.reviewer: bobgil manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md index 98a5bd34bc..9efb1181a2 100644 --- a/windows/client-management/mdm/policy-csp-autoplay.md +++ b/windows/client-management/mdm/policy-csp-autoplay.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-bitlocker.md b/windows/client-management/mdm/policy-csp-bitlocker.md index 6358520e87..283f6421fa 100644 --- a/windows/client-management/mdm/policy-csp-bitlocker.md +++ b/windows/client-management/mdm/policy-csp-bitlocker.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-bits.md b/windows/client-management/mdm/policy-csp-bits.md index f5b219a08f..81ec70c880 100644 --- a/windows/client-management/mdm/policy-csp-bits.md +++ b/windows/client-management/mdm/policy-csp-bits.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index a4c76ab6b6..025122b10d 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 02/12/2020 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md index 1573428da2..1a06b54ae0 100644 --- a/windows/client-management/mdm/policy-csp-camera.md +++ b/windows/client-management/mdm/policy-csp-camera.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index 5bfd9802ea..a88970a383 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 2b6d5e2822..76c31ff34a 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md index 71abb291fb..21357c48c3 100644 --- a/windows/client-management/mdm/policy-csp-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-credentialproviders.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-credentialsdelegation.md b/windows/client-management/mdm/policy-csp-credentialsdelegation.md index a6101081b4..87b03eb667 100644 --- a/windows/client-management/mdm/policy-csp-credentialsdelegation.md +++ b/windows/client-management/mdm/policy-csp-credentialsdelegation.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md index f89eb54960..2b0be6c478 100644 --- a/windows/client-management/mdm/policy-csp-credentialsui.md +++ b/windows/client-management/mdm/policy-csp-credentialsui.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md index e3b1a040e2..0e746278c6 100644 --- a/windows/client-management/mdm/policy-csp-cryptography.md +++ b/windows/client-management/mdm/policy-csp-cryptography.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md index 7128cf8e0e..6b464729c7 100644 --- a/windows/client-management/mdm/policy-csp-dataprotection.md +++ b/windows/client-management/mdm/policy-csp-dataprotection.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md index 5eba197edf..73b7408f51 100644 --- a/windows/client-management/mdm/policy-csp-datausage.md +++ b/windows/client-management/mdm/policy-csp-datausage.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 4161b16426..102d605e73 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 01/08/2020 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 2dd019409d..283a1ba6a1 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 06/09/2020 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index 37ad19d5d7..aa850f28a4 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index f5ded57337..9a718888b1 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md index f8436f12ab..94bb5c7ab0 100644 --- a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md +++ b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index d6c294a5d7..5f1a7bd17d 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -8,7 +8,7 @@ ms.date: 09/27/2019 ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium --- diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index ff0b3e244c..ad23d85b9c 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index c5a0afd873..5fcf63a361 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-dmaguard.md b/windows/client-management/mdm/policy-csp-dmaguard.md index 859747424e..336c23a5cb 100644 --- a/windows/client-management/mdm/policy-csp-dmaguard.md +++ b/windows/client-management/mdm/policy-csp-dmaguard.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index 94f5fec5b1..4bd0742e0b 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md index 5107467175..fb0a5f37eb 100644 --- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md +++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-errorreporting.md b/windows/client-management/mdm/policy-csp-errorreporting.md index 933477e98e..4e5f16f246 100644 --- a/windows/client-management/mdm/policy-csp-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-errorreporting.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md index ced41f8ec7..9e1e22c296 100644 --- a/windows/client-management/mdm/policy-csp-eventlogservice.md +++ b/windows/client-management/mdm/policy-csp-eventlogservice.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index 9b86970c2d..1c7c1d5a4a 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 11/02/2020 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md index 0871c172eb..549a130038 100644 --- a/windows/client-management/mdm/policy-csp-exploitguard.md +++ b/windows/client-management/mdm/policy-csp-exploitguard.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md index 9b6e083850..3599a3ce1a 100644 --- a/windows/client-management/mdm/policy-csp-fileexplorer.md +++ b/windows/client-management/mdm/policy-csp-fileexplorer.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-games.md b/windows/client-management/mdm/policy-csp-games.md index d11c8ac12c..8f26e60ff4 100644 --- a/windows/client-management/mdm/policy-csp-games.md +++ b/windows/client-management/mdm/policy-csp-games.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md index cf2e208e43..4c736050b2 100644 --- a/windows/client-management/mdm/policy-csp-handwriting.md +++ b/windows/client-management/mdm/policy-csp-handwriting.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index bfce61f4d4..ef2ec926d4 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index 61c56fc7d1..4dfe60a594 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-lanmanworkstation.md index 48a4124e4d..0165674799 100644 --- a/windows/client-management/mdm/policy-csp-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-lanmanworkstation.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md index 5337f28090..430b7af709 100644 --- a/windows/client-management/mdm/policy-csp-licensing.md +++ b/windows/client-management/mdm/policy-csp-licensing.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-localusersandgroups.md b/windows/client-management/mdm/policy-csp-localusersandgroups.md index 7d0bbe6959..fb1249a953 100644 --- a/windows/client-management/mdm/policy-csp-localusersandgroups.md +++ b/windows/client-management/mdm/policy-csp-localusersandgroups.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 10/14/2020 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index 0ad9e5064a..90a9dc1bf5 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-maps.md b/windows/client-management/mdm/policy-csp-maps.md index b367ded45d..c2cb4d83fd 100644 --- a/windows/client-management/mdm/policy-csp-maps.md +++ b/windows/client-management/mdm/policy-csp-maps.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md index aff2619a83..d27b02b6fd 100644 --- a/windows/client-management/mdm/policy-csp-messaging.md +++ b/windows/client-management/mdm/policy-csp-messaging.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-mixedreality.md b/windows/client-management/mdm/policy-csp-mixedreality.md index 4ba8901cf1..2033a4f1d1 100644 --- a/windows/client-management/mdm/policy-csp-mixedreality.md +++ b/windows/client-management/mdm/policy-csp-mixedreality.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/12/2021 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/policy-csp-mssecurityguide.md b/windows/client-management/mdm/policy-csp-mssecurityguide.md index 6d9ffea053..812c96e877 100644 --- a/windows/client-management/mdm/policy-csp-mssecurityguide.md +++ b/windows/client-management/mdm/policy-csp-mssecurityguide.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md index ec90623f46..6f71a563e4 100644 --- a/windows/client-management/mdm/policy-csp-msslegacy.md +++ b/windows/client-management/mdm/policy-csp-msslegacy.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-multitasking.md b/windows/client-management/mdm/policy-csp-multitasking.md index 2dc8d7babd..5d7d45779b 100644 --- a/windows/client-management/mdm/policy-csp-multitasking.md +++ b/windows/client-management/mdm/policy-csp-multitasking.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 10/30/2020 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md index 4a5817cc0b..b7c30247ea 100644 --- a/windows/client-management/mdm/policy-csp-networkisolation.md +++ b/windows/client-management/mdm/policy-csp-networkisolation.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index 1bee02ddeb..4a19dd5b07 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 68f5886319..0ef2c8dfbd 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index a272a8c4a5..4e4e7c9f2f 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index eb6b20b388..0bcba72d88 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md index 9cef368910..69ec854522 100644 --- a/windows/client-management/mdm/policy-csp-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-remoteassistance.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md index bb050cc600..902ead52a3 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md +++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md index f5c297db0c..88f1e02ee3 100644 --- a/windows/client-management/mdm/policy-csp-remotemanagement.md +++ b/windows/client-management/mdm/policy-csp-remotemanagement.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md index fb3e09fa8e..9832eb9c61 100644 --- a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md +++ b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md index df6b0a98f7..a9f428a5a9 100644 --- a/windows/client-management/mdm/policy-csp-remoteshell.md +++ b/windows/client-management/mdm/policy-csp-remoteshell.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 60ec3daf17..4c77b145dc 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 04/07/2020 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 19ce45c204..3542a2ac74 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 02/12/2021 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index 8c2a9e3151..b632610c9f 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index 9233d3ba59..3648f9e658 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index 3ed9fb87eb..5da64f872e 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index 9ce8943851..fe81410adf 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index a4659bf1ff..f09d4aa243 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index e0164a6227..edbab49c18 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 6141fdcf82..9e31c3a67b 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 08/26/2021 ms.reviewer: @@ -94,6 +94,12 @@ manager: dansimp
    System/FeedbackHubAlwaysSaveDiagnosticsLocally
    +
    + System/LimitDiagnosticLogCollection +
    +
    + System/LimitDumpCollection +
    System/LimitEnhancedDiagnosticDataWindowsAnalytics
    @@ -1295,6 +1301,105 @@ The following list shows the supported values:
    + +**System/LimitDiagnosticLogCollection** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting specifies whether diagnostic log data can be collected when more information is needed to troubleshoot a problem. It is sent only if we have permission to collect optional diagnostic data, and only if the device meets the criteria for additional data collection. + +If you disable or do not configure this policy setting, we may occasionally collect advanced diagnostic data if the user has opted to send optional diagnostic data. + + + +ADMX Info: +- GP Friendly name: *Limit Diagnostic Log Collection* +- GP name: *LimitDiagnosticLogCollection* +- GP path: *Data Collection and Preview Builds* +- GP ADMX file name: *DataCollection.admx* + + + +The following list shows the supported values: + +- 0 – Disabled +- 1 – Enabled + + + + +
    + + +**System/LimitDumpCollection** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting limits the type of dumps that can be collected when more information is needed to troubleshoot a problem. These dumps are not sent unless we have permission to collect optional diagnostic data. + +By enabling this policy setting, Windows Error Reporting is limited to sending kernel mini dumps and user mode triage dumps only. + +If you disable or do not configure this policy setting, we may occasionally collect full or heap dumps if the user has opted to send optional diagnostic data. + + + +ADMX Info: +- GP Friendly name: *Limit Dump Collection* +- GP name: *LimitDumpCollection* +- GP path: *Data Collection and Preview Builds* +- GP ADMX file name: *DataCollection.admx* + + + +The following list shows the supported values: + +- 0 – Disabled +- 1 – Enabled + + + +
    + **System/LimitEnhancedDiagnosticDataWindowsAnalytics** diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index 76aaf84d71..c979583ff0 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-taskmanager.md b/windows/client-management/mdm/policy-csp-taskmanager.md index f671d306e6..1cae440c6c 100644 --- a/windows/client-management/mdm/policy-csp-taskmanager.md +++ b/windows/client-management/mdm/policy-csp-taskmanager.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md index ec272ae750..983bd29762 100644 --- a/windows/client-management/mdm/policy-csp-taskscheduler.md +++ b/windows/client-management/mdm/policy-csp-taskscheduler.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index d4bc93e500..be2edb8989 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: @@ -58,6 +58,9 @@ manager: dansimp
    TextInput/AllowLinguisticDataCollection
    +
    + TextInput/AllowTextInputSuggestionUpdate +
    TextInput/ConfigureJapaneseIMEVersion
    @@ -616,6 +619,51 @@ This setting supports a range of values between 0 and 1.
    + +**TextInput/AllowTextInputSuggestionUpdate** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Allows the user to turn on or off the automatic downloading of newer versions of the Expressive Input UI. +When downloading is not allowed the Expressive Input panel will always display the initial UI included with the base Windows image. + +Most restricted value is 0. + +Default: Enabled + + + +The following list shows the supported values: + +- 1 (Enabled) - The newer UX is downloaded from Microsoft service. +- 0 (Disabled) - The UX remains unchanged with what the operating system installs. + + + + +
    + **TextInput/ConfigureJapaneseIMEVersion** diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md index 4493a8a087..c1f1785f9d 100644 --- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md +++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/28/2021 ms.reviewer: @@ -22,12 +22,75 @@ manager: dansimp ## TimeLanguageSettings policies
    +
    + TimeLanguageSettings/BlockCleanupOfUnusedPreinstalledLangPacks +
    TimeLanguageSettings/ConfigureTimeZone
    +
    + TimeLanguageSettings/MachineUILanguageOverwrite +
    +
    + TimeLanguageSettings/RestrictLanguagePacksAndFeaturesInstall +
    +
    + + +**TimeLanguageSettings/BlockCleanupOfUnusedPreinstalledLangPacks** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting controls whether the maintenance task will run to clean up language packs installed on a machine but are not used by any users on that machine. + +If you enable this policy setting (value 1), language packs that are installed as part of the system image will remain installed even if they are not used by any user on that system. + +If you disable (value 0) or do not configure this policy setting, language packs that are installed as part of the system image but are not used by any user on that system will be removed as part of a scheduled clean up task. + + + + + + +ADMX Info: +- GP Friendly name: *Block cleanup of unused language packs* +- GP name: *BlockCleanupOfUnusedPreinstalledLangPacks* +- GP path: *Computer Configuration/Administrative Templates/Control Panel/Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + + + + + + + +
    @@ -74,5 +137,103 @@ Specifies the time zone to be applied to the device. This is the standard Window
    + +**TimeLanguageSettings/MachineUILanguageOverwrite** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting controls which UI language is used for computers with more than one UI language installed. + +If you enable this policy setting, the UI language of Windows menus and dialogs for systems with more than one language is restricted to a specified language. If the specified language is not installed on the target computer or you disable this policy setting, the language selection defaults to the language selected by the local administrator. + +If you disable or do not configure this policy setting, there is no restriction of a specific language used for the Windows menus and dialogs. + + + + + + +ADMX Info: +- GP Friendly name: *Force selected system UI language to overwrite the user UI language* +- GP name: *MachineUILanguageOverwrite* +- GP path: *Computer Configuration/Administrative Templates/Control Panel/Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + + + + + + + + +
    + + +**TimeLanguageSettings/RestrictLanguagePacksAndFeaturesInstall** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting restricts standard users from installing language features on demand. This policy does not restrict the Windows language, if you want to restrict the Windows language use the following policy: “Restricts the UI languages Windows should use for the selected user.” + +If you enable this policy setting, the installation of language features is prevented for standard users. + +If you disable or do not configure this policy setting, there is no language feature installation restriction for the standard users. + + + + + + + + + + + + + diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index a2120ee9fb..a89fed4218 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 11/29/2021 ms.reviewer: @@ -1222,7 +1222,6 @@ Enable IT admin to configure feature update uninstall period. Values range 2 - 6 -Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. Defers Feature Updates for the specified number of days. @@ -1394,8 +1393,6 @@ ADMX Info: > [!NOTE] -> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. -> > Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices. @@ -1929,8 +1926,6 @@ ADMX Info: -> [!NOTE] -> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. Allows IT Admins to exclude Windows Update (WU) drivers during updates. @@ -2049,7 +2044,7 @@ The following list shows the supported values: To validate this policy: 1. Enable the policy and ensure the device is on a cellular network. -2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: +2. Run the scheduled task on your device to check for app updates in the background. For example, on a device, run the following commands in TShell: ```TShell exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' ``` @@ -2102,7 +2097,7 @@ The following list shows the supported values: To validate this policy: 1. Enable the policy and ensure the device is on a cellular network. -2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: +2. Run the scheduled task on your device to check for app updates in the background. For example, on a device, run the following commands in TShell: ```TShell exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' ``` @@ -2244,8 +2239,6 @@ The following list shows the supported values: -Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. - Allows IT Admins to pause feature updates for up to 35 days. We recomment that you use the *Update/PauseFeatureUpdatesStartTime* policy if you are running Windows 10, version 1703 or later. @@ -2422,38 +2415,14 @@ This policy is deprecated. Use [Update/RequireUpdateApproval](#update-requireupd **Update/ProductVersion** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProYesYes
    BusinessYesYes
    EnterpriseYesYes
    EducationYesYes
    + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
    @@ -2578,7 +2547,7 @@ The following list shows the supported values: > [!NOTE] -> This policy is *only* recommended for managing mobile devices. If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. +> If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved. diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index a67e1377cd..7c468e27a5 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 11/24/2021 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md b/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md new file mode 100644 index 0000000000..2ca5d714a9 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md @@ -0,0 +1,133 @@ +--- +title: Policy CSP - VirtualizationBasedTechnology +description: Learn to use the Policy CSP - VirtualizationBasedTechnology setting to control the state of Hypervisor-protected Code Integrity (HVCI) on devices. +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: alekyaj +ms.localizationpriority: medium +ms.date: 11/25/2021 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - VirtualizationBasedTechnology + +
    + + +## VirtualizationBasedTechnology policies + +
    +
    + VirtualizationBasedTechnology/HypervisorEnforcedCodeIntegrity +
    +
    + VirtualizationBasedTechnology/RequireUEFIMemoryAttributesTable +
    +
    + + +
    + + +**VirtualizationBasedTechnology/HypervisorEnforcedCodeIntegrity** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Allows the IT admin to control the state of Hypervisor-protected Code Integrity (HVCI) on devices. HVCI is a feature within Virtualization Based Security, and is frequently referred to as Memory integrity. Learn more [here](/windows-hardware/design/device-experiences/oem-vbs). + +>[!NOTE] +>After the policy is pushed, a system reboot will be required to change the state of HVCI. + + + +The following are the supported values: + +- 0: (Disabled) Turns off Hypervisor-Protected Code Integrity remotely if configured previously without UEFI Lock +- 1: (Enabled with UEFI lock) Turns on Hypervisor-Protected Code Integrity with UEFI lock +- 2: (Enabled without lock) Turns on Hypervisor-Protected Code Integrity without UEFI lock + + + + + + + + + +
    + + +**VirtualizationBasedTechnology/RequireUEFIMemoryAttributesTable** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Allows the IT admin to control the state of Hypervisor-protected Code Integrity (HVCI) on devices. HVCI is a feature within Virtualization Based Security, and is frequently referred to as Memory integrity. Learn more [here](/windows-hardware/design/device-experiences/oem-vbs). + +>[!NOTE] +>After the policy is pushed, a system reboot will be required to change the state of HVCI. + + + + +The following are the supported values: + +- 0: (Disabled) Do not require UEFI Memory Attributes Table +- 1: (Enabled) Require UEFI Memory Attributes Table + + + + + + + + + +
    + + + diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index 7c694ce087..0f2a4df17d 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md index d1a9fd2e11..95b888306a 100644 --- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index 2ec774f05e..2644d6a52a 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index b4216b2026..6daf010d04 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index b3254d5ac1..5fd902e1a7 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md index 478a612256..13e24a3f5d 100644 --- a/windows/client-management/mdm/policy-csp-windowspowershell.md +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: diff --git a/windows/client-management/mdm/policy-csp-windowssandbox.md b/windows/client-management/mdm/policy-csp-windowssandbox.md index c8066ba2b0..b3c4462090 100644 --- a/windows/client-management/mdm/policy-csp-windowssandbox.md +++ b/windows/client-management/mdm/policy-csp-windowssandbox.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 10/14/2020 --- diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index 008904439b..d61b982f66 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 09/27/2019 ms.reviewer: @@ -26,6 +26,9 @@ manager: dansimp
    WirelessDisplay/AllowMdnsDiscovery
    +
    + WirelessDisplay/AllowMovementDetectionOnInfrastructure +
    WirelessDisplay/AllowProjectionFromPC
    @@ -129,6 +132,53 @@ The following list shows the supported values:
    + +**WirelessDisplay/AllowMovementDetectionOnInfrastructure** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting allows you to disable the infrastructure movement detection feature. + +If you set it to 0, your PC may stay connected and continue to project if you walk away from a Wireless Display receiver to which you are projecting over infrastructure. + +If you set it to 1, your PC will detect that you have moved and will automatically disconnect your infrastructure Wireless Display session. + +The default value is 1. + + + + +The following list shows the supported values: + +- 0 - Do not allow +- 1 (Default) - Allow + + + + +
    + **WirelessDisplay/AllowProjectionFromPC** diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index dde8b3089c..4294786148 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium ms.date: 10/28/2020 --- diff --git a/windows/client-management/mdm/policymanager-csp.md b/windows/client-management/mdm/policymanager-csp.md index 656e292b4e..903e9b2279 100644 --- a/windows/client-management/mdm/policymanager-csp.md +++ b/windows/client-management/mdm/policymanager-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/28/2017 --- diff --git a/windows/client-management/mdm/provisioning-csp.md b/windows/client-management/mdm/provisioning-csp.md index aad96d1dbf..6e19fc3072 100644 --- a/windows/client-management/mdm/provisioning-csp.md +++ b/windows/client-management/mdm/provisioning-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/proxy-csp.md b/windows/client-management/mdm/proxy-csp.md index 2a474b9321..8cea583448 100644 --- a/windows/client-management/mdm/proxy-csp.md +++ b/windows/client-management/mdm/proxy-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/push-notification-windows-mdm.md b/windows/client-management/mdm/push-notification-windows-mdm.md index 92df20eba2..13294f3ce5 100644 --- a/windows/client-management/mdm/push-notification-windows-mdm.md +++ b/windows/client-management/mdm/push-notification-windows-mdm.md @@ -11,7 +11,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/22/2017 --- diff --git a/windows/client-management/mdm/pxlogical-csp.md b/windows/client-management/mdm/pxlogical-csp.md index 5535a11feb..8a68f85050 100644 --- a/windows/client-management/mdm/pxlogical-csp.md +++ b/windows/client-management/mdm/pxlogical-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md index dd1cfc4c3a..95d4d915de 100644 --- a/windows/client-management/mdm/reboot-csp.md +++ b/windows/client-management/mdm/reboot-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/reboot-ddf-file.md b/windows/client-management/mdm/reboot-ddf-file.md index 1cf001cffb..aa6d711c71 100644 --- a/windows/client-management/mdm/reboot-ddf-file.md +++ b/windows/client-management/mdm/reboot-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/reclaim-seat-from-user.md b/windows/client-management/mdm/reclaim-seat-from-user.md index 35928407be..5f8bb0e5da 100644 --- a/windows/client-management/mdm/reclaim-seat-from-user.md +++ b/windows/client-management/mdm/reclaim-seat-from-user.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 05/05/2020 --- diff --git a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md index 28e198aa1f..f799b48992 100644 --- a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md +++ b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- @@ -23,11 +23,11 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent 1. Sign in to the Microsoft 365 admin center at using your organization's account. - ![register azuread.](images/azure-ad-add-tenant10.png) + ![screen to register azure-ad](images/azure-ad-add-tenant10.png) 2. On the **Home** page, click on the Admin tools icon. - ![register azuread.](images/azure-ad-add-tenant11.png) + ![screen for registering azure-ad](images/azure-ad-add-tenant11.png) 3. On the **Admin center** page, under Admin Centers on the left, click **Azure Active Directory**. This will take you to the Azure Active Directory portal. diff --git a/windows/client-management/mdm/registry-csp.md b/windows/client-management/mdm/registry-csp.md index d678652ec7..bcf194d65a 100644 --- a/windows/client-management/mdm/registry-csp.md +++ b/windows/client-management/mdm/registry-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/registry-ddf-file.md b/windows/client-management/mdm/registry-ddf-file.md index 6b6bc9c191..61b54cc6cb 100644 --- a/windows/client-management/mdm/registry-ddf-file.md +++ b/windows/client-management/mdm/registry-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/remotefind-csp.md b/windows/client-management/mdm/remotefind-csp.md index 0dc50af800..c559340720 100644 --- a/windows/client-management/mdm/remotefind-csp.md +++ b/windows/client-management/mdm/remotefind-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/remotefind-ddf-file.md b/windows/client-management/mdm/remotefind-ddf-file.md index 211fd88e78..e6b61e9477 100644 --- a/windows/client-management/mdm/remotefind-ddf-file.md +++ b/windows/client-management/mdm/remotefind-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/remotelock-csp.md b/windows/client-management/mdm/remotelock-csp.md index 86f5a419c8..6550982c70 100644 --- a/windows/client-management/mdm/remotelock-csp.md +++ b/windows/client-management/mdm/remotelock-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/remotelock-ddf-file.md b/windows/client-management/mdm/remotelock-ddf-file.md index d740994fc1..ade9d84d3e 100644 --- a/windows/client-management/mdm/remotelock-ddf-file.md +++ b/windows/client-management/mdm/remotelock-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/remotering-csp.md b/windows/client-management/mdm/remotering-csp.md index 8125620d66..548923b5fe 100644 --- a/windows/client-management/mdm/remotering-csp.md +++ b/windows/client-management/mdm/remotering-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/remotering-ddf-file.md b/windows/client-management/mdm/remotering-ddf-file.md index 6ce26f1758..763d8b6a90 100644 --- a/windows/client-management/mdm/remotering-ddf-file.md +++ b/windows/client-management/mdm/remotering-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/remotewipe-csp.md b/windows/client-management/mdm/remotewipe-csp.md index 67772b648f..3b2af238ea 100644 --- a/windows/client-management/mdm/remotewipe-csp.md +++ b/windows/client-management/mdm/remotewipe-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/13/2018 --- diff --git a/windows/client-management/mdm/remotewipe-ddf-file.md b/windows/client-management/mdm/remotewipe-ddf-file.md index 36a83bee33..b423d893d9 100644 --- a/windows/client-management/mdm/remotewipe-ddf-file.md +++ b/windows/client-management/mdm/remotewipe-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/13/2018 --- diff --git a/windows/client-management/mdm/reporting-csp.md b/windows/client-management/mdm/reporting-csp.md index c8bc78834a..bd1d4ec925 100644 --- a/windows/client-management/mdm/reporting-csp.md +++ b/windows/client-management/mdm/reporting-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/reporting-ddf-file.md b/windows/client-management/mdm/reporting-ddf-file.md index 5b16192077..d5d716e6bb 100644 --- a/windows/client-management/mdm/reporting-ddf-file.md +++ b/windows/client-management/mdm/reporting-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md b/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md index ad6dd045e3..db7f1cc835 100644 --- a/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md +++ b/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md @@ -11,7 +11,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/rootcacertificates-csp.md b/windows/client-management/mdm/rootcacertificates-csp.md index c1e940ef69..643e41cb54 100644 --- a/windows/client-management/mdm/rootcacertificates-csp.md +++ b/windows/client-management/mdm/rootcacertificates-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 03/06/2018 --- diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md index 166dfc0d43..78f3e0b69e 100644 --- a/windows/client-management/mdm/rootcacertificates-ddf-file.md +++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 03/07/2018 --- diff --git a/windows/client-management/mdm/secureassessment-csp.md b/windows/client-management/mdm/secureassessment-csp.md index 57f3dfc283..1911fa064d 100644 --- a/windows/client-management/mdm/secureassessment-csp.md +++ b/windows/client-management/mdm/secureassessment-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/secureassessment-ddf-file.md b/windows/client-management/mdm/secureassessment-ddf-file.md index 383470060b..76fa3dcb8b 100644 --- a/windows/client-management/mdm/secureassessment-ddf-file.md +++ b/windows/client-management/mdm/secureassessment-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/securitypolicy-csp.md b/windows/client-management/mdm/securitypolicy-csp.md index a08448947e..b92b03ae67 100644 --- a/windows/client-management/mdm/securitypolicy-csp.md +++ b/windows/client-management/mdm/securitypolicy-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/server-requirements-windows-mdm.md b/windows/client-management/mdm/server-requirements-windows-mdm.md index 032469c901..3880906b71 100644 --- a/windows/client-management/mdm/server-requirements-windows-mdm.md +++ b/windows/client-management/mdm/server-requirements-windows-mdm.md @@ -11,7 +11,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/sharedpc-csp.md b/windows/client-management/mdm/sharedpc-csp.md index 82731ed689..fb2d0fb906 100644 --- a/windows/client-management/mdm/sharedpc-csp.md +++ b/windows/client-management/mdm/sharedpc-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 01/16/2019 --- diff --git a/windows/client-management/mdm/sharedpc-ddf-file.md b/windows/client-management/mdm/sharedpc-ddf-file.md index 61e26ea7a0..362f24ac59 100644 --- a/windows/client-management/mdm/sharedpc-ddf-file.md +++ b/windows/client-management/mdm/sharedpc-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/storage-csp.md b/windows/client-management/mdm/storage-csp.md index ea5aad60ca..2bb326151e 100644 --- a/windows/client-management/mdm/storage-csp.md +++ b/windows/client-management/mdm/storage-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/storage-ddf-file.md b/windows/client-management/mdm/storage-ddf-file.md index 17340fbf2d..16d67a7431 100644 --- a/windows/client-management/mdm/storage-ddf-file.md +++ b/windows/client-management/mdm/storage-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md index 00da69a8cb..ee78eb1927 100644 --- a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md +++ b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md index d2df672d1e..32af3e680b 100644 --- a/windows/client-management/mdm/supl-csp.md +++ b/windows/client-management/mdm/supl-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/12/2019 --- diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index 1fabc85e07..dec54b3f0a 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/03/2020 --- diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index 8c596e748e..e0a043830c 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 07/28/2017 --- @@ -241,7 +241,7 @@ The data type is integer. Supported operation is Get.

    Added in Windows 10, version 1703. Node for the Skype for Business settings. **InBoxApps/SkypeForBusiness/DomainName** -

    Added in Windows 10, version 1703. Specifies the domain of the Skype for Business account when you are using Active Directory. For more information, see Set up Skype for Business Online. +

    Added in Windows 10, version 1703. Specifies the domain of the Skype for Business account when you are using Active Directory. For more information, see Set up Skype for Business Online.

    The data type is string. Supported operation is Get and Replace. diff --git a/windows/client-management/mdm/surfacehub-ddf-file.md b/windows/client-management/mdm/surfacehub-ddf-file.md index d270254f30..70ed2fa2a4 100644 --- a/windows/client-management/mdm/surfacehub-ddf-file.md +++ b/windows/client-management/mdm/surfacehub-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/tenantlockdown-csp.md b/windows/client-management/mdm/tenantlockdown-csp.md index 3c062277a0..52db501db8 100644 --- a/windows/client-management/mdm/tenantlockdown-csp.md +++ b/windows/client-management/mdm/tenantlockdown-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/13/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/tenantlockdown-ddf.md b/windows/client-management/mdm/tenantlockdown-ddf.md index b064d57b68..af4f245a6e 100644 --- a/windows/client-management/mdm/tenantlockdown-ddf.md +++ b/windows/client-management/mdm/tenantlockdown-ddf.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/13/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 7a1fa1b52f..6ac4cc4a3d 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -831,6 +831,8 @@ items: href: policy-csp-update.md - name: UserRights href: policy-csp-userrights.md + - name: VirtualizationBasedTechnology + href: policy-csp-virtualizationbasedtechnology.md - name: Wifi href: policy-csp-wifi.md - name: WindowsConnectionManager diff --git a/windows/client-management/mdm/tpmpolicy-csp.md b/windows/client-management/mdm/tpmpolicy-csp.md index 93e9c4a508..6c01205868 100644 --- a/windows/client-management/mdm/tpmpolicy-csp.md +++ b/windows/client-management/mdm/tpmpolicy-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/01/2017 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/tpmpolicy-ddf-file.md b/windows/client-management/mdm/tpmpolicy-ddf-file.md index fd463047e0..5cd81b56b7 100644 --- a/windows/client-management/mdm/tpmpolicy-ddf-file.md +++ b/windows/client-management/mdm/tpmpolicy-ddf-file.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/uefi-csp.md b/windows/client-management/mdm/uefi-csp.md index c6d416f858..8a3a6d1f58 100644 --- a/windows/client-management/mdm/uefi-csp.md +++ b/windows/client-management/mdm/uefi-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/02/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/uefi-ddf.md b/windows/client-management/mdm/uefi-ddf.md index 1432ef811a..0124a0a281 100644 --- a/windows/client-management/mdm/uefi-ddf.md +++ b/windows/client-management/mdm/uefi-ddf.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/02/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/understanding-admx-backed-policies.md b/windows/client-management/mdm/understanding-admx-backed-policies.md index a0be6b4e19..ea7fed9759 100644 --- a/windows/client-management/mdm/understanding-admx-backed-policies.md +++ b/windows/client-management/mdm/understanding-admx-backed-policies.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 03/23/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/unifiedwritefilter-csp.md b/windows/client-management/mdm/unifiedwritefilter-csp.md index 00d2b86cd5..186d8823ae 100644 --- a/windows/client-management/mdm/unifiedwritefilter-csp.md +++ b/windows/client-management/mdm/unifiedwritefilter-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/unifiedwritefilter-ddf.md b/windows/client-management/mdm/unifiedwritefilter-ddf.md index 2eb8bf1445..f91c0ba659 100644 --- a/windows/client-management/mdm/unifiedwritefilter-ddf.md +++ b/windows/client-management/mdm/unifiedwritefilter-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/update-csp.md b/windows/client-management/mdm/update-csp.md index 3ad57bf759..1d11592519 100644 --- a/windows/client-management/mdm/update-csp.md +++ b/windows/client-management/mdm/update-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 02/23/2018 --- diff --git a/windows/client-management/mdm/update-ddf-file.md b/windows/client-management/mdm/update-ddf-file.md index 44f580cb4f..fa91e9823e 100644 --- a/windows/client-management/mdm/update-ddf-file.md +++ b/windows/client-management/mdm/update-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 02/23/2018 --- diff --git a/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md b/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md index 37ff112671..dc580c2252 100644 --- a/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md +++ b/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/vpn-csp.md b/windows/client-management/mdm/vpn-csp.md index 80121f22ea..0190c77520 100644 --- a/windows/client-management/mdm/vpn-csp.md +++ b/windows/client-management/mdm/vpn-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 04/02/2017 --- diff --git a/windows/client-management/mdm/vpn-ddf-file.md b/windows/client-management/mdm/vpn-ddf-file.md index 889a2f8f25..a3c1b08789 100644 --- a/windows/client-management/mdm/vpn-ddf-file.md +++ b/windows/client-management/mdm/vpn-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md index 87588a2a0e..add96c2ec0 100644 --- a/windows/client-management/mdm/vpnv2-csp.md +++ b/windows/client-management/mdm/vpnv2-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/21/2021 --- diff --git a/windows/client-management/mdm/vpnv2-ddf-file.md b/windows/client-management/mdm/vpnv2-ddf-file.md index ea97295698..7ac4734a65 100644 --- a/windows/client-management/mdm/vpnv2-ddf-file.md +++ b/windows/client-management/mdm/vpnv2-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 10/30/2020 --- diff --git a/windows/client-management/mdm/vpnv2-profile-xsd.md b/windows/client-management/mdm/vpnv2-profile-xsd.md index ee3e5cfb4c..d318a8734b 100644 --- a/windows/client-management/mdm/vpnv2-profile-xsd.md +++ b/windows/client-management/mdm/vpnv2-profile-xsd.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 07/14/2020 --- diff --git a/windows/client-management/mdm/w4-application-csp.md b/windows/client-management/mdm/w4-application-csp.md index de649eb77b..643381e5ac 100644 --- a/windows/client-management/mdm/w4-application-csp.md +++ b/windows/client-management/mdm/w4-application-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/w7-application-csp.md b/windows/client-management/mdm/w7-application-csp.md index 7745749716..c69b5612ca 100644 --- a/windows/client-management/mdm/w7-application-csp.md +++ b/windows/client-management/mdm/w7-application-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index e6864ea72c..e3e4ad6b7e 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/18/2019 --- diff --git a/windows/client-management/mdm/wifi-ddf-file.md b/windows/client-management/mdm/wifi-ddf-file.md index 8dff039754..2b315c6b15 100644 --- a/windows/client-management/mdm/wifi-ddf-file.md +++ b/windows/client-management/mdm/wifi-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/28/2018 --- diff --git a/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md b/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md index 2e285342fd..f822a664d9 100644 --- a/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md +++ b/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 03/23/2020 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/win32appinventory-csp.md b/windows/client-management/mdm/win32appinventory-csp.md index c8c22786a1..428ed3f3cf 100644 --- a/windows/client-management/mdm/win32appinventory-csp.md +++ b/windows/client-management/mdm/win32appinventory-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/win32appinventory-ddf-file.md b/windows/client-management/mdm/win32appinventory-ddf-file.md index 1f20685d75..a70763abb9 100644 --- a/windows/client-management/mdm/win32appinventory-ddf-file.md +++ b/windows/client-management/mdm/win32appinventory-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/win32compatibilityappraiser-csp.md b/windows/client-management/mdm/win32compatibilityappraiser-csp.md index a3868db287..015e95075d 100644 --- a/windows/client-management/mdm/win32compatibilityappraiser-csp.md +++ b/windows/client-management/mdm/win32compatibilityappraiser-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 07/19/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/win32compatibilityappraiser-ddf.md b/windows/client-management/mdm/win32compatibilityappraiser-ddf.md index ce4b0b3bf3..05237311f1 100644 --- a/windows/client-management/mdm/win32compatibilityappraiser-ddf.md +++ b/windows/client-management/mdm/win32compatibilityappraiser-ddf.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 07/19/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/windows-mdm-enterprise-settings.md b/windows/client-management/mdm/windows-mdm-enterprise-settings.md index bb12be25b3..579d50e4c2 100644 --- a/windows/client-management/mdm/windows-mdm-enterprise-settings.md +++ b/windows/client-management/mdm/windows-mdm-enterprise-settings.md @@ -11,13 +11,13 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman -ms.date: 11/02/2021 +author: dansimp +ms.date: 06/26/2017 --- # Enterprise settings, policies, and app management -The actual management interaction between the device and server is done via the DM client. The DM client communicates with the enterprise management server via DM v1.2 SyncML syntax. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://www.openmobilealliance.org/release/DM/V1_2-20070209-A/OMA-TS-DM_Protocol-V1_2-20070209-A.pdf). +The actual management interaction between the device and server is done via the DM client. The DM client communicates with the enterprise management server via DM v1.2 SyncML syntax. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526). Windows currently supports one MDM server. The DM client that is configured via the enrollment process is granted access to enterprise related settings. Enterprise MDM settings are exposed via various configuration service providers to the DM client. For the list of available configuration service providers, see [Configuration service provider reference](configuration-service-provider-reference.md). diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md index bba543313e..c8bd5266d0 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 11/01/2017 --- diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md index 5877c32e22..93b378c6f0 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md index 847d9d69c8..c4c0409389 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 09/10/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/windowslicensing-csp.md b/windows/client-management/mdm/windowslicensing-csp.md index 9c3bf1705a..a44bc79b01 100644 --- a/windows/client-management/mdm/windowslicensing-csp.md +++ b/windows/client-management/mdm/windowslicensing-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 08/15/2018 --- diff --git a/windows/client-management/mdm/windowslicensing-ddf-file.md b/windows/client-management/mdm/windowslicensing-ddf-file.md index baa67a10f6..d31c057de5 100644 --- a/windows/client-management/mdm/windowslicensing-ddf-file.md +++ b/windows/client-management/mdm/windowslicensing-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 07/16/2017 --- diff --git a/windows/client-management/mdm/windowssecurityauditing-csp.md b/windows/client-management/mdm/windowssecurityauditing-csp.md index 56f387cdc1..f34aa9ceac 100644 --- a/windows/client-management/mdm/windowssecurityauditing-csp.md +++ b/windows/client-management/mdm/windowssecurityauditing-csp.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/windowssecurityauditing-ddf-file.md b/windows/client-management/mdm/windowssecurityauditing-ddf-file.md index c4710fae63..0777a525d9 100644 --- a/windows/client-management/mdm/windowssecurityauditing-ddf-file.md +++ b/windows/client-management/mdm/windowssecurityauditing-ddf-file.md @@ -8,7 +8,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/wirednetwork-csp.md b/windows/client-management/mdm/wirednetwork-csp.md index ed5591ef9b..fc6a7c7176 100644 --- a/windows/client-management/mdm/wirednetwork-csp.md +++ b/windows/client-management/mdm/wirednetwork-csp.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/27/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/wirednetwork-ddf-file.md b/windows/client-management/mdm/wirednetwork-ddf-file.md index 6ca631d6fe..bc61e8f7d0 100644 --- a/windows/client-management/mdm/wirednetwork-ddf-file.md +++ b/windows/client-management/mdm/wirednetwork-ddf-file.md @@ -5,7 +5,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/28/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/wmi-providers-supported-in-windows.md b/windows/client-management/mdm/wmi-providers-supported-in-windows.md index 4de983ce51..c968865ad0 100644 --- a/windows/client-management/mdm/wmi-providers-supported-in-windows.md +++ b/windows/client-management/mdm/wmi-providers-supported-in-windows.md @@ -11,7 +11,7 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.date: 06/26/2017 --- diff --git a/windows/client-management/troubleshoot-event-id-41-restart.md b/windows/client-management/troubleshoot-event-id-41-restart.md index 277685cfc8..c1d7a706b0 100644 --- a/windows/client-management/troubleshoot-event-id-41-restart.md +++ b/windows/client-management/troubleshoot-event-id-41-restart.md @@ -2,7 +2,7 @@ title: Advanced troubleshooting for Event ID 41 - "The system has rebooted without cleanly shutting down first" description: Describes the circumstances that cause a computer to generate Event ID 41, and provides guidance for troubleshooting the issue author: Teresa-Motiv -ms.author: v-tea +ms.author: dougeby ms.date: 12/27/2019 ms.prod: w10 ms.topic: article diff --git a/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md b/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md index fb99d5d919..a22426c30a 100644 --- a/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md +++ b/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md @@ -2,7 +2,7 @@ title: Stop error occurs when you update the in-box Broadcom network adapter driver description: Describes an issue that causes a stop error when you update an in-box Broadcom driver on Windows Server 2019, version 1809. author: Teresa-Motiv -ms.author: v-tea +ms.author: dougeby ms.date: 2/3/2020 ms.prod: w10 ms.topic: article diff --git a/windows/client-management/troubleshoot-stop-errors.md b/windows/client-management/troubleshoot-stop-errors.md index 13ad63c974..cc92de3f11 100644 --- a/windows/client-management/troubleshoot-stop-errors.md +++ b/windows/client-management/troubleshoot-stop-errors.md @@ -49,6 +49,9 @@ To troubleshoot Stop error messages, follow these general steps: 1. Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update history for your system: + - [Windows 10, version 21H2](https://support.microsoft.com/topic/windows-10-update-history-857b8ccb-71e4-49e5-b3f6-7073197d98fb) + - [Windows 10, version 21H1](https://support.microsoft.com/topic/windows-10-update-history-1b6aac92-bf01-42b5-b158-f80c6d93eb11) + - [Windows 10, version 20H2](https://support.microsoft.com/topic/windows-10-update-history-7dd3071a-3906-fa2c-c342-f7f86728a6e3) - [Windows 10, version 2004](https://support.microsoft.com/help/4555932) - [Windows 10, version 1909](https://support.microsoft.com/help/4529964) - [Windows 10, version 1903](https://support.microsoft.com/help/4498140) @@ -82,7 +85,7 @@ To troubleshoot Stop error messages, follow these general steps: > >To do this, see [How to perform a clean boot in Windows](https://support.microsoft.com/help/929135). > - >You can disable a driver by following the steps in [How to temporarily deactivate the kernel mode filter driver in Windows](https://support.microsoft.com/help/816071). + >You can disable a driver by following the steps in [How to temporarily deactivate the kernel mode filter driver in Windows](/troubleshoot/windows-server/performance/deactivate-kernel-mode-filter-driver). > >You may also want to consider the option of rolling back changes or reverting to the last-known working state. For more information, see [Roll Back a Device Driver to a Previous Version](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732648(v=ws.11)). @@ -126,9 +129,9 @@ More information on how to use Dumpchk.exe to check your dump files: ### Pagefile Settings -- [Introduction of page file in Long-Term Servicing Channel and Semi-Annual Channel of Windows](https://support.microsoft.com/help/4133658) -- [How to determine the appropriate page file size for 64-bit versions of Windows](https://support.microsoft.com/help/2860880) -- [How to generate a kernel or a complete memory dump file in Windows Server 2008 and Windows Server 2008 R2](https://support.microsoft.com/help/969028) +- [Introduction of page file in Long-Term Servicing Channel and Semi-Annual Channel of Windows](/windows/client-management/introduction-page-file) +- [How to determine the appropriate page file size for 64-bit versions of Windows](/windows/client-management/determine-appropriate-page-file-size) +- [How to generate a kernel or a complete memory dump file in Windows Server 2008 and Windows Server 2008 R2](/windows/client-management/generate-kernel-or-complete-crash-dump) ### Memory dump analysis @@ -166,13 +169,13 @@ You can use the tools such as Windows Software Development KIT (SDK) and Symbols 6. Click on **Open Crash Dump**, and then open the memory.dmp file that you copied. See the example below. - ![WinDbg img.](images/windbg.png) + :::image type="content" alt-text="WinDbg img." source="images/windbg.png" lightbox="images/windbg.png"::: 7. There should be a link that says **!analyze -v** under **Bugcheck Analysis**. Click that link. This will enter the command !analyze -v in the prompt at the bottom of the page. 8. A detailed bugcheck analysis will appear. See the example below. - ![Bugcheck analysis.](images/bugcheck-analysis.png) + :::image type="content" alt-text="Bugcheck analysis." source="images/bugcheck-analysis.png" lightbox="images/bugcheck-analysis.png"::: 9. Scroll down to the section where it says **STACK_TEXT**. There will be rows of numbers with each row followed by a colon and some text. That text should tell you what DLL is causing the crash and if applicable what service is crashing the DLL. diff --git a/windows/client-management/troubleshoot-tcpip-rpc-errors.md b/windows/client-management/troubleshoot-tcpip-rpc-errors.md index 808a919eef..6601c0c57d 100644 --- a/windows/client-management/troubleshoot-tcpip-rpc-errors.md +++ b/windows/client-management/troubleshoot-tcpip-rpc-errors.md @@ -38,7 +38,7 @@ Before getting in to troubleshooting the *RPC server unavailable- error Client A wants to execute some functions or wants to make use of a service running on the remote server, will first establish the connection with the Remote Server by doing a three-way handshake. -![Diagram illustrating connection to remote server.](images/rpc-flow.png) +:::image type="content" alt-text="Diagram illustrating connection to remote server." source="images/rpc-flow.png" lightbox="images/rpc-flow.png"::: RPC ports can be given from a specific range as well. ### Configure RPC dynamic port allocation @@ -47,7 +47,7 @@ Remote Procedure Call (RPC) dynamic port allocation is used by server applicatio Customers using firewalls may want to control which ports RPC is using so that their firewall router can be configured to forward only these Transmission Control Protocol (UDP and TCP) ports. Many RPC servers in Windows let you specify the server port in custom configuration items such as registry entries. When you can specify a dedicated server port, you know what traffic flows between the hosts across the firewall, and you can define what traffic is allowed in a more directed manner. -As a server port, please choose a port outside of the range you may want to specify below. You can find a comprehensive list of server ports that are used in Windows and major Microsoft products in the article [Service overview and network port requirements for Windows](https://support.microsoft.com/help/832017). +As a server port, please choose a port outside of the range you may want to specify below. You can find a comprehensive list of server ports that are used in Windows and major Microsoft products in the article [Service overview and network port requirements for Windows](/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements). The article also lists the RPC servers and which RPC servers can be configured to use custom server ports beyond the facilities the RPC runtime offers. Some firewalls also allow for UUID filtering where it learns from a RPC Endpoint Mapper request for a RPC interface UUID. The response has the server port number, and a subsequent RPC Bind on this port is then allowed to pass. @@ -110,13 +110,13 @@ If you would like to do a deep dive as to how it works, see [RPC over IT/Pro](ht The best thing to always troubleshoot RPC issues before even getting in to traces is by making use of tools like **PortQry**. You can quickly determine if you are able to make a connection by running the command: -```cmd +```console Portqry.exe -n -e 135 ``` This would give you a lot of output to look for, but you should be looking for *ip_tcp- and the port number in the brackets, which tells whether you were successfully able to get a dynamic port from EPM and also make a connection to it. If the above fails, you can typically start collecting simultaneous network traces. Something like this from the output of “PortQry”: -```cmd +```console Portqry.exe -n 169.254.0.2 -e 135 ``` Partial output below: @@ -141,17 +141,20 @@ The one in bold is the ephemeral port number that you made a connection to succe You can run the commands below to leverage Windows inbuilt netsh captures, to collect a simultaneous trace. Remember to execute the below on an “Admin CMD”, it requires elevation. - On the client - ```cmd + + ```console Netsh trace start scenario=netconnection capture=yes tracefile=c:\client_nettrace.etl maxsize=512 overwrite=yes report=yes ``` - On the Server - ```cmd + + ```console Netsh trace start scenario=netconnection capture=yes tracefile=c:\server_nettrace.etl maxsize=512 overwrite=yes report=yes ``` Now try to reproduce your issue from the client machine and as soon as you feel the issue has been reproduced, go ahead and stop the traces using the command -```cmd + +```console Netsh trace stop ``` @@ -163,13 +166,13 @@ Open the traces in [Microsoft Network Monitor 3.4](troubleshoot-tcpip-netmon.md) - Now check if you are getting a response from the server. If you get a response, note the dynamic port number that you have been allocated to use. - ![Screenshot of Network Monitor with dynamic port highlighted.](images/tcp-ts-23.png) + :::image type="content" alt-text="Screenshot of Network Monitor with dynamic port highlighted." source="images/tcp-ts-23.png" lightbox="images/tcp-ts-23.png"::: - Check if we are connecting successfully to this Dynamic port successfully. - The filter should be something like this: `tcp.port==` and `ipv4.address==` - ![Screenshot of Network Monitor with filter applied.](images/tcp-ts-24.png) + :::image type="content" alt-text="Screenshot of Network Monitor with filter applied." source="images/tcp-ts-24.png" lightbox="images/tcp-ts-24.png"::: This should help you verify the connectivity and isolate if any network issues are seen. @@ -178,7 +181,7 @@ This should help you verify the connectivity and isolate if any network issues a The most common reason why we would see the RPC server unavailable is when the dynamic port that the client tries to connect is not reachable. The client side trace would then show TCP SYN retransmits for the dynamic port. -![Screenshot of Network Monitor with TCP SYN retransmits.](images/tcp-ts-25.png) +:::image type="content" alt-text="Screenshot of Network Monitor with TCP SYN retransmits." source="images/tcp-ts-25.png" lightbox="images/tcp-ts-25.png"::: The port cannot be reachable due to one of the following reasons: diff --git a/windows/client-management/troubleshoot-windows-freeze.md b/windows/client-management/troubleshoot-windows-freeze.md index a255ead455..9d73bacae3 100644 --- a/windows/client-management/troubleshoot-windows-freeze.md +++ b/windows/client-management/troubleshoot-windows-freeze.md @@ -133,7 +133,7 @@ If the computer is no longer frozen and now is running in a good state, use the To allow the operating system to generate a memory dump file at an NMI interruption, set the value of the [NMICrashDump](/previous-versions/windows/it-pro/windows-server-2003/cc783271(v=ws.10)) registry entry to `1` (REG_DWORD). Then, restart the computer to apply this change. > [!NOTE] - > This is applicable only for Windows 7, Windows Server 2008 R2, and earlier versions of Windows. For Windows 8 Windows Server 2012, and later versions of Windows, the NMICrashDump registry key is no longer required, and an NMI interruption will result in [a Stop error that follows a memory dump data collection](https://support.microsoft.com/help/2750146). + > This is applicable only for Windows 7, Windows Server 2008 R2, and earlier versions of Windows. For Windows 8 Windows Server 2012, and later versions of Windows, the NMICrashDump registry key is no longer required, and an NMI interruption will result in [a Stop error that follows a memory dump data collection](/troubleshoot/windows-client/performance/nmi-hardware-failure-error). 4. When the computer exhibits the problem, hold down the right **Ctrl** key, and press the **Scroll Lock** key two times to generate a memory dump file. @@ -158,17 +158,17 @@ Learn how to use Dumpchk.exe to check your dump files: You can use Windows Performance Monitor to examine how programs that you run affect your computer's performance, both in real time and by collecting log data for later analysis. To create performance counter and event trace log collections on local and remote systems, run the following commands in a command prompt as administrator: -```cmd +```console Logman create counter LOGNAME_Long -u DOMAIN\USERNAME * -f bincirc -v mmddhhmm -max 500 -c "\\COMPUTERNAME\LogicalDisk(*)\*" "\\COMPUTERNAME\Memory\*" "\\COMPUTERNAME\Network Interface(*)\*" "\\COMPUTERNAME\Paging File(*)\*" "\\COMPUTERNAME\PhysicalDisk(*)\*" "\\COMPUTERNAME\Process(*)\*" "\\COMPUTERNAME\Redirector\*" "\\COMPUTERNAME\Server\*" "\\COMPUTERNAME\System\*" "\\COMPUTERNAME\Terminal Services\*" "\\COMPUTERNAME\Processor(*)\*" "\\COMPUTERNAME\Cache\*" -si 00:05:00 ``` -```cmd +```console Logman create counter LOGNAME_Short -u DOMAIN\USERNAME * -f bincirc -v mmddhhmm -max 500 -c "\\COMPUTERNAME\LogicalDisk(*)\*" "\\COMPUTERNAME\Memory\*" "\\COMPUTERNAME\Network Interface(*)\*" "\\COMPUTERNAME\Paging File(*)\*" "\\COMPUTERNAME\PhysicalDisk(*)\*" "\\COMPUTERNAME\Process(*)\*" "\\COMPUTERNAME\Redirector\*" "\\COMPUTERNAME\Server\*" "\\COMPUTERNAME\System\*" "\\COMPUTERNAME\Terminal Services\*" "\\COMPUTERNAME\Processor(*)\*" "\\COMPUTERNAME\Cache\*" -si 00:00:10 ``` Then, you can start or stop the log by running the following commands: -```cmd +```console logman start LOGNAME_Long / LOGNAME_Short logman stop LOGNAME_Long / LOGNAME_Short ``` @@ -283,6 +283,6 @@ The memory dump process occurs by pressing the RIGHT CTRL + SCROLL LOCK + SCROLL On Windows Server 2008, you may not have enough free disk space to generate a complete memory dump file on the system volume. There's a [hotfix](https://support.microsoft.com/help/957517) that allows for the data collection even though there isn't sufficient space on the system drive to store the memory dump file. -Additionally, on Windows Server 2008 Service Pack (SP2), there's a second option if the system drive doesn't have sufficient space. Namely, you can use the DedicatedDumpFile registry entry. To learn how to use the registry entry, see [New behavior in Windows Vista and Windows Server 2008](https://support.microsoft.com/help/969028). +Additionally, on Windows Server 2008 Service Pack (SP2), there's a second option if the system drive doesn't have sufficient space. Namely, you can use the DedicatedDumpFile registry entry. To learn how to use the registry entry, see [New behavior in Windows Vista and Windows Server 2008](/windows/client-management/generate-kernel-or-complete-crash-dump). For more information, see [How to use the DedicatedDumpFile registry value to overcome space limitations on the system drive](https://blogs.msdn.com/b/ntdebugging/archive/2010/04/02/how-to-use-the-dedicateddumpfile-registry-value-to-overcome-space-limitations-on-the-system-drive-when-capturing-a-system-memory-dump.aspx). \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-o365.md b/windows/configuration/cortana-at-work/cortana-at-work-o365.md index 2241f9d819..3a9e871905 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-o365.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-o365.md @@ -20,7 +20,7 @@ Your employees can use Cortana to help manage their day and be more productive b **See also:** -[Known issues for Windows Desktop Search and Cortana in Windows 10](https://support.microsoft.com/help/3206883/known-issues-for-windows-desktop-search-and-cortana-in-windows-10). +[Known issues for Windows Desktop Search and Cortana in Windows 10](/troubleshoot/windows-client/shell-experience/windows-desktop-search-and-cortana-issues). ### Before you begin There are a few things to be aware of before you start using Cortana in Windows 10, versions 1909 and earlier. diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md index d61c30032f..ea48de4346 100644 --- a/windows/configuration/kiosk-single-app.md +++ b/windows/configuration/kiosk-single-app.md @@ -205,7 +205,7 @@ Clear-AssignedAccess >[!IMPORTANT] ->When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](https://support.microsoft.com/help/324737/how-to-turn-on-automatic-logon-in-windows). +>When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon). When you use the **Provision kiosk devices** wizard in Windows Configuration Designer, you can configure the kiosk to run either a Universal Windows app or a Windows desktop application. diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 6b2320ac1e..1cd8c9fbff 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -353,7 +353,7 @@ Starting with Windows 10 version 1809, you can configure the display name that w On domain-joined devices, local user accounts aren't shown on the sign-in screen by default. To show the **AutoLogonAccount** on the sign-in screen, enable the following Group Policy setting: **Computer Configuration > Administrative Templates > System > Logon > Enumerate local users on domain-joined computers**. (The corresponding MDM policy setting is [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers in the Policy CSP](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-enumeratelocalusersondomainjoinedcomputers).) >[!IMPORTANT] ->When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](https://support.microsoft.com/help/324737/how-to-turn-on-automatic-logon-in-windows). +>When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon). ##### Config for individual accounts diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md index 8f3f00962f..703606edff 100644 --- a/windows/configuration/provisioning-packages/provisioning-packages.md +++ b/windows/configuration/provisioning-packages/provisioning-packages.md @@ -86,18 +86,6 @@ The following table describes settings that you can configure using the wizards | Configure kiosk common settings | Set tablet mode, configure welcome and shutdown screens, turn off timeout settings | ❌ | ✔️ | ❌ | | Developer Setup | Enable Developer Mode | ❌ | ❌ | ✔️ | - - - - - - - - - - - - - [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) - [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard) - [Instructions for the HoloLens wizard](/hololens/hololens-provisioning#wizard) @@ -138,7 +126,7 @@ WCD supports the following scenarios for IT administrators: * **Simple provisioning** – Enables IT administrators to define a desired configuration in WCD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner. -[Learn how to use simple provisioning to configure Windows computers.](provision-pcs-for-initial-deployment.md) + [Learn how to use simple provisioning to configure Windows computers.](provision-pcs-for-initial-deployment.md) * **Advanced provisioning (deployment of classic (Win32) and Universal Windows Platform (UWP) apps, and certificates)** – Allows an IT administrator to use WCD to open provisioning packages in the advanced settings editor and include apps for deployment on end-user devices. diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md index 0cb346ab02..18cc716b31 100644 --- a/windows/configuration/set-up-shared-or-guest-pc.md +++ b/windows/configuration/set-up-shared-or-guest-pc.md @@ -64,8 +64,8 @@ Shared PC mode exposes a set of customizations to tailor the behavior to your re | Setting | Value | |:---|:---| | EnableSharedPCMode | Set as **True**. If this is not set to **True**, shared PC mode is not turned on and none of the other settings apply. This setting controls this API: [IsEnabled](/uwp/api/windows.system.profile.sharedmodesettings)

    Some of the remaining settings in **SharedPC** are optional, but we strongly recommend that you also set `EnableAccountManager` to **True**. | -| AccountManagement: AccountModel | This option controls how users can sign-in on the PC. Choosing domain-joined will enable any user in the domain to sign-in. Specifying the guest option will add the **Guest** option to the sign-in screen and enable anonymous guest access to the PC.
    - **Only guest** allows anyone to use the PC as a local standard (non-admin) account.
    - **Domain-joined only** allows users to sign in with an Active Directory or Azure AD account.
    - **Domain-joined and guest** allows users to sign in with an Active Directory, Azure AD, or local standard account. | -| AccountManagement: DeletionPolicy | - **Delete immediately** will delete the account on sign-out.
    - **Delete at disk space threshold** will start deleting accounts when available disk space falls below the threshold you set for **DiskLevelDeletion**, and it will stop deleting accounts when the available disk space reaches the threshold you set for **DiskLevelCaching**. Accounts are deleted in order of oldest accessed to most recently accessed.

    Example: The caching number is 50 and the deletion number is 25. Accounts will be cached while the free disk space is above 25%. When the free disk space is less than 25% (the deletion number) at a maintenance period, accounts will be deleted (oldest last used first) until the free disk space is above 50% (the caching number). Accounts will be deleted immediately at sign off of an account if free space is under the deletion threshold and disk space is very low, regardless if the PC is actively in use or not.
    - **Delete at disk space threshold and inactive threshold** will apply the same disk space checks as noted above, but also delete accounts if they have not signed in within the number of days specified by **InactiveThreshold** | +| AccountManagement: AccountModel | This option controls how users can sign-in on the PC. Choosing domain-joined will enable any user in the domain to sign-in.

    Specifying the guest option will add the **Guest** option to the sign-in screen and enable anonymous guest access to the PC.

    - **Only guest** allows anyone to use the PC as a local standard (non-admin) account.
    - **Domain-joined only** allows users to sign in with an Active Directory or Azure AD account.
    - **Domain-joined and guest** allows users to sign in with an Active Directory, Azure AD, or local standard account. | +| AccountManagement: DeletionPolicy | - **Delete immediately** will delete the account on sign-out.

    - **Delete at disk space threshold** will start deleting accounts when available disk space falls below the threshold you set for **DiskLevelDeletion**, and it will stop deleting accounts when the available disk space reaches the threshold you set for **DiskLevelCaching**. Accounts are deleted in order of oldest accessed to most recently accessed.

    Example: The caching number is 50 and the deletion number is 25. Accounts will be cached while the free disk space is above 25%. When the free disk space is less than 25% (the deletion number) at a maintenance period, accounts will be deleted (oldest last used first) until the free disk space is above 50% (the caching number). Accounts will be deleted immediately at sign off of an account if free space is under the deletion threshold and disk space is very low, regardless if the PC is actively in use or not.
    - **Delete at disk space threshold and inactive threshold** will apply the same disk space checks as noted above, but also delete accounts if they have not signed in within the number of days specified by **InactiveThreshold** | | AccountManagement: DiskLevelCaching | If you set **DeletionPolicy** to **Delete at disk space threshold**, set the percent of total disk space to be used as the disk space threshold for account caching. | | AccountManagement: DiskLevelDeletion | If you set **DeletionPolicy** to **Delete at disk space threshold**, set the percent of total disk space to be used as the disk space threshold for account deletion. | | AccountManagement: InactiveThreshold | If you set **DeletionPolicy** to **Delete at disk space threshold and inactive threshold**, set the number of days after which an account that has not signed in will be deleted. | @@ -243,92 +243,137 @@ On a desktop computer, navigate to **Settings** > **Accounts** > **Work ac New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\$sid" -Force ``` - ## Policies set by shared PC mode + Shared PC mode sets local group policies to configure the device. Some of these are configurable using the shared pc mode options. > [!IMPORTANT] > It is not recommended to set additional policies on PCs configured for **Shared PC Mode**. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required. - +### Admin Templates > Control Panel > Personalization - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Policy name

    Value

    When set?

    Admin Templates > Control Panel > Personalization

    Prevent enabling lock screen slide show

    Enabled

    Always

    Prevent changing lock screen and logon image

    Enabled

    Always

    Admin Templates > System > Power Management > Button Settings

    Select the Power button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the Power button action (on battery)

    Sleep

    SetPowerPolicies=True

    Select the Sleep button action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (plugged in)

    Sleep

    SetPowerPolicies=True

    Select the lid switch action (on battery)

    Sleep

    SetPowerPolicies=True

    Admin Templates > System > Power Management > Sleep Settings

    Require a password when a computer wakes (plugged in)

    Enabled

    SignInOnResume=True

    Require a password when a computer wakes (on battery)

    Enabled

    SignInOnResume=True

    Specify the system sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the system sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Turn off hybrid sleep (plugged in)

    Enabled

    SetPowerPolicies=True

    Turn off hybrid sleep (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the unattended sleep timeout (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Specify the unattended sleep timeout (on battery)

    SleepTimeout

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (plugged in)

    Enabled

    SetPowerPolicies=True

    Allow standby states (S1-S3) when sleeping (on battery)

    Enabled

    SetPowerPolicies=True

    Specify the system hibernate timeout (plugged in)

    Enabled, 0

    SetPowerPolicies=True

    Specify the system hibernate timeout (on battery)

    Enabled, 0

    SetPowerPolicies=True

    Admin Templates>System>Power Management>Video and Display Settings

    Turn off the display (plugged in)

    SleepTimeout

    SetPowerPolicies=True

    Turn off the display (on battery

    SleepTimeout

    SetPowerPolicies=True

    Admin Templates>System>Power Management>Energy Saver Settings

    Energy Saver Battery Threshold (on battery)70SetPowerPolicies=True

    Admin Templates>System>Logon

    Show first sign-in animation

    Disabled

    Always

    Hide entry points for Fast User Switching

    Enabled

    Always

    Turn on convenience PIN sign-in

    Disabled

    Always

    Turn off picture password sign-in

    Enabled

    Always

    Turn off app notification on the lock screen

    Enabled

    Always

    Allow users to select when a password is required when resuming from connected standby

    Disabled

    SignInOnResume=True

    Block user from showing account details on sign-in

    Enabled

    Always

    Admin Templates>System>User Profiles

    Turn off the advertising ID

    Enabled

    SetEduPolicies=True

    Admin Templates>Windows Components

    Do not show Windows Tips

    Enabled

    SetEduPolicies=True

    Turn off Microsoft consumer experiences

    Enabled

    SetEduPolicies=True

    Microsoft Passport for Work

    Disabled

    Always

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    Admin Templates>Windows Components>Biometrics

    Allow the use of biometrics

    Disabled

    Always

    Allow users to log on using biometrics

    Disabled

    Always

    Allow domain users to log on using biometrics

    Disabled

    Always

    Admin Templates>Windows Components>Data Collection and Preview Builds

    Toggle user control over Insider builds

    Disabled

    Always

    Disable pre-release features or settings

    Disabled

    Always

    Do not show feedback notifications

    Enabled

    Always

    Allow TelemetryBasic, 0SetEduPolicies=True

    Admin Templates>Windows Components>File Explorer

    Show lock in the user tile menu

    Disabled

    Always

    Admin Templates>Windows Components>Maintenance Scheduler

    Automatic Maintenance Activation Boundary

    MaintenanceStartTime

    Always

    Automatic Maintenance Random Delay

    Enabled, 2 hours

    Always

    Automatic Maintenance WakeUp Policy

    Enabled

    Always

    Admin Templates>Windows Components>Windows Hello for Business

    Use phone sign-in

    Disabled

    Always

    Use Windows Hello for Business

    Disabled

    Always

    Use biometrics

    Disabled

    Always

    Admin Templates>Windows Components>OneDrive

    Prevent the usage of OneDrive for file storage

    Enabled

    Always

    Windows Settings>Security Settings>Local Policies>Security Options

    Interactive logon: Do not display last user name

    Enabled, Disabled when account model is only guest

    Always

    Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

    Disabled

    Always

    Shutdown: Allow system to be shut down without having to log on

    Disabled

    Always

    User Account Control: Behavior of the elevation prompt for standard users

    Auto deny

    Always



    +|Policy Name| Value|When set?| +|--- |--- |--- | +|Prevent enabling lock screen slide show|Enabled|Always| +|Prevent changing lock screen and logon image|Enabled|Always| +### Admin Templates > System > Power Management > Button Settings +|Policy Name| Value|When set?| +|--- |--- |--- | +|Select the Power button action (plugged in)|Sleep|SetPowerPolicies=True| +|Select the Power button action (on battery)|Sleep|SetPowerPolicies=True| +|Select the Sleep button action (plugged in)|Sleep|SetPowerPolicies=True| +|Select the lid switch action (plugged in)|Sleep|SetPowerPolicies=True| +|Select the lid switch action (on battery)|Sleep|SetPowerPolicies=True| +### Admin Templates > System > Power Management > Sleep Settings +|Policy Name| Value|When set?| +|--- |--- |--- | +|Require a password when a computer wakes (plugged in)|Enabled|SignInOnResume=True| +|Require a password when a computer wakes (on battery)|Enabled|SignInOnResume=True| +|Specify the system sleep timeout (plugged in)|*SleepTimeout*|SetPowerPolicies=True| +|Specify the system sleep timeout (on battery)|*SleepTimeout*|SetPowerPolicies=True| +|Turn off hybrid sleep (plugged in)|Enabled|SetPowerPolicies=True| +|Turn off hybrid sleep (on battery)|Enabled|SetPowerPolicies=True| +|Specify the unattended sleep timeout (plugged in)|*SleepTimeout*|SetPowerPolicies=True| +|Specify the unattended sleep timeout (on battery)|*SleepTimeout*|SetPowerPolicies=True| +|Allow standby states (S1-S3) when sleeping (plugged in)|Enabled|SetPowerPolicies=True| +|Allow standby states (S1-S3) when sleeping (on battery)|Enabled |SetPowerPolicies=True| +|Specify the system hibernate timeout (plugged in)|Enabled, 0|SetPowerPolicies=True| +|Specify the system hibernate timeout (on battery)|Enabled, 0|SetPowerPolicies=True| +### Admin Templates>System>Power Management>Video and Display Settings + +|Policy Name| Value|When set?| +|--- |--- |--- | +|Turn off the display (plugged in)|*SleepTimeout*|SetPowerPolicies=True| +|Turn off the display (on battery|*SleepTimeout*|SetPowerPolicies=True| + +### Admin Templates>System>Power Management>Energy Saver Settings + +|Policy Name| Value|When set?| +|--- |--- |--- | +|Energy Saver Battery Threshold (on battery)|70|SetPowerPolicies=True| + +### Admin Templates>System>Logon + +|Policy Name| Value|When set?| +|--- |--- |--- | +|Show first sign-in animation|Disabled|Always| +|Hide entry points for Fast User Switching|Enabled|Always| +|Turn on convenience PIN sign-in|Disabled|Always| +|Turn off picture password sign-in|Enabled|Always| +|Turn off app notification on the lock screen|Enabled|Always| +|Allow users to select when a password is required when resuming from connected standby|Disabled|SignInOnResume=True| +|Block user from showing account details on sign-in|Enabled|Always| + +### Admin Templates>System>User Profiles + +|Policy Name| Value|When set?| +|--- |--- |--- | +|Turn off the advertising ID|Enabled|SetEduPolicies=True| + +### Admin Templates>Windows Components + +|Policy Name| Value|When set?| +|--- |--- |--- | +|Do not show Windows Tips |Enabled|SetEduPolicies=True| +|Turn off Microsoft consumer experiences |Enabled|SetEduPolicies=True| +|Microsoft Passport for Work|Disabled|Always| +|Prevent the usage of OneDrive for file storage|Enabled|Always| + +### Admin Templates>Windows Components>Biometrics + +|Policy Name| Value|When set?| +|--- |--- |--- | +|Allow the use of biometrics|Disabled|Always| +|Allow users to log on using biometrics|Disabled|Always| +|Allow domain users to log on using biometrics|Disabled|Always| + +### Admin Templates>Windows Components>Data Collection and Preview Builds + +|Policy Name| Value|When set?| +|--- |--- |--- | +|Toggle user control over Insider builds|Disabled|Always| +|Disable pre-release features or settings|Disabled|Always| +|Do not show feedback notifications|Enabled|Always| +|Allow Telemetry|Basic, 0|SetEduPolicies=True| + +### Admin Templates>Windows Components>File Explorer + +|Policy Name| Value|When set?| +|--- |--- |--- | +|Show lock in the user tile menu|Disabled|Always| + +### Admin Templates>Windows Components>Maintenance Scheduler + +|Policy Name| Value|When set?| +|--- |--- |--- | +|Automatic Maintenance Activation Boundary|*MaintenanceStartTime*|Always| +|Automatic Maintenance Random Delay|Enabled, 2 hours|Always| +|Automatic Maintenance WakeUp Policy|Enabled|Always| + +### Admin Templates>Windows Components>Windows Hello for Business + +|Policy Name| Value|When set?| +|--- |--- |--- | +|Use phone sign-in|Disabled|Always| +|Use Windows Hello for Business|Disabled|Always| +|Use biometrics|Disabled|Always| + +### Admin Templates>Windows Components>OneDrive + +|Policy Name| Value|When set?| +|--- |--- |--- | +|Prevent the usage of OneDrive for file storage|Enabled|Always| + +### Windows Settings>Security Settings>Local Policies>Security Options + +|Policy Name| Value|When set?| +|--- |--- |--- | +|Interactive logon: Do not display last user name|Enabled, Disabled when account model is only guest|Always| +|Interactive logon: Sign-in last interactive user automatically after a system-initiated restart|Disabled |Always| +|Shutdown: Allow system to be shut down without having to log on|Disabled|Always| +|User Account Control: Behavior of the elevation prompt for standard users|Auto deny|Always| diff --git a/windows/configuration/start-layout-troubleshoot.md b/windows/configuration/start-layout-troubleshoot.md index a655857a5f..000d733a4e 100644 --- a/windows/configuration/start-layout-troubleshoot.md +++ b/windows/configuration/start-layout-troubleshoot.md @@ -43,7 +43,7 @@ When troubleshooting basic Start issues (and for the most part, all other Window - `get-AppXPackage -Name Microsoft.Windows.ShellExperienceHost` - `get-AppXPackage -Name Microsoft.Windows.Cortana` - ![Example of output from cmdlets.](images/start-ts-1.png) + :::image type="content" alt-text="Example of output from cmdlets." source="images/start-ts-1.png" lightbox="images/start-ts-1.png"::: Failure messages will appear if they aren't installed @@ -189,7 +189,7 @@ Events for both PDC and Background Tasks Infrastructure Service will be recorded ### Symptom: Application tiles like Alarm, Calculator, and Edge are missing from Start menu and the Settings app fails to open on Windows 10, version 1709 when a local user profile is deleted -![Screenshots that show download icons on app tiles and missing app tiles.](images/start-ts-2.png) +:::image type="content" alt-text="Screenshots that show download icons on app tiles and missing app tiles." source="images/start-ts-2.png" lightbox="images/start-ts-2.png"::: **Cause**: This issue is known. The first-time sign-in experience is not detected and does not trigger the install of some apps. @@ -280,7 +280,7 @@ Additionally, users may see blank tiles if sign-in was attempted without network ### Symptom: Start Menu issues with Tile Data Layer corruption -**Cause**: Windows 10, version 1507 through the release of version 1607 uses a database for the Tile image information. This is called the Tile Data Layer database. (The feature was deprecated in [Windows 10 1703](https://support.microsoft.com/help/4014193/features-that-are-removed-or-deprecated-in-windows-10-creators-update).) +**Cause**: Windows 10, version 1507 through the release of version 1607 uses a database for the Tile image information. This is called the Tile Data Layer database. (The feature was deprecated in [Windows 10 1703](/windows/deployment/planning/windows-10-removed-features).) **Resolution** There are steps you can take to fix the icons, first is to confirm that is the issue that needs to be addressed. @@ -293,9 +293,9 @@ Additionally, users may see blank tiles if sign-in was attempted without network >[!Note] >Corruption recovery removes any manual pins from Start. Apps should still be visible, but you’ll need to re-pin any secondary tiles and/or pin app tiles to the main Start view. Aps that you have installed that are completely missing from “all apps” is unexpected, however. That implies the re-registration didn’t work. -- Open a command prompt, and run the following command: +Open a command prompt, and run the following command: -``` +```console C:\Windows\System32\tdlrecover.exe -reregister -resetlayout -resetcache ``` diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md index e7d3bcc9da..ceb2627452 100644 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ b/windows/configuration/stop-employees-from-using-microsoft-store.md @@ -83,7 +83,7 @@ For more information on the rules available via AppLocker on the different suppo Applies to: Windows 10 Enterprise, Windows 10 Education > [!Note] -> Not supported on Windows 10 Pro, starting with version 1511. For more info, see [Knowledge Base article #3135657](https://support.microsoft.com/kb/3135657). +> Not supported on Windows 10 Pro, starting with version 1511. For more info, see [Knowledge Base article #3135657](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store). You can also use Group Policy to manage access to Microsoft Store. diff --git a/windows/configuration/ue-v/uev-prepare-for-deployment.md b/windows/configuration/ue-v/uev-prepare-for-deployment.md index 08853f5b22..31455009a3 100644 --- a/windows/configuration/ue-v/uev-prepare-for-deployment.md +++ b/windows/configuration/ue-v/uev-prepare-for-deployment.md @@ -22,7 +22,7 @@ Before you deploy User Experience Virtualization (UE-V), review this topic for i ## Plan your UE-V deployment -With UE-V, you can synchronize user-defined application and operating system settings across all the devices that a user works from. Use UE-V to synchronize settings for Windows applications and custom applications, such as third-party and line of business applications. +With UE-V, you can synchronize user-defined application and operating system settings across all the devices that a user works from. Use UE-V to synchronize settings for Windows applications and custom applications, such as third-party and line-of-business applications. Whether you want to synchronize settings for only default Windows applications or for both Windows and custom applications, you’ll need to first deploy the features required to use UE-V. @@ -44,7 +44,7 @@ If you want to use UE-V to synchronize user-defined settings for custom applicat The workflow diagram below illustrates a typical UE-V deployment and the decisions you need to be prepared to make. -![UE-V deployment preparation.](images/uev-deployment-preparation.png) +:::image type="content" alt-text="UE-V deployment preparation." source="images/uev-deployment-preparation.png"::: @@ -311,7 +315,7 @@ The UE-V settings storage location and settings template catalog support storing - [Information about roaming profiles from the Directory Services team](https://blogs.technet.microsoft.com/askds/tag/roaming-profiles/) - - [Information about Microsoft support policy for a DFS-R and DFS-N deployment scenario](https://support.microsoft.com/kb/2533009) + - [Information about Microsoft support policy for a DFS-R and DFS-N deployment scenario](/troubleshoot/windows-server/networking/support-policy-for-dfsr-dfsn-deployment) In addition, because SYSVOL uses DFSR for replication, SYSVOL cannot be used for UE-V data file replication. @@ -329,16 +333,16 @@ Computers that run the UE-V service must use a time server to maintain a consist Before you proceed, ensure that your environment meets these requirements for using UE-V. -| **Operating system** | **Edition** | **Service pack** | **System architecture** | **Windows PowerShell** | **Microsoft .NET Framework** | +| Operating system | Edition | Service pack | System architecture | Windows PowerShell | Microsoft .NET Framework | |--------------------------|---------------|------------------|-------------------------|--------------------------|--------------------------------| | Windows 10, version 1607 | Windows 10 for Enterprise | NA | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 or higher | | Windows 8 and Windows 8.1 | Enterprise or Pro | None | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 or higher | | Windows Server 2012 and Windows Server 2012 R2 | Standard or Datacenter | None | 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 or higher | -**Note** -- Windows Server 2012 operating systems come with .NET Framework 4.5 installed. The Windows 10 operating system comes with .NET Framework 4.6 installed. - -- The “Delete Roaming Cache” policy for mandatory profiles is not supported with UE-V and should not be used. +> [!NOTE] +> - Windows Server 2012 operating systems come with .NET Framework 4.5 installed. The Windows 10 operating system comes with .NET Framework 4.6 installed. +> +> - The “Delete Roaming Cache” policy for mandatory profiles is not supported with UE-V and should not be used. There are no special random access memory (RAM) requirements specific to UE-V. @@ -368,19 +372,19 @@ Enable this configuration using one of these methods: Restart the device to allow the settings to synchronize. -- >**Note** - These methods do not work for pooled virtual desktop infrastructure (VDI) environments. +> [!NOTE] +> These methods do not work for pooled virtual desktop infrastructure (VDI) environments. ->**Note** -If you set *SyncMethod = None*, any settings changes are saved directly to the server. If the network connection to the settings storage path is not found, then the settings changes are cached on the device and are synchronized the next time that the sync provider runs. If the settings storage path is not found and the user profile is removed from a pooled VDI environment on log off, settings changes are lost and the user must reapply the change when the computer is reconnected to the settings storage path. +> [!NOTE] +> If you set *SyncMethod = None*, any settings changes are saved directly to the server. If the network connection to the settings storage path is not found, then the settings changes are cached on the device and are synchronized the next time that the sync provider runs. If the settings storage path is not found and the user profile is removed from a pooled VDI environment on log off, settings changes are lost and the user must reapply the change when the computer is reconnected to the settings storage path. **Synchronization for external sync engines** The *SyncMethod=External* parameter specifies that if UE-V settings are written to a local folder on the user device, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different devices that users access. **Support for shared VDI sessions** UE-V supports VDI sessions that are shared among end users. You can register and configure a special VDI template, which ensures that UE-V keeps all of its functionality intact for non-persistent VDI sessions. ->**Note** -If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as [back-up/restore and last known good (LKG)](uev-manage-administrative-backup-and-restore.md). +> [!NOTE] +> If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as [back-up/restore and last known good (LKG)](uev-manage-administrative-backup-and-restore.md). The VDI template is provided with UE-V and is typically available here after installation: C:\ProgramData\Microsoft\UEV\InboxTemplates diff --git a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md index 6135a8daf8..b225fd6214 100644 --- a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md +++ b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md @@ -105,8 +105,7 @@ You can use the **Fix Description** tab of the Query tool to add parameters that The query runs and the results of the query are displayed in the lower pane. -## Querying by Using the Fix Description Tab - +## Querying by Using the Advanced Tab You can use the **Fix Description** tab of the Query tool to add additional SQL Server SELECT and WHERE clauses to your search criteria. diff --git a/windows/deployment/planning/windows-10-removed-features.md b/windows/deployment/planning/windows-10-removed-features.md index 3bd41f1ff6..79092a21ec 100644 --- a/windows/deployment/planning/windows-10-removed-features.md +++ b/windows/deployment/planning/windows-10-removed-features.md @@ -61,7 +61,7 @@ The following features and functionalities have been removed from the installed |Reader app | Functionality to be integrated into Microsoft Edge. | 1709 | |Reading List | Functionality to be integrated into Microsoft Edge. | 1709 | |Screen saver functionality in Themes | This functionality is disabled in Themes, and classified as **Removed** in this table. Screen saver functionality in Group Policies, Control Panel, and Sysprep continues to be functional. Lock screen features and policies are preferred. | 1709 | -|Syskey.exe | Removing this nonsecure security feature. We recommend that users use BitLocker instead. For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window). | 1709 | +|Syskey.exe | Removing this nonsecure security feature. We recommend that users use BitLocker instead. For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](/troubleshoot/windows-server/identity/syskey-exe-utility-is-no-longer-supported). | 1709 | |TCP Offload Engine | Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193)| 1709 | |Tile Data Layer |To be replaced by the Tile Store.| 1709 | |Resilient File System (ReFS) (added: August 17, 2017)| Creation ability will be available in the following editions only: Windows 10 Enterprise and Windows 10 Pro for Workstations. Creation ability will be removed from all other editions. All other editions will have Read and Write ability. | 1709 | diff --git a/windows/deployment/update/quality-updates.md b/windows/deployment/update/quality-updates.md index 2f90ee99e0..2bd74d5b87 100644 --- a/windows/deployment/update/quality-updates.md +++ b/windows/deployment/update/quality-updates.md @@ -61,7 +61,7 @@ Some key considerations about OOB releases include: ## More information -For additional details about the different types of Windows updates like critical, security, drivers, service packs, and more, please see the [Description of the standard terminology used to describe Microsoft software updates](https://support.microsoft.com/help/824684) and [Introducing a new deployment service for driver and firmware updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/introducing-a-new-deployment-service-for-driver-and-firmware/ba-p/2176942). +For additional details about the different types of Windows updates like critical, security, drivers, service packs, and more, please see the [Description of the standard terminology used to describe Microsoft software updates](/troubleshoot/windows-client/deployment/standard-terminology-software-updates) and [Introducing a new deployment service for driver and firmware updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/introducing-a-new-deployment-service-for-driver-and-firmware/ba-p/2176942). ## Related topics diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index f454a8215c..9ebb4c84ec 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -118,7 +118,7 @@ Delivery Optimization also communicates with its cloud service by using HTTP/HTT #### What are the requirements if I use a proxy? -For Delivery Optimization to successfully use the proxy, you should set up the proxy by using Windows proxy settings or Internet Explorer proxy settings. For details see [Using a proxy with Delivery Optimization](./delivery-optimization-proxy.md). Most content downloaded with Delivery Optimization uses byte range requests. Make sure your proxy allows byte range requests. For more information, see [Proxy requirements for Windows Update](https://support.microsoft.com/help/3175743/proxy-requirements-for-windows-update). +For Delivery Optimization to successfully use the proxy, you should set up the proxy by using Windows proxy settings or Internet Explorer proxy settings. For details see [Using a proxy with Delivery Optimization](./delivery-optimization-proxy.md). Most content downloaded with Delivery Optimization uses byte range requests. Make sure your proxy allows byte range requests. For more information, see [Proxy requirements for Windows Update](/windows/deployment/update/windows-update-troubleshooting). #### What hostnames should I allow through my firewall to support Delivery Optimization? diff --git a/windows/deployment/update/waas-overview.md b/windows/deployment/update/waas-overview.md index a7c678949a..fb16b23675 100644 --- a/windows/deployment/update/waas-overview.md +++ b/windows/deployment/update/waas-overview.md @@ -113,7 +113,7 @@ Specialized systems—such as devices that control medical equipment, point-of-s Microsoft never publishes feature updates through Windows Update on devices that run Windows 10 Enterprise LTSC. Instead, it typically offers new LTSC releases every 2–3 years, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle. > [!NOTE] -> LTSC releases will support the currently released processors and chipsets at the time of release of the LTSC. As future CPU generations are released, support will be created through future LTSC releases that customers can deploy for those systems. For more information, see **Supporting the latest processor and chipsets on Windows** in [Lifecycle support policy FAQ - Windows Products](https://support.microsoft.com/help/18581/lifecycle-support-policy-faq-windows-products). +> LTSC releases will support the currently released processors and chipsets at the time of release of the LTSC. As future CPU generations are released, support will be created through future LTSC releases that customers can deploy for those systems. For more information, see **Supporting the latest processor and chipsets on Windows** in [Lifecycle support policy FAQ - Windows Products](/lifecycle/faq/windows). The Long-term Servicing Channel is available only in the Windows 10 Enterprise LTSC editions. This edition of Windows doesn’t include a number of applications, such as Microsoft Edge, Microsoft Store, Cortana (though limited search capabilities remain available), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. These apps are not supported in the Enterprise LTSC editions, even if you install by using sideloading. diff --git a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md index 3fda1c0024..3f7a279aaa 100644 --- a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md +++ b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md @@ -28,7 +28,7 @@ Here’s an example of what this process might look like: - **Configure test devices.** Configure test devices in the Windows Insider Program so that Insiders can test feature updates before they’re available to the General Availability Channel. Typically, this population would be a few test devices that IT staff members use to evaluate pre-release builds of Windows. Microsoft provides current development builds to Windows Insider members approximately every week so that interested users can see the functionality Microsoft is adding. See the section Windows Insider for details on how to enroll in the Windows Insider Program for Business. - **Identify excluded devices.** For some organizations, special-purpose devices such as those used to control factory or medical equipment or run ATMs require a stricter, less frequent feature update cycle than the General Availability Channel can offer. For those devices, install the Enterprise LTSC edition to avoid feature updates for up to 10 years. Identify these devices, and separate them from the phased deployment and servicing cycles to help remove confusion for your administrators and ensure that devices are handled correctly. - **Recruit volunteers.** The purpose of testing a deployment is to receive feedback. One effective way to recruit pilot users is to request volunteers. When doing so, clearly state that you’re looking for feedback rather than people to just “try it out” and that there could be occasional issues involved with accepting feature updates right away. With Windows as a service, the expectation is that there should be few issues, but if an issue does arise, you want testers to let you know as soon as possible. When considering whom to recruit for pilot groups, be sure to include members who provide the broadest set of applications and devices to validate the largest number of apps and devices possible. -- **Update Group Policy.** Each feature update includes new group policies to manage new features. If you use Group Policy to manage devices, the Group Policy Admin for the Active Directory domain will need to download an .admx package and copy it to their [Central Store](https://support.microsoft.com/help/929841/how-to-create-the-central-store-for-group-policy-administrative-templa) (or to the [PolicyDefinitions](/previous-versions/dotnet/articles/bb530196(v=msdn.10)) directory in the SYSVOL folder of a domain controller if not using a Central Store). You can manage new group policies from the latest release of Windows by using Remote Server Administration Tools. The ADMX download package is created at the end of each development cycle and then posted for download. To find the ADMX download package for a given Windows build, search for “ADMX download for Windows build xxxx”. For details about Group Policy management, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) +- **Update Group Policy.** Each feature update includes new group policies to manage new features. If you use Group Policy to manage devices, the Group Policy Admin for the Active Directory domain will need to download an .admx package and copy it to their [Central Store](/troubleshoot/windows-server/group-policy/create-central-store-domain-controller) (or to the [PolicyDefinitions](/previous-versions/dotnet/articles/bb530196(v=msdn.10)) directory in the SYSVOL folder of a domain controller if not using a Central Store). You can manage new group policies from the latest release of Windows by using Remote Server Administration Tools. The ADMX download package is created at the end of each development cycle and then posted for download. To find the ADMX download package for a given Windows build, search for “ADMX download for Windows build xxxx”. For details about Group Policy management, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) - **Choose a servicing tool.** Decide which product you’ll use to manage the Windows updates in your environment. If you’re currently using Windows Server Update Services (WSUS) or Microsoft Endpoint Manager to manage your Windows updates, you can continue using those products to manage Windows 10 or Windows 11 updates. Alternatively, you can use Windows Update for Business. In addition to which product you’ll use, consider how you’ll deliver the updates. Multiple peer-to-peer options are available to make update distribution faster. For a comparison of tools, see [Servicing tools](waas-overview.md#servicing-tools). - **Prioritize applications.** First, create an application portfolio. This list should include everything installed in your organization and any webpages your organization hosts. Next, prioritize this list to identify those apps that are the most business critical. Because the expectation is that application compatibility with new versions of Windows will be high, only the most business-critical applications should be tested before the pilot phase; everything else can be tested afterwards. For more information about identifying compatibility issues withe applications, see [Manage Windows upgrades with Upgrade Analytics](/mem/configmgr/desktop-analytics/overview). diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index a84632b0f8..8590d0c0cc 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -33,7 +33,7 @@ To manage updates with Windows Update for Business as described in this article, - Create Active Directory security groups that align with the deployment rings you use to phase deployment of updates. - Allow access to the Windows Update service. -- Download and install ADMX templates appropriate to your Windows 10 version. For more information, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759) and [Step-By-Step: Managing Windows 10 with Administrative templates](/archive/blogs/canitpro/step-by-step-managing-windows-10-with-administrative-templates). +- Download and install ADMX templates appropriate to your Windows 10 version. For more information, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) and [Step-By-Step: Managing Windows 10 with Administrative templates](/archive/blogs/canitpro/step-by-step-managing-windows-10-with-administrative-templates). ## Set up Windows Update for Business @@ -44,10 +44,15 @@ Follow these steps on a device running the Remote Server Administration Tools or ### Set up a ring 1. Start Group Policy Management Console (gpmc.msc). -2. Expand **Forest > Domains > *\**. + +2. Expand **Forest > Domains > *\*. + 3. Right-click *\* and select **Create a GPO in this domain and link it here**. -4. In the **New GPO** dialog box, enter *Windows Update for Business - Group 1* as the name of the new Group Policy Object. + +4. In the **New GPO** dialog box, enter **Windows Update for Business - Group 1** as the name of the new Group Policy Object. + 5. Right-click the **"Windows Update for Business - Group 1"** object, and then select **Edit**. + 6. In the Group Policy Management Editor, go to **Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update**. You are now ready to start assigning policies to this ring (group) of devices. @@ -70,8 +75,11 @@ Drivers are automatically enabled because they are beneficial to device systems. #### I want to receive pre-release versions of the next feature update 1. Ensure that you are enrolled in the Windows Insider Program for Business. This is a completely free program available to commercial customers to aid them in their validation of feature updates before they are released. Joining the program enables you to receive updates prior to their release as well as receive emails and content related to what is coming in the next updates. + 2. Use Group Policy Management Console to go to: **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Manage preview builds** and set the policy to **Enable preview builds** for any of test devices you want to install pre-release builds. + 3. Use Group Policy Management Console to go to **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and feature updates are received**. In the **Options** pane, use the pulldown menu to select one of the preview builds. We recomment **Windows Insider Program Slow** for commercial customers using pre-release builds for validation. + 4. Select **OK**. #### I want to manage which released feature update my devices receive @@ -85,19 +93,19 @@ A Windows Update for Business administrator can defer or pause updates. You can In this example, there are three rings for quality updates. The first ring ("pilot") has a deferral period of 0 days. The second ring ("fast") has a deferral of five days. The third ring ("slow") has a deferral of ten days. -![illustration of devices divided into three rings.](images/waas-wufb-3-rings.png) +:::image type="content" alt-text="illustration of devices divided into three rings." source="images/waas-wufb-3-rings.png" lightbox="images/waas-wufb-3-rings.png"::: When the quality update is released, it is offered to devices in the pilot ring the next time they scan for updates. ##### Five days later The devices in the fast ring are offered the quality update the next time they scan for updates. -![illustration of devices with fast ring deployed.](images/waas-wufb-fast-ring.png) +:::image type="content" alt-text="illustration of devices with fast ring deployed." source="images/waas-wufb-fast-ring.png" lightbox="images/waas-wufb-fast-ring.png"::: ##### Ten days later Ten days after the quality update is released, it is offered to the devices in the slow ring the next time they scan for updates. -![illustration of devices with slow ring deployed.](images/waas-wufb-slow-ring.png) +:::image type="content" alt-text="illustration of devices with slow ring deployed." source="images/waas-wufb-slow-ring.png" lightbox="images/waas-wufb-slow-ring.png"::: If no problems occur, all of the devices that scan for updates will be offered the quality update within ten days of its release, in three waves. @@ -105,11 +113,11 @@ If no problems occur, all of the devices that scan for updates will be offered t In this example, some problem is discovered during the deployment of the update to the "pilot" ring. -![illustration of devices divided with pilot ring experiencing a problem.](images/waas-wufb-pilot-problem.png) +:::image type="content" alt-text="illustration of devices divided with pilot ring experiencing a problem." source="images/waas-wufb-pilot-problem.png" lightbox="images/waas-wufb-pilot-problem.png"::: At this point, the IT administrator can set a policy to pause the update. In this example, the admin selects the **Pause quality updates** check box. -![illustration of rings with pause quality update check box selected.](images/waas-wufb-pause.png) +:::image type="content" alt-text="illustration of rings with pause quality update check box selected." source="images/waas-wufb-pause.png" lightbox="images/waas-wufb-pause.png"::: Now all devices are paused from updating for 35 days. When the pause is removed, they will be offered the *next* quality update, which ideally will not have the same issue. If there is still an issue, the IT admin can pause updates again. diff --git a/windows/deployment/update/windows-as-a-service.md b/windows/deployment/update/windows-as-a-service.md index 2e41bda86e..a034dba7a3 100644 --- a/windows/deployment/update/windows-as-a-service.md +++ b/windows/deployment/update/windows-as-a-service.md @@ -1,5 +1,5 @@ --- -title: Windows as a service +title: Windows as a service ms.prod: w10 ms.topic: landing-page ms.manager: laurawi @@ -26,21 +26,20 @@ Find the latest and greatest news on Windows 10 deployment and servicing. **Discovering the Windows 10 Update history pages** > [!VIDEO https://www.youtube-nocookie.com/embed/mTnAb9XjMPY] -Everyone wins when transparency is a top priority. We want you to know when updates are available, as well as alert you to any potential issues you may encounter during or after you install an update. Bookmark the Windows release health dashboard for near real-time information on known issues, workarounds, and resolutions--as well as the current status of the latest feature update rollout. +Everyone wins when transparency is a top priority. We want you to know when updates are available, as well as alert you to any potential issues you may encounter during or after you install an update. Bookmark the [Windows release health dashboard](/windows/release-health/) for near real-time information on known issues, workarounds, and resolutions--as well as the current status of the latest feature update rollout. The latest news: -

    + +- [How to get Extended Security Updates for eligible Windows devices](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/How-to-get-Extended-Security-Updates-for-eligible-Windows/ba-p/917807) - October 17, 2019 +- [End of service reminders for Windows 10, versions 1703 and 1803](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/End-of-service-reminders-for-Windows-10-versions-1703-and-1803/ba-p/903715) - October 9, 2019 +- [Using machine learning to improve the Windows 10 update experience](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Using-machine-learning-to-improve-the-Windows-10-update/ba-p/877860) - September 26, 2019 +- [Publishing pre-release Windows 10 feature updates to WSUS](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Publishing-pre-release-Windows-10-feature-updates-to-WSUS/ba-p/845054) - September 24, 2019 +- [New extended support dates for MDOP tools](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/New-extended-support-dates-for-MDOP-tools/ba-p/837312) - September 4, 2019 +- [FastTrack for Windows 10 deployment and other migration resources](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/FastTrack-for-Windows-10-deployment-and-other-migration/ba-p/800406) - August 12, 2019 +- [Tactical considerations for creating Windows deployment rings](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Tactical-considerations-for-creating-Windows-deployment-rings/ba-p/746979) - July 10, 2019 +- [Upgrading Windows 10 devices with installation media different than the original OS install language](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Upgrading-Windows-10-devices-with-installation-media-different/ba-p/746126) - July 9, 2019 +- [Moving to the next Windows 10 feature update for commercial customers](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Moving-to-the-next-Windows-10-feature-update-for-commercial/ba-p/732968) - July 1, 2019 + [See more news](waas-morenews.md). You can also check out the [Windows 10 blog](https://techcommunity.microsoft.com/t5/Windows-10-Blog/bg-p/Windows10Blog). @@ -49,20 +48,19 @@ Written by IT pros for IT pros, sharing real world examples and scenarios for Wi Champs -**NEW** Tactical considerations for creating Windows deployment rings +[**NEW** Tactical considerations for creating Windows deployment rings](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Tactical-considerations-for-creating-Windows-deployment-rings/ba-p/746979) -**NEW** Windows 10 Enterprise vs. Windows 10 Pro: Modern management considerations for your organization +[**NEW** Windows 10 Enterprise vs. Windows 10 Pro: Modern management considerations for your organization](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-Enterprise-vs-Windows-10-Pro-Modern-management/ba-p/720445) -Deployment rings: The hidden [strategic] gem of Windows as a service +[Deployment rings: The hidden [strategic] gem of Windows as a service](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Deployment-rings-The-hidden-strategic-gem-of-Windows-as-a/ba-p/659622) -Classifying Windows updates in common deployment tools +[Classifying Windows updates in common deployment tools](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Classifying-Windows-updates-in-common-deployment-tools/ba-p/331175) -Express updates for Windows Server 2016 re-enabled for November 2018 update - +[Express updates for Windows Server 2016 re-enabled for November 2018 update](/windows-server/get-started/express-updates) -2019 SHA-2 Code Signing Support requirement for Windows and WSUS +[2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/) -Deploying Windows 10 Feature Updates to 24/7 Mission Critical Devices +[What is Windows Update for Business?](waas-manage-updates-wufb.md) ## Discover @@ -70,14 +68,14 @@ Learn more about Windows as a service and its value to your organization. Discover -Overview of Windows as a service +[Overview of Windows as a service](waas-overview.md) -Quick guide to Windows as a service +[Quick guide to Windows as a service](waas-quick-start.md) -What's new in Windows 10 deployment +[What's new in Windows 10 deployment](../deploy-whats-new.md) -How Microsoft IT deploys Windows 10 +[How Microsoft IT deploys Windows 10](https://channel9.msdn.com/events/Ignite/2015/BRK3303) ## Plan @@ -85,15 +83,15 @@ Prepare to implement Windows as a service effectively using the right tools, pro Plan -Simplified updates +[Simplified updates](https://www.microsoft.com/windowsforbusiness/simplified-updates) -Windows 10 end user readiness +[Windows 10 end user readiness](https://www.microsoft.com/itpro/windows-10/end-user-readiness) -Ready for Windows +[Ready for Windows](https://developer.microsoft.com/windows/ready-for-windows#/) -Manage Windows upgrades with Upgrade Readiness +[Manage Windows upgrades with Upgrade Readiness](/mem/configmgr/desktop-analytics/overview) -Preparing your organization for a seamless Windows 10 deployment +[Preparing your organization for a seamless Windows 10 deployment](https://www.microsoft.com/itshowcase/windows10deployment) ## Deploy @@ -101,18 +99,18 @@ Secure your organization's deployment investment. Deploy -Update Windows 10 in the enterprise +[Update Windows 10 in the enterprise](index.md) -Deploying as an in-place upgrade +[Deploying as an in-place upgrade](https://www.microsoft.com/itshowcase/Article/Content/668/Deploying-Windows-10-at-Microsoft-as-an-inplace-upgrade) -Configure Windows Update for Business +[Configure Windows Update for Business](waas-configure-wufb.md) -Express update delivery +[Express update delivery](waas-optimize-windows-10-updates.md#express-update-delivery) -Windows 10 deployment considerations +[Windows 10 deployment considerations](../planning/windows-10-deployment-considerations.md) ## Microsoft Ignite 2018 Ignite -Looking to learn more? These informative session replays from Microsoft Ignite 2018 (complete with downloadable slide decks) can provide some great insights on Windows as a service. See [MyIgnite - Session catalog](https://myignite.techcommunity.microsoft.com/sessions). \ No newline at end of file +Looking to learn more? These informative session replays from Microsoft Ignite 2018 (complete with downloadable slide decks) can provide some great insights on Windows as a service. See [MyIgnite - Session catalog](https://myignite.techcommunity.microsoft.com/sessions). diff --git a/windows/deployment/update/windows-update-errors.md b/windows/deployment/update/windows-update-errors.md index 2ae8ed4834..fdb75805e5 100644 --- a/windows/deployment/update/windows-update-errors.md +++ b/windows/deployment/update/windows-update-errors.md @@ -99,7 +99,7 @@ The following table provides information about common errors you might run into | Message | Description | Mitigation | |---------|-------------|------------| -| WU_E_SETUP_SKIP_UPDATE | An update to the Windows Update Agent was skipped due to a directive in the Wuident.cab file. | You might encounter this error when WSUS is not sending the self-update to the clients.

    Review [KB920659](https://support.microsoft.com/help/920659/the-microsoft-windows-server-update-services-wsus-selfupdate-service-d) for instructions to resolve the issue. | +| WU_E_SETUP_SKIP_UPDATE | An update to the Windows Update Agent was skipped due to a directive in the Wuident.cab file. | You might encounter this error when WSUS is not sending the self-update to the clients.

    Review [KB920659](/troubleshoot/windows-server/deployment/wsus-selfupdate-not-send-automatic-updates) for instructions to resolve the issue. | ## 0x80244007 diff --git a/windows/deployment/update/windows-update-resources.md b/windows/deployment/update/windows-update-resources.md index 37a8ea37ae..fedd94b39a 100644 --- a/windows/deployment/update/windows-update-resources.md +++ b/windows/deployment/update/windows-update-resources.md @@ -30,13 +30,13 @@ The following resources provide additional information about using Windows Updat ## WSUS Troubleshooting -[Troubleshooting issues with WSUS client agents](https://support.microsoft.com/help/10132/) +[Troubleshooting issues with WSUS client agents](/troubleshoot/mem/configmgr/troubleshoot-issues-with-wsus-client-agents) -[How to troubleshoot WSUS](https://support.microsoft.com/help/4025764/) +[How to troubleshoot WSUS](/troubleshoot/mem/configmgr/troubleshoot-wsus-connection-failures) -[Error 80244007 when WSUS client scans for updates](https://support.microsoft.com/help/4096317/) +[Error 80244007 when WSUS client scans for updates](/troubleshoot/mem/configmgr/error-80244007-when-wsus-client-scans-updates) -[Updates may not be installed with Fast Startup in Windows 10](https://support.microsoft.com/help/4011287/) +[Updates may not be installed with Fast Startup in Windows 10](/troubleshoot/windows-client/deployment/updates-not-install-with-fast-startup) ## How do I reset Windows Update components? diff --git a/windows/deployment/update/windows-update-troubleshooting.md b/windows/deployment/update/windows-update-troubleshooting.md index 6b5410c4f1..50b478c5c9 100644 --- a/windows/deployment/update/windows-update-troubleshooting.md +++ b/windows/deployment/update/windows-update-troubleshooting.md @@ -154,7 +154,7 @@ Go to Services.msc and ensure that Windows Firewall Service is enabled. Stopping ## Issues arising from configuration of conflicting policies Windows Update provides a wide range configuration policy to control the behavior of the Windows Update service in a managed environment. While these policies let you configure the settings at a granular level, misconfiguration or setting conflicting policies may lead to unexpected behaviors. -For more information, see [How to configure automatic updates by using Group Policy or registry settings](https://support.microsoft.com/help/328010/how-to-configure-automatic-updates-by-using-group-policy-or-registry-s) for more information. +For more information, see [How to configure automatic updates by using Group Policy or registry settings](/windows/deployment/update/waas-wu-settings) for more information. ## Device cannot access update files diff --git a/windows/deployment/upgrade/log-files.md b/windows/deployment/upgrade/log-files.md index 3d678e1787..cedd5aed0e 100644 --- a/windows/deployment/upgrade/log-files.md +++ b/windows/deployment/upgrade/log-files.md @@ -253,4 +253,4 @@ This analysis indicates that the Windows upgrade error can be resolved by deleti
    [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
    [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
    [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
    [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) \ No newline at end of file +
    [Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors) \ No newline at end of file diff --git a/windows/deployment/upgrade/quick-fixes.md b/windows/deployment/upgrade/quick-fixes.md index ed61e6c2c4..b82bc221dc 100644 --- a/windows/deployment/upgrade/quick-fixes.md +++ b/windows/deployment/upgrade/quick-fixes.md @@ -34,20 +34,25 @@ The Microsoft Virtual Agent provided by [Microsoft Support](https://support.micr ## List of fixes -
      -
    1. Remove nonessential external hardware, such as docks and USB devices. More information.
      2. -
    2. Check the system drive for errors and attempt repairs. More information.
      3. -
    3. Run the Windows Update troubleshooter. More information.
      4. -
    4. Attempt to restore and repair system files. More information.
      5. -
    5. Update Windows so that all available recommended updates are installed, and ensure the computer is rebooted if this is necessary to complete installation of an update. More information.
      6. -
    6. Temporarily uninstall non-Microsoft antivirus software. - More information.
      7. +1. Remove nonessential external hardware, such as docks and USB devices. [More information](#remove-external-hardware). -
    7. Uninstall all nonessential software. More information.
      8. -
    8. Update firmware and drivers. More information
      9. -
    9. Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. More information.
      10. -
    10. Verify at least 16 GB of free space is available to upgrade a 32-bit OS, or 20 GB for a 64-bit OS. More information.
      11. -
    +2. Check the system drive for errors and attempt repairs. [More information](#repair-the-system-drive). + +3. Run the Windows Update troubleshooter. [More information](#windows-update-troubleshooter). + +4. Attempt to restore and repair system files. [More information](#repair-system-files). + +5. Update Windows so that all available recommended updates are installed, and ensure the computer is rebooted if this is necessary to complete installation of an update. [More information](#update-windows). + +6. Temporarily uninstall non-Microsoft antivirus software. [More information](#uninstall-non-microsoft-antivirus-software). + +7. Uninstall all nonessential software. [More information](#uninstall-non-essential-software). + +8. Update firmware and drivers. [More information](#update-firmware-and-drivers). + +9. Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. [More information](#ensure-that-download-and-install-updates-is-selected). + +10. Verify at least 16 GB of free space is available to upgrade a 32-bit OS, or 20 GB for a 64-bit OS. [More information](#verify-disk-space). ## Step by step instructions @@ -81,14 +86,20 @@ The system drive is the drive that contains the [system partition](/windows-hard To check and repair errors on the system drive: 1. Click **Start**. -2. Type **command**. -3. Right-click **Command Prompt** and then left-click **Run as administrator**. -4. If you are prompted by UAC, click **Yes**. -5. Type **chkdsk /F** and press ENTER. -6. When you are prompted to schedule a check the next time the system restarts, type **Y**. -7. See the following example - ``` +2. Type **command**. + +3. Right-click **Command Prompt** and then left-click **Run as administrator**. + +4. If you are prompted by UAC, click **Yes**. + +5. Type **chkdsk /F** and press ENTER. + +6. When you are prompted to schedule a check the next time the system restarts, type **Y**. + +7. See the following example. + + ```console C:\WINDOWS\system32>chkdsk /F The type of the file system is NTFS. Cannot lock current drive. @@ -123,12 +134,16 @@ This fix is also described in detail at [answers.microsoft.com](https://answers. To check and repair system files: 1. Click **Start**. + 2. Type **command**. + 3. Right-click **Command Prompt** and then left-click **Run as administrator**. + 4. If you are prompted by UAC, click **Yes**. + 5. Type **sfc /scannow** and press ENTER. See the following example: - ``` + ```console C:\>sfc /scannow Beginning system scan. This process will take some time. @@ -140,7 +155,7 @@ To check and repair system files: ``` 6. If you are running Windows 8.1 or later, type **DISM.exe /Online /Cleanup-image /Restorehealth** and press ENTER (the DISM command options are not available for Windows 7). See the following example: - ``` + ```console C:\>DISM.exe /Online /Cleanup-image /Restorehealth Deployment Image Servicing and Management tool @@ -215,7 +230,7 @@ In the previous example, there is 703 GB of available free space on the system d To free up additional space on the system drive, begin by running Disk Cleanup. You can access Disk Cleanup by right-clicking the hard drive icon and then clicking Properties. See the following example: -![Disk cleanup.](../images/cleanup.png) +:::image type="content" alt-text="Disk cleanup." source="../images/cleanup.png"::: For instructions to run Disk Cleanup and other suggestions to free up hard drive space, see [Tips to free up drive space on your PC](https://support.microsoft.com/help/17421/windows-free-up-drive-space). diff --git a/windows/deployment/upgrade/resolution-procedures.md b/windows/deployment/upgrade/resolution-procedures.md index 227541cee7..608df22ec5 100644 --- a/windows/deployment/upgrade/resolution-procedures.md +++ b/windows/deployment/upgrade/resolution-procedures.md @@ -45,7 +45,7 @@ See the following general troubleshooting procedures associated with a result co | :--- | :--- | :--- | | 0xC1900101 - 0x20004 | Uninstall antivirus applications.
    Remove all unused SATA devices.
    Remove all unused devices and drivers.
    Update drivers and BIOS. | Windows Setup encountered an error during the SAFE_OS with the INSTALL_RECOVERY_ENVIRONMENT operation.
    This is generally caused by out-of-date drivers. | | 0xC1900101 - 0x2000c | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.
    Contact your hardware vendor to obtain updated device drivers.
    Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. | Windows Setup encountered an unspecified error during Wim apply in the WinPE phase.
    This is generally caused by out-of-date drivers | -| 0xC1900101 - 0x20017 | Ensure that all that drivers are updated.
    Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory, and then locate the problem drivers.
    For more information, see [Windows Vista, Windows 7, Windows Server 2008 R2, Windows 8.1, and Windows 10 setup log file locations](https://support.microsoft.com/en-us/help/927521/windows-vista-windows-7-windows-server-2008-r2-windows-8-1-and-windows).
    Update or uninstall the problem drivers. | A driver has caused an illegal operation.
    Windows was not able to migrate the driver, resulting in a rollback of the operating system.
    This is a SafeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software. | +| 0xC1900101 - 0x20017 | Ensure that all that drivers are updated.
    Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory, and then locate the problem drivers.
    For more information, see [Windows Vista, Windows 7, Windows Server 2008 R2, Windows 8.1, and Windows 10 setup log file locations](/troubleshoot/windows-client/deployment/windows-setup-log-file-locations).
    Update or uninstall the problem drivers. | A driver has caused an illegal operation.
    Windows was not able to migrate the driver, resulting in a rollback of the operating system.
    This is a SafeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software. | | 0xC1900101 - 0x30018 | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.
    Contact your hardware vendor to obtain updated device drivers.
    Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. | A device driver has stopped responding to setup.exe during the upgrade process. | | 0xC1900101 - 0x3000D | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.
    Update or uninstall the display driver. | Installation failed during the FIRST_BOOT phase while attempting the MIGRATE_DATA operation.
    This can occur due to a problem with a display driver. | | 0xC1900101 - 0x4000D | Check supplemental rollback logs for a setupmem.dmp file, or event logs for any unexpected reboots or errors.
    Review the rollback log and determine the stop code.
    The rollback log is located in the $Windows.~BT\Sources\Rollback folder. An example analysis is shown below. This example is not representative of all cases:
     
    Info SP Crash 0x0000007E detected
    Info SP Module name :
    Info SP Bugcheck parameter 1 : 0xFFFFFFFFC0000005
    Info SP Bugcheck parameter 2 : 0xFFFFF8015BC0036A
    Info SP Bugcheck parameter 3 : 0xFFFFD000E5D23728
    Info SP Bugcheck parameter 4 : 0xFFFFD000E5D22F40
    Info SP Cannot recover the system.
    Info SP Rollback: Showing splash window with restoring text: Restoring your previous version of Windows.
     
    Typically, there is a dump file for the crash to analyze. If you are not equipped to debug the dump, then attempt the following basic troubleshooting procedures:
     
    1. Make sure you have enough disk space.
    2. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.
    3. Try changing video adapters.
    4. Check with your hardware vendor for any BIOS updates.
    5. Disable BIOS memory options such as caching or shadowing. | A rollback occurred due to a driver configuration issue.
    Installation failed during the second boot phase while attempting the MIGRATE_DATA operation.
    This can occur because of incompatible drivers. | @@ -188,6 +188,6 @@ Also see the following sequential list of modern setup (mosetup) error codes wit - [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) - [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) - [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/home?category=Windows10ITPro) -- [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) +- [Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors) - [Win 7 to Win 10 upgrade error (0x800707E7 - 0x3000D)](https://answers.microsoft.com/en-us/windows/forum/all/win-7-to-win-10-upgrade-error-0x800707e7-0x3000d/1273bc1e-8a04-44d4-a6b2-808c9feeb020)) - [Win 10 upgrade error: User profile suffix mismatch, 0x800707E7 - 0x3000D](https://answers.microsoft.com/en-us/windows/forum/windows_10-windows_install/win-10-upgrade-error-user-profile-suffix-mismatch/0f006733-2af5-4b42-a2d4-863fad05273d?page=3) diff --git a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md index 7056b16082..e1749e6b58 100644 --- a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md +++ b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md @@ -61,5 +61,5 @@ See the following topics in this article:
    [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
    [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
    [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
    [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) +
    [Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors)
    \ No newline at end of file diff --git a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md index 09c6a58127..f81c8e5e88 100644 --- a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md +++ b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md @@ -85,7 +85,7 @@ When performing an operating system upgrade, Windows Setup uses phases described **Figure 1**: Phases of a successful Windows 10 upgrade (uninstall is not shown): -![Upgrade process.](../images/upgrade-process.png) +:::image type="content" alt-text="Upgrade process." source="../images/upgrade-process.png" lightbox="../images/upgrade-process.png"::: DU = Driver/device updates.
    OOBE = Out of box experience.
    @@ -97,4 +97,4 @@ WIM = Windows image (Microsoft)
    [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
    [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-/ifications)
    [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
    [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) \ No newline at end of file +
    [Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors) \ No newline at end of file diff --git a/windows/deployment/upgrade/upgrade-error-codes.md b/windows/deployment/upgrade/upgrade-error-codes.md index 2286a7ec90..95f6cd4f49 100644 --- a/windows/deployment/upgrade/upgrade-error-codes.md +++ b/windows/deployment/upgrade/upgrade-error-codes.md @@ -21,10 +21,10 @@ ms.collection: highpri - Windows 10 >[!NOTE] ->This is a 400 level topic (advanced).
    +>This is a 400 level topic (advanced). +> >See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. - If the upgrade process is not successful, Windows Setup will return two codes: 1. **A result code**: The result code corresponds to a specific Win32 or NTSTATUS error. @@ -39,7 +39,7 @@ Note: If only a result code is returned, this can be because a tool is being use ## Result codes -A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue.
    To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](resolution-procedures.md) section later in this article. +A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue. To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](resolution-procedures.md) section later in this article. The following set of result codes are associated with [Windows Setup](/windows-hardware/manufacture/desktop/windows-setup-command-line-options) compatibility warnings: @@ -88,74 +88,64 @@ Extend codes can be matched to the phase and operation when an error occurred. T The following tables provide the corresponding phase and operation for values of an extend code: -
    +### Extend code: phase - - -
    Extend code: phase
    HexPhase -
    0SP_EXECUTION_UNKNOWN -
    1SP_EXECUTION_DOWNLEVEL -
    2SP_EXECUTION_SAFE_OS -
    3SP_EXECUTION_FIRST_BOOT -
    4SP_EXECUTION_OOBE_BOOT -
    5SP_EXECUTION_UNINSTALL -
    +|Hex|Phase| +|--- |--- | +|0|SP_EXECUTION_UNKNOWN| +|1|SP_EXECUTION_DOWNLEVEL| +|2|SP_EXECUTION_SAFE_OS| +|3|SP_EXECUTION_FIRST_BOOT| +|4|SP_EXECUTION_OOBE_BOOT| +|5|SP_EXECUTION_UNINSTALL| +### Extend code: Operation - - - - - -
    Extend code: operation
    - -
    HexOperation -
    0SP_EXECUTION_OP_UNKNOWN -
    1SP_EXECUTION_OP_COPY_PAYLOAD -
    2SP_EXECUTION_OP_DOWNLOAD_UPDATES -
    3SP_EXECUTION_OP_INSTALL_UPDATES -
    4SP_EXECUTION_OP_INSTALL_RECOVERY_ENVIRONMENT -
    5SP_EXECUTION_OP_INSTALL_RECOVERY_IMAGE -
    6SP_EXECUTION_OP_REPLICATE_OC -
    7SP_EXECUTION_OP_INSTALL_DRVIERS -
    8SP_EXECUTION_OP_PREPARE_SAFE_OS -
    9SP_EXECUTION_OP_PREPARE_ROLLBACK -
    ASP_EXECUTION_OP_PREPARE_FIRST_BOOT -
    BSP_EXECUTION_OP_PREPARE_OOBE_BOOT -
    CSP_EXECUTION_OP_APPLY_IMAGE -
    DSP_EXECUTION_OP_MIGRATE_DATA -
    ESP_EXECUTION_OP_SET_PRODUCT_KEY -
    FSP_EXECUTION_OP_ADD_UNATTEND -
    -    		 - -
    HexOperation -
    10SP_EXECUTION_OP_ADD_DRIVER -
    11SP_EXECUTION_OP_ENABLE_FEATURE -
    12SP_EXECUTION_OP_DISABLE_FEATURE -
    13SP_EXECUTION_OP_REGISTER_ASYNC_PROCESS -
    14SP_EXECUTION_OP_REGISTER_SYNC_PROCESS -
    15SP_EXECUTION_OP_CREATE_FILE -
    16SP_EXECUTION_OP_CREATE_REGISTRY -
    17SP_EXECUTION_OP_BOOT -
    18SP_EXECUTION_OP_SYSPREP -
    19SP_EXECUTION_OP_OOBE -
    1ASP_EXECUTION_OP_BEGIN_FIRST_BOOT -
    1BSP_EXECUTION_OP_END_FIRST_BOOT -
    1CSP_EXECUTION_OP_BEGIN_OOBE_BOOT -
    1DSP_EXECUTION_OP_END_OOBE_BOOT -
    1ESP_EXECUTION_OP_PRE_OOBE -
    1FSP_EXECUTION_OP_POST_OOBE -
    20SP_EXECUTION_OP_ADD_PROVISIONING_PACKAGE -
    -
    +|Hex|Operation| +|--- |--- | +|0|SP_EXECUTION_OP_UNKNOWN| +|1|SP_EXECUTION_OP_COPY_PAYLOAD| +|2|SP_EXECUTION_OP_DOWNLOAD_UPDATES| +|3|SP_EXECUTION_OP_INSTALL_UPDATES| +|4|SP_EXECUTION_OP_INSTALL_RECOVERY_ENVIRONMENT| +|5|SP_EXECUTION_OP_INSTALL_RECOVERY_IMAGE| +|6|SP_EXECUTION_OP_REPLICATE_OC| +|7|SP_EXECUTION_OP_INSTALL_DRIVERS| +|8|SP_EXECUTION_OP_PREPARE_SAFE_OS| +|9|SP_EXECUTION_OP_PREPARE_ROLLBACK| +|A|SP_EXECUTION_OP_PREPARE_FIRST_BOOT| +|B|SP_EXECUTION_OP_PREPARE_OOBE_BOOT| +|C|SP_EXECUTION_OP_APPLY_IMAGE| +|D|SP_EXECUTION_OP_MIGRATE_DATA| +|E|SP_EXECUTION_OP_SET_PRODUCT_KEY| +|F|SP_EXECUTION_OP_ADD_UNATTEND| + +|Hex|Operation| +|--- |--- | +|10|SP_EXECUTION_OP_ADD_DRIVER| +|11|SP_EXECUTION_OP_ENABLE_FEATURE| +|12|SP_EXECUTION_OP_DISABLE_FEATURE| +|13|SP_EXECUTION_OP_REGISTER_ASYNC_PROCESS| +|14|SP_EXECUTION_OP_REGISTER_SYNC_PROCESS| +|15|SP_EXECUTION_OP_CREATE_FILE| +|16|SP_EXECUTION_OP_CREATE_REGISTRY| +|17|SP_EXECUTION_OP_BOOT| +|18|SP_EXECUTION_OP_SYSPREP| +|19|SP_EXECUTION_OP_OOBE| +|1A|SP_EXECUTION_OP_BEGIN_FIRST_BOOT| +|1B|SP_EXECUTION_OP_END_FIRST_BOOT| +|1C|SP_EXECUTION_OP_BEGIN_OOBE_BOOT| +|1D|SP_EXECUTION_OP_END_OOBE_BOOT| +|1E|SP_EXECUTION_OP_PRE_OOBE| +|1F|SP_EXECUTION_OP_POST_OOBE| +|20|SP_EXECUTION_OP_ADD_PROVISIONING_PACKAGE| For example: An extend code of **0x4000D**, represents a problem during phase 4 (**0x4**) with data migration (**000D**). ## Related topics -[Windows 10 FAQ for IT professionals](../planning/windows-10-enterprise-faq-itpro.yml) -
    [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
    [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-/ifications) -
    [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
    [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) \ No newline at end of file +[Windows 10 FAQ for IT professionals](../planning/windows-10-enterprise-faq-itpro.yml) +[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) +[Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications) +[Microsoft Windows Q & A](/answers/products/windows) +[Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors) diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md index e7434cf95e..4505749b15 100644 --- a/windows/deployment/upgrade/windows-10-edition-upgrades.md +++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md @@ -135,6 +135,7 @@ Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 by entering a ### Scenario example Downgrading from Enterprise + - Original edition: **Professional OEM** - Upgrade edition: **Enterprise** - Valid downgrade paths: **Pro, Pro for Workstations, Pro Education, Education** @@ -143,102 +144,24 @@ You can move directly from Enterprise to any valid destination edition. In this ### Supported Windows 10 downgrade paths -✔ = Supported downgrade path
    - S  = Supported; Not considered a downgrade or an upgrade
    -[blank] = Not supported or not a downgrade
    +✔ = Supported downgrade path -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Destination edition
           HomeProPro for WorkstationsPro EducationEducationEnterprise LTSCEnterprise
    Starting edition
    Home
    Pro
    Pro for Workstations
    Pro Education
    Education✔✔✔S
    Enterprise LTSC
    Enterprise✔✔✔S
    +S = Supported; Not considered a downgrade or an upgrade + +[blank] = Not supported or not a downgrade + +**Destination Edition: (Starting)** + +|Edition|Home|Pro|Pro for Workstations|Pro Education|Education|Enterprise LTSC|Enterprise| +|--- |--- |--- |--- |--- |--- |--- |--- | +|Home|||||||| +|Pro|||||||| +|Pro for Workstations|||||||| +|Pro Education|||||||| +|Education||✔|✔|✔|||S| +|Enterprise LTSC|||||||| +|Enterprise||✔|✔|✔|S||| -> > **Windows N/KN**: Windows "N" and "KN" SKUs follow the same rules shown above. Some slightly more complex scenarios are not represented by the table above. For example, you can perform an upgrade from Pro to Pro for Workstation on a computer with an embedded Pro key using a Pro for Workstation license key, and then later downgrade this computer back to Pro with the firmware-embedded key. The downgrade is allowed but only because the pre-installed OS is Pro. @@ -247,4 +170,4 @@ Some slightly more complex scenarios are not represented by the table above. For [Windows 10 upgrade paths](./windows-10-upgrade-paths.md)
    [Windows 10 volume license media](../windows-10-media.md)
    -[Windows 10 Subscription Activation](/windows/deployment/windows-10-enterprise-subscription-activation) \ No newline at end of file +[Windows 10 Subscription Activation](/windows/deployment/windows-10-enterprise-subscription-activation) diff --git a/windows/deployment/upgrade/windows-10-upgrade-paths.md b/windows/deployment/upgrade/windows-10-upgrade-paths.md index 88c583d5f3..19f8ab5ad8 100644 --- a/windows/deployment/upgrade/windows-10-upgrade-paths.md +++ b/windows/deployment/upgrade/windows-10-upgrade-paths.md @@ -26,7 +26,7 @@ This topic provides a summary of available upgrade paths to Windows 10. You can If you are also migrating to a different edition of Windows, see [Windows 10 edition upgrade](windows-10-edition-upgrades.md). Methods and supported paths are described on this page to change the edition of Windows. These methods require that you input a license or product key for the new Windows edition prior to starting the upgrade process. Edition downgrade is also supported for some paths, but please note that applications and settings are not maintained when the Windows edition is downgraded. -- **Windows 10 version upgrade**: You can directly upgrade any General Availability Channel version of Windows 10 to a newer, supported General Availability Channel version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) for availability and service information. +- **Windows 10 version upgrade**: You can directly upgrade any General Availability Channel version of Windows 10 to a newer, supported General Availability Channel version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](/lifecycle/faq/windows) for availability and service information. - **In-place upgrade from Windows 7, Windows 8.1, or [Windows 10 General Availability Channel](/windows/release-health/release-information)** to Windows 10 LTSC is not supported. Windows 10 LTSC 2015 did not block this in-place upgrade path. This issue was corrected in the Windows 10 LTSC 2016 release, which only allows data-only and clean install options. diff --git a/windows/deployment/upgrade/windows-error-reporting.md b/windows/deployment/upgrade/windows-error-reporting.md index 50aad1782d..74fb942b19 100644 --- a/windows/deployment/upgrade/windows-error-reporting.md +++ b/windows/deployment/upgrade/windows-error-reporting.md @@ -32,7 +32,7 @@ To use Windows PowerShell, type the following commands from an elevated Windows > [!IMPORTANT] > The following source will be available only if you have updated from a previous version of Windows 10 to a new version. If you installed the current version and have not updated, the source named **WinSetupDiag02** will be unavailable. -```Powershell +```powershell $events = Get-WinEvent -FilterHashtable @{LogName="Application";ID="1001";Data="WinSetupDiag02"} $event = [xml]$events[0].ToXml() $event.Event.EventData.Data @@ -43,7 +43,8 @@ To use Event Viewer: 2. Click **Find**, and then search for **winsetupdiag02**. 3. Double-click the event that is highlighted. -Note: For legacy operating systems, the Event Name was WinSetupDiag01. +> [!NOTE] +> For legacy operating systems, the Event Name was WinSetupDiag01. Ten parameters are listed in the event: @@ -63,7 +64,7 @@ Ten parameters are listed in the event: The event will also contain links to log files that can be used to perform a detailed diagnosis of the error. An example of this event from a successful upgrade is shown below. -![Windows Error Reporting.](../images/event.png) +:::image type="content" alt-text="Windows Error Reporting." source="../images/event.png" lightbox="../images/event.png"::: ## Related topics @@ -71,4 +72,4 @@ The event will also contain links to log files that can be used to perform a det [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -[Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) \ No newline at end of file +[Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors) \ No newline at end of file diff --git a/windows/deployment/volume-activation/configure-client-computers-vamt.md b/windows/deployment/volume-activation/configure-client-computers-vamt.md index 5cbd41f410..ec417c9558 100644 --- a/windows/deployment/volume-activation/configure-client-computers-vamt.md +++ b/windows/deployment/volume-activation/configure-client-computers-vamt.md @@ -24,7 +24,7 @@ To enable the Volume Activation Management Tool (VAMT) to function correctly, ce Organizations where the VAMT will be widely used may benefit from making these changes inside the master image for Windows. -> [IMPORTANT] +> [!IMPORTANT] > This procedure only applies to clients running Windows Vista or later. For clients running Windows XP Service Pack 1, see [Connecting Through Windows Firewall](/windows/win32/wmisdk/connecting-to-wmi-remotely-with-vbscript). ## Configuring the Windows Firewall to allow VAMT access @@ -38,8 +38,8 @@ Enable the VAMT to access client computers using the **Windows Firewall** Contro 5. Select the **Windows Management Instrumentation (WMI)** checkbox. 6. Click **OK**. - **Warning**   - By default, Windows Firewall Exceptions only apply to traffic originating on the local subnet. To expand the exception to apply to multiple subnets, you need to change the exception settings in the Windows Firewall with Advanced Security, as described below. +> [!WARNING] +> By default, Windows Firewall Exceptions only apply to traffic originating on the local subnet. To expand the exception to apply to multiple subnets, you need to change the exception settings in the Windows Firewall with Advanced Security, as described below. ## Configure Windows Firewall to allow VAMT access across multiple subnets @@ -65,12 +65,12 @@ Enable the VAMT to access client computers across multiple subnets using the **W In certain scenarios, only a limited set of TCP/IP ports are allowed through a hardware firewall. Administrators must ensure that WMI (which relies on RPC over TCP/IP) is allowed through these types of firewalls. By default, the WMI port is a dynamically allocated random port above 1024. The following Microsoft knowledge article discusses how administrators can limit the range of dynamically-allocated ports. This is useful if, for example, the hardware firewall only allows traffic in a certain range of ports. - For more info, see [How to configure RPC dynamic port allocation to work with firewalls](https://support.microsoft.com/help/929851). + For more info, see [How to configure RPC dynamic port allocation to work with firewalls](/troubleshoot/windows-server/networking/default-dynamic-port-range-tcpip-chang). ## Create a registry value for the VAMT to access workgroup-joined computer -> [WARNING]   -> This section contains information about how to modify the registry. Make sure to back up the registry before you modify it; in addition, ensure that you know how to restore the registry, if a problem occurs. For more information about how to back up, restore, and modify the registry, see [Windows registry information for advanced users](https://support.microsoft.com/help/256986). +> [!WARNING] +> This section contains information about how to modify the registry. Make sure to back up the registry before you modify it; in addition, ensure that you know how to restore the registry, if a problem occurs. For more information about how to back up, restore, and modify the registry, see [Windows registry information for advanced users](/troubleshoot/windows-server/performance/windows-registry-advanced-users). On the client computer, create the following registry key using regedit.exe. @@ -81,7 +81,7 @@ On the client computer, create the following registry key using regedit.exe. - **Type: DWORD** - **Value Data: 1** - > [NOTE] + > [!NOTE] > To discover VAMT-manageable Windows computers in workgroups, you must enable network discovery on each client. ## Deployment options diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md index b8352c8389..d63a5a3512 100644 --- a/windows/deployment/wds-boot-support.md +++ b/windows/deployment/wds-boot-support.md @@ -28,64 +28,16 @@ When you PXE-boot from a WDS server that uses the **boot.wim** file from install ## Deployment scenarios affected -The table below provides support details for specific deployment scenarios. +The table below provides support details for specific deployment scenarios (Boot Image Version). + +||Windows 10|Windows Server 2016|Windows Server 2019|Windows Server 2022|Windows 11| +|--- |--- |--- |--- |--- |--- | +|**Windows 10**|Supported, using a boot image from matching or newer version.|Supported, using a boot image from Windows 10, version 1607 or later.|Supported, using a boot image from Windows 10, version 1809 or later.|Not supported.|Not supported.| +|**Windows Server 2016**|Supported, using a boot image from Windows 10, version 1607 or later.|Supported.|Not supported.|Not supported.|Not supported.| +|**Windows Server 2019**|Supported, using a boot image from Windows 10, version 1809 or later.|Supported.|Supported.|Not supported.|Not supported.| +|**Windows Server 2022**|Deprecated, with a warning message.|Deprecated, with a warning message.|Deprecated, with a warning message.|Deprecated, with a warning message.|Not supported.| +|**Windows 11**|Not supported, blocked.|Not supported, blocked.|Not supported, blocked.|Not supported, blocked.|Not supported, blocked.| -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
           Windows 10Windows Server 2016Windows Server 2019Windows Server 2022Windows 11
    -
     
     
     
     
     
     
     
     
     
    Boot image version
    Windows 10Supported, using a boot image from matching or newer version.Supported, using a boot image from Windows 10, version 1607 or later.Supported, using a boot image from Windows 10, version 1809 or later.Not supported.Not supported.
    Windows Server 2016Supported, using a boot image from Windows 10, version 1607 or later.Supported.Not supported.Not supported.Not supported.
    Windows Server 2019Supported, using a boot image from Windows 10, version 1809 or later.Supported.Supported.Not supported.Not supported.
    Windows Server 2022Deprecated, with a warning message.Deprecated, with a warning message.Deprecated, with a warning message.Deprecated, with a warning message.Not supported.
    Windows 11Not supported, blocked.Not supported, blocked.Not supported, blocked.Not supported, blocked.Not supported, blocked.
    ## Reason for the change diff --git a/windows/deployment/windows-10-deployment-scenarios.md b/windows/deployment/windows-10-deployment-scenarios.md index 098cf03790..8dd6d2f734 100644 --- a/windows/deployment/windows-10-deployment-scenarios.md +++ b/windows/deployment/windows-10-deployment-scenarios.md @@ -19,127 +19,46 @@ ms.collection: highpri # Windows 10 deployment scenarios **Applies to** + - Windows 10 To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the capabilities and limitations of each, is a key task. -The following table summarizes various Windows 10 deployment scenarios. The scenarios are each assigned to one of three categories. +## Deployment categories + +The following tables summarize various Windows 10 deployment scenarios. The scenarios are each assigned to one of three categories. + - Modern deployment methods are recommended unless you have a specific need to use a different procedure. These methods are supported with existing tools such as Microsoft Deployment Toolkit (MDT) and Microsoft Endpoint Configuration Manager. These methods are discussed in detail on the [Modern Desktop Deployment Center](/microsoft-365/enterprise/desktop-deployment-center-home). - - Note: Once you have deployed Windows 10 in your organization, it is important to stay up to date by [creating a deployment plan](update/create-deployment-plan.md) for Windows 10 feature updates. -- Dynamic deployment methods enable you to configure applications and settings for specific use cases. -- Traditional deployment methods use existing tools to deploy operating system images.
      - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    CategoryScenarioDescriptionMore information
    Modern + > [!NOTE] + > Once you have deployed Windows 10 in your organization, it is important to stay up to date by [creating a deployment plan](update/create-deployment-plan.md) for Windows 10 feature updates. -[Windows Autopilot](#windows-autopilot) - Customize the out-of-box-experience (OOBE) for your organization, and deploy a new system with apps and settings already configured. - -Overview of Windows Autopilot -
    +- Dynamic deployment methods enable you to configure applications and settings for specific use cases. -[In-place upgrade](#in-place-upgrade) +- Traditional deployment methods use existing tools to deploy operating system images. - - Use Windows Setup to update your OS and migrate apps and settings. Rollback data is saved in Windows.old. - -Perform an in-place upgrade to Windows 10 with MDT
    Perform an in-place upgrade to Windows 10 using Configuration Manager -
    - Dynamic - +### Modern -[Subscription Activation](#windows-10-subscription-activation) - - Switch from Windows 10 Pro to Enterprise when a subscribed user signs in. - -Windows 10 Subscription Activation -
    +|Scenario|Description|More information| +|--- |--- |--- | +|[Windows Autopilot](#windows-autopilot)|Customize the out-of-box-experience (OOBE) for your organization, and deploy a new system with apps and settings already configured|[Overview of Windows Autopilot](/windows/deployment/windows-autopilot/windows-10-autopilot)| +|[In-place upgrade](#in-place-upgrade)|Use Windows Setup to update your OS and migrate apps and settings. Rollback data is saved in Windows.old.|[Perform an in-place upgrade to Windows 10 with MDT](/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit)
    [Perform an in-place upgrade to Windows 10 using Configuration Manager](/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager)| - [AAD / MDM](#dynamic-provisioning) -     		- The device is automatically joined to AAD and configured by MDM. - -Azure Active Directory integration with MDM -
    +### Dynamic - [Provisioning packages](#dynamic-provisioning) - - Using the Windows Imaging and Configuration Designer tool, create provisioning packages that can be applied to devices. - -Configure devices without MDM -
    - Traditional - +|Scenario|Description|More information| +|--- |--- |--- | +|[Subscription Activation](#windows-10-subscription-activation)|Switch from Windows 10 Pro to Enterprise when a subscribed user signs in.|[Windows 10 Subscription Activation](/windows/deployment/windows-10-enterprise-subscription-activation)| +|[AAD / MDM](#dynamic-provisioning)|The device is automatically joined to AAD and configured by MDM.|[Azure Active Directory integration with MDM](/windows/client-management/mdm/azure-active-directory-integration-with-mdm)| +|[Provisioning packages](#dynamic-provisioning)|Using the Windows Imaging and Configuration Designer tool, create provisioning packages that can be applied to devices.|[Configure devices without MDM](/windows/configuration/configure-devices-without-mdm)| - [Bare metal](#new-computer) - - Deploy a new device, or wipe an existing device and deploy with a fresh image. - - Deploy a Windows 10 image using MDT
    Deploy Windows 10 using PXE and Configuration Manager -
    - - [Refresh](#computer-refresh) - - Also called wipe and load. Redeploy a device by saving the user state, wiping the disk, then restoring the user state. - - Refresh a Windows 7 computer with Windows 10
    Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager -
    - - [Replace](#computer-replace) - - Replace an existing device with a new one by saving the user state on the old device and then restoring it to the new device. - - Replace a Windows 7 computer with a Windows 10 computer
    Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager -
    - -
      +### Traditional +|Scenario|Description|More information| +|--- |--- |--- | +|[Bare metal](#new-computer)|Deploy a new device, or wipe an existing device and deploy with a fresh image. |[Deploy a Windows 10 image using MDT](/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt)
    [Deploy Windows 10 using PXE and Configuration Manager](/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager)| +|[Refresh](#computer-refresh)|Also called wipe and load. Redeploy a device by saving the user state, wiping the disk, then restoring the user state. | [Refresh a Windows 7 computer with Windows 10](/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10)
    [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager)| +|[Replace](#computer-replace)|Replace an existing device with a new one by saving the user state on the old device and then restoring it to the new device.| [Replace a Windows 7 computer with a Windows 10 computer](/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer)
    [Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager)| >[!IMPORTANT] >The Windows Autopilot and Subscription Activation scenarios require that the beginning OS be Windows 10 version 1703, or later.
    @@ -176,8 +95,11 @@ Scenarios that support in-place upgrade with some additional procedures include There are some situations where you cannot use in-place upgrade; in these situations, you can use traditional deployment (wipe-and-load) instead. Examples of these situations include: - Changing from Windows 7, Windows 8, or Windows 8.1 x86 to Windows 10 x64. The upgrade process cannot change from a 32-bit operating system to a 64-bit operating system, because of possible complications with installed applications and drivers. + - Windows To Go and Boot from VHD installations. The upgrade process is unable to upgrade these installations. Instead, new installations would need to be performed. + - Updating existing images. While it might be tempting to try to upgrade existing Windows 7, Windows 8, or Windows 8.1 images to Windows 10 by installing the old image, upgrading it, and then recapturing the new Windows 10 image, this is not supported – preparing an upgraded OS for imaging (using Sysprep.exe) is not supported and will not work when it detects the upgraded OS. + - Dual-boot and multi-boot systems. The upgrade process is designed for devices running a single OS; if using dual-boot or multi-boot systems with multiple operating systems (not leveraging virtual machines for the second and subsequent operating systems), additional care should be taken. diff --git a/windows/deployment/windows-10-media.md b/windows/deployment/windows-10-media.md index 3595e295f0..d3de108475 100644 --- a/windows/deployment/windows-10-media.md +++ b/windows/deployment/windows-10-media.md @@ -53,7 +53,7 @@ Features on demand is a method for adding features to your Windows 10 image that
    [Volume Activation for Windows 10](./volume-activation/volume-activation-windows-10.md)
    [Plan for volume activation](./volume-activation/plan-for-volume-activation-client.md)
    [VLSC downloads FAQ](https://www.microsoft.com/Licensing/servicecenter/Help/FAQDetails.aspx?id=150) -
    [Download and burn an ISO file on the volume licensing site (VLSC)](https://support.microsoft.com/help/2472143/download-and-burn-an-iso-file-on-the-volume-licensing-site-vlsc) +
    [Download and burn an ISO file on the volume licensing site (VLSC)](/troubleshoot/windows-client/deployment/iso-file-on-vlsc)   diff --git a/windows/deployment/windows-10-poc-mdt.md b/windows/deployment/windows-10-poc-mdt.md index c59e537d48..6cc78efe42 100644 --- a/windows/deployment/windows-10-poc-mdt.md +++ b/windows/deployment/windows-10-poc-mdt.md @@ -25,7 +25,8 @@ ms.topic: article - Windows 10 -**Important**: This guide leverages the proof of concept (PoC) environment configured using procedures in the following guide: +> [!IMPORTANT] +> This guide leverages the proof of concept (PoC) environment configured using procedures in the following guide: - [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) Please complete all steps in the prerequisite guide before starting this guide. This guide requires about 5 hours to complete, but can require less time or more time depending on the speed of the Hyper-V host. After completing the current guide, also see the companion guide: @@ -36,7 +37,7 @@ The PoC environment is a virtual network running on Hyper-V with three virtual m - **SRV1**: A dual-homed contoso.com domain member server, DNS server, and default gateway providing NAT service for the PoC network. - **PC1**: A contoso.com member computer running Windows 7, Windows 8, or Windows 8.1 that has been shadow-copied from a physical computer on your corporate network. ->This guide uses the Hyper-V server role. If you do not complete all steps in a single session, consider using [checkpoints](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn818483(v=ws.11)) and [saved states](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee247418(v=ws.10)) to pause, resume, or restart your work. +This guide uses the Hyper-V server role. If you do not complete all steps in a single session, consider using [checkpoints](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn818483(v=ws.11)) and [saved states](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee247418(v=ws.10)) to pause, resume, or restart your work. ## In this guide @@ -44,23 +45,15 @@ This guide provides instructions to install and configure the Microsoft Deployme Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed. -
    - -
    - - -
    TopicDescriptionTime - -
    About MDTA high-level overview of the Microsoft Deployment Toolkit (MDT).Informational -
    Install MDTDownload and install MDT.40 minutes -
    Create a deployment share and reference imageA reference image is created to serve as the template for deploying new images.90 minutes -
    Deploy a Windows 10 image using MDTThe reference image is deployed in the PoC environment.60 minutes -
    Refresh a computer with Windows 10Export user data from an existing client computer, wipe the computer, install a new operating system, and then restore user data and settings.60 minutes -
    Replace a computer with Windows 10Back up an existing client computer, then restore this backup to a new computer.60 minutes -
    Troubleshooting logs, events, and utilitiesLog locations and troubleshooting hints.Informational -
    - -
    +|Topic|Description|Time| +|--- |--- |--- | +|[About MDT](#about-mdt)|A high-level overview of the Microsoft Deployment Toolkit (MDT).|Informational| +|[Install MDT](#install-mdt)|Download and install MDT.|40 minutes| +|[Create a deployment share and reference image](#create-a-deployment-share-and-reference-image)|A reference image is created to serve as the template for deploying new images.|90 minutes| +|[Deploy a Windows 10 image using MDT](#deploy-a-windows-10-image-using-mdt)|The reference image is deployed in the PoC environment.|60 minutes| +|[Refresh a computer with Windows 10](#refresh-a-computer-with-windows-10)|Export user data from an existing client computer, wipe the computer, install a new operating system, and then restore user data and settings.|60 minutes| +|[Replace a computer with Windows 10](#replace-a-computer-with-windows-10)|Back up an existing client computer, then restore this backup to a new computer.|60 minutes| +|[Troubleshooting logs, events, and utilities](#troubleshooting-logs-events-and-utilities)|Log locations and troubleshooting hints.|Informational| ## About MDT @@ -73,18 +66,19 @@ MDT performs deployments by using the Lite Touch Installation (LTI), Zero Touch 1. On SRV1, temporarily disable IE Enhanced Security Configuration for Administrators by typing the following commands at an elevated Windows PowerShell prompt: - ``` + ```powershell $AdminKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" Set-ItemProperty -Path $AdminKey -Name “IsInstalled” -Value 0 Stop-Process -Name Explorer ``` + 2. Download and install the 64-bit version of [Microsoft Deployment Toolkit (MDT)](https://www.microsoft.com/download/details.aspx?id=54259) on SRV1 using the default options. As of the writing of this guide, the latest version of MDT was 8443. 3. Download and install the latest [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) on SRV1 using the default installation settings. The current version is the ADK for Windows 10, version 1703. Installation might require several minutes to acquire all components. 3. If desired, re-enable IE Enhanced Security Configuration: - ``` + ```powershell Set-ItemProperty -Path $AdminKey -Name “IsInstalled” -Value 1 Stop-Process -Name Explorer ``` @@ -95,7 +89,7 @@ A reference image serves as the foundation for Windows 10 devices in your organi 1. In [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md), the Windows 10 Enterprise .iso file was saved to the c:\VHD directory as **c:\VHD\w10-enterprise.iso**. The first step in creating a deployment share is to mount this file on SRV1. To mount the Windows 10 Enterprise DVD on SRV1, open an elevated Windows PowerShell prompt on the Hyper-V host computer and type the following command: - ``` + ```powershell Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\w10-enterprise.iso ``` 2. On SRV1, verify that the Windows Enterprise installation DVD is mounted as drive letter D. @@ -130,7 +124,7 @@ A reference image serves as the foundation for Windows 10 devices in your organi - Progress: wait for files to be copied - Confirmation: click **Finish** - >For purposes of this test lab, we will only add the prerequisite .NET Framework feature. Commerical applications (ex: Microsoft Office) will not be added to the deployment share. For information about adding applications, see the [Add applications](./deploy-windows-mdt/create-a-windows-10-reference-image.md) section of the [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md) topic in the TechNet library. + For purposes of this test lab, we will only add the prerequisite .NET Framework feature. Commerical applications (ex: Microsoft Office) will not be added to the deployment share. For information about adding applications, see the [Add applications](./deploy-windows-mdt/create-a-windows-10-reference-image.md) section of the [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md) topic in the TechNet library. 11. The next step is to create a task sequence to reference the operating system that was imported. To create a task sequence, right-click the **Task Sequences** node and then click **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - Task sequence ID: **REFW10X64-001**
    @@ -141,7 +135,7 @@ A reference image serves as the foundation for Windows 10 devices in your organi - Specify Product Key: **Do not specify a product key at this time** - Full Name: **Contoso** - Organization: **Contoso** - - Internet Explorer home page: **http://www.contoso.com** + - Internet Explorer home page: `http://www.contoso.com` - Admin Password: **Do not specify an Administrator password at this time** - Summary: click **Next** - Confirmation: click **Finish** @@ -159,7 +153,8 @@ A reference image serves as the foundation for Windows 10 devices in your organi 17. Enable Windows Update in the task sequence by clicking the **Windows Update (Post-Application Installation)** step, clicking the **Options** tab, and clearing the **Disable this step** checkbox. - >Note: Since we are not installing applications in this test lab, there is no need to enable the Windows Update Pre-Application Installation step. However, you should enable this step if you are also installing applications. + > [!NOTE] + > Since we are not installing applications in this test lab, there is no need to enable the Windows Update Pre-Application Installation step. However, you should enable this step if you are also installing applications. 18. Click **OK** to complete editing the task sequence. @@ -167,7 +162,7 @@ A reference image serves as the foundation for Windows 10 devices in your organi 20. Replace the default rules with the following text: - ``` + ```text [Settings] Priority=Default @@ -202,7 +197,7 @@ A reference image serves as the foundation for Windows 10 devices in your organi 21. Click **Apply** and then click **Edit Bootstrap.ini**. Replace the contents of the Bootstrap.ini file with the following text, and save the file: - ``` + ```text [Settings] Priority=Default @@ -222,20 +217,18 @@ A reference image serves as the foundation for Windows 10 devices in your organi 25. Copy **c:\MDTBuildLab\Boot\LiteTouchPE_x86.iso** on SRV1 to the **c:\VHD** directory on the Hyper-V host computer. Note that in MDT, the x86 boot image can deploy both x86 and x64 operating systems, except on computers based on Unified Extensible Firmware Interface (UEFI). - >Hint: To copy the file, right-click the **LiteTouchPE_x86.iso** file and click **Copy** on SRV1, then open the **c:\VHD** folder on the Hyper-V host, right-click inside the folder and click **Paste**. + > [!TIP] + > To copy the file, right-click the **LiteTouchPE_x86.iso** file and click **Copy** on SRV1, then open the **c:\VHD** folder on the Hyper-V host, right-click inside the folder and click **Paste**. 26. Open a Windows PowerShell prompt on the Hyper-V host computer and type the following commands: -
    - 
    -
+    ```powershell
     New-VM REFW10X64-001 -SwitchName poc-internal -NewVHDPath "c:\VHD\REFW10X64-001.vhdx" -NewVHDSizeBytes 60GB
     Set-VMMemory REFW10X64-001 -DynamicMemoryEnabled $true -MinimumBytes 1024MB -MaximumBytes 1024MB -Buffer 20
     Set-VMDvdDrive REFW10X64-001 -Path c:\VHD\LiteTouchPE_x86.iso
     Start-VM REFW10X64-001
     vmconnect localhost REFW10X64-001
-
    -
    + ``` The VM will require a few minutes to prepare devices and boot from the LiteTouchPE_x86.iso file. @@ -307,7 +300,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 1. On SRV1, open an elevated Windows PowerShell prompt and type the following commands: - ``` + ```powershell copy-item "C:\Program Files\Microsoft Deployment Toolkit\Templates\Bootstrap.ini" C:\MDTProd\Control\Bootstrap.ini -Force copy-item "C:\Program Files\Microsoft Deployment Toolkit\Templates\CustomSettings.ini" C:\MDTProd\Control\CustomSettings.ini -Force ``` @@ -315,7 +308,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 3. Click the **Rules** tab and replace the rules with the following text (don't click OK yet): - ``` + ```text [Settings] Priority=Default @@ -351,19 +344,21 @@ This procedure will demonstrate how to deploy the reference image to the PoC env SkipFinalSummary=NO EventService=http://SRV1:9800 ``` - **Note**: The contents of the Rules tab are added to c:\MDTProd\Control\CustomSettings.ini. + + > [!NOTE] + > The contents of the Rules tab are added to c:\MDTProd\Control\CustomSettings.ini. - >In this example a **MachineObjectOU** entry is not provided. Normally this entry describes the specific OU where new client computer objects are created in Active Directory. However, for the purposes of this test lab clients are added to the default computers OU, which requires that this parameter be unspecified. + In this example a **MachineObjectOU** entry is not provided. Normally this entry describes the specific OU where new client computer objects are created in Active Directory. However, for the purposes of this test lab clients are added to the default computers OU, which requires that this parameter be unspecified. If desired, edit the follow line to include or exclude other users when migrating settings. Currently, the command is set to user exclude (ue) all users except for CONTOSO users specified by the user include option (ui): - ``` + ```console ScanStateArgs=/ue:*\* /ui:CONTOSO\* ``` For example, to migrate **all** users on the computer, replace this line with the following: - ``` + ```console ScanStateArgs=/all ``` @@ -371,7 +366,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 4. Click **Edit Bootstap.ini** and replace text in the file with the following text: - ``` + ```text [Settings] Priority=Default @@ -382,6 +377,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env UserPassword=pass@word1 SkipBDDWelcome=YES ``` + 5. Click **OK** when finished. ### Update the deployment share @@ -406,7 +402,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 1. Initialize Windows Deployment Services (WDS) by typing the following command at an elevated Windows PowerShell prompt on SRV1: - ``` + ```powershell WDSUTIL /Verbose /Progress /Initialize-Server /Server:SRV1 /RemInst:"C:\RemoteInstall" WDSUTIL /Set-Server /AnswerClients:All ``` @@ -421,11 +417,12 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 1. Before using WDS to deploy a client image, you must temporarily disable the external network adapter on SRV1. This is just an artifact of the lab environment. In a typical deployment environment WDS would not be installed on the default gateway. - >**Note**: Do not disable the *internal* network interface. To quickly view IP addresses and interface names configured on the VM, type **Get-NetIPAddress | ft interfacealias, ipaddress** + > [!NOTE] + > Do not disable the *internal* network interface. To quickly view IP addresses and interface names configured on the VM, type **Get-NetIPAddress | ft interfacealias, ipaddress** Assuming the external interface is named "Ethernet 2", to disable the *external* interface on SRV1, open a Windows PowerShell prompt on SRV1 and type the following command: - ``` + ```powershell Disable-NetAdapter "Ethernet 2" -Confirm:$false ``` @@ -434,28 +431,30 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 2. Next, switch to the Hyper-V host and open an elevated Windows PowerShell prompt. Create a generation 2 VM on the Hyper-V host that will load its OS using PXE. To create this VM, type the following commands at an elevated Windows PowerShell prompt: - ``` + ```powershell New-VM –Name "PC2" –NewVHDPath "c:\vhd\pc2.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 Set-VMMemory -VMName "PC2" -DynamicMemoryEnabled $true -MinimumBytes 720MB -MaximumBytes 2048MB -Buffer 20 ``` - >Dynamic memory is configured on the VM to conserve resources. However, this can cause memory allocation to be reduced past what is required to install an operating system. If this happens, reset the VM and begin the OS installation task sequence immediately. This ensures the VM memory allocation is not decreased too much while it is idle. + Dynamic memory is configured on the VM to conserve resources. However, this can cause memory allocation to be reduced past what is required to install an operating system. If this happens, reset the VM and begin the OS installation task sequence immediately. This ensures the VM memory allocation is not decreased too much while it is idle. 3. Start the new VM and connect to it: - ``` + ```powershell Start-VM PC2 vmconnect localhost PC2 ``` + 4. When prompted, hit ENTER to start the network boot process. 5. In the Windows Deployment Wizard, choose the **Windows 10 Enterprise x64 Custom Image** and then click **Next**. 6. After MDT lite touch installation has started, be sure to re-enable the external network adapter on SRV1. This is needed so the client can use Windows Update after operating system installation is complete.To re-enable the external network interface, open an elevated Windows PowerShell prompt on SRV1 and type the following command: - ``` + ```powershell Enable-NetAdapter "Ethernet 2" ``` + 7. On SRV1, in the Deployment Workbench console, click on **Monitoring** and view the status of installation. Right-click **Monitoring** and click **Refresh** if no data is displayed. 8. OS installation requires about 10 minutes. When the installation is complete, the system will reboot automatically, configure devices, and install updates, requiring another 10-20 minutes. When the new client computer is finished updating, click **Finish**. You will be automatically signed in to the local computer as administrator. @@ -470,34 +469,36 @@ This section will demonstrate how to export user data from an existing client co 1. If the PC1 VM is not already running, then start and connect to it: - ``` + ```powershell Start-VM PC1 vmconnect localhost PC1 ``` 2. Switch back to the Hyper-V host and create a checkpoint for the PC1 VM so that it can easily be reverted to its current state for troubleshooting purposes and to perform additional scenarios. Checkpoints are also known as snapshots. To create a checkpoint for the PC1 VM, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: - ``` + ```powershell Checkpoint-VM -Name PC1 -SnapshotName BeginState ``` 3. Sign on to PC1 using the CONTOSO\Administrator account. - >Specify **contoso\administrator** as the user name to ensure you do not sign on using the local administrator account. You must sign in with this account so that you have access to the deployment share. + Specify **contoso\administrator** as the user name to ensure you do not sign on using the local administrator account. You must sign in with this account so that you have access to the deployment share. 4. Open an elevated command prompt on PC1 and type the following: - ``` + ```console cscript \\SRV1\MDTProd$\Scripts\Litetouch.vbs ``` - **Note**: For more information on tools for viewing log files and to assist with troubleshooting, see [Configuration Manager Tools](/configmgr/core/support/tools). + > [!NOTE] + > For more information on tools for viewing log files and to assist with troubleshooting, see [Configuration Manager Tools](/configmgr/core/support/tools). 5. Choose the **Windows 10 Enterprise x64 Custom Image** and then click **Next**. 6. Choose **Do not back up the existing computer** and click **Next**. - **Note**: The USMT will still back up the computer. + > [!NOTE] + > The USMT will still back up the computer. 7. Lite Touch Installation will perform the following actions: - Back up user settings and data using USMT. @@ -511,13 +512,13 @@ This section will demonstrate how to export user data from an existing client co 9. Create another checkpoint for the PC1 VM so that you can review results of the computer refresh later. To create a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: - ``` + ```powershell Checkpoint-VM -Name PC1 -SnapshotName RefreshState ``` 10. Restore the PC1 VM to it's previous state in preparation for the replace procedure. To restore a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: - ``` + ```powershell Restore-VMSnapshot -VMName PC1 -Name BeginState -Confirm:$false Start-VM PC1 vmconnect localhost PC1 @@ -537,11 +538,12 @@ At a high level, the computer replace process consists of:
    2. Click **OK**, right-click **MDT Production**, click **Update Deployment Share** and accept the default options in the wizard to update the share. 3. Type the following commands at an elevated Windows PowerShell prompt on SRV1: - ``` + ```powershell New-Item -Path C:\MigData -ItemType directory New-SmbShare -Name MigData$ -Path C:\MigData -ChangeAccess EVERYONE icacls C:\MigData /grant '"contoso\administrator":(OI)(CI)(M)' ``` + 4. On SRV1 in the deployment workbench, under **MDT Production**, right-click the **Task Sequences** node, and click **New Folder**. 5. Name the new folder **Other**, and complete the wizard using default options. 6. Right-click the **Other** folder and then click **New Task Sequence**. Use the following values in the wizard: @@ -556,21 +558,22 @@ At a high level, the computer replace process consists of:
    1. If you are not already signed on to PC1 as **contoso\administrator**, sign in using this account. To verify the currently signed in account, type the following command at an elevated command prompt: - ``` + ```console whoami ``` 2. To ensure a clean environment before running the backup task sequence, type the following at an elevated Windows PowerShell prompt on PC1: - ``` + ```powershell Remove-Item c:\minint -recurse Remove-Item c:\_SMSTaskSequence -recurse Restart-Computer ``` 3. Sign in to PC1 using the contoso\administrator account, and then type the following at an elevated command prompt: - ``` + ```console cscript \\SRV1\MDTProd$\Scripts\Litetouch.vbs ``` + 4. Complete the deployment wizard using the following: - **Task Sequence**: Backup Only Task Sequence - **User Data**: Specify a location: **\\\\SRV1\MigData$\PC1** @@ -579,7 +582,7 @@ At a high level, the computer replace process consists of:
    6. On PC1, verify that **The user state capture was completed successfully** is displayed, and click **Finish** when the capture is complete. 7. On SRV1, verify that the file **USMT.MIG** was created in the **C:\MigData\PC1\USMT** directory. See the following example: - ``` + ```powershell PS C:\> dir C:\MigData\PC1\USMT Directory: C:\MigData\PC1\USMT @@ -588,49 +591,52 @@ At a high level, the computer replace process consists of:
    ---- ------------- ------ ---- -a--- 9/6/2016 11:34 AM 14248685 USMT.MIG ``` - ### Deploy PC3 -8. On the Hyper-V host, type the following commands at an elevated Windows PowerShell prompt: +### Deploy PC3 - ``` +1. On the Hyper-V host, type the following commands at an elevated Windows PowerShell prompt: + + ```powershell New-VM –Name "PC3" –NewVHDPath "c:\vhd\pc3.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 Set-VMMemory -VMName "PC3" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes 2048MB -Buffer 20 ``` -9. Temporarily disable the external network adapter on SRV1 again, so that we can successfully boot PC3 from WDS. To disable the adapter, type the following command at an elevated Windows PowerShell prompt on SRV1: - ``` +2. Temporarily disable the external network adapter on SRV1 again, so that we can successfully boot PC3 from WDS. To disable the adapter, type the following command at an elevated Windows PowerShell prompt on SRV1: + + ```powershell Disable-NetAdapter "Ethernet 2" -Confirm:$false ``` - >As mentioned previously, ensure that you disable the **external** network adapter, and wait for the command to complete before proceeding. + As mentioned previously, ensure that you disable the **external** network adapter, and wait for the command to complete before proceeding. -10. Start and connect to PC3 by typing the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: +3. Start and connect to PC3 by typing the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: - ``` + ```powershell Start-VM PC3 vmconnect localhost PC3 ``` -11. When prompted, press ENTER for network boot. +4. When prompted, press ENTER for network boot. -12. On PC3, use the following settings for the Windows Deployment Wizard: +5. On PC3, use the following settings for the Windows Deployment Wizard: - **Task Sequence**: Windows 10 Enterprise x64 Custom Image - **Move Data and Settings**: Do not move user data and settings - **User Data (Restore)**: Specify a location: **\\\\SRV1\MigData$\PC1** -13. When OS installation has started on PC1, re-enable the external network adapter on SRV1 by typing the following command on SRV1: +6. When OS installation has started on PC1, re-enable the external network adapter on SRV1 by typing the following command on SRV1: - ``` + ```powershell Enable-NetAdapter "Ethernet 2" ``` -14. Setup will install the Windows 10 Enterprise operating system, update via Windows Update, and restore the user settings and data from PC1. -15. When PC3 has completed installing the OS, sign in to PC3 using the contoso\administrator account. When the PC completes updating, click **Finish**. +7. Setup will install the Windows 10 Enterprise operating system, update via Windows Update, and restore the user settings and data from PC1. -16. Verify that settings have been migrated from PC1. This completes demonstration of the replace procedure. +8. When PC3 has completed installing the OS, sign in to PC3 using the contoso\administrator account. When the PC completes updating, click **Finish**. -17. Shut down PC3 in preparation for the [next](windows-10-poc-sc-config-mgr.md) procedure. +9. Verify that settings have been migrated from PC1. This completes demonstration of the replace procedure. + +10. Shut down PC3 in preparation for the [next](windows-10-poc-sc-config-mgr.md) procedure. ## Troubleshooting logs, events, and utilities diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md index 3855f4698d..fe437a325e 100644 --- a/windows/deployment/windows-10-poc.md +++ b/windows/deployment/windows-10-poc.md @@ -39,6 +39,7 @@ Approximately 3 hours are required to configure the PoC environment. You will ne Windows PowerShell commands are provided to set up the PoC environment quickly. You do not need to be an expert in Windows PowerShell to complete the steps in the guide, however you are required to customize some commands to your environment. +> [!TIP] > Instructions to "type" Windows PowerShell commands provided in this guide can be followed literally by typing the commands, but the preferred method is to copy and paste these commands. > > A Windows PowerShell window can be used to run all commands in this guide. However, when commands are specified for a command prompt, you must either type CMD at the Windows PowerShell prompt to enter the command prompt, or preface the command with "cmd /c", or if desired you can escape special characters in the command using the back-tick character (`). In most cases, the simplest thing is to type cmd and enter a command prompt, type the necessary commands, then type "exit" to return to Windows PowerShell. @@ -53,26 +54,22 @@ After completing the instructions in this guide, you will have a PoC environment Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed. -
    +
    -
    - - - -
    TopicDescriptionTime
    Hardware and software requirementsPrerequisites to complete this guide.Informational -
    Lab setupA description and diagram of the PoC environment.Informational -
    Configure the PoC environmentParent topic for procedures.Informational -
    Verify support and install Hyper-VVerify that installation of Hyper-V is supported, and install the Hyper-V server role.10 minutes -
    Download VHD and ISO filesDownload evaluation versions of Windows Server 2012 R2 and Windows 10 and prepare these files to be used on the Hyper-V host.30 minutes -
    Convert PC to VMConvert a physical computer on your network to a VM hosted in Hyper-V.30 minutes -
    Resize VHDIncrease the storage capacity for one of the Windows Server VMs.5 minutes -
    Configure Hyper-VCreate virtual switches, determine available RAM for virtual machines, and add virtual machines.15 minutes -
    Configure service and user accountsStart virtual machines and configure all services and settings.60 minutes -
    Configure VMsStart virtual machines and configure all services and settings.60 minutes -
    Appendix A: Verify the configurationVerify and troubleshoot network connectivity and services in the PoC environment.30 minutes -
    Appendix B: Terminology in this guideTerms used in this guide.Informational -
    -
    +|Topic|Description|Time| +|--- |--- |--- | +|[Hardware and software requirements](#hardware-and-software-requirements)|Prerequisites to complete this guide.|Informational| +|[Lab setup](#lab-setup)|A description and diagram of the PoC environment.|Informational| +|[Configure the PoC environment](#configure-the-poc-environment)|Parent topic for procedures.|Informational| +|[Verify support and install Hyper-V](#verify-support-and-install-hyper-v)|Verify that installation of Hyper-V is supported, and install the Hyper-V server role.|10 minutes| +|[Download VHD and ISO files](#download-vhd-and-iso-files)|Download evaluation versions of Windows Server 2012 R2 and Windows 10 and prepare these files to be used on the Hyper-V host.|30 minutes| +|[Convert PC to VM](#convert-pc-to-vm)|Convert a physical computer on your network to a VM hosted in Hyper-V.|30 minutes| +|[Resize VHD](#resize-vhd)|Increase the storage capacity for one of the Windows Server VMs.|5 minutes| +|[Configure Hyper-V](#configure-hyper-v)|Create virtual switches, determine available RAM for virtual machines, and add virtual machines.|15 minutes| +|[Configure service and user accounts](#configure-vms)|Start virtual machines and configure all services and settings.|60 minutes| +|[Configure VMs](#configure-vms)|Start virtual machines and configure all services and settings.|60 minutes| +|[Appendix A: Verify the configuration](#appendix-a-verify-the-configuration)|Verify and troubleshoot network connectivity and services in the PoC environment.|30 minutes| +|[Appendix B: Terminology in this guide](#appendix-b-terminology-used-in-this-guide)|Terms used in this guide.|Informational| ## Hardware and software requirements @@ -83,68 +80,25 @@ One computer that meets the hardware and software specifications below is requir Hardware requirements are displayed below: -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Computer 1 (required)Computer 2 (recommended)
    RoleHyper-V hostClient computer
    DescriptionThis computer will run Hyper-V, the Hyper-V management tools, and the Hyper-V Windows PowerShell module.This computer is a Windows 7 or Windows 8/8.1 client on your corporate network that will be converted to a VM to demonstrate the upgrade process.
    OSWindows 8.1/10 or Windows Server 2012/2012 R2/2016*Windows 7 or a later
    EditionEnterprise, Professional, or EducationAny
    Architecture64-bitAny
    Note: Retaining applications and settings requires that architecture (32 or 64-bit) is the same before and after the upgrade.
    RAM8 GB RAM (16 GB recommended) to test Windows 10 deployment with MDT. -
    16 GB RAM to test Windows 10 deployment with Microsoft Endpoint Configuration Manager.    		Any
    Disk200 GB available hard disk space, any format.Any size, MBR formatted.
    CPUSLAT-Capable CPUAny
    NetworkInternet connectionAny
    +
    +||Computer 1 (required)|Computer 2 (recommended)| +|--- |--- |--- | +|**Role**|Hyper-V host|Client computer| +|**Description**|This computer will run Hyper-V, the Hyper-V management tools, and the Hyper-V Windows PowerShell module.|This computer is a Windows 7 or Windows 8/8.1 client on your corporate network that will be converted to a VM to demonstrate the upgrade process.| +|**OS**|Windows 8.1/10 or Windows Server 2012/2012 R2/2016*|Windows 7 or a later| +|**Edition**|Enterprise, Professional, or Education|Any| +|**Architecture**|64-bit|Any

    *Note: Retaining applications and settings requires that architecture (32 or 64-bit) is the same before and after the upgrade.*| +|**RAM**|8 GB RAM (16 GB recommended) to test Windows 10 deployment with MDT.
    16 GB RAM to test Windows 10 deployment with Microsoft Endpoint Configuration Manager.|Any| +|**Disk**|200 GB available hard disk space, any format.|Any size, MBR formatted.| +|**CPU**|SLAT-Capable CPU|Any| +|**Network**|Internet connection|Any| \*The Hyper-V server role can also be installed on a computer running Windows Server 2008 R2. However, the Windows PowerShell module for Hyper-V is not available on Windows Server 2008 R2, therefore you cannot use many of the steps provided in this guide to configure Hyper-V. To manage Hyper-V on Windows Server 2008 R2, you can use Hyper-V WMI, or you can use the Hyper-V Manager console. Providing all steps in this guide as Hyper-V WMI or as 2008 R2 Hyper-V Manager procedures is beyond the scope of the guide. -
    -
    The Hyper-V role cannot be installed on Windows 7 or earlier versions of Windows. -
    +The Hyper-V role cannot be installed on Windows 7 or earlier versions of Windows. + + ## Lab setup @@ -156,13 +110,15 @@ The lab architecture is summarized in the following diagram: - Two VMs are running Windows Server 2012 R2 with required network services and tools installed. - Two VMs are client systems: One VM is intended to mirror a host on your corporate network (computer 2) and one VM is running Windows 10 Enterprise to demonstrate the hardware replacement scenario. ->If you have an existing Hyper-V host, you can use this host and skip the Hyper-V installation section in this guide. +> [!NOTE] +> If you have an existing Hyper-V host, you can use this host and skip the Hyper-V installation section in this guide. The two Windows Server VMs can be combined into a single VM to conserve RAM and disk space if required. However, instructions in this guide assume two server systems are used. Using two servers enables Active Directory Domain Services and DHCP to be installed on a server that is not directly connected to the corporate network. This mitigates the risk of clients on the corporate network receiving DHCP leases from the PoC network (i.e. "rogue" DHCP), and limits NETBIOS service broadcasts. ## Configure the PoC environment ->**Hint**: Before you begin, ensure that Windows PowerShell is pinned to the taskbar for easy access. If the Hyper-V host is running Windows Server then Windows PowerShell is automatically pinned to the taskbar. To pin Windows PowerShell to the taskbar on Windows 8.1 or Windows 10: Click **Start**, type **power**, right click **Windows PowerShell**, and then click **Pin to taskbar**. After Windows PowerShell is pinned to the taskbar, you can open an elevated Windows PowerShell prompt by right-clicking the icon on the taskbar and then clicking **Run as Administrator**. +> [!TIP] +> Before you begin, ensure that Windows PowerShell is pinned to the taskbar for easy access. If the Hyper-V host is running Windows Server then Windows PowerShell is automatically pinned to the taskbar. To pin Windows PowerShell to the taskbar on Windows 8.1 or Windows 10: Click **Start**, type **power**, right click **Windows PowerShell**, and then click **Pin to taskbar**. After Windows PowerShell is pinned to the taskbar, you can open an elevated Windows PowerShell prompt by right-clicking the icon on the taskbar and then clicking **Run as Administrator**. ### Procedures in this section @@ -179,7 +135,7 @@ Starting with Windows 8, the host computer’s microprocessor must support secon 1. To verify your computer supports SLAT, open an administrator command prompt, type **systeminfo**, press ENTER, and review the section displayed at the bottom of the output, next to Hyper-V Requirements. See the following example: - 
    +    ```console
     C:\>systeminfo
 
     ...
@@ -187,7 +143,7 @@ Starting with Windows 8, the host computer’s microprocessor must support secon
                                Virtualization Enabled In Firmware: Yes
                                Second Level Address Translation: Yes
                                Data Execution Prevention Available: Yes
-
    + ``` In this example, the computer supports SLAT and Hyper-V. @@ -195,7 +151,7 @@ Starting with Windows 8, the host computer’s microprocessor must support secon You can also identify Hyper-V support using [tools](/archive/blogs/taylorb/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v) provided by the processor manufacturer, the [msinfo32](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731397(v=ws.11)) tool, or you can download the [coreinfo](/sysinternals/downloads/coreinfo) utility and run it, as shown in the following example: - 
    +    ```console
     C:\>coreinfo -v
 
     Coreinfo v3.31 - Dump information on system CPU and memory topology
@@ -208,27 +164,32 @@ Starting with Windows 8, the host computer’s microprocessor must support secon
     HYPERVISOR      -       Hypervisor is present
     VMX             *       Supports Intel hardware-assisted virtualization
     EPT             *       Supports Intel extended page tables (SLAT)
-
    + ``` - Note: A 64-bit operating system is required to run Hyper-V. + > [!NOTE] + > A 64-bit operating system is required to run Hyper-V. 2. The Hyper-V feature is not installed by default. To install it, open an elevated Windows PowerShell window and type the following command: - 
    Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All
    + ```powershell + Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All + ``` This command works on all operating systems that support Hyper-V, but on Windows Server operating systems you must type an additional command to add the Hyper-V Windows PowerShell module and the Hyper-V Manager console. This command will also install Hyper-V if it isn't already installed, so if desired you can just type the following command on Windows Server 2012 or 2016 instead of using the Enable-WindowsOptionalFeature command: - 
    Install-WindowsFeature -Name Hyper-V -IncludeManagementTools
    + ```powershell + Install-WindowsFeature -Name Hyper-V -IncludeManagementTools + ``` When you are prompted to restart the computer, choose **Yes**. The computer might restart more than once. After installation is complete, you can open Hyper-V Manager by typing **virtmgmt.msc** at an elevated command prompt. - >Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: + Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: ![hyper-v features.](images/hyper-v-feature.png) ![hyper-v.](images/svr_mgr2.png) -

    If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. + If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. ### Download VHD and ISO files @@ -236,63 +197,65 @@ When you have completed installation of Hyper-V on the host computer, begin conf 1. Create a directory on your Hyper-V host named **C:\VHD** and download a single [Windows Server 2012 R2 VHD](https://www.microsoft.com/evalcenter/evaluate-windows-server-2012-r2) from the TechNet Evaluation Center to the **C:\VHD** directory. - **Important**: This guide assumes that VHDs are stored in the **C:\VHD** directory on the Hyper-V host. If you use a different directory to store VHDs, you must adjust steps in this guide appropriately. + > [!IMPORTANT] + > This guide assumes that VHDs are stored in the **C:\VHD** directory on the Hyper-V host. If you use a different directory to store VHDs, you must adjust steps in this guide appropriately. After completing registration you will be able to download the 7.47 GB Windows Server 2012 R2 evaluation VHD. An example of the download offering is shown below. - - -
    VHD
    + :::image type="content" alt-text="VHD" source="images/download_vhd.png"::: 2. Download the file to the **C:\VHD** directory. When the download is complete, rename the VHD file that you downloaded to **2012R2-poc-1.vhd**. This is done to make the filename simple to recognize and type. + 3. Copy the VHD to a second file also in the **C:\VHD** directory and name this VHD **2012R2-poc-2.vhd**. + 4. Download the [Windows 10 Enterprise ISO](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) from the TechNet Evaluation Center to the **C:\VHD** directory on your Hyper-V host. - >During registration, you must specify the type, version, and language of installation media to download. In this example, a Windows 10 Enterprise, 64 bit, English ISO is chosen. You can choose a different version if desired. **Note: The evaluation version of Windows 10 does not support in-place upgrade**. + During registration, you must specify the type, version, and language of installation media to download. In this example, a Windows 10 Enterprise, 64 bit, English ISO is chosen. You can choose a different version if desired. + + > [!NOTE] + > The evaluation version of Windows 10 does not support in-place upgrade**. 5. Rename the ISO file that you downloaded to **w10-enterprise.iso**. Again, this is done so that the filename is simple to type and recognize. After completing registration you will be able to download the 3.63 GB Windows 10 Enterprise evaluation ISO. -After completing these steps, you will have three files in the **C:\VHD** directory: **2012R2-poc-1.vhd**, **2012R2-poc-2.vhd**, **w10-enterprise.iso**. + After completing these steps, you will have three files in the **C:\VHD** directory: **2012R2-poc-1.vhd**, **2012R2-poc-2.vhd**, **w10-enterprise.iso**. -The following displays the procedures described in this section, both before and after downloading files: + The following displays the procedures described in this section, both before and after downloading files: -

    -C:>mkdir VHD
-C:>cd VHD
-C:\VHD>ren 9600*.vhd 2012R2-poc-1.vhd
-C:\VHD>copy 2012R2-poc-1.vhd 2012R2-poc-2.vhd
-   1 file(s) copied.
-C:\VHD ren *.iso w10-enterprise.iso
-C:\VHD>dir /B
-2012R2-poc-1.vhd
-2012R2-poc-2.vhd
-w10-enterprise.iso
-
    + ```console + C:>mkdir VHD + C:>cd VHD + C:\VHD>ren 9600*.vhd 2012R2-poc-1.vhd + C:\VHD>copy 2012R2-poc-1.vhd 2012R2-poc-2.vhd + 1 file(s) copied. + C:\VHD ren *.iso w10-enterprise.iso + C:\VHD>dir /B + 2012R2-poc-1.vhd + 2012R2-poc-2.vhd + w10-enterprise.iso + ``` ### Convert PC to VM ->Important: Do not attempt to use the VM resulting from the following procedure as a reference image. Also, to avoid conflicts with existing clients, do not start the VM outside the PoC network. +> [!IMPORTANT] +> Do not attempt to use the VM resulting from the following procedure as a reference image. Also, to avoid conflicts with existing clients, do not start the VM outside the PoC network. -
    If you do not have a PC available to convert to VM, perform the following steps to download an evaluation VM: -
    -
      -
    1. Open the Download virtual machines page. -
    2. Under Virtual machine, choose IE11 on Win7. -
    3. Under Select platform choose HyperV (Windows). -
    4. Click Download .zip. The download is 3.31 GB. -
    5. Extract the zip file. Three directories are created. -
    6. Open the Virtual Hard Disks directory and then copy IE11 - Win7.vhd to the C:\VHD directory. -
    7. Rename IE11 - Win7.vhd to w7.vhd (do not rename the file to w7.vhdx). -
    8. In step 5 of the Configure Hyper-V section, replace the VHD file name w7.vhdx with w7.vhd. -
    -
    + +1. Open the [Download virtual machines](https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/) page. +2. Under **Virtual machine**, choose **IE11 on Win7**. +3. Under **Select platform** choose **HyperV (Windows)**. +4. Click **Download .zip**. The download is 3.31 GB. +5. Extract the zip file. Three directories are created. +6. Open the **Virtual Hard Disks** directory and then copy **IE11 - Win7.vhd** to the **C:\VHD** directory. +7. Rename **IE11 - Win7.vhd** to **w7.vhd** (do not rename the file to w7.vhdx). +8. In step 5 of the [Configure Hyper-V](#configure-hyper-v) section, replace the VHD file name **w7.vhdx** with **w7.vhd**. If you have a PC available to convert to VM (computer 2): 1. Sign in on computer 2 using an account with Administrator privileges. ->Important: the account used in this step must have local administrator privileges. You can use a local computer account, or a domain account with administrative rights if domain policy allows the use of cached credentials. After converting the computer to a VM, you must be able to sign in on this VM with administrator rights while the VM is disconnected from the corporate network. + > [!IMPORTANT] + > The account used in this step must have local administrator privileges. You can use a local computer account, or a domain account with administrative rights if domain policy allows the use of cached credentials. After converting the computer to a VM, you must be able to sign in on this VM with administrator rights while the VM is disconnected from the corporate network. 2. [Determine the VM generation and partition type](#determine-the-vm-generation-and-partition-type) that is required. 3. Based on the VM generation and partition type, perform one of the following procedures: [Prepare a generation 1 VM](#prepare-a-generation-1-vm), [Prepare a generation 2 VM](#prepare-a-generation-2-vm), or [prepare a generation 1 VM from a GPT disk](#prepare-a-generation-1-vm-from-a-gpt-disk). @@ -301,54 +264,34 @@ If you have a PC available to convert to VM (computer 2): When creating a VM in Hyper-V, you must specify either generation 1 or generation 2. The following table describes requirements for these two types of VMs. -
    - - - - - - - - - - - - - - - - - - - - -
    ArchitectureOperating systemPartition style
    Generation 132-bit or 64-bitWindows 7 or laterMBR
    Generation 264-bitWindows 8 or laterMBR or GPT
    - -
    +||Architecture|Operating system|Partition style| +|--- |--- |--- |--- | +|**Generation 1**|32-bit or 64-bit|Windows 7 or later|MBR| +|**Generation 2**|64-bit|Windows 8 or later|MBR or GPT| If the PC is running a 32-bit OS or the OS is Windows 7, it must be converted to a generation 1 VM. Otherwise, it can be converted to a generation 2 VM. - To determine the OS and architecture of a PC, type **systeminfo** at a command prompt and review the output next to **OS Name** and **System Type**. - To determine the partition style, open a Windows PowerShell prompt on the PC and type the following command: -
    -Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type
-
    + ```powershell + Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type + ``` If the **Type** column does not indicate GPT, then the disk partition format is MBR ("Installable File System" = MBR). In the following example, the disk is GPT: -
    +```powershell
 PS C:> Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type
 
 SystemName                           Caption                                 Type
 ----------                           -------                                 ----
 USER-PC1                             Disk #0, Partition #0                   GPT: System
 USER-PC1                             Disk #0, Partition #1                   GPT: Basic Data
-
    +``` On a computer running Windows 8 or later, you can also type **Get-Disk** at a Windows PowerShell prompt to discover the partition style. The default output of this cmdlet displays the partition style for all attached disks. Both commands are displayed below. In this example, the client computer is running Windows 8.1 and uses a GPT style partition format: -
    +```powershell
 PS C:> Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type
 
 SystemName                            Caption                               Type
@@ -364,176 +307,162 @@ PS C:> Get-Disk
 Number Friendly Name                  OperationalStatus                     Total Size Partition Style
 ------ -------------                  -----------------                     ---------- ---------------
 0      INTEL SSDSCMMW240A3L           Online                                223.57 GB GPT
-
    +``` **Choosing a VM generation** -The following table displays the Hyper-V VM generation to choose based on the OS, architecture, and partition style. Links to procedures to create the corresponding VMs are included. +The following tables display the Hyper-V VM generation to choose based on the OS, architecture, and partition style. Links to procedures to create the corresponding VMs are included. -
    +**Windows 7 MBR** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    OSPartition styleArchitectureVM generationProcedure
    Windows 7MBR321Prepare a generation 1 VM
    641Prepare a generation 1 VM
    GPT32N/AN/A
    641Prepare a generation 1 VM from a GPT disk
    Windows 8 or laterMBR321Prepare a generation 1 VM
    641, 2Prepare a generation 1 VM
    GPT321Prepare a generation 1 VM from a GPT disk
    642Prepare a generation 2 VM
    +|Architecture|VM generation|Procedure| +|--- |--- |--- | +|32|1|[Prepare a generation 1 VM](#prepare-a-generation-1-vm)| +|64|1|[Prepare a generation 1 VM](#prepare-a-generation-1-vm)| -
    +**Windows 7 GPT** + +|Architecture|VM generation|Procedure| +|--- |--- |--- | +|32|N/A|N/A| +|64|1|[Prepare a generation 1 VM from a GPT disk](#prepare-a-generation-1-vm-from-a-gpt-disk)| + +**Windows 8 or later MBR** + +|Architecture|VM generation|Procedure| +|--- |--- |--- | +|32|1|[Prepare a generation 1 VM](#prepare-a-generation-1-vm)| +|64|1, 2|[Prepare a generation 1 VM](#prepare-a-generation-1-vm)| + +**Windows 8 or later GPT** + +|Architecture|VM generation|Procedure| +|--- |--- |--- | +|32|1|[Prepare a generation 1 VM from a GPT disk](#prepare-a-generation-1-vm-from-a-gpt-disk)| +|64|2|[Prepare a generation 2 VM](#prepare-a-generation-2-vm)| + +> [!NOTE] +> +>- If the PC is running Windows 7, it can only be converted and hosted in Hyper-V as a generation 1 VM. This Hyper-V requirement means that if the Windows 7 PC is also using a GPT partition style, the OS disk can be shadow copied, but a new system partition must be created. In this case, see [Prepare a generation 1 VM from a GPT disk](#prepare-a-generation-1-vm-from-a-gpt-disk). +> +>- If the PC is running Windows 8 or later and uses the GPT partition style, you can capture the disk image and create a generation 2 VM. To do this, you must temporarily mount the EFI system partition which is accomplished using the mountvol command. In this case, see [Prepare a generation 2 VM](#prepare-a-generation-2-vm). +> +>- If the PC is using an MBR partition style, you can convert the disk to VHD and use it to create a generation 1 VM. If you use the Disk2VHD tool described in this guide, it is not necessary to mount the MBR system partition, but it is still necessary to capture it. In this case, see [Prepare a generation 1 VM](#prepare-a-generation-1-vm). -Notes:
    -
      -
    • If the PC is running Windows 7, it can only be converted and hosted in Hyper-V as a generation 1 VM. This Hyper-V requirement means that if the Windows 7 PC is also using a GPT partition style, the OS disk can be shadow copied, but a new system partition must be created. In this case, see Prepare a generation 1 VM from a GPT disk. -
    • If the PC is running Windows 8 or later and uses the GPT partition style, you can capture the disk image and create a generation 2 VM. To do this, you must temporarily mount the EFI system partition which is accomplished using the mountvol command. In this case, see Prepare a generation 2 VM. -
    • If the PC is using an MBR partition style, you can convert the disk to VHD and use it to create a generation 1 VM. If you use the Disk2VHD tool described in this guide, it is not necessary to mount the MBR system partition, but it is still necessary to capture it. In this case, see Prepare a generation 1 VM. -
    #### Prepare a generation 1 VM 1. Download the [Disk2vhd utility](/sysinternals/downloads/disk2vhd), extract the .zip file and copy **disk2vhd.exe** to a flash drive or other location that is accessible from the computer you wish to convert. - >You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive. + > [!TIP] + > You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive. 2. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface. -3. Select the checkboxes next to the **C:\\** and the **system reserved** (BIOS/MBR) volumes. The system volume is not assigned a drive letter, but will be displayed in the Disk2VHD tool with a volume label similar to **\\?\Volume{**. See the following example. **Important**: You must include the system volume in order to create a bootable VHD. If this volume is not displayed in the disk2vhd tool, then the computer is likely to be using the GPT partition style. For more information, see [Determine VM generation](#determine-vm-generation). + +3. Select the checkboxes next to the **C:\\** and the **system reserved** (BIOS/MBR) volumes. The system volume is not assigned a drive letter, but will be displayed in the Disk2VHD tool with a volume label similar to **\\?\Volume{**. See the following example. + + > [!IMPORTANT] + > You must include the system volume in order to create a bootable VHD. If this volume is not displayed in the disk2vhd tool, then the computer is likely to be using the GPT partition style. For more information, see [Determine VM generation](#determine-vm-generation). + 4. Specify a location to save the resulting VHD or VHDX file (F:\VHD\w7.vhdx in the following example) and click **Create**. See the following example: ![disk2vhd 1.](images/disk2vhd.png) - >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. + Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better, however, when the VHD is saved on a disk different than those being converted, such as a flash drive. 5. When the Disk2vhd utility has completed converting the source computer to a VHD, copy the VHDX file (w7.vhdx) to your Hyper-V host in the C:\VHD directory. There should now be four files in this directory: - 
    +    ```cmd
     C:\vhd>dir /B
     2012R2-poc-1.vhd
     2012R2-poc-2.vhd
     w10-enterprise.iso
     w7.VHDX
-
    + ``` #### Prepare a generation 2 VM 1. Download the [Disk2vhd utility](/sysinternals/downloads/disk2vhd), extract the .zip file and copy **disk2vhd.exe** to a flash drive or other location that is accessible from the computer you wish to convert. - >You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive. + > [!TIP] + > You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive. 2. On the computer you wish to convert, open an elevated command prompt and type the following command: - 
    mountvol s: /s
    + ```console + mountvol s: /s + ``` This command temporarily assigns a drive letter of S to the system volume and mounts it. If the letter S is already assigned to a different volume on the computer, then choose one that is available (ex: mountvol z: /s). 3. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface. 4. Select the checkboxes next to the **C:\\** and the **S:\\** volumes, and clear the **Use Volume Shadow Copy checkbox**. Volume shadow copy will not work if the EFI system partition is selected. - **Important**: You must include the EFI system partition in order to create a bootable VHD. The Windows RE tools partition (shown below) is not required, but it can also be converted if desired. + > [!IMPORTANT] + > You must include the EFI system partition in order to create a bootable VHD. The Windows RE tools partition (shown below) is not required, but it can also be converted if desired. 5. Specify a location to save the resulting VHD or VHDX file (F:\VHD\PC1.vhdx in the following example) and click **Create**. See the following example: ![disk2vhd 2.](images/disk2vhd-gen2.png) - >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. + Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. 6. When the Disk2vhd utility has completed converting the source computer to a VHD, copy the VHDX file (PC1.vhdx) to your Hyper-V host in the C:\VHD directory. There should now be four files in this directory: - 
    +    ```console
     C:\vhd>dir /B
     2012R2-poc-1.vhd
     2012R2-poc-2.vhd
     w10-enterprise.iso
     PC1.VHDX
-
    + ``` #### Prepare a generation 1 VM from a GPT disk 1. Download the [Disk2vhd utility](/sysinternals/downloads/disk2vhd), extract the .zip file and copy **disk2vhd.exe** to a flash drive or other location that is accessible from the computer you wish to convert. - >You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive. + You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive. 2. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface. -3. Select the checkbox next to the **C:\\** volume and clear the checkbox next to **Use Vhdx**. Note: the system volume is not copied in this scenario, it will be added later. +3. Select the checkbox next to the **C:\\** volume and clear the checkbox next to **Use Vhdx**. + + > [!NOTE] + > The system volume is not copied in this scenario, it will be added later. + 4. Specify a location to save the resulting VHD file (F:\VHD\w7.vhd in the following example) and click **Create**. See the following example: ![disk2vhd 3.](images/disk2vhd4.png) - >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. + Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. 5. When the Disk2vhd utility has completed converting the source computer to a VHD, copy the VHD file (w7.vhd) to your Hyper-V host in the C:\VHD directory. There should now be four files in this directory: - 
    +    ```cmd
     C:\vhd>dir /B
     2012R2-poc-1.vhd
     2012R2-poc-2.vhd
     w10-enterprise.iso
     w7.VHD
-
    + ``` - >In its current state, the w7.VHD file is not bootable. The VHD will be used to create a bootable VM later in the [Configure Hyper-V](#configure-hyper-v) section. + In its current state, the w7.VHD file is not bootable. The VHD will be used to create a bootable VM later in the [Configure Hyper-V](#configure-hyper-v) section. ### Resize VHD -
    Enhanced session mode -**Important**: Before proceeding, verify that you can take advantage of [enhanced session mode](/windows-server/virtualization/hyper-v/learn-more/Use-local-resources-on-Hyper-V-virtual-machine-with-VMConnect) when completing instructions in this guide. Enhanced session mode enables you to copy and paste the commands from the Hyper-V host to VMs, between VMs, and between RDP sessions. After copying some text, you can paste into a Windows PowerShell window by simply right-clicking. Before right-clicking, do not left click other locations as this can empty the clipboard. You can also copy and paste files directly from one computer to another by right-clicking and selecting copy on one computer, then right-clicking and selecting paste on another computer. +> [!IMPORTANT] +> Before proceeding, verify that you can take advantage of [enhanced session mode](/windows-server/virtualization/hyper-v/learn-more/Use-local-resources-on-Hyper-V-virtual-machine-with-VMConnect) when completing instructions in this guide. Enhanced session mode enables you to copy and paste the commands from the Hyper-V host to VMs, between VMs, and between RDP sessions. After copying some text, you can paste into a Windows PowerShell window by simply right-clicking. Before right-clicking, do not left click other locations as this can empty the clipboard. You can also copy and paste files directly from one computer to another by right-clicking and selecting copy on one computer, then right-clicking and selecting paste on another computer. To ensure that enhanced session mode is enabled on the Hyper-V host, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: -
    Set-VMhost -EnableEnhancedSessionMode $TRUE
    +```powershell +Set-VMhost -EnableEnhancedSessionMode $TRUE +``` ->If enhanced session mode was not previously enabled, close any existing virtual machine connections and re-open them to enable access to enhanced session mode. As mentioned previously: instructions to "type" commands provided in this guide can be typed, but the preferred method is to copy and paste these commands. Most of the commands to this point in the guide have been brief, but many commands in sections below are longer and more complex. +If enhanced session mode was not previously enabled, close any existing virtual machine connections and re-open them to enable access to enhanced session mode. As mentioned previously: instructions to "type" commands provided in this guide can be typed, but the preferred method is to copy and paste these commands. Most of the commands to this point in the guide have been brief, but many commands in sections below are longer and more complex.
    @@ -541,58 +470,66 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 1. To add available space for the partition, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: - 
    +    ```powershell
     Resize-VHD -Path c:\VHD\2012R2-poc-2.vhd -SizeBytes 100GB
     $x = (Mount-VHD -Path c:\VHD\2012R2-poc-2.vhd -passthru | Get-Disk | Get-Partition | Get-Volume).DriveLetter
     Resize-Partition -DriveLetter $x -Size (Get-PartitionSupportedSize -DriveLetter $x).SizeMax
-
    + ``` 2. Verify that the mounted VHD drive is resized to 100 GB, and then dismount the drive: - 
    +    ```powershell
     Get-Volume -DriveLetter $x
-    Dismount-VHD -Path c:\VHD\2012R2-poc-2.vhd
    + Dismount-VHD -Path c:\VHD\2012R2-poc-2.vhd + ``` ### Configure Hyper-V 1. Open an elevated Windows PowerShell window and type the following command to create two virtual switches named "poc-internal" and "poc-external": - >If the Hyper-V host already has an external virtual switch bound to a physical NIC, do not attempt to add a second external virtual switch. Attempting to add a second external switch will result in an error indicating that the NIC is **already bound to the Microsoft Virtual Switch protocol.** In this case, choose one of the following options:
    -    A) Remove the existing external virtual switch, then add the poc-external switch
    -    B) Rename the existing external switch to "poc-external"
    -    C) Replace each instance of "poc-external" used in this guide with the name of your existing external virtual switch
    + If the Hyper-V host already has an external virtual switch bound to a physical NIC, do not attempt to add a second external virtual switch. Attempting to add a second external switch will result in an error indicating that the NIC is **already bound to the Microsoft Virtual Switch protocol.** In this case, choose one of the following options: + + **A**: Remove the existing external virtual switch, then add the poc-external switch + + **B**: Rename the existing external switch to "poc-external" + + **C**: Replace each instance of "poc-external" used in this guide with the name of your existing external virtual switch
    + If you choose B) or C), then do not run the second command below. - 
    +    ```powershell
     New-VMSwitch -Name poc-internal -SwitchType Internal -Notes "PoC Network"
     New-VMSwitch -Name poc-external -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name -Notes "PoC External"
-
    + ``` - **Note**: The second command above will temporarily interrupt network connectivity on the Hyper-V host. + > [!NOTE] + > The second command above will temporarily interrupt network connectivity on the Hyper-V host. - >Since an external virtual switch is associated to a physical network adapter on the Hyper-V host, this adapter must be specified when adding the virtual switch. The previous commands automate this by filtering for active non-virtual ethernet adapters using the Get-NetAdapter cmdlet ($_.Status -eq "Up" -and !$_.Virtual). If your Hyper-V host is dual-homed with multiple active ethernet adapters, this automation will not work, and the second command above will fail. In this case, you must edit the command used to add the "poc-external" virtual switch by inserting the appropriate NetAdapterName. The NetAdapterName value corresponds to the name of the network interface you wish to use. For example, if the network interface you use on the Hyper-V host to connect to the Internet is named "Ethernet 2" then type the following command to create an external virtual switch: New-VMSwitch -Name poc-external -NetAdapterName "Ethernet 2" -Notes "PoC External" + Since an external virtual switch is associated to a physical network adapter on the Hyper-V host, this adapter must be specified when adding the virtual switch. The previous commands automate this by filtering for active non-virtual ethernet adapters using the Get-NetAdapter cmdlet ($_.Status -eq "Up" -and !$_.Virtual). If your Hyper-V host is dual-homed with multiple active ethernet adapters, this automation will not work, and the second command above will fail. In this case, you must edit the command used to add the "poc-external" virtual switch by inserting the appropriate NetAdapterName. The NetAdapterName value corresponds to the name of the network interface you wish to use. For example, if the network interface you use on the Hyper-V host to connect to the Internet is named "Ethernet 2" then type the following command to create an external virtual switch: New-VMSwitch -Name poc-external -NetAdapterName "Ethernet 2" -Notes "PoC External" 2. At the elevated Windows PowerShell prompt, type the following command to determine the megabytes of RAM that are currently available on the Hyper-V host: - 
    +    ```powershell
     (Get-VMHostNumaNode).MemoryAvailable
-
    + ``` This command will display the megabytes of RAM available for VMs. On a Hyper-V host computer with 16 GB of physical RAM installed, 10,000 MB of RAM or greater should be available if the computer is not also running other applications. On a computer with 8 GB of physical RAM installed, at least 4000 MB should be available. If the computer has less RAM available than this, try closing applications to free up more memory. 3. Determine the available memory for VMs by dividing the available RAM by 4. For example: - 
    +    ```powershell
     (Get-VMHostNumaNode).MemoryAvailable/4
     2775.5
-
    + ``` In this example, VMs can use a maximum of 2700 MB of RAM each, to run four VMs simultaneously. 4. At the elevated Windows PowerShell prompt, type the following command to create two new VMs. Other VMs will be added later. - >**Important**: Replace the value of 2700MB for $maxRAM in the first command below with the RAM value that you calculated in the previous step. - 
    +    > [!IMPORTANT]
+    > Replace the value of 2700MB for $maxRAM in the first command below with the RAM value that you calculated in the previous step.
+
+    ```powershell
     $maxRAM = 2700MB
     New-VM -Name "DC1" -VHDPath c:\vhd\2012R2-poc-1.vhd -SwitchName poc-internal
     Set-VMMemory -VMName "DC1" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes $maxRAM -Buffer 20
@@ -601,35 +538,37 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
     Add-VMNetworkAdapter -VMName "SRV1" -SwitchName "poc-external"
     Set-VMMemory -VMName "SRV1" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes $maxRAM -Buffer 80
     Enable-VMIntegrationService -Name "Guest Service Interface" -VMName SRV1
-
    + ``` - **Note**: The RAM values assigned to VMs in this step are not permanent, and can be easily increased or decreased later if needed to address performance issues. + > [!NOTE] + > The RAM values assigned to VMs in this step are not permanent, and can be easily increased or decreased later if needed to address performance issues. 5. Using the same elevated Windows PowerShell prompt that was used in the previous step, type one of the following sets of commands, depending on the type of VM that was prepared in the [Determine VM generation](#determine-vm-generation) section, either generation 1, generation 2, or generation 1 with GPT. To create a generation 1 VM (using c:\vhd\w7.vhdx): - 
    +    ```powershell
     New-VM -Name "PC1" -VHDPath c:\vhd\w7.vhdx -SwitchName poc-internal
     Set-VMMemory -VMName "PC1" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes $maxRAM -Buffer 20
     Enable-VMIntegrationService -Name "Guest Service Interface" -VMName PC1
-
    + ``` To create a generation 2 VM (using c:\vhd\PC1.vhdx): - 
    +    ```powershell
     New-VM -Name "PC1" -Generation 2 -VHDPath c:\vhd\PC1.vhdx -SwitchName poc-internal
     Set-VMMemory -VMName "PC1" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes $maxRAM -Buffer 20
     Enable-VMIntegrationService -Name "Guest Service Interface" -VMName PC1
-
    + ``` To create a generation 1 VM from a GPT disk (using c:\vhd\w7.vhd): - >Note: The following procedure is more complex because it includes steps to convert the OS partition from GPT to MBR format. Steps are included to create a temporary VHD and attach it to the VM, the OS image is saved to this drive, the OS drive is then reformatted to MBR, the OS image restored, and the temporary drive is removed. + > [!NOTE] + > The following procedure is more complex because it includes steps to convert the OS partition from GPT to MBR format. Steps are included to create a temporary VHD and attach it to the VM, the OS image is saved to this drive, the OS drive is then reformatted to MBR, the OS image restored, and the temporary drive is removed. First, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host to create a temporary VHD that will be used to save the OS image. Do not forget to include a pipe (|) at the end of the first five commands: - 
    +    ```powershell
     New-VHD -Path c:\vhd\d.vhd -SizeBytes 1TB |
     Mount-VHD -Passthru |
     Get-Disk -Number {$_.DiskNumber} |
@@ -637,11 +576,11 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
     New-Partition -UseMaximumSize |
     Format-Volume -Confirm:$false -FileSystem NTFS -force
     Dismount-VHD -Path c:\vhd\d.vhd
-
    + ``` Next, create the PC1 VM with two attached VHDs, and boot to DVD ($maxram must be defined previously using the same Windows PowerShell prompt): - 
    +    ```powershell
     New-VM -Name "PC1" -VHDPath c:\vhd\w7.vhd -SwitchName poc-internal
     Add-VMHardDiskDrive -VMName PC1 -Path c:\vhd\d.vhd
     Set-VMDvdDrive -VMName PC1 -Path c:\vhd\w10-enterprise.iso
@@ -649,7 +588,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
     Enable-VMIntegrationService -Name "Guest Service Interface" -VMName PC1
     Start-VM PC1
     vmconnect localhost PC1
-
    + ``` The VM will automatically boot into Windows Setup. In the PC1 window: @@ -659,13 +598,13 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 4. Click **Command Prompt**. 5. Type the following command to save an image of the OS drive: - 
    +      ```console
       dism /Capture-Image /ImageFile:D:\c.wim /CaptureDir:C:\ /Name:Drive-C
-
    + ``` 6. Wait for the OS image to complete saving, and then type the following commands to convert the C: drive to MBR: - 
    +      ```console
       diskpart
       select disk 0
       clean
@@ -677,121 +616,122 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
       format fs=ntfs quick label=OS
       assign letter=c
       exit
-
    + ``` 7. Type the following commands to restore the OS image and boot files: - 
    +      ```console
       dism /Apply-Image /ImageFile:D:\c.wim /Index:1 /ApplyDir:C:\
       bcdboot c:\windows
       exit
-
    + ``` 8. Click **Continue** and verify the VM boots successfully (do not boot from DVD). 9. Click **Ctrl+Alt+Del**, and then in the bottom right corner, click **Shut down**. 10. Type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host to remove the temporary disks and drives from PC1: - 
    -       Remove-VMHardDiskDrive -VMName PC1 -ControllerType IDE -ControllerNumber 0 -ControllerLocation 1
-       Set-VMDvdDrive -VMName PC1 -Path $null
-
    + ```powershell + Remove-VMHardDiskDrive -VMName PC1 -ControllerType IDE -ControllerNumber 0 -ControllerLocation 1 + Set-VMDvdDrive -VMName PC1 -Path $null + ``` ### Configure VMs 1. At an elevated Windows PowerShell prompt on the Hyper-V host, start the first Windows Server VM and connect to it by typing the following commands: - 
    +    ```powershell
     Start-VM DC1
     vmconnect localhost DC1
-
    + ``` 2. Click **Next** to accept the default settings, read the license terms and click **I accept**, provide an administrator password of pass@word1, and click **Finish**. 3. Click **Ctrl+Alt+Del** in the upper left corner of the virtual machine connection window, and then sign in to DC1 using the Administrator account. 4. Right-click **Start**, point to **Shut down or sign out**, and click **Sign out**. The VM connection will reset and a new connection dialog box will appear enabling you to choose a custom display configuration. Select a desktop size, click **Connect** and sign in again with the local Administrator account. Note: Signing in this way ensures that [enhanced session mode](/windows-server/virtualization/hyper-v/learn-more/Use-local-resources-on-Hyper-V-virtual-machine-with-VMConnect) is enabled. It is only necessary to do this the first time you sign in to a new VM. 5. If DC1 is configured as described in this guide, it will currently be assigned an APIPA address, have a randomly generated hostname, and a single network adapter named "Ethernet." Open an elevated Windows PowerShell prompt on DC1 and type or paste the following commands to provide a new hostname and configure a static IP address and gateway: - 
    +    ```powershell
     Rename-Computer DC1
     New-NetIPAddress -InterfaceAlias Ethernet -IPAddress 192.168.0.1 -PrefixLength 24 -DefaultGateway 192.168.0.2
     Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 192.168.0.1,192.168.0.2
-
    + ``` - > The default gateway at 192.168.0.2 will be configured later in this guide. - > - > Note: A list of available tasks for an app will be populated the first time you run it on the taskbar. Because these tasks aren't available until the App has been run, you will not see the **Run as Administrator** task until you have left-clicked Windows PowerShell for the first time. In this newly created VM, you will need to left-click Windows PowerShell one time, and then you can right-click and choose Run as Administrator to open an elevated Windows PowerShell prompt. + The default gateway at 192.168.0.2 will be configured later in this guide. + + > [!NOTE] + > A list of available tasks for an app will be populated the first time you run it on the taskbar. Because these tasks aren't available until the App has been run, you will not see the **Run as Administrator** task until you have left-clicked Windows PowerShell for the first time. In this newly created VM, you will need to left-click Windows PowerShell one time, and then you can right-click and choose Run as Administrator to open an elevated Windows PowerShell prompt. 6. Install the Active Directory Domain Services role by typing the following command at an elevated Windows PowerShell prompt: - 
    +    ```powershell
     Install-WindowsFeature -Name AD-Domain-Services -IncludeAllSubFeature -IncludeManagementTools
-
    + ``` 7. Before promoting DC1 to a Domain Controller, you must reboot so that the name change in step 3 above takes effect. To restart the computer, type the following command at an elevated Windows PowerShell prompt: - 
    +    ```powershell
     Restart-Computer
-
    + ``` 8. When DC1 has rebooted, sign in again and open an elevated Windows PowerShell prompt. Now you can promote the server to be a domain controller. The directory services restore mode password must be entered as a secure string. Type the following commands at the elevated Windows PowerShell prompt: - 
    +    ```powershell
     $pass = "pass@word1" | ConvertTo-SecureString -AsPlainText -Force
     Install-ADDSForest -DomainName contoso.com -InstallDns -SafeModeAdministratorPassword $pass -Force
-
    + ``` Ignore any warnings that are displayed. The computer will automatically reboot upon completion. 9. When the reboot has completed, reconnect to DC1, sign in using the CONTOSO\Administrator account, open an elevated Windows PowerShell prompt, and use the following commands to add a reverse lookup zone for the PoC network, add the DHCP Server role, authorize DHCP in Active Directory, and suppress the post-DHCP-install alert: - 
    +    ```powershell
     Add-DnsServerPrimaryZone -NetworkID "192.168.0.0/24" -ReplicationScope Forest
     Add-WindowsFeature -Name DHCP -IncludeManagementTools
     netsh dhcp add securitygroups
     Restart-Service DHCPServer
     Add-DhcpServerInDC  dc1.contoso.com  192.168.0.1
     Set-ItemProperty -Path registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ServerManager\Roles\12 -Name ConfigurationState -Value 2
-
    + ``` 10. Next, add a DHCP scope and set option values: - 
    +    ```powershell
     Add-DhcpServerv4Scope -Name "PoC Scope" -StartRange 192.168.0.100 -EndRange 192.168.0.199 -SubnetMask 255.255.255.0 -Description "Windows 10 PoC" -State Active
     Set-DhcpServerv4OptionValue -ScopeId 192.168.0.0 -DnsDomain contoso.com -Router 192.168.0.2 -DnsServer 192.168.0.1,192.168.0.2 -Force
-
    + ``` - >The -Force option is necessary when adding scope options to skip validation of 192.168.0.2 as a DNS server because we have not configured it yet. The scope should immediately begin issuing leases on the PoC network. The first DHCP lease that will be issued is to vEthernet interface on the Hyper-V host, which is a member of the internal network. You can verify this by using the command: Get-DhcpServerv4Lease -ScopeId 192.168.0.0. + The -Force option is necessary when adding scope options to skip validation of 192.168.0.2 as a DNS server because we have not configured it yet. The scope should immediately begin issuing leases on the PoC network. The first DHCP lease that will be issued is to vEthernet interface on the Hyper-V host, which is a member of the internal network. You can verify this by using the command: Get-DhcpServerv4Lease -ScopeId 192.168.0.0. 11. The DNS server role will also be installed on the member server, SRV1, at 192.168.0.2 so that we can forward DNS queries from DC1 to SRV1 to resolve Internet names without having to configure a forwarder outside the PoC network. Since the IP address of SRV1 already exists on DC1's network adapter, it will be automatically added during the DCPROMO process. To verify this server-level DNS forwarder on DC1, type the following command at an elevated Windows PowerShell prompt on DC1: - 
    +    ```powershell
     Get-DnsServerForwarder
-
    + ``` The following output should be displayed: - 
    +    ```powershell
     UseRootHint        : True
     Timeout(s)         : 3
     EnableReordering   : True
     IPAddress          : 192.168.0.2
     ReorderedIPAddress : 192.168.0.2
-
    + ``` If this output is not displayed, you can use the following command to add SRV1 as a forwarder: - 
    +    ```powershell
     Add-DnsServerForwarder -IPAddress 192.168.0.2
-
    + ``` **Configure service and user accounts** Windows 10 deployment with MDT and Microsoft Endpoint Manager requires specific accounts to perform some actions. Service accounts will be created to use for these tasks. A user account is also added in the contoso.com domain that can be used for testing purposes. In the test lab environment, passwords are set to never expire. - >To keep this test lab relatively simple, we will not create a custom OU structure and set permissions. Required permissions are enabled by adding accounts to the Domain Admins group. To configure these settings in a production environment, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) + To keep this test lab relatively simple, we will not create a custom OU structure and set permissions. Required permissions are enabled by adding accounts to the Domain Admins group. To configure these settings in a production environment, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) On DC1, open an elevated Windows PowerShell prompt and type the following commands: - 
    +    ```powershell
     New-ADUser -Name User1 -UserPrincipalName user1 -Description "User account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
     New-ADUser -Name MDT_BA -UserPrincipalName MDT_BA -Description "MDT Build Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
     New-ADUser -Name CM_JD -UserPrincipalName CM_JD -Description "Configuration Manager Join Domain Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $true
@@ -802,7 +742,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
     Set-ADUser -Identity MDT_BA -PasswordNeverExpires $true
     Set-ADUser -Identity CM_JD -PasswordNeverExpires $true
     Set-ADUser -Identity CM_NAA -PasswordNeverExpires $true
-
    + ``` 12. Minimize the DC1 VM window but **do not stop** the VM. @@ -810,20 +750,20 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 13. If the PC1 VM is not started yet, using an elevated Windows PowerShell prompt on the Hyper-V host, start the client VM (PC1), and connect to it: - 
    +    ```powershell
     Start-VM PC1
     vmconnect localhost PC1
-
    + ``` 14. Sign in to PC1 using an account that has local administrator rights. - >PC1 will be disconnected from its current domain, so you cannot use a domain account to sign on unless these credentials are cached and the use of cached credentials is permitted by Group Policy. If cached credentials are available and permitted, you can use these credentials to sign in. Otherwise, use an existing local administrator account. + PC1 will be disconnected from its current domain, so you cannot use a domain account to sign on unless these credentials are cached and the use of cached credentials is permitted by Group Policy. If cached credentials are available and permitted, you can use these credentials to sign in. Otherwise, use an existing local administrator account. 15. After signing in, the operating system detects that it is running in a new environment. New drivers will be automatically installed, including the network adapter driver. The network adapter driver must be updated before you can proceed, so that you will be able to join the contoso.com domain. Depending on the resources allocated to PC1, installing the network adapter driver might take a few minutes. You can monitor device driver installation by clicking **Show hidden icons** in the notification area. ![PoC 1.](images/installing-drivers.png) - >If the client was configured with a static address, you must change this to a dynamic one so that it can obtain a DHCP lease. + If the client was configured with a static address, you must change this to a dynamic one so that it can obtain a DHCP lease. 16. When the new network adapter driver has completed installation, you will receive an alert to set a network location for the contoso.com network. Select **Work network** and then click **Close**. When you receive an alert that a restart is required, click **Restart Later**. @@ -831,7 +771,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to To open Windows PowerShell on Windows 7, click **Start**, and search for "**power**." Right-click **Windows PowerShell** and then click **Pin to Taskbar** so that it is simpler to use Windows PowerShell during this lab. Click **Windows PowerShell** on the taskbar, and then type **ipconfig** at the prompt to see the client's current IP address. Also type **ping dc1.contoso.com** and **nltest /dsgetdc:contoso.com** to verify that it can reach the domain controller. See the following examples of a successful network connection: - ``` + ```console ipconfig Windows IP Configuration @@ -862,99 +802,108 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to Flags: PDC GC DS LDAP KDC TIMESERV WRITABLE DNS_FOREST CLOSE_SITE FULL_SECRET WS 0xC000 ``` - >If PC1 is running Windows 7, enhanced session mode might not be available, which means that you cannot copy and paste commands from the Hyper-V host to a Windows PowerShell prompt on PC1. However, it is possible to use integration services to copy a file from the Hyper-V host to a VM. The next procedure demonstrates this. If the Copy-VMFile command fails, then type the commands below at an elevated Windows PowerShell prompt on PC1 instead of saving them to a script to run remotely. If PC1 is running Windows 8 or a later operating system, you can use enhanced session mode to copy and paste these commands instead of typing them. + > [!NOTE] + > If PC1 is running Windows 7, enhanced session mode might not be available, which means that you cannot copy and paste commands from the Hyper-V host to a Windows PowerShell prompt on PC1. However, it is possible to use integration services to copy a file from the Hyper-V host to a VM. The next procedure demonstrates this. If the Copy-VMFile command fails, then type the commands below at an elevated Windows PowerShell prompt on PC1 instead of saving them to a script to run remotely. If PC1 is running Windows 8 or a later operating system, you can use enhanced session mode to copy and paste these commands instead of typing them. 18. Minimize the PC1 window and switch to the Hyper-V host computer. Open an elevated Windows PowerShell ISE window on the Hyper-V host (right-click Windows PowerShell and then click **Run ISE as Administrator**) and type the following commands in the (upper) script editor pane: - 
    +    ```powershell
     (Get-WmiObject Win32_ComputerSystem).UnjoinDomainOrWorkgroup($null,$null,0)
     $pass = "pass@word1" | ConvertTo-SecureString -AsPlainText -Force
     $user = "contoso\administrator"
     $cred = New-Object System.Management.Automation.PSCredential($user,$pass)
     Add-Computer -DomainName contoso.com -Credential $cred
     Restart-Computer
-
    + ``` - >If you do not see the script pane, click **View** and verify **Show Script Pane Top** is enabled. Click **File** and then click **New**. + If you do not see the script pane, click **View** and verify **Show Script Pane Top** is enabled. Click **File** and then click **New**. See the following example: - ![ISE 1.](images/ISE.png) + :::image type="content" alt-text="ISE 1." source="images/ISE.png" lightbox="images/ISE.png"::: 19. Click **File**, click **Save As**, and save the commands as **c:\VHD\pc1.ps1** on the Hyper-V host. + 20. In the (lower) terminal input window, type the following commands to enable Guest Service Interface on PC1 and then use this service to copy the script to PC1: - 
    +    ```powershell
     Enable-VMIntegrationService -VMName PC1 -Name "Guest Service Interface"
     Copy-VMFile "PC1" -SourcePath "C:\VHD\pc1.ps1" -DestinationPath "C:\pc1.ps1" -CreateFullPath -FileSource Host
-
    + ``` - >In order for this command to work properly, PC1 must be running the vmicguestinterface (Hyper-V Guest Service Interface) service. If this service is not enabled in this step, then the copy-VMFile command will fail. In this case, you can try updating integration services on the VM by mounting the Hyper-V Integration Services Setup (vmguest.iso), which is located in C:\Windows\System32 on Windows Server 2012 and 2012 R2 operating systems that are running the Hyper-V role service. + > [!NOTE] + > In order for this command to work properly, PC1 must be running the vmicguestinterface (Hyper-V Guest Service Interface) service. If this service is not enabled in this step, then the copy-VMFile command will fail. In this case, you can try updating integration services on the VM by mounting the Hyper-V Integration Services Setup (vmguest.iso), which is located in C:\Windows\System32 on Windows Server 2012 and 2012 R2 operating systems that are running the Hyper-V role service. If the copy-vmfile command does not work and you cannot properly enable or upgrade integration services on PC1, then create the file c:\pc1.ps1 on the VM by typing the commands into this file manually. The copy-vmfile command is only used in this procedure as a demonstration of automation methods that can be used in a Hyper-V environment when enhanced session mode is not available. After typing the script file manually, be sure to save the file as a Windows PowerShell script file with the .ps1 extension and not as a text (.txt) file. 21. On PC1, type the following commands at an elevated Windows PowerShell prompt: - 
    +    ```powershell
     Get-Content c:\pc1.ps1 | powershell.exe -noprofile -
-
    + ``` - >The commands in this script might take a few moments to complete. If an error is displayed, check that you typed the command correctly, paying close attention to spaces. PC1 is removed from its domain in this step while not connected to the corporate network so as to ensure the computer object in the corporate domain is unaffected. PC1 is also not renamed to "PC1" in system properties so that it maintains some of its mirrored identity. However, if desired you can also rename the computer. + The commands in this script might take a few moments to complete. If an error is displayed, check that you typed the command correctly, paying close attention to spaces. PC1 is removed from its domain in this step while not connected to the corporate network so as to ensure the computer object in the corporate domain is unaffected. PC1 is also not renamed to "PC1" in system properties so that it maintains some of its mirrored identity. However, if desired you can also rename the computer. 22. Upon completion of the script, PC1 will automatically restart. When it has restarted, sign in to the contoso.com domain using the **Switch User** option, with the **user1** account you created in step 11 of this section. - >**Important**: The settings that will be used later to migrate user data specifically select only accounts that belong to the CONTOSO domain. However, this can be changed to migrate all user accounts, or only other specified accounts. If you wish to test migration of user data and settings with accounts other than those in the CONTOSO domain, you must specify these accounts or domains when you configure the value of **ScanStateArgs** in the MDT test lab guide. This value is specifically called out when you get to that step. If you wish to only migrate CONTOSO accounts, then you can log in with the user1 account or the administrator account at this time and modify some of the files and settings for later use in migration testing. + + > [!IMPORTANT] + > The settings that will be used later to migrate user data specifically select only accounts that belong to the CONTOSO domain. However, this can be changed to migrate all user accounts, or only other specified accounts. If you wish to test migration of user data and settings with accounts other than those in the CONTOSO domain, you must specify these accounts or domains when you configure the value of **ScanStateArgs** in the MDT test lab guide. This value is specifically called out when you get to that step. If you wish to only migrate CONTOSO accounts, then you can log in with the user1 account or the administrator account at this time and modify some of the files and settings for later use in migration testing. + 23. Minimize the PC1 window but do not turn it off while the second Windows Server 2012 R2 VM (SRV1) is configured. This verifies that the Hyper-V host has enough resources to run all VMs simultaneously. Next, SRV1 will be started, joined to the contoso.com domain, and configured with RRAS and DNS services. + 24. On the Hyper-V host computer, at an elevated Windows PowerShell prompt, type the following commands: - 
    +    ```powershell
     Start-VM SRV1
     vmconnect localhost SRV1
-
    + ``` 25. Accept the default settings, read license terms and accept them, provide an administrator password of pass@word1, and click **Finish**. When you are prompted about finding PCs, devices, and content on the network, click **Yes**. + 26. Sign in to SRV1 using the local administrator account. In the same way that was done on DC1, sign out of SRV1 and then sign in again to enable enhanced session mode. This will enable you to copy and paste Windows PowerShell commands from the Hyper-V host to the VM. + 27. Open an elevated Windows PowerShell prompt on SRV1 and type the following commands: - 
    +    ```powershell
     Rename-Computer SRV1
     New-NetIPAddress -InterfaceAlias Ethernet -IPAddress 192.168.0.2 -PrefixLength 24
     Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 192.168.0.1,192.168.0.2
     Restart-Computer
-
    + ``` - >[!IMPORTANT] - >Verify that you are configuring the correct interface in this step. The commands in this step assume that the poc-internal interface on SRV1 is named "Ethernet." If you are unsure how to check the interface, see step #30 below for instructions and tips on how to verify and modify the interface name. + > [!IMPORTANT] + > Verify that you are configuring the correct interface in this step. The commands in this step assume that the poc-internal interface on SRV1 is named "Ethernet." If you are unsure how to check the interface, see step #30 below for instructions and tips on how to verify and modify the interface name. 28. Wait for the computer to restart, sign in again, then type the following commands at an elevated Windows PowerShell prompt: - 
    +    ```powershell
     $pass = "pass@word1" | ConvertTo-SecureString -AsPlainText -Force
     $user = "contoso\administrator"
     $cred = New-Object System.Management.Automation.PSCredential($user,$pass)
     Add-Computer -DomainName contoso.com -Credential $cred
     Restart-Computer
-
    + ``` 29. Sign in to the contoso.com domain on SRV1 using the domain administrator account (enter contoso\administrator as the user), open an elevated Windows PowerShell prompt, and type the following commands: - 
    +    ```powershell
     Install-WindowsFeature -Name DNS -IncludeManagementTools
     Install-WindowsFeature -Name WDS -IncludeManagementTools
     Install-WindowsFeature -Name Routing -IncludeManagementTools
-
    + ``` 30. Before configuring the routing service that was just installed, verify that network interfaces were added to SRV1 in the right order, resulting in an interface alias of "Ethernet" for the private interface, and an interface alias of "Ethernet 2" for the public interface. Also verify that the external interface has a valid external DHCP IP address lease. To view a list of interfaces, associated interface aliases, and IP addresses on SRV1, type the following Windows PowerShell command. Example output of the command is also shown below: - 
    +    ```powershell
     Get-NetAdapter | ? status -eq ‘up’ | Get-NetIPAddress -AddressFamily IPv4 | ft IPAddress, InterfaceAlias
 
     IPAddress                                                                  InterfaceAlias
     ---------                                                                  --------------
     10.137.130.118                                                             Ethernet 2
     192.168.0.2                                                                Ethernet
-
    + ``` In this example, the poc-internal network interface at 192.168.0.2 is associated with the "Ethernet" interface and the Internet-facing poc-external interface is associated with the "Ethernet 2" interface. If your interfaces are different, you must adjust the commands provided in the next step appropriately to configure routing services. Also note that if the "Ethernet 2" interface has an IP address in the 192.168.0.100-105 range then it likely is getting a DHCP lease from DC1 instead of your corporate network. If this is the case, you can try removing and re-adding the second network interface from the SRV1 VM through its Hyper-V settings. @@ -964,37 +913,38 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 31. To configure SRV1 with routing capability for the PoC network, type or paste the following commands at an elevated Windows PowerShell prompt on SRV1: - 
    +    ```powershell
     Install-RemoteAccess -VpnType Vpn
     cmd /c netsh routing ip nat install
     cmd /c netsh routing ip nat add interface name="Ethernet 2" mode=FULL
     cmd /c netsh routing ip nat add interface name="Ethernet" mode=PRIVATE
     cmd /c netsh routing ip nat add interface name="Internal" mode=PRIVATE
-
    + ``` 32. The DNS service on SRV1 also needs to resolve hosts in the `contoso.com` domain. This can be accomplished with a conditional forwarder. Open an elevated Windows PowerShell prompt on SRV1 and type the following command: - 
    +    ```powershell
     Add-DnsServerConditionalForwarderZone -Name contoso.com -MasterServers 192.168.0.1
-
    + ``` 33. In most cases, this completes configuration of the PoC network. However, if your corporate network has a firewall that filters queries from local DNS servers, you will also need to configure a server-level DNS forwarder on SRV1 to resolve Internet names. To test whether or not DNS is working without this forwarder, try to reach a name on the Internet from DC1 or PC1, which are only using DNS services on the PoC network. You can test DNS with the ping command, for example: - 
    +    ```powershell
     ping www.microsoft.com
-
    + ``` If you see "Ping request could not find host `www.microsoft.com`" on PC1 and DC1, but not on SRV1, then you will need to configure a server-level DNS forwarder on SRV1. To do this, open an elevated Windows PowerShell prompt on SRV1 and type the following command. - **Note**: This command also assumes that "Ethernet 2" is the external-facing network adapter on SRV1. If the external adapter has a different name, replace "Ethernet 2" in the command below with that name: + > [!NOTE] + > This command also assumes that "Ethernet 2" is the external-facing network adapter on SRV1. If the external adapter has a different name, replace "Ethernet 2" in the command below with that name: - 
    +    ```powershell
     Add-DnsServerForwarder -IPAddress (Get-DnsClientServerAddress -InterfaceAlias "Ethernet 2").ServerAddresses
-
    + ``` 34. If DNS and routing are both working correctly, you will see the following on DC1 and PC1 (the IP address might be different, but that is OK): - 
    +    ```powershell
     PS C:\> ping www.microsoft.com
 
     Pinging e2847.dspb.akamaiedge.net [23.222.146.170] with 32 bytes of data:
@@ -1007,15 +957,15 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
         Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
     Approximate round trip times in milli-seconds:
         Minimum = 1ms, Maximum = 3ms, Average = 2ms
-
    + ``` 35. Verify that all three VMs can reach each other, and the Internet. See [Appendix A: Verify the configuration](#appendix-a-verify-the-configuration) for more information. 36. Lastly, because the client computer has different hardware after copying it to a VM, its Windows activation will be invalidated and you might receive a message that you must activate Windows in 3 days. To extend this period to 30 days, type the following commands at an elevated Windows PowerShell prompt on PC1: - 
    +    ```powershell
     runas /noprofile /env /user:administrator@contoso.com "cmd /c slmgr -rearm"
     Restart-Computer
-
    + ``` This completes configuration of the starting PoC environment. Additional services and tools are installed in subsequent guides. @@ -1025,7 +975,7 @@ Use the following procedures to verify that the PoC environment is configured pr 1. On DC1, open an elevated Windows PowerShell prompt and type the following commands: - 
    +    ```powershell
     Get-Service NTDS,DNS,DHCP
     DCDiag -a
     Get-DnsServerResourceRecord -ZoneName contoso.com -RRType A
@@ -1034,72 +984,79 @@ Use the following procedures to verify that the PoC environment is configured pr
     Get-DhcpServerInDC
     Get-DhcpServerv4Statistics
     ipconfig /all
-
    + ``` - **Get-Service** displays a status of "Running" for all three services.
    - **DCDiag** displays "passed test" for all tests.
    - **Get-DnsServerResourceRecord** displays the correct DNS address records for DC1, SRV1, and the computername of PC1. Additional address records for the zone apex (@), DomainDnsZones, and ForestDnsZones will also be registered.
    - **Get-DnsServerForwarder** displays a single forwarder of 192.168.0.2.
    - **Resolve-DnsName** displays public IP address results for `www.microsoft.com`.
    - **Get-DhcpServerInDC** displays 192.168.0.1, `dc1.contoso.com`.
    - **Get-DhcpServerv4Statistics** displays 1 scope with 2 addresses in use (these belong to PC1 and the Hyper-V host).
    + **Get-Service** displays a status of "Running" for all three services. + + **DCDiag** displays "passed test" for all tests. + + **Get-DnsServerResourceRecord** displays the correct DNS address records for DC1, SRV1, and the computername of PC1. Additional address records for the zone apex (@), DomainDnsZones, and ForestDnsZones will also be registered. + + **Get-DnsServerForwarder** displays a single forwarder of 192.168.0.2. + + **Resolve-DnsName** displays public IP address results for `www.microsoft.com`. + + **Get-DhcpServerInDC** displays 192.168.0.1, `dc1.contoso.com`. + + **Get-DhcpServerv4Statistics** displays 1 scope with 2 addresses in use (these belong to PC1 and the Hyper-V host). + **ipconfig** displays a primary DNS suffix and suffix search list of `contoso.com`, IP address of 192.168.0.1, subnet mask of 255.255.255.0, default gateway of 192.168.0.2, and DNS server addresses of 192.168.0.1 and 192.168.0.2. 2. On SRV1, open an elevated Windows PowerShell prompt and type the following commands: - 
    +    ```powershell
     Get-Service DNS,RemoteAccess
     Get-DnsServerForwarder
     Resolve-DnsName -Server dc1.contoso.com -Name www.microsoft.com
     ipconfig /all
     netsh int ipv4 show address
-
    + ``` + + **Get-Service** displays a status of "Running" for both services. + + **Get-DnsServerForwarder** either displays no forwarders, or displays a list of forwarders you are required to use so that SRV1 can resolve Internet names. + + **Resolve-DnsName** displays public IP address results for `www.microsoft.com`. + + **ipconfig** displays a primary DNS suffix of `contoso.com`. The suffix search list contains `contoso.com` and your corporate domain. Two ethernet adapters are shown: Ethernet adapter "Ethernet" has an IP addresses of 192.168.0.2, subnet mask of 255.255.255.0, no default gateway, and DNS server addresses of 192.168.0.1 and 192.168.0.2. Ethernet adapter "Ethernet 2" has an IP address, subnet mask, and default gateway configured by DHCP on your corporate network. - **Get-Service** displays a status of "Running" for both services.
    - **Get-DnsServerForwarder** either displays no forwarders, or displays a list of forwarders you are required to use so that SRV1 can resolve Internet names.
    - **Resolve-DnsName** displays public IP address results for `www.microsoft.com`.
    - **ipconfig** displays a primary DNS suffix of `contoso.com`. The suffix search list contains `contoso.com` and your corporate domain. Two ethernet adapters are shown: Ethernet adapter "Ethernet" has an IP addresses of 192.168.0.2, subnet mask of 255.255.255.0, no default gateway, and DNS server addresses of 192.168.0.1 and 192.168.0.2. Ethernet adapter "Ethernet 2" has an IP address, subnet mask, and default gateway configured by DHCP on your corporate network.
    **netsh** displays three interfaces on the computer: interface "Ethernet 2" with DHCP enabled = Yes and IP address assigned by your corporate network, interface "Ethernet" with DHCP enabled = No and IP address of 192.168.0.2, and interface "Loopback Pseudo-Interface 1" with IP address of 127.0.0.1. 3. On PC1, open an elevated Windows PowerShell prompt and type the following commands: - 
    +    ```powershell
     whoami
     hostname
     nslookup www.microsoft.com
     ping -n 1 dc1.contoso.com
     tracert www.microsoft.com
-
    + ``` + + **whoami** displays the current user context, for example in an elevated Windows PowerShell prompt, contoso\administrator is displayed. + + **hostname** displays the name of the local computer, for example W7PC-001. + + **nslookup** displays the DNS server used for the query, and the results of the query. For example, server `dc1.contoso.com`, address 192.168.0.1, Name `e2847.dspb.akamaiedge.net`. + + **ping** displays if the source can resolve the target name, and whether or not the target responds to ICMP. If it cannot be resolved, "..could not find host" will be displayed and if the target is found and also responds to ICMP, you will see "Reply from" and the IP address of the target. - **whoami** displays the current user context, for example in an elevated Windows PowerShell prompt, contoso\administrator is displayed.
    - **hostname** displays the name of the local computer, for example W7PC-001.
    - **nslookup** displays the DNS server used for the query, and the results of the query. For example, server `dc1.contoso.com`, address 192.168.0.1, Name `e2847.dspb.akamaiedge.net`.
    - **ping** displays if the source can resolve the target name, and whether or not the target responds to ICMP. If it cannot be resolved, "..could not find host" will be displayed and if the target is found and also responds to ICMP, you will see "Reply from" and the IP address of the target.
    **tracert** displays the path to reach the destination, for example `srv1.contoso.com` [192.168.0.2] followed by a list of hosts and IP addresses corresponding to subsequent routing nodes between the source and the destination. ## Appendix B: Terminology used in this guide -

      - -

    - - -
    Term -Definition -
    GPTGUID partition table (GPT) is an updated hard-disk formatting scheme that enables the use of newer hardware. GPT is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions. -
    Hyper-VHyper-V is a server role introduced with Windows Server 2008 that lets you create a virtualized computing environment. Hyper-V can also be installed as a Windows feature on Windows client operating systems, starting with Windows 8. -
    Hyper-V hostThe computer where Hyper-V is installed. -
    Hyper-V ManagerThe user-interface console used to view and configure Hyper-V. -
    MBRMaster Boot Record (MBR) is a legacy hard-disk formatting scheme that limits support for newer hardware. MBR is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions. MBR is in the process of being replaced by the GPT partition format. -
    Proof of concept (PoC)Confirmation that a process or idea works as intended. A PoC is carried out in a test environment to learn about and verify a process. -
    Shadow copyA copy or "snapshot" of a computer at a point in time, created by the Volume Shadow Copy Service (VSS), typically for backup purposes. -
    Virtual machine (VM)A VM is a virtual computer with its own operating system, running on the Hyper-V host. -
    Virtual switchA virtual network connection used to connect VMs to each other and to physical network adapters on the Hyper-V host. -
    VM snapshotA point in time image of a VM that includes its disk, memory and device state. It can be used to return a virtual machine to a former state corresponding to the time the snapshot was taken. -
    - -
    +|Term|Definition| +|--- |--- | +|GPT|GUID partition table (GPT) is an updated hard-disk formatting scheme that enables the use of newer hardware. GPT is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions.| +|Hyper-V|Hyper-V is a server role introduced with Windows Server 2008 that lets you create a virtualized computing environment. Hyper-V can also be installed as a Windows feature on Windows client operating systems, starting with Windows 8.| +|Hyper-V host|The computer where Hyper-V is installed.| +|Hyper-V Manager|The user-interface console used to view and configure Hyper-V.| +|MBR|Master Boot Record (MBR) is a legacy hard-disk formatting scheme that limits support for newer hardware. MBR is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions. MBR is in the process of being replaced by the GPT partition format.| +|Proof of concept (PoC)|Confirmation that a process or idea works as intended. A PoC is carried out in a test environment to learn about and verify a process.| +|Shadow copy|A copy or "snapshot" of a computer at a point in time, created by the Volume Shadow Copy Service (VSS), typically for backup purposes.| +|Virtual machine (VM)|A VM is a virtual computer with its own operating system, running on the Hyper-V host.| +|Virtual switch|A virtual network connection used to connect VMs to each other and to physical network adapters on the Hyper-V host.| +|VM snapshot|A point in time image of a VM that includes its disk, memory and device state. It can be used to return a virtual machine to a former state corresponding to the time the snapshot was taken.| ## Related Topics diff --git a/windows/hub/index.yml b/windows/hub/index.yml index 23a3c69aae..cd0a734c01 100644 --- a/windows/hub/index.yml +++ b/windows/hub/index.yml @@ -179,9 +179,6 @@ conceptualContent: - url: /windows/security/index itemType: overview text: Windows Enterprise Security - - url: /windows/privacy/index - itemType: overview - text: Windows Privacy - url: /windows/security/hardware itemType: overview text: Hardware security @@ -193,10 +190,13 @@ conceptualContent: text: Application security - url: /windows/security/identity itemType: overview - text: User and identity security + text: Identity and privacy - url: /windows/security/cloud itemType: overview text: Cloud services + - url: /windows/privacy/index + itemType: overview + text: Windows Privacy # additionalContent section (optional) # Card with summary style diff --git a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md index fa3ce2c285..c867fe681a 100644 --- a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md +++ b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md @@ -27,7 +27,7 @@ ms.technology: privacy > [!IMPORTANT] > The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](/windows/deployment/update/update-compliance-get-started) will continue to be supported. -> For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). +> For more information, see [Windows Analytics retirement on January 31, 2020](/lifecycle/announcements/windows-analytics-retirement). Desktop Analytics reports are powered by diagnostic data not included in the Basic level. diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index ee509f813a..5348207c2b 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -31,7 +31,7 @@ ms.technology: privacy This article describes the network connections that Windows 10 and Windows 11 components make to Microsoft and the Windows Settings, Group Policies and registry settings available to IT Professionals to help manage the data shared with Microsoft. If you want to minimize connections from Windows to Microsoft services, or configure privacy settings, there are a number of settings for consideration. For example, you can configure diagnostic data to the lowest level for your edition of Windows and evaluate other connections Windows makes to Microsoft services you want to turn off using the instructions in this article. While it is possible to minimize network connections to Microsoft, there are many reasons why these communications are enabled by default, such as updating malware definitions and maintaining current certificate revocation lists. This data helps us deliver a secure, reliable, and up-to-date experience. -Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887) package that will allow your organization to quickly configure the settings covered in this document to restrict connections from Windows 10 and Windows 11 to Microsoft. The Windows Restricted Traffic Limited Baseline is based on [Group Policy Administrative Template](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) functionality and the package you download contains further instructions on how to deploy to devices in your organization. Since some of the settings can reduce the functionality and security configuration of your device, **before deploying Windows Restricted Traffic Limited Functionality Baseline** make sure you **choose the right settings configuration for your environment** and **ensure that Windows and Microsoft Defender Antivirus are fully up to date**. Failure to do so may result in errors or unexpected behavior. You should not extract this package to the windows\system32 folder because it will not apply correctly. +Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887) package that will allow your organization to quickly configure the settings covered in this document to restrict connections from Windows 10 and Windows 11 to Microsoft. The Windows Restricted Traffic Limited Baseline is based on [Group Policy Administrative Template](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) functionality and the package you download contains further instructions on how to deploy to devices in your organization. Since some of the settings can reduce the functionality and security configuration of your device, **before deploying Windows Restricted Traffic Limited Functionality Baseline** make sure you **choose the right settings configuration for your environment** and **ensure that Windows and Microsoft Defender Antivirus are fully up to date**. Failure to do so may result in errors or unexpected behavior. You should not extract this package to the windows\system32 folder because it will not apply correctly. > [!IMPORTANT] > - The downloadable Windows 10, version 1903 scripts/settings can be used on Windows 10, version 1909 devices. @@ -423,7 +423,7 @@ To turn off Insider Preview builds for Windows 10 and Windows 11: ### 8. Internet Explorer > [!NOTE] -> When attempting to use Internet Explorer on any edition of Windows Server be aware there are restrictions enforced by [Enhanced Security Configuration (ESC)](https://support.microsoft.com/help/815141/ie-enhanced-security-configuration-changes-browsing-experience). The following Group Policies and Registry Keys are for user interactive scenarios rather than the typical idle traffic scenario. Find the Internet Explorer Group Policy objects under **Computer Configuration > Administrative Templates > Windows Components > Internet Explorer** and make these settings: +> When attempting to use Internet Explorer on any edition of Windows Server be aware there are restrictions enforced by [Enhanced Security Configuration (ESC)](/troubleshoot/browsers/enhanced-security-configuration-faq). The following Group Policies and Registry Keys are for user interactive scenarios rather than the typical idle traffic scenario. Find the Internet Explorer Group Policy objects under **Computer Configuration > Administrative Templates > Windows Components > Internet Explorer** and make these settings: | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| diff --git a/windows/privacy/manage-windows-11-endpoints.md b/windows/privacy/manage-windows-11-endpoints.md index 93a3b38255..f17e78125e 100644 --- a/windows/privacy/manage-windows-11-endpoints.md +++ b/windows/privacy/manage-windows-11-endpoints.md @@ -156,5 +156,5 @@ To view endpoints for non-Enterprise Windows 10 editions, see: ## Related links -- [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) +- [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges) - [Network infrastructure requirements for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints) \ No newline at end of file diff --git a/windows/privacy/manage-windows-1709-endpoints.md b/windows/privacy/manage-windows-1709-endpoints.md index 68e5185b57..f3bc7923bd 100644 --- a/windows/privacy/manage-windows-1709-endpoints.md +++ b/windows/privacy/manage-windows-1709-endpoints.md @@ -32,16 +32,16 @@ Some Windows components, app, and related services transfer data to Microsoft ne This article lists different endpoints that are available on a clean installation of Windows 10, version 1709 and later. Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). -Where applicable, each endpoint covered in this topic includes a link to specific details about how to control traffic to it. +Where applicable, each endpoint covered in this article includes a link to specific details about how to control traffic to it. We used the following methodology to derive these network endpoints: 1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. -2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). +2. Leave the devices running idle for a week (that is, a user isn't interacting with the system/device). 3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. 4. Compile reports on traffic going to public IP addresses. -5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. -6. All traffic was captured in our lab using a IPV4 network. Therefore no IPV6 traffic is reported here. +5. The test virtual machine was logged in using a local account and wasn't joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. As such no IPV6 traffic is reported here. > [!NOTE] > Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. @@ -60,7 +60,7 @@ If you [turn off traffic to this endpoint](manage-connections-from-windows-opera The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. -Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. +Additionally, the Microsoft Store can't revoke malicious Store apps and users can still open them. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -69,7 +69,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a The following endpoints are used for Twitter updates. To turn off traffic for these endpoints, either uninstall Twitter or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. -Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. +Additionally, the Microsoft Store can't revoke malicious Store apps and users can still open them. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -79,7 +79,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a The following endpoint is used for Facebook updates. To turn off traffic for this endpoint, either uninstall Facebook or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. -Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. +Additionally, the Microsoft Store can't revoke malicious Store apps and users can still open them. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -88,7 +88,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office. To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. -Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. +Additionally, the Microsoft Store can't revoke malicious Store apps and users can still open them. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -97,7 +97,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a The following endpoint is used for Candy Crush Saga updates. To turn off traffic for this endpoint, either uninstall Candy Crush Saga or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. -Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. +Additionally, the Microsoft Store can't revoke malicious Store apps and users can still open them. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -106,14 +106,14 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a The following endpoint is used for by the Microsoft Wallet app. To turn off traffic for this endpoint, either uninstall the Wallet app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. -Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. +Additionally, the Microsoft Store can't revoke malicious Store apps and users can still open them. | Source process | Protocol | Destination | |----------------|----------|------------| | system32\AppHostRegistrationVerifier.exe | HTTPS | wallet.microsoft.com | The following endpoint is used by the Groove Music app for update HTTP handler status. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-apps-for-websites), apps for websites won't work and customers who visit websites (such as mediaredirect.microsoft.com) that are registered with their associated app (such as Groove Music) will stay at the website and won't be able to directly launch the app. +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-apps-for-websites), apps for websites won't work and customers who visit websites (such as mediaredirect.microsoft.com) that are registered with their associated app (such as Groove Music) will stay at the website and can't directly launch the app. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -122,28 +122,28 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Cortana and Search The following endpoint is used to get images that are used for Microsoft Store suggestions. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you will block images that are used for Microsoft Store suggestions. +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you'll block images that are used for Microsoft Store suggestions. | Source process | Protocol | Destination | |----------------|----------|------------| | searchui | HTTPS |store-images.s-microsoft.com | The following endpoint is used to update Cortana greetings, tips, and Live Tiles. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you will block updates to Cortana greetings, tips, and Live Tiles. +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you'll block updates to Cortana greetings, tips, and Live Tiles. | Source process | Protocol | Destination | |----------------|----------|------------| | backgroundtaskhost | HTTPS | www.bing.com/client | The following endpoint is used to configure parameters, such as how often the Live Tile is updated. It's also used to activate experiments. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), parameters would not be updated and the device would no longer participate in experiments. +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), parameters wouldn't be updated and the device would no longer participate in experiments. | Source process | Protocol | Destination | |----------------|----------|------------| | backgroundtaskhost | HTTPS | www.bing.com/proactive | The following endpoint is used by Cortana to report diagnostic and diagnostic data information. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), Microsoft won't be aware of issues with Cortana and won't be able to fix them. +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), Microsoft won't be aware of issues with Cortana and can't fix them. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -151,11 +151,11 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Certificates -The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. +The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It's possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that isn't recommended because when root certificates are updated over time, applications and websites may stop working because they didn't receive an updated root certificate the application uses. -Additionally, it is used to download certificates that are publicly known to be fraudulent. +Additionally, it's used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. -We do not recommend blocking this endpoint. +We don't recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device. | Source process | Protocol | Destination | @@ -294,7 +294,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Office -The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. @@ -305,7 +305,7 @@ If you turn off traffic for these endpoints, users won't be able to save documen | | | *.e-msedge.net | | | | *.s-msedge.net | -The following endpoint is used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoint is used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. @@ -328,7 +328,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper |----------------|----------|------------| | onedrive | HTTP \ HTTPS | g.live.com/1rewlive5skydrive/ODSUProduction | -The following endpoint is used by OneDrive for Business to download and verify app updates. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US). +The following endpoint is used by OneDrive for Business to download and verify app updates. For more info, see [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges). To turn off traffic for this endpoint, uninstall OneDrive for Business. In this case, your device will not able to get OneDrive for Business app updates. | Source process | Protocol | Destination | @@ -456,5 +456,5 @@ To view endpoints for non-Enterprise Windows 10 editions, see: ## Related links -- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) +- [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges) - [Network infrastructure requirements for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints) \ No newline at end of file diff --git a/windows/privacy/manage-windows-1803-endpoints.md b/windows/privacy/manage-windows-1803-endpoints.md index 6dd29f8f5e..fdc72f92e7 100644 --- a/windows/privacy/manage-windows-1803-endpoints.md +++ b/windows/privacy/manage-windows-1803-endpoints.md @@ -32,16 +32,16 @@ Some Windows components, app, and related services transfer data to Microsoft ne This article lists different endpoints that are available on a clean installation of Windows 10, version 1709 and later. Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). -Where applicable, each endpoint covered in this topic includes a link to specific details about how to control traffic to it. +Where applicable, each endpoint covered in this article includes a link to specific details about how to control traffic to it. We used the following methodology to derive these network endpoints: 1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. -2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). +2. Leave the devices running idle for a week (that is, a user isn't interacting with the system/device). 3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. 4. Compile reports on traffic going to public IP addresses. -5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. -6. All traffic was captured in our lab using an IPV4 network. Therefore no IPV6 traffic is reported here. +5. The test virtual machine was logged in using a local account and wasn't joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. As such no IPV6 traffic is reported here. > [!NOTE] > Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. @@ -61,7 +61,7 @@ If you [turn off traffic to this endpoint](manage-connections-from-windows-opera The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. -Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. +Additionally, the Microsoft Store can't revoke malicious Store apps and users will can still open them. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -70,7 +70,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a The following endpoints are used for Twitter updates. To turn off traffic for these endpoints, either uninstall Twitter or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. -Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. +Additionally, the Microsoft Store can't revoke malicious Store apps and users will can still open them. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -80,7 +80,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a The following endpoint is used for Facebook updates. To turn off traffic for this endpoint, either uninstall Facebook or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. -Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. +Additionally, the Microsoft Store can't revoke malicious Store apps and users will can still open them. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -89,7 +89,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office. To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. -Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. +Additionally, the Microsoft Store can't revoke malicious Store apps and users can still open them. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -98,7 +98,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a The following endpoint is used for Candy Crush Saga updates. To turn off traffic for this endpoint, either uninstall Candy Crush Saga or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. -Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. +Additionally, the Microsoft Store can't revoke malicious Store apps and users can still open them. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -107,14 +107,14 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a The following endpoint is used for by the Microsoft Wallet app. To turn off traffic for this endpoint, either uninstall the Wallet app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Store apps cannot be installed or updated. -Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. +Additionally, the Microsoft Store can't revoke malicious Store apps and users can still open them. | Source process | Protocol | Destination | |----------------|----------|------------| | system32\AppHostRegistrationVerifier.exe | HTTPS | wallet.microsoft.com | The following endpoint is used by the Groove Music app for update HTTP handler status. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-apps-for-websites), apps for websites won't work and customers who visit websites (such as mediaredirect.microsoft.com) that are registered with their associated app (such as Groove Music) will stay at the website and won't be able to directly launch the app. +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-apps-for-websites), apps for websites won't work and customers who visit websites (such as mediaredirect.microsoft.com) that are registered with their associated app (such as Groove Music) will stay at the website and can't directly launch the app. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -123,28 +123,28 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Cortana and Search The following endpoint is used to get images that are used for Microsoft Store suggestions. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you will block images that are used for Microsoft Store suggestions. +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you'll block images that are used for Microsoft Store suggestions. | Source process | Protocol | Destination | |----------------|----------|------------| | searchui | HTTPS |store-images.s-microsoft.com | The following endpoint is used to update Cortana greetings, tips, and Live Tiles. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you will block updates to Cortana greetings, tips, and Live Tiles. +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you'll block updates to Cortana greetings, tips, and Live Tiles. | Source process | Protocol | Destination | |----------------|----------|------------| | backgroundtaskhost | HTTPS | www.bing.com/client | The following endpoint is used to configure parameters, such as how often the Live Tile is updated. It's also used to activate experiments. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), parameters would not be updated and the device would no longer participate in experiments. +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), parameters wouldn't be updated and the device would no longer participate in experiments. | Source process | Protocol | Destination | |----------------|----------|------------| | backgroundtaskhost | HTTPS | www.bing.com/proactive | The following endpoint is used by Cortana to report diagnostic and diagnostic data information. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), Microsoft won't be aware of issues with Cortana and won't be able to fix them. +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), Microsoft won't be aware of issues with Cortana and can't fix them. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -152,11 +152,11 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Certificates -The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. +The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It's possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that isn't recommended because when root certificates are updated over time, applications and websites may stop working because they didn't receive an updated root certificate the application uses. -Additionally, it is used to download certificates that are publicly known to be fraudulent. +Additionally, it's used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. -We do not recommend blocking this endpoint. +We don't recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device. | Source process | Protocol | Destination | @@ -166,7 +166,7 @@ If traffic to this endpoint is turned off, Windows no longer automatically downl ## Device authentication The following endpoint is used to authenticate a device. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), the device will not be authenticated. +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), the device won't be authenticated. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -175,7 +175,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Device metadata The following endpoint is used to retrieve device metadata. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-devinst), metadata will not be updated for the device. +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-devinst), metadata won't be updated for the device. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -185,7 +185,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Diagnostic Data The following endpoint is used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, won't be sent back to Microsoft. | Source process | Protocol | Destination | |----------------|----------|------------| @@ -298,7 +298,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Office -The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. @@ -310,7 +310,7 @@ If you turn off traffic for these endpoints, users won't be able to save documen | | | *.s-msedge.net | | | HTTPS | ocos-office365-s2s.msedge.net | -The following endpoint is used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoint is used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. @@ -333,7 +333,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper |----------------|----------|------------| | onedrive | HTTP \ HTTPS | g.live.com/1rewlive5skydrive/ODSUProduction | -The following endpoint is used by OneDrive for Business to download and verify app updates. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US). +The following endpoint is used by OneDrive for Business to download and verify app updates. For more info, see [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges). To turn off traffic for this endpoint, uninstall OneDrive for Business. In this case, your device will not able to get OneDrive for Business app updates. | Source process | Protocol | Destination | @@ -461,5 +461,5 @@ To view endpoints for non-Enterprise Windows 10 editions, see: ## Related links -- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) +- [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges) - [Network infrastructure requirements for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints) \ No newline at end of file diff --git a/windows/privacy/manage-windows-20H2-endpoints.md b/windows/privacy/manage-windows-20H2-endpoints.md index 9e953d592b..f891d0bf27 100644 --- a/windows/privacy/manage-windows-20H2-endpoints.md +++ b/windows/privacy/manage-windows-20H2-endpoints.md @@ -156,5 +156,5 @@ To view endpoints for non-Enterprise Windows 10 editions, see: ## Related links -- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) +- [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges) - [Network infrastructure requirements for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints) \ No newline at end of file diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md index b1f5e5b96d..51e80aa248 100644 --- a/windows/privacy/manage-windows-21H1-endpoints.md +++ b/windows/privacy/manage-windows-21H1-endpoints.md @@ -154,5 +154,5 @@ To view endpoints for non-Enterprise Windows 10 editions, see: ## Related links -- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) +- [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges) - [Network infrastructure requirements for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints) \ No newline at end of file diff --git a/windows/privacy/manage-windows-21h2-endpoints.md b/windows/privacy/manage-windows-21h2-endpoints.md index 9ee456b4e0..6dc79e13de 100644 --- a/windows/privacy/manage-windows-21h2-endpoints.md +++ b/windows/privacy/manage-windows-21h2-endpoints.md @@ -154,5 +154,5 @@ To view endpoints for non-Enterprise Windows 10 editions, see: ## Related links -- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) +- [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges) - [Network infrastructure requirements for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints) \ No newline at end of file diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index 022a291824..029b3c691d 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -2,7 +2,7 @@ description: Use this article to learn more about what required Windows diagnostic data is gathered. title: Windows 10, version 21H2, Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 required diagnostic events and fields (Windows 10) keywords: privacy, telemetry -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -16,6 +16,7 @@ ms.collection: ms.topic: article audience: ITPro ms.date: +ms.technology: privacy --- diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 0930e7356b..0e97842d03 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -2,7 +2,7 @@ title: Windows Privacy Compliance Guide description: This article provides information to help IT and compliance professionals understand the personal data policies as related to Windows. keywords: privacy, GDPR, compliance -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -13,7 +13,8 @@ ms.author: brianlic manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 10/04/2021 +ms.date: 12/01/2021 +ms.technology: privacy --- # Windows Privacy Compliance:
    A Guide for IT and Compliance Professionals diff --git a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md index 52bd66824a..6f9cf021c9 100644 --- a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md +++ b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md @@ -12,7 +12,7 @@ ms.author: v-hakima manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 10/04/2021 +ms.date: 12/01/2021 ms.technology: privacy --- # Windows 11 connection endpoints for non-Enterprise editions diff --git a/windows/privacy/windows-diagnostic-data-1703.md b/windows/privacy/windows-diagnostic-data-1703.md index 1137e6a744..0ccee01ea1 100644 --- a/windows/privacy/windows-diagnostic-data-1703.md +++ b/windows/privacy/windows-diagnostic-data-1703.md @@ -2,7 +2,7 @@ title: Windows 10 diagnostic data for the Full diagnostic data level (Windows 10) description: Use this article to learn about the types of data that is collected the Full diagnostic data level. keywords: privacy,Windows 10 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high @@ -12,8 +12,9 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 11/28/2017 +ms.date: 12/01/2021 ms.reviewer: +ms.technology: privacy --- # Windows 10 diagnostic data for the Full diagnostic data level diff --git a/windows/privacy/windows-diagnostic-data.md b/windows/privacy/windows-diagnostic-data.md index 350ef3f102..88faf6a75d 100644 --- a/windows/privacy/windows-diagnostic-data.md +++ b/windows/privacy/windows-diagnostic-data.md @@ -2,7 +2,7 @@ title: Windows 10, version 1709 and Windows 11 and later optional diagnostic data (Windows 10) description: Use this article to learn about the types of optional diagnostic data that is collected. keywords: privacy,Windows 10 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high @@ -14,6 +14,9 @@ ms.collection: - M365-security-compliance - highpri ms.topic: article +ms.reviewer: +ms.technology: privacy + --- # Windows 10, version 1709 and later and Windows 11 optional diagnostic data diff --git a/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md index 4d7cae37b2..b3c1cee7bb 100644 --- a/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md @@ -2,7 +2,7 @@ title: Windows 10, version 1709, connection endpoints for non-Enterprise editions description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 1709. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high @@ -12,8 +12,9 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 6/26/2018 -ms.reviewer: +ms.date: 12/01/2021 +ms.reviewer: +ms.technology: privacy --- # Windows 10, version 1709, connection endpoints for non-Enterprise editions diff --git a/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md index dfc17c31c3..b3ec01bc64 100644 --- a/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md @@ -2,7 +2,7 @@ title: Windows 10, version 1803, connection endpoints for non-Enterprise editions description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 1803. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high @@ -12,8 +12,9 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 6/26/2018 +ms.date: 12/01/2021 ms.reviewer: +ms.technology: privacy --- # Windows 10, version 1803, connection endpoints for non-Enterprise editions diff --git a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md index aea47d78e8..ff4d97cb72 100644 --- a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md @@ -2,7 +2,7 @@ title: Windows 10, version 1809, connection endpoints for non-Enterprise editions description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 1809. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high @@ -12,8 +12,9 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 6/26/2018 +ms.date: 12/01/2021 ms.reviewer: +ms.technology: privacy --- # Windows 10, version 1809, connection endpoints for non-Enterprise editions diff --git a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md index 4a2cf3b71f..a383c259cf 100644 --- a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md @@ -2,7 +2,7 @@ title: Windows 10, version 1903, connection endpoints for non-Enterprise editions description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 1903. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high @@ -12,7 +12,8 @@ ms.author: obezeajo manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 7/22/2020 +ms.date: 12/01/2021 +ms.technology: privacy --- # Windows 10, version 1903, connection endpoints for non-Enterprise editions diff --git a/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md index 90ab13ce23..3520abedd7 100644 --- a/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md @@ -2,7 +2,7 @@ title: Windows 10, version 1909, connection endpoints for non-Enterprise editions description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 1909. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high @@ -12,7 +12,8 @@ ms.author: v-hakima manager: obezeajo ms.collection: M365-security-compliance ms.topic: article -ms.date: 08/18/2020 +ms.date: 12/01/2021 +ms.technology: privacy --- # Windows 10, version 1909, connection endpoints for non-Enterprise editions @@ -147,7 +148,8 @@ The following methodology was used to derive the network endpoints: |ris.api.iris.microsoft.com|TLS v1.2|Windows Spotlight |settings-win.data.microsoft.com|HTTPS/TLS v1.2|Used for Windows apps to dynamically update their configuration |spo-ring.msedge.net|TLSv1.2|Cortana and Live Tiles -|telecommand.telemetry.microsoft.com|TLS v1.2|Used by Windows Error Reporting ||tile-service.weather.microsoft.com|HTTP|Used for the Weather app +|telecommand.telemetry.microsoft.com|TLS v1.2|Used by Windows Error Reporting +|tile-service.weather.microsoft.com|HTTP|Used for the Weather app |tsfe.trafficshaping.dsp.mp.microsoft.com|HTTPS|Used for content regulation |v10.events.data.microsoft.com/onecollector/1.0/|HTTPS/TLS v1.2|Diagnostic Data |v10.events.data.microsoft.com|HTTPS/TLS v1.2|Used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service diff --git a/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md b/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md index edd183b412..d756be9937 100644 --- a/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md @@ -2,7 +2,7 @@ title: Windows 10, version 2004, connection endpoints for non-Enterprise editions description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 2004. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high @@ -12,7 +12,8 @@ ms.author: obezeajo manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 5/11/2020 +ms.date: 12/01/2021 +ms.technology: privacy --- # Windows 10, version 2004, connection endpoints for non-Enterprise editions diff --git a/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md b/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md index 69951778e6..63ddea60f9 100644 --- a/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md @@ -2,7 +2,7 @@ title: Windows 10, version 20H2, connection endpoints for non-Enterprise editions description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 20H2. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high @@ -12,7 +12,8 @@ ms.author: v-hakima manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/17/2020 +ms.date: 12/01/2021 +ms.technology: privacy --- # Windows 10, version 20H2, connection endpoints for non-Enterprise editions diff --git a/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md b/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md index fccffc6540..609bb9e605 100644 --- a/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md @@ -12,7 +12,7 @@ ms.author: v-hakima manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 10/04/2021 +ms.date: 12/01/2021 ms.technology: privacy --- # Windows 10, version 21H1, connection endpoints for non-Enterprise editions diff --git a/windows/security/identity-protection/access-control/access-control.md b/windows/security/identity-protection/access-control/access-control.md index 2fd6ef89b3..b4a6c2c7fa 100644 --- a/windows/security/identity-protection/access-control/access-control.md +++ b/windows/security/identity-protection/access-control/access-control.md @@ -1,7 +1,7 @@ --- title: Access Control Overview (Windows 10) description: Access Control Overview -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/access-control/active-directory-accounts.md b/windows/security/identity-protection/access-control/active-directory-accounts.md index 81735340b3..f2d6c64736 100644 --- a/windows/security/identity-protection/access-control/active-directory-accounts.md +++ b/windows/security/identity-protection/access-control/active-directory-accounts.md @@ -1,7 +1,7 @@ --- title: Active Directory Accounts (Windows 10) description: Active Directory Accounts -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -392,13 +392,13 @@ The following procedure describes how to block Internet access by creating a Gro 5. Right-click the new OU, and > **Create a GPO in this domain, and Link it here**. - ![Active Directory local accounts 2](images/adlocalaccounts-proc1-sample2.png) + ![Active Directory's local accounts](images/adlocalaccounts-proc1-sample2.png) 6. Name the GPO, and > **OK**. 7. Expand the GPO, right-click the new GPO, and > **Edit**. - ![Active Directory local accounts 3](images/adlocalaccounts-proc1-sample3.png) + ![Active Directory (AD) local accounts](images/adlocalaccounts-proc1-sample3.png) 8. Configure which members of accounts can log on locally to these administrative workstations as follows: @@ -417,7 +417,7 @@ The following procedure describes how to block Internet access by creating a Gro 5. Click **Add User or Group**, type **Administrators**, and > **OK**. - ![Active Directory local accounts 4](images/adlocalaccounts-proc1-sample4.png) + ![AD local accounts](images/adlocalaccounts-proc1-sample4.png) 9. Configure the proxy configuration: @@ -425,7 +425,7 @@ The following procedure describes how to block Internet access by creating a Gro 2. Double-click **Proxy Settings**, select the **Enable proxy settings** check box, type **127.0.0.1** (the network Loopback IP address) as the proxy address, and > **OK**. - ![Active Directory local accounts 5](images/adlocalaccounts-proc1-sample5.png) + ![AD's local accounts](images/adlocalaccounts-proc1-sample5.png) 10. Configure the loopback processing mode to enable the user Group Policy proxy setting to apply to all users on the computer as follows: @@ -458,11 +458,11 @@ The following procedure describes how to block Internet access by creating a Gro 1. Right-click **Windows Firewall with Advanced Security LDAP://path**, and > **Properties**. - ![Active Directory local accounts 6](images/adlocalaccounts-proc1-sample6.png) + ![Local accounts for Active Directory](images/adlocalaccounts-proc1-sample6.png) 2. On each profile, ensure that the firewall is enabled and that inbound connections are set to **Block all connections**. - ![Active Directory local accounts 7](images/adlocalaccounts-proc1-sample7.png) + ![Local accounts for an AD](images/adlocalaccounts-proc1-sample7.png) 3. Click **OK** to complete the configuration. @@ -500,11 +500,11 @@ Restrict logon access to lower-trust servers and workstations by using the follo 3. Right-click **Group Policy Objects**, and > **New**. - ![Active Directory local accounts 8](images/adlocalaccounts-proc2-sample1.png) + ![Local account's representation - Active Directory](images/adlocalaccounts-proc2-sample1.png) 4. In the **New GPO** dialog box, name the GPO that restricts administrators from signing in to workstations, and > **OK**. - ![Active Directory local accounts 9](images/adlocalaccounts-proc2-sample2.png) + ![Local account's representation - AD](images/adlocalaccounts-proc2-sample2.png) 5. Right-click **New GPO**, and > **Edit**. @@ -518,7 +518,7 @@ Restrict logon access to lower-trust servers and workstations by using the follo 3. Click **Add User or Group**, click **Browse**, type **Domain Admins**, and > **OK**. - ![Active Directory local accounts 10](images/adlocalaccounts-proc2-sample3.png) + ![An Active Directory's local accounts](images/adlocalaccounts-proc2-sample3.png) > [!NOTE] > You can optionally add any groups that contain server administrators who you want to restrict from signing in to workstations. @@ -540,7 +540,7 @@ Restrict logon access to lower-trust servers and workstations by using the follo 3. Click **Add User or Group** > **Browse**, type **Domain Admins**, and > **OK**. - ![Active Directory local accounts 11](images/adlocalaccounts-proc2-sample4.png) + ![An AD's local accounts](images/adlocalaccounts-proc2-sample4.png) > [!NOTE] > You can optionally add any groups that contain server administrators who you want to restrict from signing in to workstations. @@ -553,7 +553,7 @@ Restrict logon access to lower-trust servers and workstations by using the follo 6. Click **Add User or Group** > **Browse**, type **Domain Admins**, and > **OK**. - ![Active Directory local accounts 12](images/adlocalaccounts-proc2-sample5.png) + ![Local accounts for AD](images/adlocalaccounts-proc2-sample5.png) > [!NOTE] > You can optionally add any groups that contain server administrators who you want to restrict from signing in to workstations. @@ -566,6 +566,12 @@ Restrict logon access to lower-trust servers and workstations by using the follo 1. Right-click the workstation OU, and then > **Link an Existing GPO**. + ![Local accounts representation for an Active Directory](images/adlocalaccounts-proc2-sample6.png) + + 2. Select the GPO that you just created, and > **OK**. + + ![Active Directory's local accounts' presentation](images/adlocalaccounts-proc2-sample7.png) +======= ![Active Directory local accounts 13](images/adlocalaccounts-proc2-sample6.png) 2. Select the GPO that you just created, and > **OK**. @@ -593,7 +599,7 @@ It is a best practice to configure the user objects for all sensitive accounts i As with any configuration change, test this enabled setting fully to ensure that it performs correctly before you implement it. -![Active Directory local accounts 15](images/adlocalaccounts-proc3-sample1.png) +![An Active Directory local accounts' presentation](images/adlocalaccounts-proc3-sample1.png) ## Secure and manage domain controllers diff --git a/windows/security/identity-protection/access-control/active-directory-security-groups.md b/windows/security/identity-protection/access-control/active-directory-security-groups.md index de708faea8..c95e92b80c 100644 --- a/windows/security/identity-protection/access-control/active-directory-security-groups.md +++ b/windows/security/identity-protection/access-control/active-directory-security-groups.md @@ -1,7 +1,7 @@ --- title: Active Directory Security Groups description: Active Directory Security Groups -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/access-control/dynamic-access-control.md b/windows/security/identity-protection/access-control/dynamic-access-control.md index c1ae4462c3..c68a4e721f 100644 --- a/windows/security/identity-protection/access-control/dynamic-access-control.md +++ b/windows/security/identity-protection/access-control/dynamic-access-control.md @@ -1,7 +1,7 @@ --- title: Dynamic Access Control Overview (Windows 10) description: Learn about Dynamic Access Control and its associated elements, which were introduced in Windows Server 2012 and Windows 8. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index 2126be498a..f4a2c31d2b 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -1,7 +1,7 @@ --- title: Local Accounts (Windows 10) description: Learn how to secure and manage access to the resources on a standalone or member server for services or users. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -94,15 +94,11 @@ In comparison, on the Windows client operating system, a user with a local user In this case, Group Policy can be used to enable secure settings that can control the use of the local Administrators group automatically on every server or client computer. For more information about Group Policy, see [Group Policy Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831791(v=ws.11)). -**Note**   -Blank passwords are not allowed in the versions designated in the **Applies To** list at the beginning of this topic. - - - -**Important**   -Even when the Administrator account has been disabled, it can still be used to gain access to a computer by using safe mode. In the Recovery Console or in safe mode, the Administrator account is automatically enabled. When normal operations are resumed, it is disabled. - - +> [!IMPORTANT] +> +> - Blank passwords are not allowed in the versions designated in the **Applies To** list at the beginning of this topic. +> +> - Even when the Administrator account has been disabled, it can still be used to gain access to a computer by using safe mode. In the Recovery Console or in safe mode, the Administrator account is automatically enabled. When normal operations are resumed, it is disabled. ### Guest account @@ -139,53 +135,16 @@ For details about the HelpAssistant account attributes, see the following table. **HelpAssistant account attributes** - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    AttributeValue

    Well-Known SID/RID

    S-1-5-<domain>-13 (Terminal Server User), S-1-5-<domain>-14 (Remote Interactive Logon)

    Type

    User

    Default container

    CN=Users, DC=<domain>, DC=

    Default members

    None

    Default member of

    Domain Guests

    -

    Guests

    Protected by ADMINSDHOLDER?

    No

    Safe to move out of default container?

    Can be moved out, but we do not recommend it.

    Safe to delegate management of this group to non-Service admins?

    No

    +|Attribute|Value| +|--- |--- | +|Well-Known SID/RID|`S-1-5--13 (Terminal Server User), S-1-5--14 (Remote Interactive Logon)`| +|Type|User| +|Default container|`CN=Users, DC=, DC=`| +|Default members|None| +|Default member of|Domain Guests

    Guests| +|Protected by ADMINSDHOLDER?|No| +|Safe to move out of default container?|Can be moved out, but we do not recommend it.| +|Safe to delegate management of this group to non-Service admins?|No| ### DefaultAccount @@ -232,8 +191,8 @@ The SYSTEM account is used by the operating system and by services that run unde On the other hand, the SYSTEM account does appear on an NTFS file system volume in File Manager in the **Permissions** portion of the **Security** menu. By default, the SYSTEM account is granted Full Control permissions to all files on an NTFS volume. Here the SYSTEM account has the same functional rights and permissions as the Administrator account. -**Note**   -To grant the account Administrators group file permissions does not implicitly give permission to the SYSTEM account. The SYSTEM account's permissions can be removed from a file, but we do not recommend removing them. +> [!NOTE] +> To grant the account Administrators group file permissions does not implicitly give permission to the SYSTEM account. The SYSTEM account's permissions can be removed from a file, but we do not recommend removing them. ### NETWORK SERVICE The NETWORK SERVICE account is a predefined local account used by the service control manager (SCM). A service that runs in the context of the NETWORK SERVICE account presents the computer's credentials to remote servers. For more information, see [NetworkService Account](/windows/desktop/services/networkservice-account). @@ -250,8 +209,8 @@ You can use Local Users and Groups to assign rights and permissions on the local You cannot use Local Users and Groups on a domain controller. However, you can use Local Users and Groups on a domain controller to target remote computers that are not domain controllers on the network. -**Note**   -You use Active Directory Users and Computers to manage users and groups in Active Directory. +> [!NOTE] +> You use Active Directory Users and Computers to manage users and groups in Active Directory. You can also manage local users by using NET.EXE USER and manage local groups by using NET.EXE LOCALGROUP, or by using a variety of PowerShell cmdlets and other scripting technologies. @@ -271,8 +230,8 @@ The other approaches that can be used to restrict and protect user accounts with Each of these approaches is described in the following sections. -**Note**   -These approaches do not apply if all administrative local accounts are disabled. +> [!NOTE] +> These approaches do not apply if all administrative local accounts are disabled. @@ -290,77 +249,24 @@ For more information about UAC, see [User Account Control](/windows/access-prote The following table shows the Group Policy and registry settings that are used to enforce local account restrictions for remote access. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    No.

    Setting

    Detailed Description

    Policy location

    Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

    1

    Policy name

    User Account Control: Run all administrators in Admin Approval Mode

    Policy setting

    Enabled

    2

    Policy location

    Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

    Policy name

    User Account Control: Run all administrators in Admin Approval Mode

    Policy setting

    Enabled

    3

    Registry key

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

    Registry value name

    LocalAccountTokenFilterPolicy

    Registry value type

    DWORD

    Registry value data

    0

    +|No.|Setting|Detailed Description| +|--- |--- |--- | +||Policy location|Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options| +|1|Policy name|[User Account Control: Run all administrators in Admin Approval Mode](/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode)| +||Policy setting|Enabled| +|2|Policy location|Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options| +||Policy name|[User Account Control: Run all administrators in Admin Approval Mode](/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode)| +||Policy setting|Enabled| +|3|Registry key|HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System| +||Registry value name|LocalAccountTokenFilterPolicy| +||Registry value type|DWORD| +||Registry value data|0| - ->[!NOTE] ->You can also enforce the default for LocalAccountTokenFilterPolicy by using the custom ADMX in Security Templates. +> [!NOTE] +> You can also enforce the default for LocalAccountTokenFilterPolicy by using the custom ADMX in Security Templates. -**To enforce local account restrictions for remote access** +#### To enforce local account restrictions for remote access 1. Start the **Group Policy Management** Console (GPMC). @@ -430,63 +336,23 @@ The following table shows the Group Policy and registry settings that are used t Denying local accounts the ability to perform network logons can help prevent a local account password hash from being reused in a malicious attack. This procedure helps to prevent lateral movement by ensuring that the credentials for local accounts that are stolen from a compromised operating system cannot be used to compromise additional computers that use the same credentials. -**Note**   -In order to perform this procedure, you must first identify the name of the local, default Administrator account, which might not be the default user name "Administrator", and any other accounts that are members of the local Administrators group. +> [!NOTE] +> To perform this procedure, you must first identify the name of the local, default Administrator account, which might not be the default user name "Administrator", and any other accounts that are members of the local Administrators group. The following table shows the Group Policy settings that are used to deny network logon for all local Administrator accounts. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    No.

    Setting

    Detailed Description

    Policy location

    Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

    1

    Policy name

    Deny access to this computer from the network

    Policy setting

    Local account and member of Administrators group

    -

    2

    Policy location

    Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

    Policy name

    Deny log on through Remote Desktop Services

    Policy setting

    Local account and member of Administrators group

    -
    +|No.|Setting|Detailed Description| +|--- |--- |--- | +||Policy location|Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment| +|1|Policy name|[Deny access to this computer from the network](/windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network)| +||Policy setting|Local account and member of Administrators group| +|2|Policy location|Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment| +||Policy name|[Deny log on through Remote Desktop Services](/windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services)| +||Policy setting|Local account and member of Administrators group| - - -**To deny network logon to all local administrator accounts** +#### To deny network logon to all local administrator accounts 1. Start the **Group Policy Management** Console (GPMC). @@ -532,8 +398,8 @@ The following table shows the Group Policy settings that are used to deny networ 11. Create links to all other OUs that contain servers. - **Note**   - You might have to create a separate GPO if the user name of the default Administrator account is different on workstations and servers. + > [!NOTE] + > You might have to create a separate GPO if the user name of the default Administrator account is different on workstations and servers. ### Create unique passwords for local accounts with administrative rights @@ -559,4 +425,4 @@ The following resources provide additional information about technologies that a - [Security Identifiers](security-identifiers.md) -- [Access Control Overview](access-control.md) \ No newline at end of file +- [Access Control Overview](access-control.md) diff --git a/windows/security/identity-protection/access-control/microsoft-accounts.md b/windows/security/identity-protection/access-control/microsoft-accounts.md index 033df47072..79e1a30a6a 100644 --- a/windows/security/identity-protection/access-control/microsoft-accounts.md +++ b/windows/security/identity-protection/access-control/microsoft-accounts.md @@ -1,7 +1,7 @@ --- title: Microsoft Accounts (Windows 10) description: Microsoft Accounts -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/access-control/security-identifiers.md b/windows/security/identity-protection/access-control/security-identifiers.md index 65372923f4..d9d4084ca6 100644 --- a/windows/security/identity-protection/access-control/security-identifiers.md +++ b/windows/security/identity-protection/access-control/security-identifiers.md @@ -1,7 +1,7 @@ --- title: Security identifiers (Windows 10) description: Security identifiers -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/access-control/security-principals.md b/windows/security/identity-protection/access-control/security-principals.md index 293acd13c9..d6bdc4569e 100644 --- a/windows/security/identity-protection/access-control/security-principals.md +++ b/windows/security/identity-protection/access-control/security-principals.md @@ -1,7 +1,7 @@ --- title: Security Principals (Windows 10) description: Security Principals -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/access-control/service-accounts.md b/windows/security/identity-protection/access-control/service-accounts.md index de8358b611..2614ab30e4 100644 --- a/windows/security/identity-protection/access-control/service-accounts.md +++ b/windows/security/identity-protection/access-control/service-accounts.md @@ -1,7 +1,7 @@ --- title: Service Accounts (Windows 10) description: Service Accounts -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -20,8 +20,8 @@ ms.date: 11/19/2021 # Service Accounts **Applies to** -- Windows 10 -- Windows Server 2016 +- Windows 10 +- Windows Server 2016 This topic for the IT professional explains group and standalone managed service accounts, and the computer-specific virtual computer account, and it points to resources about these service accounts. @@ -31,72 +31,70 @@ A service account is a user account that is created explicitly to provide a secu This topic contains information about the following types of service accounts: -- [Standalone managed service accounts](#bkmk-standalonemanagedserviceaccounts) +- [Standalone managed service accounts](#bkmk-standalonemanagedserviceaccounts) -- [Group managed service accounts](#bkmk-groupmanagedserviceaccounts) +- [Group-managed service accounts](#bkmk-groupmanagedserviceaccounts) -- [Virtual accounts](#bkmk-virtualserviceaccounts) +- [Virtual accounts](#bkmk-virtualserviceaccounts) ### Standalone managed service accounts A managed service account is designed to isolate domain accounts in crucial applications, such as Internet Information Services (IIS), and eliminate the need for an administrator to manually administer the service principal name (SPN) and credentials for the accounts. -To use managed service accounts, the server on which the application or service is installed must be running at least Windows Server 2008 R2. One managed service account can be used for services on a single computer. Managed service accounts cannot be shared between multiple computers, and they cannot be used in server clusters where a service is replicated on multiple cluster nodes. For this scenario, you must use a group managed service account. For more information, see [Group Managed Service Accounts Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831782(v=ws.11)). +To use managed service accounts, the server on which the application or service is installed must be running at least Windows Server 2008 R2. One managed service account can be used for services on a single computer. Managed service accounts cannot be shared between multiple computers, and they cannot be used in server clusters where a service is replicated on multiple cluster nodes. For this scenario, you must use a group-managed service account. For more information, see [Group-Managed Service Accounts Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831782(v=ws.11)). In addition to the enhanced security that is provided by having individual accounts for critical services, there are four important administrative benefits associated with managed service accounts: -- You can create a class of domain accounts that can be used to manage and maintain services on local computers. +- You can create a class of domain accounts that can be used to manage and maintain services on local computers. -- Unlike domain accounts in which administrators must manually reset passwords, the network passwords for these accounts are automatically reset. +- Unlike domain accounts in which administrators must manually reset passwords, the network passwords for these accounts are automatically reset. +- You do not have to complete complex SPN management tasks to use managed service accounts. - You don't have to complete complex SPN management tasks to use managed service accounts. - -- Administrative tasks for managed service accounts can be delegated to non-administrators. +- Administrative tasks for managed service accounts can be delegated to non-administrators. ### Software requirements Managed service accounts apply to the Windows operating systems that are designated in the **Applies To** list at the beginning of this topic. -### Group managed service accounts +### Group-managed service accounts -Group managed service accounts are an extension of the standalone managed service accounts, which were introduced in Windows Server 2008 R2. These are managed domain accounts that provide automatic password management and simplified service principal name (SPN) management, including delegation of management to other administrators. +Group-managed service accounts are an extension of the standalone-managed service accounts, which were introduced in Windows Server 2008 R2. These accounts are managed domain accounts that provide automatic password management and simplified service principal name (SPN) management, including delegation of management to other administrators. -The group managed service account provides the same functionality as a standalone managed service account within the domain, but it extends that functionality over multiple servers. When connecting to a service that is hosted on a server farm, such as Network Load Balancing, the authentication protocols that support mutual authentication require all instances of the services to use the same principal. When group managed service accounts are used as service principals, the Windows Server operating system manages the password for the account instead of relying on the administrator to manage the password. +The group-managed service account provides the same functionality as a standalone managed service account within the domain, but it extends that functionality over multiple servers. When connecting to a service that is hosted on a server farm, such as Network Load Balancing, the authentication protocols that support mutual authentication require all instances of the services to use the same principal. When group-managed service accounts are used as service principals, the Windows Server operating system manages the password for the account instead of relying on the administrator to manage the password. -The Microsoft Key Distribution Service (kdssvc.dll) provides the mechanism to securely obtain the latest key or a specific key with a key identifier for an Active Directory account. This service was introduced in Windows Server 2012, and it does not run on previous versions of the Windows Server operating system. The Key Distribution Service shares a secret, which is used to create keys for the account. These keys are periodically changed. For a group managed service account, the domain controller computes the password on the key that is provided by the Key Distribution Services, in addition to other attributes of the group managed service account. +The Microsoft Key Distribution Service (kdssvc.dll) provides the mechanism to securely obtain the latest key or a specific key with a key identifier for an Active Directory account. This service was introduced in Windows Server 2012, and it does not run on previous versions of the Windows Server operating system. The Key Distribution Service shares a secret, which is used to create keys for the account. These keys are periodically changed. For a group-managed service account, the domain controller computes the password on the key that is provided by the Key Distribution Services, in addition to other attributes of the group-managed service account. ### Practical applications -Group managed service accounts provide a single identity solution for services running on a server farm, or on systems that use Network Load Balancing. By providing a group managed service account solution, services can be configured for the group managed service account principal, and the password management is handled by the operating system. +Group-managed service accounts provide a single identity solution for services running on a server farm, or on systems that use Network Load Balancing. By providing a group-managed service account solution, services can be configured for the group-managed service account principal, and the password management is handled by the operating system. -By using a group managed service account, services or service administrators don't need to manage password synchronization between service instances. The group managed service account supports hosts that are kept offline for an extended time period and the management of member hosts for all instances of a service. This means that you can deploy a server farm that supports a single identity to which existing client computers can authenticate without knowing the instance of the service to which they are connecting. +By using a group-managed service account, service administrators do not need to manage password synchronization between service instances. The group-managed service account supports hosts that are kept offline for an extended time period and the management of member hosts for all instances of a service. This provision means that you can deploy a server farm that supports a single identity to which existing client computers can authenticate without knowing the instance of the service to which they are connecting. -Failover clusters don't support group managed service account s. However, services that run on top of the Cluster service can use a group managed service account or a standalone managed service account if they are a Windows service, an App pool, a scheduled task, or if they natively support group managed service account or standalone managed service accounts. +Failover clusters do not support group-managed service accounts. However, services that run on top of the Cluster service can use a group-managed service account or a standalone managed service account if they are a Windows service, an App pool, a scheduled task, or if they natively support group-managed service account or standalone managed service accounts. ### Software requirements -Group managed service accounts can only be configured and administered on computers running at least Windows Server 2012, but they can be deployed as a single service identity solution in domains that still have domain controllers running operating systems earlier than Windows Server 2012. There are no domain or forest functional level requirements. +Group-managed service accounts can only be configured and administered on computers running at least Windows Server 2012, but they can be deployed as a single service identity solution in domains that still have domain controllers running operating systems earlier than Windows Server 2012. There are no domain or forest functional level requirements. -A 64-bit architecture is required to run the Windows PowerShell commands that are used to administer group managed service accounts. +A 64-bit architecture is required to run the Windows PowerShell commands that are used to administer group-managed service accounts. -A managed service account is dependent on encryption types supported by Kerberos. When a client computer authenticates to a server by using Kerberos protocol, the domain controller creates a Kerberos service ticket that is protected with encryption that the domain controller and the server support. The domain controller uses the account’s **msDS-SupportedEncryptionTypes** attribute to determine what encryption the server supports, and if there is no attribute, it assumes that the client computer does not support stronger encryption types. The Advanced Encryption Standard (AES) should always be explicitly configured for managed service accounts. If computers that host the managed service account are configured to not support RC4, authentication will always fail. +A managed service account is dependent on encryption types supported by Kerberos. When a client computer authenticates to a server by using Kerberos protocol, the domain controller creates a Kerberos service ticket that is protected with encryption that the domain controller and the server support. The domain controller uses the account’s **msDS-SupportedEncryptionTypes** attribute to determine what encryption the server supports, and if there is no attribute, it assumes that the client computer does not support stronger encryption types. The Advanced Encryption Standard (AES) must always be configured for managed service accounts. If computers that host the managed service account are configured to not support RC4, authentication will always fail. **Note**   Introduced in Windows Server 2008 R2, the Data Encryption Standard (DES) is disabled by default. For more information about supported encryption types, see [Changes in Kerberos Authentication](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd560670(v=ws.10)). - - -Group managed service accounts are not applicable in Windows operating systems prior to Windows Server 2012. +Group-managed service accounts are not applicable in Windows operating systems prior to Windows Server 2012. ### Virtual accounts Virtual accounts were introduced in Windows Server 2008 R2 and Windows 7, and are managed local accounts that provide the following features to simplify service administration: -- The virtual account is automatically managed. +- The virtual account is automatically managed. -- The virtual account can access the network in a domain environment. +- The virtual account can access the network in a domain environment. -- No password management is required. For example, if the default value is used for the service accounts during SQL Server setup on Windows Server 2008 R2, a virtual account that uses the instance name as the service name is established in the format NT SERVICE\\<SERVICENAME>. +- No password management is required. For example, if the default value is used for the service accounts during SQL Server setup on Windows Server 2008 R2, a virtual account that uses the instance name as the service name is established in the format NT SERVICE\\<SERVICENAME>. Services that run as virtual accounts access network resources by using the credentials of the computer account in the format <domain\_name>\\<computer\_name>$. @@ -109,7 +107,7 @@ Virtual accounts apply to the Windows operating systems that are designated in t ## See also -The following table provides links to additional resources that are related to standalone managed service accounts, group managed service accounts, and virtual accounts. +The following table provides links to other resources that are related to standalone managed service accounts, group-managed service accounts, and virtual accounts. | Content type | References | |---------------|-------------| diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index f08c30bd24..d4abeec003 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -1,7 +1,7 @@ --- title: Special Identities (Windows 10) description: Special Identities -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/configure-s-mime.md b/windows/security/identity-protection/configure-s-mime.md index 2f95950f32..d0ddb7f478 100644 --- a/windows/security/identity-protection/configure-s-mime.md +++ b/windows/security/identity-protection/configure-s-mime.md @@ -4,7 +4,7 @@ description: S/MIME lets users encrypt outgoing messages and attachments so that ms.assetid: 7F9C2A99-42EB-4BCC-BB53-41C04FBBBF05 ms.reviewer: keywords: encrypt, digital signature -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/credential-guard/additional-mitigations.md b/windows/security/identity-protection/credential-guard/additional-mitigations.md index 74a0f7dd85..9ca5657e1d 100644 --- a/windows/security/identity-protection/credential-guard/additional-mitigations.md +++ b/windows/security/identity-protection/credential-guard/additional-mitigations.md @@ -1,7 +1,7 @@ --- title: Additional mitigations description: Advice and sample code for making your domain environment more secure and robust with Windows Defender Credential Guard. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md index 871578d4d0..f9dce14935 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md @@ -1,7 +1,7 @@ --- title: Advice while using Windows Defender Credential Guard (Windows) description: Considerations and recommendations for certain scenarios when using Windows Defender Credential Guard in Windows. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md index c3473caa24..0d09f98a43 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md @@ -1,7 +1,7 @@ --- title: How Windows Defender Credential Guard works description: Learn how Windows Defender Credential Guard uses virtualization to protect secrets, so that only privileged system software can access them. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index 208a4b22a1..1dae9e49d5 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -1,7 +1,7 @@ --- title: Windows Defender Credential Guard - Known issues (Windows) description: Windows Defender Credential Guard - Known issues in Windows Enterprise -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security @@ -24,11 +24,11 @@ ms.reviewer: - Windows Server 2016 - Windows Server 2019 -Windows Defender Credential Guard has certain application requirements. Windows Defender Credential Guard blocks specific authentication capabilities. Therefore applications that require such capabilities will not function when it is enabled. For further information, see [Application requirements](/windows/access-protection/credential-guard/credential-guard-requirements#application-requirements). +Windows Defender Credential Guard has certain application requirements. Windows Defender Credential Guard blocks specific authentication capabilities. So applications that require such capabilities won't function when it's enabled. For more information, see [Application requirements](/windows/access-protection/credential-guard/credential-guard-requirements#application-requirements). The following known issue has been fixed in the [Cumulative Security Update for November 2017](https://support.microsoft.com/help/4051033): -- Scheduled tasks with domain user stored credentials fail to run when Credential Guard is enabled. The task fails and reports Event ID 104 with the following message:
    +- Scheduled tasks with domain user-stored credentials fail to run when Credential Guard is enabled. The task fails and reports Event ID 104 with the following message:
    "Task Scheduler failed to log on ‘\Test’.
    Failure occurred in ‘LogonUserExEx’.
    User Action: Ensure the credentials for the task are correctly specified.
    @@ -70,9 +70,9 @@ The following known issues have been fixed by servicing releases made available The following issue affects the Java GSS API. See the following Oracle bug database article: -- [JDK-8161921: Windows Defender Credential Guard does not allow sharing of TGT with Java](http://bugs.java.com/bugdatabase/view_bug.do?bug_id=8161921) +- [JDK-8161921: Windows Defender Credential Guard doesn't allow sharing of TGT with Java](http://bugs.java.com/bugdatabase/view_bug.do?bug_id=8161921) -When Windows Defender Credential Guard is enabled on Windows, the Java GSS API will not authenticate. This is expected behavior because Windows Defender Credential Guard blocks specific application authentication capabilities and will not provide the TGT session key to applications regardless of registry key settings. For further information see [Application requirements](/windows/access-protection/credential-guard/credential-guard-requirements#application-requirements). +When Windows Defender Credential Guard is enabled on Windows, the Java GSS API won't authenticate. This is expected behavior because Windows Defender Credential Guard blocks specific application authentication capabilities and won't provide the TGT session key to applications regardless of registry key settings. For further information, see [Application requirements](/windows/access-protection/credential-guard/credential-guard-requirements#application-requirements). The following issue affects Cisco AnyConnect Secure Mobility Client: @@ -85,15 +85,15 @@ The following issue affects McAfee Application and Change Control (MACC): The following issue affects AppSense Environment Manager. - For further information, see the following Knowledge Base article: + For more information, see the following Knowledge Base article: - [Installing AppSense Environment Manager on Windows machines causes LSAISO.exe to exhibit high CPU usage when Windows Defender Credential Guard is enabled](http://www.appsense.com/kb/160525073917945) [1] \** The following issue affects Citrix applications: - Windows machines exhibit high CPU usage with Citrix applications installed when Windows Defender Credential Guard is enabled. [1] -[1] Products that connect to Virtualization Based Security (VBS) protected processes can cause Windows Defender Credential Guard-enabled Windows 10, Windows 11, Windows Server 2016 or Windows Server 2019 machines to exhibit high CPU usage. For technical and troubleshooting information, see the following Microsoft Knowledge Base article: +[1] Products that connect to Virtualization Based Security (VBS) protected processes can cause Windows Defender Credential Guard-enabled Windows 10, Windows 11, Windows Server 2016, or Windows Server 2019 machines to exhibit high CPU usage. For technical and troubleshooting information, see the following Microsoft Knowledge Base article: -- [KB4032786 High CPU usage in the LSAISO process on Windows](https://support.microsoft.com/help/4032786) +- [KB4032786 High CPU usage in the LSAISO process on Windows](/troubleshoot/windows-client/performance/lsaiso-process-high-cpu-usage) For further technical information on LSAISO.exe, see the MSDN article: [Isolated User Mode (IUM) Processes](/windows/win32/procthread/isolated-user-mode--ium--processes) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 8eca62faa0..f5c9ad4cbf 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -1,14 +1,14 @@ --- title: Manage Windows Defender Credential Guard (Windows) description: Learn how to deploy and manage Windows Defender Credential Guard using Group Policy, the registry, or hardware readiness tools. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dansimp -ms.author: v-tea +ms.author: v-tappelgate manager: dansimp ms.collection: - M365-identity-device-management diff --git a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md index 30f8dbe57c..170018c2c2 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md @@ -1,7 +1,7 @@ --- title: Windows Defender Credential Guard protection limits & mitigations (Windows) description: Scenarios not protected by Windows Defender Credential Guard in Windows, and additional mitigations you can use. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md index e348a5ba65..9cab64d757 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md @@ -1,7 +1,7 @@ --- title: Windows Defender Credential Guard protection limits (Windows) description: Some ways to store credentials are not protected by Windows Defender Credential Guard in Windows. Learn more with this guide. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index d6f1e64f67..095e9ddef9 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -1,7 +1,7 @@ --- title: Windows Defender Credential Guard Requirements (Windows) description: Windows Defender Credential Guard baseline hardware, firmware, and software requirements, and additional protections for improved security. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md index f4e9fb404e..709bc9de64 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md @@ -1,7 +1,7 @@ --- title: Scripts for Certificate Issuance Policies in Windows Defender Credential Guard (Windows) description: Obtain issuance policies from the certificate authority for Windows Defender Credential Guard on Windows. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/credential-guard/credential-guard.md b/windows/security/identity-protection/credential-guard/credential-guard.md index d4d4c73e7a..2c6e89c1e2 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard.md +++ b/windows/security/identity-protection/credential-guard/credential-guard.md @@ -2,7 +2,8 @@ title: Protect derived domain credentials with Windows Defender Credential Guard (Windows) description: Windows Defender Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. ms.assetid: 4F1FE390-A166-4A24-8530-EA3369FEB4B1 -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md index 5e6d9befec..a3c6d35840 100644 --- a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md +++ b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md @@ -1,7 +1,7 @@ --- title: Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool description: Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool script -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/enterprise-certificate-pinning.md b/windows/security/identity-protection/enterprise-certificate-pinning.md index fea29a3fc3..bef5c8651e 100644 --- a/windows/security/identity-protection/enterprise-certificate-pinning.md +++ b/windows/security/identity-protection/enterprise-certificate-pinning.md @@ -9,8 +9,8 @@ ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article -ms.prod: w10 -ms.technology: windows +ms.prod: m365-security +ms.technology: windows-sec ms.pagetype: security ms.localizationpriority: medium ms.date: 07/27/2017 diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index 46ae044e8f..92e56d01b5 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -1,7 +1,7 @@ --- title: WebAuthn APIs description: Learn how to use WebAuthn APIs to enable password-less authentication for your sites and apps. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index d1e93b59ef..f208a8b623 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -2,7 +2,7 @@ title: Multi-factor Unlock description: Learn how Windows 10 and Windows 11 offer multi-factor device unlock by extending Windows Hello with trusted signals. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, multi, factor, multifactor, multi-factor -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile @@ -347,7 +347,7 @@ This example configures Wi-Fi as a trusted signal (Windows 10, version 1803 or l You need at least a Windows 10, version 1709 or later workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business Group Policy settings, which includes multi-factor unlock. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows on a computer running Windows 10, version 1709 or later. -Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. +Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) for more information. ### Create the Multifactor Unlock Group Policy object diff --git a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md index 8e5fd2f049..fccc969f85 100644 --- a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md +++ b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md @@ -2,7 +2,7 @@ title: Azure Active Directory join cloud only deployment description: Use this deployment guide to successfully use Azure Active Directory to join a Windows 10 or Windows 11 device. keywords: identity, Hello, Active Directory, cloud, -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md index b317356b81..a7761bfd94 100644 --- a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md +++ b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md @@ -2,7 +2,7 @@ title: Having enough Domain Controllers for Windows Hello for Business deployments description: Guide for planning to have an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md index 1933fad122..44dc96c2b7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md +++ b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md @@ -3,7 +3,7 @@ title: Windows Hello and password changes (Windows) description: When you change your password on a device, you may need to sign in with a password on other devices to reset Hello. ms.assetid: 83005FE4-8899-47A6-BEA9-C17CCA0B6B55 ms.reviewer: -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md index 8547067ad6..e6b66a231d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md +++ b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md @@ -3,7 +3,7 @@ title: Windows Hello biometrics in the enterprise (Windows) description: Windows Hello uses biometrics to authenticate users and guard against potential spoofing, through fingerprint matching and facial recognition. ms.assetid: d3f27d94-2226-4547-86c0-65c84d6df8Bc keywords: Windows Hello, enterprise biometrics -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index 958d349b3e..78a031e4af 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -2,7 +2,7 @@ title: Prepare and Deploy Windows AD FS certificate trust (Windows Hello for Business) description: Learn how to Prepare and Deploy Windows Server 2016 Active Directory Federation Services (AD FS) for Windows Hello for Business, using certificate trust. keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md index e138bab868..8fecc4d5ee 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md @@ -2,7 +2,7 @@ title: Configure Windows Hello for Business Policy settings - certificate trust description: Configure Windows Hello for Business Policy settings for Windows Hello for Business. Certificate-based deployments need three group policy settings. keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md index f468cbe23f..e89eef978c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md @@ -2,7 +2,7 @@ title: Update Active Directory schema for cert-trust deployment (Windows Hello for Business) description: How to Validate Active Directory prerequisites for Windows Hello for Business when deploying with the certificate trust model. keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md index 6a840d43c6..2cd3770d1b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md @@ -2,7 +2,7 @@ title: Validate and Deploy MFA for Windows Hello for Business with certificate trust description: How to Validate and Deploy Multifactor Authentication (MFA) Services for Windows Hello for Business with certificate trust keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile @@ -16,7 +16,7 @@ localizationpriority: medium ms.date: 08/19/2018 ms.reviewer: --- -# Validate and Deploy Multifactor Authentication (MFA) +# Validate and Deploy Multifactor Authentication feature **Applies to** diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md index 2f2d3bcf5b..366ce9b8bb 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md @@ -2,7 +2,7 @@ title: Validate Public Key Infrastructure - certificate trust model (Windows Hello for Business) description: How to Validate Public Key Infrastructure for Windows Hello for Business, under a certificate trust model. keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md index db310a19e8..f802872ce7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md @@ -2,7 +2,7 @@ title: Windows Hello for Business Deployment Guide - On Premises Certificate Trust Deployment description: A guide to on premises, certificate trust Windows Hello for Business deployment. keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md index ab014e303e..57e428e8b6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md @@ -2,7 +2,7 @@ title: Windows Hello for Business Deployment Overview description: Use this deployment guide to successfully deploy Windows Hello for Business in an existing environment. keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md index 30dbcc8929..41f1a39158 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md @@ -3,7 +3,7 @@ title: Windows Hello for Business Deployment Known Issues description: A Troubleshooting Guide for Known Windows Hello for Business Deployment Issues keywords: identity, PIN, biometric, Hello, passport params: siblings_only -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md index 5a5f0334f7..5a525a6f6a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md @@ -2,7 +2,7 @@ title: Windows Hello for Business Deployment Guide - On Premises Key Deployment description: A guide to on premises, key trust Windows Hello for Business deployment. keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index 260463cdb8..ec0411f5bd 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -2,7 +2,7 @@ title: Deploying Certificates to Key Trust Users to Enable RDP description: Learn how to deploy certificates to a Key Trust user to enable remote desktop with supplied credentials keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, remote desktop, RDP -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index 854123637f..27ec5e7658 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -3,7 +3,7 @@ title: Windows Hello errors during PIN creation (Windows) description: When you set up Windows Hello in Windows 10, you may get an error during the Create a work PIN step. ms.assetid: DFEFE22C-4FEF-4FD9-BFC4-9B419C339502 keywords: PIN, error, create a work PIN -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/hello-for-business/hello-event-300.md b/windows/security/identity-protection/hello-for-business/hello-event-300.md index a41f3c8418..5eecb9ecac 100644 --- a/windows/security/identity-protection/hello-for-business/hello-event-300.md +++ b/windows/security/identity-protection/hello-for-business/hello-event-300.md @@ -4,7 +4,7 @@ description: This event is created when a Windows Hello for Business is successf ms.assetid: 0DD59E75-1C5F-4CC6-BB0E-71C83884FF04 ms.reviewer: keywords: ngc -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 913d779ce0..66e88ee1a6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -3,7 +3,7 @@ metadata: title: Windows Hello for Business Frequently Asked Questions (FAQ) description: Use these frequently asked questions (FAQ) to learn important details about Windows Hello for Business. keywords: identity, PIN, biometric, Hello, passport - ms.prod: w10 + ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md index 0b13b8388a..ebd49da74d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md @@ -2,7 +2,7 @@ title: Conditional Access description: Ensure that only approved users can access your devices, applications, and services from anywhere by enabling single sign-on with Azure Active Directory. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, conditional access -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md index 82cb73cd43..c1051280eb 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md @@ -2,7 +2,7 @@ title: Dual Enrollment description: Learn how to configure Windows Hello for Business dual enrollment. Also, learn how to configure Active Directory to support Domain Administrator enrollment. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, dual enrollment, -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md index 6a880c9a9c..b7a04269f4 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md @@ -2,7 +2,7 @@ title: Dynamic lock description: Learn how to set Dynamic lock on Windows 10 and Windows 11 devices, by configuring group policies. This feature locks a device when a Bluetooth signal falls below a set value. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, conditional access -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index a1c8949be0..49ebf32dd9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -2,7 +2,7 @@ title: Pin Reset description: Learn how Microsoft PIN reset services enables you to help users recover who have forgotten their PIN. keywords: identity, PIN, Hello, passport, WHFB, hybrid, cert-trust, device, reset -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md index 8ed00949b2..3b8be4415e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -2,7 +2,7 @@ title: Remote Desktop description: Learn how Windows Hello for Business supports using biometrics with remote desktop keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, remote desktop, RDP -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md index d6cff27980..892f986c01 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md @@ -1,7 +1,7 @@ --- title: How Windows Hello for Business works - Authentication description: Learn about the authentication flow for Windows Hello for Business. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md index 9e1ddf66b7..bf92834f9b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md @@ -1,7 +1,7 @@ --- title: How Windows Hello for Business works - Provisioning description: Explore the provisioning flows for Windows Hello for Business, from within a variety of environments. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -39,6 +39,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, ## Azure AD joined provisioning in a Managed environment ![Azure AD joined provisioning in a Managed environment.](images/howitworks/prov-aadj-managed.png) +[Full size image](images/howitworks/prov-aadj-managed.png) | Phase | Description | | :----: | :----------- | @@ -50,6 +51,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Azure AD joined provisioning in a Federated environment ![Azure AD joined provisioning in Managed environment.](images/howitworks/prov-aadj-federated.png) +[Full size image](images/howitworks/prov-aadj-federated.png) | Phase | Description | | :----: | :----------- | @@ -60,7 +62,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment ![Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment.](images/howitworks/prov-haadj-keytrust-managed.png) - +[Full size image](images/howitworks/prov-haadj-keytrust-managed.png) | Phase | Description | |:-----:|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| @@ -78,7 +80,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment ![Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment.](images/howitworks/prov-haadj-instant-certtrust-federated.png) - +[Full size image](images/howitworks/prov-haadj-instant-certtrust-federated.png) | Phase | Description | |:-----:|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| @@ -96,6 +98,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Domain joined provisioning in an On-premises Key Trust deployment ![Domain joined provisioning in an On-premises Key Trust deployment.](images/howitworks/prov-onprem-keytrust.png) +[Full size image](images/howitworks/prov-onprem-keytrust.png) | Phase | Description | | :----: | :----------- | @@ -107,6 +110,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Domain joined provisioning in an On-premises Certificate Trust deployment ![Domain joined provisioning in an On-premises Certificate Trust deployment.](images/howitworks/prov-onprem-certtrust.png) +[Full size image](images/howitworks/prov-onprem-certtrust.png) | Phase | Description | | :----: | :----------- | diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index cae576ab66..4bdde9ea88 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -1,7 +1,7 @@ --- title: How Windows Hello for Business works - Technology and Terms description: Explore technology and terms associated with Windows Hello for Business. Learn how Windows Hello for Business works. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md index 657611e55f..90514e334a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md @@ -1,7 +1,7 @@ --- title: How Windows Hello for Business works description: Learn how Windows Hello for Business works, and how it can help your users authenticate to services. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index 7ad9aed6b5..4176bd6721 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -2,7 +2,7 @@ title: Configure Azure AD joined devices for On-premises Single-Sign On using Windows Hello for Business description: Before adding Azure Active Directory (Azure AD) joined devices to your existing hybrid deployment, you need to verify the existing deployment can support them. keywords: identity, PIN, biometric, Hello, passport, AADJ, SSO, -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index fba0adf89f..cd403a4167 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -2,7 +2,7 @@ title: Using Certificates for AADJ On-premises Single-sign On single sign-on description: If you want to use certificates for on-premises single-sign on for Azure Active Directory joined devices, then follow these additional steps. keywords: identity, PIN, biometric, Hello, passport, AADJ, SSO, -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md index cb23b1e6a7..c74516519b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md @@ -2,7 +2,7 @@ title: Azure AD Join Single Sign-on Deployment description: Learn how to provide single sign-on to your on-premises resources for Azure Active Directory joined devices, using Windows Hello for Business. keywords: identity, PIN, biometric, Hello, passport, AADJ, SSO, -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md index c9afa19802..893bb67c67 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md @@ -2,7 +2,7 @@ title: Hybrid Azure AD joined Windows Hello for Business Trust New Installation (Windows Hello for Business) description: Learn about new installations for Windows Hello for Business certificate trust and the various technologies hybrid certificate trust deployments rely on. keywords: identity, PIN, biometric, Hello, passport, WHFB -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md index ba0f914fa0..2bae50c063 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -2,7 +2,7 @@ title: Configure Device Registration for Hybrid Azure AD joined Windows Hello for Business description: Azure Device Registration for Hybrid Certificate Trust Deployment (Windows Hello for Business) keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md index 228747d35b..edf8fab283 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md @@ -2,7 +2,7 @@ title: Hybrid Azure AD joined Windows Hello for Business Prerequisites description: Learn these prerequisites for hybrid Windows Hello for Business deployments using certificate trust. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md index 9cd1d4350b..b9a5fcd43e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md @@ -2,7 +2,7 @@ title: Hybrid Certificate Trust Deployment (Windows Hello for Business) description: Learn the information you need to successfully deploy Windows Hello for Business in a hybrid certificate trust scenario. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index e7082740c2..560844634b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -2,7 +2,7 @@ title: Hybrid Azure AD joined Windows Hello for Business Certificate Trust Provisioning (Windows Hello for Business) description: In this article, learn about provisioning for hybrid certificate trust deployments of Windows Hello for Business. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md index 2a261013b9..6d48646f3b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md @@ -2,7 +2,7 @@ title: Configure Hybrid Azure AD joined Windows Hello for Business - Active Directory (AD) description: Discussing the configuration of Active Directory (AD) in a Hybrid deployment of Windows Hello for Business keywords: identity, PIN, biometric, Hello, passport, WHFB, ad -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md index 398d31c3d6..2a5517fe70 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md @@ -2,7 +2,7 @@ title: Configuring Hybrid Azure AD joined Windows Hello for Business - Active Directory Federation Services (ADFS) description: Discussing the configuration of Active Directory Federation Services (ADFS) in a Hybrid deployment of Windows Hello for Business keywords: identity, PIN, biometric, Hello, passport, WHFB, adfs -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md index c48e5ae621..681c874730 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md @@ -2,7 +2,7 @@ title: Configure Hybrid Azure AD joined Windows Hello for Business Directory Synch description: Discussing Directory Synchronization in a Hybrid deployment of Windows Hello for Business keywords: identity, PIN, biometric, Hello, passport, WHFB, dirsync, connect -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md index 53d6fd45a0..fc322a0194 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -2,7 +2,7 @@ title: Configuring Hybrid Azure AD joined Windows Hello for Business - Public Key Infrastructure (PKI) description: Discussing the configuration of the Public Key Infrastructure (PKI) in a Hybrid deployment of Windows Hello for Business keywords: identity, PIN, biometric, Hello, passport, WHFB, PKI -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md index 519afac582..632f6ebf3c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md @@ -2,7 +2,7 @@ title: Configuring Hybrid Azure AD joined Windows Hello for Business - Group Policy description: Discussing the configuration of Group Policy in a Hybrid deployment of Windows Hello for Business keywords: identity, PIN, biometric, Hello, passport, WHFB -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile @@ -30,7 +30,7 @@ ms.reviewer: You need at least a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows on a computer running Windows 10, version 1703 or later. -Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10 Creators Edition (1703) to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. +Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10 Creators Edition (1703) to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) for more information. Domain controllers of Windows Hello for Business deployments need one Group Policy setting, which enables automatic certificate enrollment for the newly create domain controller authentication certificate. This policy setting ensures domain controllers (new and existing) automatically request and renew the correct domain controller certificate. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md index a56e989ba6..498f54f10a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md @@ -2,7 +2,7 @@ title: Configure Hybrid Windows Hello for Business Settings (Windows Hello for Business) description: Learn how to configure Windows Hello for Business settings in hybrid certificate trust deployment. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md index bb3de61241..00829103e4 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md @@ -2,7 +2,7 @@ title: Windows Hello for Business Hybrid Azure AD joined Key Trust New Installation description: Learn how to configure a hybrid key trust deployment of Windows Hello for Business for systems with no previous installations. keywords: identity, PIN, biometric, Hello, passport, WHFB -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md index 713fcd89a5..3a30549629 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -2,7 +2,7 @@ title: Configure Device Registration for Hybrid Azure AD joined key trust Windows Hello for Business description: Azure Device Registration for Hybrid Certificate Key Deployment (Windows Hello for Business) keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust, device, registration -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md index 5acfb06f68..db1f93ef28 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md @@ -2,7 +2,7 @@ title: Configure Directory Synchronization for Hybrid Azure AD joined key trust Windows Hello for Business description: Azure Directory Synchronization for Hybrid Certificate Key Deployment (Windows Hello for Business) keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust, directory, synchronization, AADConnect -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 95442ae6dd..faa8dbee77 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -2,7 +2,7 @@ title: Hybrid Azure AD joined Key trust Windows Hello for Business Prerequisites (Windows Hello for Business) description: Learn about the prerequisites for hybrid Windows Hello for Business deployments using key trust and what the next steps are in the deployment process. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile @@ -66,7 +66,7 @@ The Windows Hello for Business deployment depends on an enterprise public key in Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object. -The minimum required Enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party Enterprise certification authority. The requirements for the domain controller certificate are shown below. For more details, see [Requirements for domain controller certificates from a third-party CA](https://support.microsoft.com/help/291010/requirements-for-domain-controller-certificates-from-a-third-party-ca). +The minimum required Enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party Enterprise certification authority. The requirements for the domain controller certificate are shown below. For more details, see [Requirements for domain controller certificates from a third-party CA](/troubleshoot/windows-server/windows-security/requirements-domain-controller). * The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL, or an Authority Information Access (AIA) extension that points to an Online Certificate Status Protocol (OCSP) responder. * The certificate Subject section should contain the directory path of the server object (the distinguished name). diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md index 93903312e5..a8b090fc5b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md @@ -2,7 +2,7 @@ title: Hybrid Key Trust Deployment (Windows Hello for Business) description: Review this deployment guide to successfully deploy Windows Hello for Business in a hybrid key trust scenario. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md index 8d412b86f0..224aa7d094 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md @@ -2,7 +2,7 @@ title: Hybrid Azure AD joined Windows Hello for Business key trust Provisioning (Windows Hello for Business) description: Learn about provisioning for hybrid key trust deployments of Windows Hello for Business and learn where to find the hybrid key trust deployment guide. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md index 0f8a916c18..c8db509239 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md @@ -2,7 +2,7 @@ title: Configuring Hybrid Azure AD joined key trust Windows Hello for Business - Active Directory (AD) description: Configuring Hybrid key trust Windows Hello for Business - Active Directory (AD) keywords: identity, PIN, biometric, Hello, passport, WHFB, ad, key trust, key-trust -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md index 28f3658a43..8e58707531 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md @@ -2,7 +2,7 @@ title: Hybrid Azure AD joined Windows Hello for Business - Directory Synchronization description: How to configure Hybrid key trust Windows Hello for Business - Directory Synchronization keywords: identity, PIN, biometric, Hello, passport, WHFB, dirsync, connect, Windows Hello, AD Connect, key trust, key-trust -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md index bc2ae4f46c..700d8a0062 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md @@ -2,7 +2,7 @@ title: Configure Hybrid Azure AD joined key trust Windows Hello for Business description: Configuring Hybrid key trust Windows Hello for Business - Public Key Infrastructure (PKI) keywords: identity, PIN, biometric, Hello, passport, WHFB, PKI, Windows Hello, key trust, key-trust -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md index 3cdd96f898..6b08257dd3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md @@ -2,7 +2,7 @@ title: Configure Hybrid Azure AD joined Windows Hello for Business - Group Policy description: Configuring Hybrid key trust Windows Hello for Business - Group Policy keywords: identity, PIN, biometric, Hello, passport, WHFB, Windows Hello, key trust, key-trust -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile @@ -30,7 +30,7 @@ ms.reviewer: You need at least a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows on a computer running Windows 10, version 1703 or later. -Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10 Creators Edition (1703) to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. +Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10 Creators Edition (1703) to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) for more information. Domain controllers of Windows Hello for Business deployments need one Group Policy setting, which enables automatic certificate enrollment for the newly create domain controller authentication certificate. This policy setting ensures domain controllers (new and existing) automatically request and renew the correct domain controller certificate. @@ -69,7 +69,7 @@ Sign-in a domain controller or management workstations with _Domain Admin_ equiv 3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. >[!IMPORTANT] ->If you don't find options in GPO, you have to load the [PolicyDefinitions folder](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra). +>If you don't find options in GPO, you have to load the [PolicyDefinitions folder](/troubleshoot/windows-client/group-policy/create-and-manage-central-store). ### Windows Hello for Business Group Policy diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md index b849c9ce8a..b7f6408196 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md @@ -2,7 +2,7 @@ title: Configure Hybrid Azure AD joined Windows Hello for Business key trust Settings description: Begin the process of configuring your hybrid key trust environment for Windows Hello for Business. Start with your Active Directory configuration. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 0f9a7881ad..38ad42ddd5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -3,7 +3,7 @@ title: Windows Hello for Business Deployment Prerequisite Overview description: Overview of all the different infrastructure requirements for Windows Hello for Business deployment models ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md index 7423caec53..0dfae840a6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md @@ -2,7 +2,7 @@ title: Prepare & Deploy Windows Active Directory Federation Services with key trust (Windows Hello for Business) description: How to Prepare and Deploy Windows Server 2016 Active Directory Federation Services for Windows Hello for Business using key trust. keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md index 116c9ba6ab..0933808ce7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md @@ -2,7 +2,7 @@ title: Configure Windows Hello for Business Policy settings - key trust description: Configure Windows Hello for Business Policy settings for Windows Hello for Business keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile @@ -28,7 +28,7 @@ ms.reviewer: You need at least a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows. You can download these tools from [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows on a computer running Windows 10, version 1703 or later. -Alternatively, you can create a copy of the .ADMX and .ADML files from a Windows 10, version 1703 installation setup template folder to their respective language folder on a Windows Server, or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. +Alternatively, you can create a copy of the .ADMX and .ADML files from a Windows 10, version 1703 installation setup template folder to their respective language folder on a Windows Server, or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) for more information. On-premises certificate-based deployments of Windows Hello for Business needs one Group Policy setting: Enable Windows Hello for Business diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md index 943e611e93..85a36fa384 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md @@ -2,7 +2,7 @@ title: Key registration for on-premises deployment of Windows Hello for Business description: How to Validate Active Directory prerequisites for Windows Hello for Business when deploying with the key trust model. keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md index 349b328807..549c4ffd5d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md @@ -2,7 +2,7 @@ title: Validate and Deploy MFA for Windows Hello for Business with key trust description: How to Validate and Deploy Multifactor Authentication (MFA) Services for Windows Hello for Business with key trust keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md index d4e87e620e..e4d0dbd8ab 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md @@ -2,7 +2,7 @@ title: Validate Public Key Infrastructure - key trust model (Windows Hello for Business) description: How to Validate Public Key Infrastructure for Windows Hello for Business, under a key trust model. keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index de574128e5..d6d92affa4 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -3,7 +3,7 @@ title: Manage Windows Hello in your organization (Windows) description: You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello for Business on devices running Windows 10. ms.assetid: 47B55221-24BE-482D-BD31-C78B22AC06D8 keywords: identity, PIN, biometric, Hello -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -41,151 +41,32 @@ The following table lists the Group Policy settings that you can configure for W > [!NOTE] > Starting with Windows 10, version 1709, the location of the PIN complexity section of the Group Policy is: **Computer Configuration** > **Administrative Templates** > **System** > **PIN Complexity**. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PolicyScopeOptions
    Use Windows Hello for BusinessComputer or user -

    Not configured: Device does not provision Windows Hello for Business for any user.

    -

    Enabled: Device provisions Windows Hello for Business using keys or certificates for all users.

    -

    Disabled: Device does not provision Windows Hello for Business for any user.

    -
    Use a hardware security deviceComputer -

    Not configured: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

    -

    Enabled: Windows Hello for Business will only be provisioned using TPM. This feature will provision Windows Hello for Business using TPM 1.2 unless the option to exclude them is explicitly set.

    -

    Disabled: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

    -
    Use certificate for on-premises authenticationComputer or user -

    Not configured: Windows Hello for Business enrolls a key that is used for on-premises authentication.

    -

    Enabled: Windows Hello for Business enrolls a sign-in certificate using ADFS that is used for on-premises authentication.

    -

    Disabled: Windows Hello for Business enrolls a key that is used for on-premises authentication.

    -
    Use PIN recoveryComputer -

    Added in Windows 10, version 1703

    -

    Not configured: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

    -

    Enabled: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.

    -

    Disabled: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

    -

    +|Policy|Scope|Options| +|--- |--- |--- | +|Use Windows Hello for Business|Computer or user|

    Not configured: Device does not provision Windows Hello for Business for any user.

    Enabled: Device provisions Windows Hello for Business using keys or certificates for all users.

    Disabled: Device does not provision Windows Hello for Business for any user.| +|Use a hardware security device|Computer|

    Not configured: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

    Enabled: Windows Hello for Business will only be provisioned using TPM. This feature will provision Windows Hello for Business using TPM 1.2 unless the option to exclude them is explicitly set.

    Disabled: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.| +|Use certificate for on-premises authentication|Computer or user|

    Not configured: Windows Hello for Business enrolls a key that is used for on-premises authentication.

    Enabled: Windows Hello for Business enrolls a sign-in certificate using ADFS that is used for on-premises authentication.

    Disabled: Windows Hello for Business enrolls a key that is used for on-premises authentication.| +|Use PIN recovery|Computer|

    Added in Windows 10, version 1703

    Not configured: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service

    Enabled: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset

    Disabled: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

    For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md).| +|Use biometrics|Computer|

    Not configured: Biometrics can be used as a gesture in place of a PIN

    Enabled: Biometrics can be used as a gesture in place of a PIN.

    Disabled: Only a PIN can be used as a gesture.| -For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md). -

    -
    Use biometricsComputer -

    Not configured: Biometrics can be used as a gesture in place of a PIN.

    -

    Enabled: Biometrics can be used as a gesture in place of a PIN.

    -

    Disabled: Only a PIN can be used as a gesture.

    -
    PIN ComplexityRequire digitsComputer -

    Not configured: Users must include a digit in their PIN.

    -

    Enabled: Users must include a digit in their PIN.

    -

    Disabled: Users cannot use digits in their PIN.

    -
    Require lowercase lettersComputer -

    Not configured: Users cannot use lowercase letters in their PIN.

    -

    Enabled: Users must include at least one lowercase letter in their PIN.

    -

    Disabled: Users cannot use lowercase letters in their PIN.

    -
    Maximum PIN lengthComputer -

    Not configured: PIN length must be less than or equal to 127.

    -

    Enabled: PIN length must be less than or equal to the number you specify.

    -

    Disabled: PIN length must be less than or equal to 127.

    -
    Minimum PIN lengthComputer -

    Not configured: PIN length must be greater than or equal to 4.

    -

    Enabled: PIN length must be greater than or equal to the number you specify.

    -

    Disabled: PIN length must be greater than or equal to 4.

    -
    ExpirationComputer -

    Not configured: PIN does not expire.

    -

    Enabled: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.

    -

    Disabled: PIN does not expire.

    -
    HistoryComputer -

    Not configured: Previous PINs are not stored.

    -

    Enabled: Specify the number of previous PINs that can be associated to a user account that can't be reused.

    -

    Disabled: Previous PINs are not stored.

    -
    Note  Current PIN is included in PIN history.
    -
     
    -
    Require special charactersComputer -

    Not configured: Users cannot include a special character in their PIN.

    -

    Enabled: Users must include at least one special character in their PIN.

    -

    Disabled: Users cannot include a special character in their PIN.

    -
    Require uppercase lettersComputer -

    Not configured: Users cannot include an uppercase letter in their PIN.

    -

    Enabled: Users must include at least one uppercase letter in their PIN.

    -

    Disabled: Users cannot include an uppercase letter in their PIN.

    -
    Phone Sign-inUse Phone Sign-inComputer -

    Not currently supported.

    -
    +### PIN Complexity + +|Policy|Scope|Options| +|--- |--- |--- | +|Require digits|Computer|

    Not configured: Users must include a digit in their PIN.

    Enabled: Users must include a digit in their PIN.

    Disabled: Users cannot use digits in their PIN.| +|Require lowercase letters|Computer|

    Not configured: Users cannot use lowercase letters in their PIN

    Enabled: Users must include at least one lowercase letter in their PIN.

    Disabled: Users cannot use lowercase letters in their PIN.| +|Maximum PIN length|Computer|

    Not configured: PIN length must be less than or equal to 127.

    Enabled: PIN length must be less than or equal to the number you specify.

    Disabled: PIN length must be less than or equal to 127.| +|Minimum PIN length|Computer|

    Not configured: PIN length must be greater than or equal to 4.

    Enabled: PIN length must be greater than or equal to the number you specify.

    Disabled: PIN length must be greater than or equal to 4.| +|Expiration|Computer|

    Not configured: PIN does not expire.

    Enabled: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.

    Disabled: PIN does not expire.| +|History|Computer|

    Not configured: Previous PINs are not stored.

    Enabled: Specify the number of previous PINs that can be associated to a user account that can't be reused.

    Disabled: Previous PINs are not stored.

    Note  Current PIN is included in PIN history.
    | +|Require special characters|Computer|

    Not configured: Windows allows, but does not require, special characters in the PIN.

    Enabled: Windows requires the user to include at least one special character in their PIN.

    Disabled: Windows does not allow the user to include special characters in their PIN.| +|Require uppercase letters|Computer|

    Not configured: Users cannot include an uppercase letter in their PIN.

    Enabled: Users must include at least one uppercase letter in their PIN.

    Disabled: Users cannot include an uppercase letter in their PIN.| + +### Phone Sign-in + +|Policy|Scope|Options| +|--- |--- |--- | +|Use Phone Sign-in|Computer|Not currently supported.| ## MDM policy settings for Windows Hello for Business @@ -194,175 +75,38 @@ The following table lists the MDM policy settings that you can configure for Win >[!IMPORTANT] >Starting in Windows 10, version 1607, all devices only have one PIN associated with Windows Hello for Business. This means that any PIN on a device will be subject to the policies specified in the PassportForWork CSP. The values specified take precedence over any complexity rules set via Exchange ActiveSync (EAS) or the DeviceLock CSP. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PolicyScopeDefaultOptions
    UsePassportForWorkDevice or userTrue -

    True: Windows Hello for Business will be provisioned for all users on the device.

    -

    False: Users will not be able to provision Windows Hello for Business.

    -
    Note  If Windows Hello for Business is enabled, and then the policy is changed to False, users who previously set up Windows Hello for Business can continue to use it, but will not be able to set up Windows Hello for Business on other devices.
    -
     
    -
    RequireSecurityDeviceDevice or userFalse -

    True: Windows Hello for Business will only be provisioned using TPM.

    -

    False: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

    -
    ExcludeSecurityDeviceTPM12DeviceFalse -

    Added in Windows 10, version 1703

    -

    True: TPM revision 1.2 modules will be disallowed from being used with Windows Hello for Business.

    -

    False: TPM revision 1.2 modules will be allowed to be used with Windows Hello for Business.

    -
    EnablePinRecoveryDevice or userFalse -

    Added in Windows 10, version 1703

    -

    True: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.

    -

    False: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.

    -

    +|Policy|Scope|Default|Options| +|--- |--- |--- |--- | +|UsePassportForWork|Device or user|True|

    True: Windows Hello for Business will be provisioned for all users on the device.

    False: Users will not be able to provision Windows Hello for Business.

    **Note:** If Windows Hello for Business is enabled, and then the policy is changed to False, users who previously set up Windows Hello for Business can continue to use it, but will not be able to set up Windows Hello for Business on other devices
    | +|RequireSecurityDevice|Device or user|False|

    True: Windows Hello for Business will only be provisioned using TPM.

    False: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.| +|ExcludeSecurityDevice

    TPM12|Device|False|Added in Windows 10, version 1703

    True: TPM revision 1.2 modules will be disallowed from being used with Windows Hello for Business.

    False: TPM revision 1.2 modules will be allowed to be used with Windows Hello for Business.| +|EnablePinRecovery|Device or use|False|

    Added in Windows 10, version 1703

    True: Windows Hello for Business uses the Azure-based PIN recovery service for PIN reset.

    False: Windows Hello for Business does not create or store a PIN recovery secret. PIN reset does not use the Azure-based PIN recovery service.For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md).| -For more information about using the PIN recovery service for PIN reset see [Windows Hello for Business PIN Reset](hello-feature-pin-reset.md). -

    -
    Biometrics -

    UseBiometrics

    -    		Device False -

    True: Biometrics can be used as a gesture in place of a PIN for domain sign-in.

    -

    False: Only a PIN can be used as a gesture for domain sign-in.

    -
    -

    FacialFeaturesUser

    -

    EnhancedAntiSpoofing

    -    		DeviceNot configured -

    Not configured: users can choose whether to turn on enhanced anti-spoofing.

    -

    True: Enhanced anti-spoofing is required on devices which support it.

    -

    False: Users cannot turn on enhanced anti-spoofing.

    -
    PINComplexity
    Digits Device or user1 -

    0: Digits are allowed.

    -

    1: At least one digit is required.

    -

    2: Digits are not allowed.

    -
    Lowercase letters Device or user2 -

    0: Lowercase letters are allowed.

    -

    1: At least one lowercase letter is required.

    -

    2: Lowercase letters are not allowed.

    -
    Special charactersDevice or user2 -

    0: Special characters are allowed.

    -

    1: At least one special character is required.

    -

    2: Special characters are not allowed.

    -
    Uppercase lettersDevice or user2 -

    0: Uppercase letters are allowed.

    -

    1: At least one uppercase letter is required.

    -

    2: Uppercase letters are not allowed.

    -
    Maximum PIN length Device or user127 -

    Maximum length that can be set is 127. Maximum length cannot be less than minimum setting.

    -
    Minimum PIN lengthDevice or user4 -

    Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting.

    -
    Expiration Device or user0 -

    Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user's PIN will never expire. -

    -
    HistoryDevice or user0 -

    Integer value that specifies the number of past PINs that can be associated to a user account that can't be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required. -

    -
    Remote -

    UseRemotePassport

    -    		Device or userFalse -

    Not currently supported.

    -
    +### Biometrics + +|Policy|Scope|Default|Options| +|--- |--- |--- |--- | +|UseBiometrics|Device |False|

    True: Biometrics can be used as a gesture in place of a PIN for domain sign-in.

    False: Only a PIN can be used as a gesture for domain sign-in.| +|

    FacialFeaturesUser

    EnhancedAntiSpoofing|Device|Not configured|

    Not configured: users can choose whether to turn on enhanced anti-spoofing.

    True: Enhanced anti-spoofing is required on devices which support it.

    False: Users cannot turn on enhanced anti-spoofing.| + +### PINComplexity + +|Policy|Scope|Default|Options| +|--- |--- |--- |--- | +|Digits |Device or user|1 |

    0: Digits are allowed.

    1: At least one digit is required.

    2: Digits are not allowed.| +|Lowercase letters |Device or user|2|

    0: Lowercase letters are allowed.

    1: At least one lowercase letter is required.

    2: Lowercase letters are not allowed.| +|Special characters|Device or user|2|

    0: Special characters are allowed.

    1: At least one special character is required.

    2: Special characters are not allowed.| +|Uppercase letters|Device or user|2|

    0: Uppercase letters are allowed.

    1: At least one uppercase letter is required.

    2: Uppercase letters are not allowed.| +|Maximum PIN length |Device or user|127 |

    Maximum length that can be set is 127. Maximum length cannot be less than minimum setting.| +|Minimum PIN length|Device or user|4|

    Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting.| +|Expiration |Device or user|0|

    Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user's PIN will never expire.| +|History|Device or user|0|

    Integer value that specifies the number of past PINs that can be associated to a user account that can't be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required.| + +### Remote + +|Policy|Scope|Default|Options| +|--- |--- |--- |--- | +|UseRemotePassport|Device or user|False|Not currently supported.| >[!NOTE] > In Windows 10, version 1709 and later, if policy is not configured to explicitly require letters or special characters, users can optionally set an alphanumeric PIN. Prior to version 1709 the user is required to set a numeric PIN. @@ -379,7 +123,7 @@ All PIN complexity policies, are grouped separately from feature enablement and >[!NOTE] > Windows Hello for Business policy conflict resolution logic does not respect the ControlPolicyConflict/MDMWinsOverGP policy in the Policy CSP. - +> >Examples > >The following are configured using computer Group Policy: @@ -424,4 +168,4 @@ If you want to use Windows Hello for Business with certificates, you'll need a d - [Windows Hello and password changes](hello-and-password-changes.md) - [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) - [Event ID 300 - Windows Hello successfully created](hello-event-300.md) -- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 64a4985b03..be17f3e5ce 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -3,7 +3,7 @@ title: Windows Hello for Business Overview (Windows) ms.reviewer: An overview of Windows Hello for Business description: Learn how Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices in Windows 10 and Windows 11. keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index d0c17c1f16..b5c42012a1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -2,7 +2,7 @@ title: Planning a Windows Hello for Business Deployment description: Learn about the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of your infrastructure. keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md index bf0a6af0ea..966f0adef8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md +++ b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md @@ -4,7 +4,7 @@ description: When you set a policy to require Windows Hello for Business in the ms.assetid: 5270B416-CE31-4DD9-862D-6C22A2AE508B ms.reviewer: keywords: identity, PIN, biometric, Hello -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/hello-for-business/hello-videos.md b/windows/security/identity-protection/hello-for-business/hello-videos.md index 0f47042799..61a06b945e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-videos.md +++ b/windows/security/identity-protection/hello-for-business/hello-videos.md @@ -2,7 +2,7 @@ title: Windows Hello for Business Videos description: View several informative videos describing features and experiences in Windows Hello for Business in Windows 10 and Windows 11. keywords: identity, PIN, biometric, Hello, passport, video, watch, passwordless -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md index 657098b167..66b952c2e2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md +++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md @@ -3,7 +3,7 @@ title: Why a PIN is better than a password (Windows) description: Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password . ms.assetid: A6FC0520-01E6-4E90-B53D-6C4C4E780212 keywords: pin, security, password, hello -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/hello-for-business/index.yml b/windows/security/identity-protection/hello-for-business/index.yml index bced7d0bcd..4cb62fb1ce 100644 --- a/windows/security/identity-protection/hello-for-business/index.yml +++ b/windows/security/identity-protection/hello-for-business/index.yml @@ -6,7 +6,7 @@ summary: Learn how to manage and deploy Windows Hello for Business. metadata: title: Windows Hello for Business documentation description: Learn how to manage and deploy Windows Hello for Business. - ms.prod: w10 + ms.prod: m365-security ms.topic: landing-page author: mapalko manager: dansimp diff --git a/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md b/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md index 73aab32a55..308554bde8 100644 --- a/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md +++ b/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md @@ -2,7 +2,7 @@ title: Microsoft-compatible security key description: Learn how a Microsoft-compatible security key for Windows is different (and better) than any other FIDO2 security key. keywords: FIDO2, security key, CTAP, Hello, WHFB -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index f7bb6e7722..56a0e61012 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -2,7 +2,7 @@ title: Passwordless Strategy description: Learn about the password-less strategy and how Windows Hello for Business implements this strategy in Windows 10 and Windows 11. keywords: identity, PIN, biometric, Hello, passport, video, watch, passwordless -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/reset-security-key.md b/windows/security/identity-protection/hello-for-business/reset-security-key.md index 92a7af375c..d9743650a3 100644 --- a/windows/security/identity-protection/hello-for-business/reset-security-key.md +++ b/windows/security/identity-protection/hello-for-business/reset-security-key.md @@ -2,7 +2,7 @@ title: Reset-security-key description: Windows 10 and Windows 11 enables users to sign in to their device using a security key. How to reset a security key keywords: FIDO2, security key, CTAP, Microsoft-compatible security key -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile diff --git a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md index d90093aab8..e6350966ce 100644 --- a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md @@ -1,7 +1,7 @@ --- title: How Windows Hello for Business works (Windows) description: Learn about registration, authentication, key material, and infrastructure for Windows Hello for Business. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/index.md b/windows/security/identity-protection/index.md index 7e62fc8954..e4ecd908cf 100644 --- a/windows/security/identity-protection/index.md +++ b/windows/security/identity-protection/index.md @@ -1,7 +1,7 @@ --- title: Identity and access management (Windows 10) description: Learn more about identity and access protection technologies in Windows 10 and Windows 10 Mobile. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md b/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md index 9cf1ca34c2..9839a92845 100644 --- a/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md +++ b/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md @@ -4,7 +4,7 @@ description: Digital certificates bind the identity of a user or computer to a p ms.assetid: FF7B1BE9-41F4-44B0-A442-249B650CEE25 ms.reviewer: keywords: S/MIME, PFX, SCEP -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/password-support-policy.md b/windows/security/identity-protection/password-support-policy.md index b92183cdd3..88d73b87aa 100644 --- a/windows/security/identity-protection/password-support-policy.md +++ b/windows/security/identity-protection/password-support-policy.md @@ -6,8 +6,8 @@ manager: kaushika ms.custom: - CI ID 110060 - CSSTroubleshoot -ms.author: v-tea -ms.prod: w10 +ms.author: v-tappelgate +ms.prod: m365-security ms.sitesec: library ms.pagetype: security author: Teresa-Motiv diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index cb1f1f6d7a..e919cee245 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -1,7 +1,7 @@ --- title: Protect Remote Desktop credentials with Windows Defender Remote Credential Guard (Windows 10) description: Windows Defender Remote Credential Guard helps to secure your Remote Desktop credentials by never sending them to the target device. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index 70b89b04ee..99de6899d4 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -1,7 +1,7 @@ --- title: Smart Card and Remote Desktop Services (Windows) description: This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 604f470a49..bad0c616fe 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -1,7 +1,7 @@ --- title: Smart Card Architecture (Windows) description: This topic for the IT professional describes the system architecture that supports smart cards in the Windows operating system. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index 32f79fdf8f..1ad9d49a24 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -1,7 +1,7 @@ --- title: Certificate Propagation Service (Windows) description: This topic for the IT professional describes the certificate propagation service (CertPropSvc), which is used in smart card implementation. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index 7e32d7679f..5bb30875b0 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -1,7 +1,7 @@ --- title: Certificate Requirements and Enumeration (Windows) description: This topic for the IT professional and smart card developers describes how certificates are managed and used for smart card sign-in. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md index 3a098751e8..f557a5a713 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md +++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md @@ -1,7 +1,7 @@ --- title: Smart Card Troubleshooting (Windows) description: Describes the tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/smart-cards/smart-card-events.md b/windows/security/identity-protection/smart-cards/smart-card-events.md index b8f7de6f81..0d7a79fdac 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-events.md +++ b/windows/security/identity-protection/smart-cards/smart-card-events.md @@ -1,7 +1,7 @@ --- title: Smart Card Events (Windows) description: This topic for the IT professional and smart card developer describes events that are related to smart card deployment and development. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index 17d490b6d0..a74dfed7b2 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -1,7 +1,7 @@ --- title: Smart Card Group Policy and Registry Settings (Windows) description: Discover the Group Policy, registry key, local security policy, and credential delegation policy settings that are available for configuring smart cards. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md index a366007a1e..d6656c1427 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md +++ b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md @@ -1,7 +1,7 @@ --- title: How Smart Card Sign-in Works in Windows description: This topic for IT professional provides links to resources about the implementation of smart card technologies in the Windows operating system. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md index c52deb3971..77c8c9d18b 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md @@ -1,7 +1,7 @@ --- title: Smart Card Removal Policy Service (Windows) description: This topic for the IT professional describes the role of the removal policy service (ScPolicySvc) in smart card implementation. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md index ba3e2a4c05..dd3d3ccddb 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md @@ -1,7 +1,7 @@ --- title: Smart Cards for Windows Service (Windows) description: This topic for the IT professional and smart card developers describes how the Smart Cards for Windows service manages readers and application interactions. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md index 1151e206de..935f57edf3 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md @@ -1,7 +1,7 @@ --- title: Smart Card Tools and Settings (Windows) description: This topic for the IT professional and smart card developer links to information about smart card debugging, settings, and events. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md index dfd605776c..377f4811d2 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md +++ b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md @@ -1,7 +1,7 @@ --- title: Smart Card Technical Reference (Windows) description: Learn about the Windows smart card infrastructure for physical smart cards, and how smart card-related components work in Windows. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md index e9f7b85291..b1e9071045 100644 --- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md +++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md @@ -2,7 +2,8 @@ title: How User Account Control works (Windows) description: User Account Control (UAC) is a fundamental component of Microsoft's overall security vision. UAC helps mitigate the impact of malware. ms.assetid: 9f921779-0fd3-4206-b0e4-05a19883ee59 -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: operate ms.sitesec: library ms.pagetype: security @@ -106,169 +107,35 @@ The following diagram details the UAC architecture. To better understand each component, review the table below: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ComponentDescription
    User
    -

    User performs operation requiring privilege

    -    		 -

    If the operation changes the file system or registry, Virtualization is called. All other operations call ShellExecute.

    -
    -

    ShellExecute

    -    		 -

    ShellExecute calls CreateProcess. ShellExecute looks for the ERROR_ELEVATION_REQUIRED error from CreateProcess. If it receives the error, ShellExecute calls the Application Information service to attempt to perform the requested task with the elevated prompt.

    -
    -

    CreateProcess

    -    		 -

    If the application requires elevation, CreateProcess rejects the call with ERROR_ELEVATION_REQUIRED.

    -
    System
    -

    Application Information service

    -    		 -

    A system service that helps start apps that require one or more elevated privileges or user rights to run, such as local administrative tasks, and apps that require higher integrity levels. The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required and (depending on Group Policy) consent is given by the user to do so.

    -
    -

    Elevating an ActiveX install

    -    		 -

    If ActiveX is not installed, the system checks the UAC slider level. If ActiveX is installed, the User Account Control: Switch to the secure desktop when prompting for elevation Group Policy setting is checked.

    -
    -

    Check UAC slider level

    -    		 -

    UAC has a slider to select from four levels of notification.

    -
      -

    • Always notify will:

      -
        -
      • Notify you when programs try to install software or make changes to your computer.
        • -
      • Notify you when you make changes to Windows settings.
        • -
      • Freeze other tasks until you respond.
        • -
      -

      Recommended if you often install new software or visit unfamiliar websites.


      -
      • -

    • Notify me only when programs try to make changes to my computer will:

      -
        -
      • Notify you when programs try to install software or make changes to your computer.
        • -
      • Not notify you when you make changes to Windows settings.
        • -
      • Freeze other tasks until you respond.
        • -
      -

      Recommended if you do not often install apps or visit unfamiliar websites.


      -
      • -

    • Notify me only when programs try to make changes to my computer (do not dim my desktop) will:

      -
        -
      • Notify you when programs try to install software or make changes to your computer.
        • -
      • Not notify you when you make changes to Windows settings.
        • -
      • Not freeze other tasks until you respond.
        • -
      -

      Not recommended. Choose this only if it takes a long time to dim the desktop on your computer.


      -
      • -

    • Never notify (Disable UAC prompts) will:

      -
        -
      • Not notify you when programs try to install software or make changes to your computer.
        • -
      • Not notify you when you make changes to Windows settings.
        • -
      • Not freeze other tasks until you respond.
        • -
      -

      Not recommended due to security concerns.

      -
    -
    -

    Secure desktop enabled

    -    		 -

    The User Account Control: Switch to the secure desktop when prompting for elevation policy setting is checked:

    -
      -
    • -

      If the secure desktop is enabled, all elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users.

      -
      • -
    • -

      If the secure desktop is not enabled, all elevation requests go to the interactive user's desktop, and the per-user settings for administrators and standard users are used.

      -
      • -
    -
    -

    CreateProcess

    -    		 -

    CreateProcess calls AppCompat, Fusion, and Installer detection to assess if the app requires elevation. The file is then inspected to determine its requested execution level, which is stored in the application manifest for the file. CreateProcess fails if the requested execution level specified in the manifest does not match the access token and returns an error (ERROR_ELEVATION_REQUIRED) to ShellExecute.

    -
    -

    AppCompat

    -    		 -

    The AppCompat database stores information in the application compatibility fix entries for an application.

    -
    -

    Fusion

    -    		 -

    The Fusion database stores information from application manifests that describe the applications. The manifest schema is updated to add a new requested execution level field.

    -
    -

    Installer detection

    -    		 -

    Installer detection detects setup files, which helps prevent installations from being run without the user's knowledge and consent.

    -
    Kernel
    -

    Virtualization

    -    		 -

    Virtualization technology ensures that non-compliant apps do not silently fail to run or fail in a way that the cause cannot be determined. UAC also provides file and registry virtualization and logging for applications that write to protected areas.

    -
    -

    File system and registry

    -    		 -

    The per-user file and registry virtualization redirects per-computer registry and file write requests to equivalent per-user locations. Read requests are redirected to the virtualized per-user location first and to the per-computer location second.

    -
    +### User + +|Component|Description| +|--- |--- | +|

    User performs operation requiring privilege|

    If the operation changes the file system or registry, Virtualization is called. All other operations call ShellExecute.| +|

    ShellExecute|

    ShellExecute calls CreateProcess. ShellExecute looks for the ERROR_ELEVATION_REQUIRED error from CreateProcess. If it receives the error, ShellExecute calls the Application Information service to attempt to perform the requested task with the elevated prompt.| +|

    CreateProcess|

    If the application requires elevation, CreateProcess rejects the call with ERROR_ELEVATION_REQUIRED.| + +### System + +|Component|Description| +|--- |--- | +|

    Application Information service|

    A system service that helps start apps that require one or more elevated privileges or user rights to run, such as local administrative tasks, and apps that require higher integrity levels. The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required and (depending on Group Policy) consent is given by the user to do so.| +|

    Elevating an ActiveX install|

    If ActiveX is not installed, the system checks the UAC slider level. If ActiveX is installed, the **User Account Control: Switch to the secure desktop when prompting for elevation** Group Policy setting is checked.| +|

    Check UAC slider level|

    UAC has a slider to select from four levels of notification.

    • **Always notify** will:

      • Notify you when programs try to install software or make changes to your computer.
      • Notify you when you make changes to Windows settings.
      • Freeze other tasks until you respond.

      Recommended if you often install new software or visit unfamiliar websites.

    • **Notify me only when programs try to make changes to my computer** will:

      • Notify you when programs try to install software or make changes to your computer.
      • Not notify you when you make changes to Windows settings.
      • Freeze other tasks until you respond.

      Recommended if you do not often install apps or visit unfamiliar websites.

    • **Notify me only when programs try to make changes to my computer (do not dim my desktop)** will:

      • Notify you when programs try to install software or make changes to your computer.
      • Not notify you when you make changes to Windows settings.
      • Not freeze other tasks until you respond.

      Not recommended. Choose this only if it takes a long time to dim the desktop on your computer.

    • **Never notify (Disable UAC prompts)** will:

      • Not notify you when programs try to install software or make changes to your computer.
      • Not notify you when you make changes to Windows settings.
      • Not freeze other tasks until you respond.

      Not recommended due to security concerns.| +|

      Secure desktop enabled|

      The **User Account Control: Switch to the secure desktop when prompting for elevation** policy setting is checked:

      • If the secure desktop is enabled, all elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users.

      • If the secure desktop is not enabled, all elevation requests go to the interactive user's desktop, and the per-user settings for administrators and standard users are used.| +|

        CreateProcess|

        CreateProcess calls AppCompat, Fusion, and Installer detection to assess if the app requires elevation. The file is then inspected to determine its requested execution level, which is stored in the application manifest for the file. CreateProcess fails if the requested execution level specified in the manifest does not match the access token and returns an error (ERROR_ELEVATION_REQUIRED) to ShellExecute.| +|

        AppCompat|

        The AppCompat database stores information in the application compatibility fix entries for an application.| +|

        Fusion|

        The Fusion database stores information from application manifests that describe the applications. The manifest schema is updated to add a new requested execution level field.| +|

        Installer detection|

        Installer detection detects setup files, which helps prevent installations from being run without the user's knowledge and consent.| + +### Kernel + +|Component|Description| +|--- |--- | +|

        Virtualization|

        Virtualization technology ensures that non-compliant apps do not silently fail to run or fail in a way that the cause cannot be determined. UAC also provides file and registry virtualization and logging for applications that write to protected areas.| +|

        File system and registry|

        The per-user file and registry virtualization redirects per-computer registry and file write requests to equivalent per-user locations. Read requests are redirected to the virtualized per-user location first and to the per-computer location second.| -The slider will never turn UAC completely off. If you set it to Never notify, it will: +The slider will never turn UAC completely off. If you set it to **Never notify**, it will: - Keep the UAC service running. - Cause all elevation request initiated by administrators to be auto-approved without showing a UAC prompt. diff --git a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md index 3ea3734384..98cfc580cb 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md @@ -1,7 +1,7 @@ --- title: User Account Control Group Policy and registry key settings (Windows) description: Here's a list of UAC Group Policy and registry key settings that your organization can use to manage UAC. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/user-account-control/user-account-control-overview.md b/windows/security/identity-protection/user-account-control/user-account-control-overview.md index 3ed51e743f..3d91177ca0 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-overview.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-overview.md @@ -2,7 +2,8 @@ title: User Account Control (Windows) description: User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. ms.assetid: 43ac4926-076f-4df2-84af-471ee7d20c38 -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: operate ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md index a3cfe02792..4b29de5fe4 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md @@ -2,7 +2,8 @@ title: User Account Control security policy settings (Windows) description: You can use security policies to configure how User Account Control works in your organization. ms.assetid: 3D75A9AC-69BB-4EF2-ACB3-1769791E1B98 -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md index 4468785ff0..7b01e6dec2 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md @@ -1,7 +1,7 @@ --- title: Deploy Virtual Smart Cards (Windows 10) description: This topic for the IT professional discusses the factors to consider when you deploy a virtual smart card authentication solution. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md index 044f7c1fe1..852c4af6d4 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md @@ -1,7 +1,7 @@ --- title: Evaluate Virtual Smart Card Security (Windows 10) description: This topic for the IT professional describes security characteristics and considerations when deploying TPM virtual smart cards. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md index c6ad4e0710..799487b7f9 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md @@ -1,7 +1,7 @@ --- title: Get Started with Virtual Smart Cards - Walkthrough Guide (Windows 10) description: This topic for the IT professional describes how to set up a basic test environment for using TPM virtual smart cards. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md index 1ef7fb2c75..cfdee83c74 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md @@ -1,7 +1,7 @@ --- title: Virtual Smart Card Overview (Windows 10) description: Learn more about the virtual smart card technology that was developed by Microsoft. Find links to additional topics about virtual smart cards. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md index 4a9273d496..48cbc570a2 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md @@ -1,7 +1,7 @@ --- title: Tpmvscmgr (Windows 10) description: This topic for the IT professional describes the Tpmvscmgr command-line tool, through which an administrator can create and delete TPM virtual smart cards on a computer. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md index d7c394285f..f64d08cdbe 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md @@ -1,7 +1,7 @@ --- title: Understanding and Evaluating Virtual Smart Cards (Windows 10) description: Learn how smart card technology can fit into your authentication design. Find links to additional topics about virtual smart cards. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md index 4d3f59ff0a..da45445e1a 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md @@ -1,7 +1,7 @@ --- title: Use Virtual Smart Cards (Windows 10) description: This topic for the IT professional describes requirements for virtual smart cards and provides information about how to use and manage them. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md index 907bcfc24c..70c0e42b27 100644 --- a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md +++ b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md @@ -1,7 +1,7 @@ --- title: How to configure Diffie Hellman protocol over IKEv2 VPN connections (Windows 10 and Windows 11) description: Learn how to update the Diffie Hellman configuration of VPN servers and clients by running VPN cmdlets to secure connections. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking @@ -23,7 +23,7 @@ To secure the connections, update the configuration of VPN servers and clients b ## VPN server -For VPN servers that run Windows Server 2012 R2 or later, you need to run [Set-VpnServerConfiguration](/powershell/module/remoteaccess/set-vpnserverconfiguration?view=win10-ps) to configure the tunnel type. This makes all IKE exchanges on IKEv2 tunnel use the secure configuration. +For VPN servers that run Windows Server 2012 R2 or later, you need to run [Set-VpnServerConfiguration](/powershell/module/remoteaccess/set-vpnserverconfiguration?view=win10-ps&preserve-view=true) to configure the tunnel type. This makes all IKE exchanges on IKEv2 tunnel use the secure configuration. ```powershell Set-VpnServerConfiguration -TunnelType IKEv2 -CustomPolicy @@ -38,7 +38,7 @@ Set-VpnServerIPsecConfiguration -CustomPolicy ## VPN client For VPN client, you need to configure each VPN connection. -For example, run [Set-VpnConnectionIPsecConfiguration (version 4.0)](/powershell/module/vpnclient/set-vpnconnectionipsecconfiguration?view=win10-ps) and specify the name of the connection: +For example, run [Set-VpnConnectionIPsecConfiguration (version 4.0)](/powershell/module/vpnclient/set-vpnconnectionipsecconfiguration?view=win10-ps&preserve-view=true) and specify the name of the connection: ```powershell diff --git a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md index 510a5a9e76..6298f7d90f 100644 --- a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md +++ b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md @@ -1,7 +1,7 @@ --- title: How to use Single Sign-On (SSO) over VPN and Wi-Fi connections (Windows 10 and Windows 11) description: Explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity-protection/vpn/vpn-authentication.md b/windows/security/identity-protection/vpn/vpn-authentication.md index 77824138a9..70d6af4858 100644 --- a/windows/security/identity-protection/vpn/vpn-authentication.md +++ b/windows/security/identity-protection/vpn/vpn-authentication.md @@ -1,7 +1,7 @@ --- title: VPN authentication options (Windows 10 and Windows 11) description: Learn about the EAP authentication methods that Windows supports in VPNs to provide secure authentication using username/password and certificate-based methods. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking @@ -23,15 +23,54 @@ In addition to older and less-secure password-based authentication methods (whic Windows supports a number of EAP authentication methods. - - - - - - - -
        MethodDetails
        EAP-Microsoft Challenge Handshake Authentication Protocol version 2 (EAP-MSCHAPv2)
        • User name and password authentication
        • Winlogon credentials - can specify authentication with computer sign-in credentials
        EAP-Transport Layer Security (EAP-TLS)
        • Supports the following types of certificate authentication
          • Certificate with keys in the software Key Storage Provider (KSP)
          • Certificate with keys in Trusted Platform Module (TPM) KSP
          • Smart card certificates
          • Windows Hello for Business certificate
        • Certificate filtering
          • Certificate filtering can be enabled to search for a particular certificate to use to authenticate with
          • Filtering can be Issuer-based or Enhanced Key Usage (EKU)-based
        • Server validation - with TLS, server validation can be toggled on or off
          • Server name - specify the server to validate
          • Server certificate - trusted root certificate to validate the server
          • Notification - specify if the user should get a notification asking whether to trust the server or not
        Protected Extensible Authentication Protocol (PEAP)
        • Server validation - with PEAP, server validation can be toggled on or off
          • Server name - specify the server to validate
          • Server certificate - trusted root certificate to validate the server
          • Notification - specify if the user should get a notification asking whether to trust the server or not
        • Inner method - the outer method creates a secure tunnel inside while the inner method is used to complete the authentication
          • EAP-MSCHAPv2
          • EAP-TLS
        • Fast Reconnect: reduces the delay between an authentication request by a client and the response by the Network Policy Server (NPS) or other Remote Authentication Dial-in User Service (RADIUS) server. This reduces resource requirements for both client and server, and minimizes the number of times that users are prompted for credentials.
        • Cryptobinding: By deriving and exchanging values from the PEAP phase 1 key material (Tunnel Key) and from the PEAP phase 2 inner EAP method key material (Inner Session Key), it is possible to prove that the two authentications terminate at the same two entities (PEAP peer and PEAP server). This process, termed "cryptobinding", is used to protect the PEAP negotiation against "Man in the Middle" attacks.
        Tunneled Transport Layer Security (TTLS)
        • Inner method
          • Non-EAP
            • Password Authentication Protocol (PAP)
            • CHAP
            • MSCHAP
            • MSCHAPv2
          • EAP
            • MSCHAPv2
            • TLS
        • Server validation: in TTLS, the server must be validated. The following can be configured:
          • Server name
          • Trusted root certificate for server certificate
          • Whether there should be a server validation notification
        -
        +- EAP-Microsoft Challenge Handshake Authentication Protocol version 2 (EAP-MSCHAPv2): + - User name and password authentication + - Winlogon credentials - can specify authentication with computer sign-in credentials + +- EAP-Transport Layer Security (EAP-TLS): + - Supports the following types of certificate authentication: + - Certificate with keys in the software Key Storage Provider (KSP) + - Certificate with keys in Trusted Platform Module (TPM) KSP + - Smart card certificates + - Windows Hello for Business certificate + + - Certificate filtering: + - Certificate filtering can be enabled to search for a particular certificate to use to authenticate with + - Filtering can be Issuer-based or Enhanced Key Usage (EKU)-based + + - Server validation - with TLS, server validation can be toggled on or off: + - Server name - specify the server to validate + - Server certificate - trusted root certificate to validate the server + - Notification - specify if the user should get a notification asking whether to trust the server or not + +- [Protected Extensible Authentication Protocol (PEAP)](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754179(v=ws.11)): + - Server validation - with PEAP, server validation can be toggled on or off: + - Server name - specify the server to validate + - Server certificate - trusted root certificate to validate the server + - Notification - specify if the user should get a notification asking whether to trust the server or not + + - Inner method - the outer method creates a secure tunnel inside while the inner method is used to complete the authentication: + - EAP-MSCHAPv2 + - EAP-TLS + + - Fast Reconnect: reduces the delay between an authentication request by a client and the response by the Network Policy Server (NPS) or other Remote Authentication Dial-in User Service (RADIUS) server. This reduces resource requirements for both client and server, and minimizes the number of times that users are prompted for credentials. + + - [Cryptobinding](/openspecs/windows_protocols/ms-peap/757a16c7-0826-4ba9-bb71-8c3f1339e937): By deriving and exchanging values from the PEAP phase 1 key material (**Tunnel Key**) and from the PEAP phase 2 inner EAP method key material (**Inner Session Key**), it is possible to prove that the two authentications terminate at the same two entities (PEAP peer and PEAP server). This process, termed "cryptobinding", is used to protect the PEAP negotiation against "Man in the Middle" attacks. + +- Tunneled Transport Layer Security (TTLS) + - Inner method + - Non-EAP + - Password Authentication Protocol (PAP) + - CHAP + - MSCHAP + - MSCHAPv2 + - EAP + - MSCHAPv2 + - TLS + - Server validation: in TTLS, the server must be validated. The following can be configured: + - Server name + - Trusted root certificate for server certificate + - Whether there should be a server validation notification For a UWP VPN plug-in, the app vendor controls the authentication method to be used. The following credential types can be used: diff --git a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md index 128afcfee9..5e8dbb7965 100644 --- a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md +++ b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md @@ -1,7 +1,7 @@ --- title: VPN auto-triggered profile options (Windows 10 and Windows 11) description: Learn about the types of auto-trigger rules for VPNs in Windows, which start a VPN when it is needed to access a resource. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking diff --git a/windows/security/identity-protection/vpn/vpn-conditional-access.md b/windows/security/identity-protection/vpn/vpn-conditional-access.md index 068d41d1a5..fafe96b51b 100644 --- a/windows/security/identity-protection/vpn/vpn-conditional-access.md +++ b/windows/security/identity-protection/vpn/vpn-conditional-access.md @@ -1,7 +1,7 @@ --- title: VPN and conditional access (Windows 10 and Windows 11) description: Learn how to integrate the VPN client with the Conditional Access Platform, so you can create access rules for Azure Active Directory (Azure AD) connected apps. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking diff --git a/windows/security/identity-protection/vpn/vpn-connection-type.md b/windows/security/identity-protection/vpn/vpn-connection-type.md index 90b1a56b41..72d3fed61c 100644 --- a/windows/security/identity-protection/vpn/vpn-connection-type.md +++ b/windows/security/identity-protection/vpn/vpn-connection-type.md @@ -1,7 +1,7 @@ --- title: VPN connection types (Windows 10 and Windows 11) description: Learn about Windows VPN platform clients and the VPN connection-type features that can be configured. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking diff --git a/windows/security/identity-protection/vpn/vpn-guide.md b/windows/security/identity-protection/vpn/vpn-guide.md index 3f23cadc79..f1ef2a83ef 100644 --- a/windows/security/identity-protection/vpn/vpn-guide.md +++ b/windows/security/identity-protection/vpn/vpn-guide.md @@ -1,7 +1,7 @@ --- title: Windows VPN technical guide (Windows 10 and Windows 11) description: Learn about decisions to make for Windows 10 or Windows 11 clients in your enterprise VPN solution and how to configure your deployment. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library author: dansimp diff --git a/windows/security/identity-protection/vpn/vpn-name-resolution.md b/windows/security/identity-protection/vpn/vpn-name-resolution.md index a61584597c..a07cf8e0c7 100644 --- a/windows/security/identity-protection/vpn/vpn-name-resolution.md +++ b/windows/security/identity-protection/vpn/vpn-name-resolution.md @@ -1,7 +1,7 @@ --- title: VPN name resolution (Windows 10 and Windows 11) description: Learn how the name resolution setting in the VPN profile configures how name resolution works when a VPN client connects to a VPN server. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking diff --git a/windows/security/identity-protection/vpn/vpn-office-365-optimization.md b/windows/security/identity-protection/vpn/vpn-office-365-optimization.md index 562a872615..a0a8aecf5e 100644 --- a/windows/security/identity-protection/vpn/vpn-office-365-optimization.md +++ b/windows/security/identity-protection/vpn/vpn-office-365-optimization.md @@ -1,7 +1,7 @@ --- title: Optimizing Office 365 traffic for remote workers with the native Windows 10 or Windows 11 VPN client description: tbd -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking diff --git a/windows/security/identity-protection/vpn/vpn-profile-options.md b/windows/security/identity-protection/vpn/vpn-profile-options.md index 8e683158b9..c999481679 100644 --- a/windows/security/identity-protection/vpn/vpn-profile-options.md +++ b/windows/security/identity-protection/vpn/vpn-profile-options.md @@ -4,7 +4,7 @@ description: Windows adds Virtual Private Network (VPN) profile options to help ms.assetid: E3F99DF9-863D-4E28-BAED-5C1B1B913523 ms.reviewer: manager: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking diff --git a/windows/security/identity-protection/vpn/vpn-routing.md b/windows/security/identity-protection/vpn/vpn-routing.md index 5c2b3d00e1..3ba700ab9e 100644 --- a/windows/security/identity-protection/vpn/vpn-routing.md +++ b/windows/security/identity-protection/vpn/vpn-routing.md @@ -1,7 +1,7 @@ --- title: VPN routing decisions (Windows 10 and Windows 10) description: Learn about approaches that either send all data through a VPN or only selected data. The one you choose impacts capacity planning and security expectations. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking diff --git a/windows/security/identity-protection/vpn/vpn-security-features.md b/windows/security/identity-protection/vpn/vpn-security-features.md index 88d9c1dfba..31f424f860 100644 --- a/windows/security/identity-protection/vpn/vpn-security-features.md +++ b/windows/security/identity-protection/vpn/vpn-security-features.md @@ -1,7 +1,7 @@ --- title: VPN security features (Windows 10 and Windows 11) description: Learn about security features for VPN, including LockDown VPN, Windows Information Protection integration with VPN, and traffic filters. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking diff --git a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md index 3a8d6e6ed0..0465f35ec4 100644 --- a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md +++ b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md @@ -3,7 +3,7 @@ title: Windows Credential Theft Mitigation Guide Abstract description: Provides a summary of the Windows credential theft mitigation guide. ms.assetid: 821ddc1a-f401-4732-82a7-40d1fff5a78a ms.reviewer: -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/identity.md b/windows/security/identity.md index 0cfa07beba..7e2e8ca4b9 100644 --- a/windows/security/identity.md +++ b/windows/security/identity.md @@ -13,7 +13,7 @@ ms.prod: m365-security ms.technology: windows-sec --- -# Windows identity and user security +# Windows identity and privacy Malicious actors launch millions of password attacks every day. Weak passwords, password spraying, and phishing are the entry point for many attacks. Knowing that the right user is accessing the right device and the right data is critical to keeping your business, family, and self, safe and secure. Windows Hello, Windows Hello for Business, and Credential Guard enable customers to move to passwordless multifactor authentication (MFA). MFA can reduce the risk of compromise in organizations. diff --git a/windows/security/includes/improve-request-performance.md b/windows/security/includes/improve-request-performance.md index efaf6664a9..2048d9f516 100644 --- a/windows/security/includes/improve-request-performance.md +++ b/windows/security/includes/improve-request-performance.md @@ -3,7 +3,7 @@ title: Improve request performance description: Improve request performance keywords: server, request, performance search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/includes/machineactionsnote.md b/windows/security/includes/machineactionsnote.md index 713356c6f7..5d784c2abe 100644 --- a/windows/security/includes/machineactionsnote.md +++ b/windows/security/includes/machineactionsnote.md @@ -6,7 +6,7 @@ ms.reviewer: manager: dansimp ms.author: macapara author: mjcaparas -ms.prod: w10 +ms.prod: m365-security --- >[!Note] diff --git a/windows/security/includes/microsoft-defender-api-usgov.md b/windows/security/includes/microsoft-defender-api-usgov.md index eb6e94cc23..536dab4a74 100644 --- a/windows/security/includes/microsoft-defender-api-usgov.md +++ b/windows/security/includes/microsoft-defender-api-usgov.md @@ -3,7 +3,7 @@ title: Microsoft Defender for Endpoint API URIs for US Government description: Microsoft Defender for Endpoint API URIs for US Government keywords: defender, endpoint, api, government, gov search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/includes/microsoft-defender.md b/windows/security/includes/microsoft-defender.md index cf62bf3732..f3a6cb666b 100644 --- a/windows/security/includes/microsoft-defender.md +++ b/windows/security/includes/microsoft-defender.md @@ -6,7 +6,7 @@ ms.reviewer: manager: dansimp ms.author: dansimp author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.topic: include --- diff --git a/windows/security/includes/prerelease.md b/windows/security/includes/prerelease.md index a008aa45d7..bced58da9f 100644 --- a/windows/security/includes/prerelease.md +++ b/windows/security/includes/prerelease.md @@ -6,7 +6,7 @@ ms.reviewer: manager: dansimp ms.author: macapara author: mjcaparas -ms.prod: w10 +ms.prod: m365-security --- > [!IMPORTANT] diff --git a/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md b/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md index 3c10de8372..0a0b518012 100644 --- a/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md @@ -3,7 +3,7 @@ title: BCD settings and BitLocker (Windows 10) description: This topic for IT professionals describes the BCD settings that are used by BitLocker. ms.assetid: c4ab7ac9-16dc-4c7e-b061-c0b0deb2c4fa ms.reviewer: -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml index a920bdcb74..cb7895bee9 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml @@ -3,7 +3,8 @@ metadata: title: BitLocker and Active Directory Domain Services (AD DS) FAQ (Windows 10) description: Learn more about how BitLocker and Active Directory Domain Services (AD DS) can work together to keep devices secure. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee - ms.prod: w10 + ms.reviewer: + ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md index d43cdb899b..dfac592fab 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md +++ b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md @@ -2,7 +2,8 @@ title: BitLocker basic deployment (Windows 10) description: This article for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. ms.assetid: 97c646cb-9e53-4236-9678-354af41151c4 -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security @@ -184,132 +185,20 @@ manage-bde -on C: Windows PowerShell cmdlets provide an alternative way to work with BitLocker. Using Windows PowerShell's scripting capabilities, administrators can integrate BitLocker options into existing scripts with ease. The list below displays the available BitLocker cmdlets. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

        Name

        Parameters

        Add-BitLockerKeyProtector

        -ADAccountOrGroup

        -

        -ADAccountOrGroupProtector

        -

        -Confirm

        -

        -MountPoint

        -

        -Password

        -

        -PasswordProtector

        -

        -Pin

        -

        -RecoveryKeyPath

        -

        -RecoveryKeyProtector

        -

        -RecoveryPassword

        -

        -RecoveryPasswordProtector

        -

        -Service

        -

        -StartupKeyPath

        -

        -StartupKeyProtector

        -

        -TpmAndPinAndStartupKeyProtector

        -

        -TpmAndPinProtector

        -

        -TpmAndStartupKeyProtector

        -

        -TpmProtector

        -

        -WhatIf

        Backup-BitLockerKeyProtector

        -Confirm

        -

        -KeyProtectorId

        -

        -MountPoint

        -

        -WhatIf

        Disable-BitLocker

        -Confirm

        -

        -MountPoint

        -

        -WhatIf

        Disable-BitLockerAutoUnlock

        -Confirm

        -

        -MountPoint

        -

        -WhatIf

        Enable-BitLocker

        -AdAccountOrGroup

        -

        -AdAccountOrGroupProtector

        -

        -Confirm

        -

        -EncryptionMethod

        -

        -HardwareEncryption

        -

        -Password

        -

        -PasswordProtector

        -

        -Pin

        -

        -RecoveryKeyPath

        -

        -RecoveryKeyProtector

        -

        -RecoveryPassword

        -

        -RecoveryPasswordProtector

        -

        -Service

        -

        -SkipHardwareTest

        -

        -StartupKeyPath

        -

        -StartupKeyProtector

        -

        -TpmAndPinAndStartupKeyProtector

        -

        -TpmAndPinProtector

        -

        -TpmAndStartupKeyProtector

        -

        -TpmProtector

        -

        -UsedSpaceOnly

        -

        -WhatIf

        Enable-BitLockerAutoUnlock

        -Confirm

        -

        -MountPoint

        -

        -WhatIf

        Get-BitLockerVolume

        -MountPoint

        Lock-BitLocker

        -Confirm

        -

        -ForceDismount

        -

        -MountPoint

        -

        -WhatIf

        Remove-BitLockerKeyProtector

        -Confirm

        -

        -KeyProtectorId

        -

        -MountPoint

        -

        -WhatIf

        Resume-BitLocker

        -Confirm

        -

        -MountPoint

        -

        -WhatIf

        Suspend-BitLocker

        -Confirm

        -

        -MountPoint

        -

        -RebootCount

        -

        -WhatIf

        Unlock-BitLocker

        -AdAccountOrGroup

        -

        -Confirm

        -

        -MountPoint

        -

        -Password

        -

        -RecoveryKeyPath

        -

        -RecoveryPassword

        -

        -RecoveryPassword

        -

        -WhatIf

        +|Name|Parameters| +|--- |--- | +|**Add-BitLockerKeyProtector**|

      • ADAccountOrGroup
      • ADAccountOrGroupProtector
      • Confirm
      • MountPoint
      • Password
      • PasswordProtector
      • Pin
      • RecoveryKeyPath
      • RecoveryKeyProtector
      • RecoveryPassword
      • RecoveryPasswordProtector
      • Service
      • StartupKeyPath
      • StartupKeyProtector
      • TpmAndPinAndStartupKeyProtector
      • TpmAndPinProtector
      • TpmAndStartupKeyProtector
      • TpmProtector
      • WhatIf| +|**Backup-BitLockerKeyProtector**|
      • Confirm
      • KeyProtectorId
      • MountPoint
      • WhatIf| +|**Disable-BitLocker**|
      • Confirm
      • MountPoint
      • WhatIf| +|**Disable-BitLockerAutoUnlock**|
      • Confirm
      • MountPoint
      • WhatIf| +|**Enable-BitLocker**|
      • AdAccountOrGroup
      • AdAccountOrGroupProtector
      • Confirm
      • EncryptionMethod
      • HardwareEncryption
      • Password
      • PasswordProtector
      • Pin
      • RecoveryKeyPath
      • RecoveryKeyProtector
      • RecoveryPassword
      • RecoveryPasswordProtector
      • Service
      • SkipHardwareTest
      • StartupKeyPath
      • StartupKeyProtector
      • TpmAndPinAndStartupKeyProtector
      • TpmAndPinProtector
      • TpmAndStartupKeyProtector
      • TpmProtector
      • UsedSpaceOnly
      • WhatIf| +|**Enable-BitLockerAutoUnlock**|
      • Confirm
      • MountPoint
      • WhatIf| +|**Get-BitLockerVolume**|
      • MountPoint| +|**Lock-BitLocker**|
      • Confirm
      • ForceDismount
      • MountPoint
      • WhatIf| +|**Remove-BitLockerKeyProtector**|
      • Confirm
      • KeyProtectorId
      • MountPoint
      • WhatIf| +|**Resume-BitLocker**|
      • Confirm
      • MountPoint
      • WhatIf| +|**Suspend-BitLocker**|
      • Confirm
      • MountPoint
      • RebootCount
      • WhatIf| +|**Unlock-BitLocker**|
      • AdAccountOrGroup
      • Confirm
      • MountPoint
      • Password
      • RecoveryKeyPath
      • RecoveryPassword
      • RecoveryPassword
      • WhatIf| Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they are encrypting prior to running Windows PowerShell cmdlets. diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md index 574dad11e1..0d8ddfd9ee 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md @@ -2,7 +2,8 @@ title: BitLocker Countermeasures (Windows 10) description: Windows uses technologies including TPM, Secure Boot, Trusted Boot, and Early Launch Antimalware (ELAM) to protect against attacks on the BitLocker encryption key. ms.assetid: ebdb0637-2597-4da1-bb18-8127964686ea -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml index d247254b4b..85b7bbb000 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml @@ -4,7 +4,7 @@ metadata: description: Browse frequently asked questions about BitLocker deployment and administration, such as, "Can BitLocker deployment be automated in an enterprise environment?" ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee ms.reviewer: - ms.prod: w10 + ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md index e017f3cd8d..c9cf5ba6f5 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md @@ -1,7 +1,7 @@ --- title: BitLocker deployment comparison (Windows 10) description: This article shows the BitLocker deployment comparison chart. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md index 4594e1c375..2b18579a8c 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md +++ b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md @@ -1,7 +1,7 @@ --- title: Overview of BitLocker Device Encryption in Windows description: This topic provides an overview of how BitLocker Device Encryption can help protect data on devices running Windows. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security @@ -142,6 +142,6 @@ Part of the Microsoft Desktop Optimization Pack, MBAM makes it easier to manage * Enforces the BitLocker encryption policy options that you set for your enterprise. * Integrates with existing management tools, such as Microsoft Endpoint Configuration Manager. * Offers an IT-customizable recovery user experience. -* Supports Windows 11 and Windows 10. +* Supports Windows 10. -For more information about MBAM, including how to obtain it, see [Microsoft BitLocker Administration and Monitoring](/microsoft-desktop-optimization-pack/) on the MDOP TechCenter. \ No newline at end of file +For more information about MBAM, including how to obtain it, see [Microsoft BitLocker Administration and Monitoring](/microsoft-desktop-optimization-pack/) on the MDOP TechCenter. diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.yml b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.yml index f6f5f81fa5..fd752a06bd 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.yml @@ -3,7 +3,8 @@ metadata: title: BitLocker FAQ (Windows 10) description: Find the answers you need by exploring this brief hub page listing FAQ pages for various aspects of BitLocker. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee - ms.prod: w10 + ms.reviewer: + ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index 12cc8715fe..aa7bdd87b0 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -2,7 +2,8 @@ title: BitLocker Group Policy settings (Windows 10) description: This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. ms.assetid: 4904e336-29fe-4cef-bb6c-3950541864af -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md index 5a619e7a83..28c20974f7 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md @@ -3,7 +3,7 @@ title: BitLocker How to deploy on Windows Server 2012 and later description: This topic for the IT professional explains how to deploy BitLocker and Windows Server 2012 and later ms.assetid: 91c18e9e-6ab4-4607-8c75-d983bbe2542f ms.reviewer: -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md index cf8030fe0c..80bc08da6e 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md @@ -2,7 +2,8 @@ title: BitLocker - How to enable Network Unlock (Windows 10) description: This article for the IT professional describes how BitLocker Network Unlock works and how to configure it. ms.assetid: be45bc28-47db-4931-bfec-3c348151d2e9 -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.yml index 4413577e0b..eba6835e4f 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.yml @@ -4,7 +4,7 @@ metadata: description: Browse frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee ms.reviewer: - ms.prod: w10 + ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md index e99cd2215d..83d1f263d5 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md +++ b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md @@ -1,7 +1,7 @@ --- title: BitLocker Management Recommendations for Enterprises (Windows 10) description: Refer to relevant documentation, products, and services to learn about managing BitLocker for enterprises and see recommendations for different computers. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security @@ -32,7 +32,7 @@ Though much Windows BitLocker [documentation](bitlocker-overview.md) has been pu Companies that image their own computers using Microsoft System Center 2012 Configuration Manager SP1 (SCCM) or later can use an existing task sequence to [pre-provision BitLocker](/configmgr/osd/understand/task-sequence-steps#BKMK_PreProvisionBitLocker) encryption while in Windows Preinstallation Environment (WinPE) and can then [enable protection](/configmgr/osd/understand/task-sequence-steps#BKMK_EnableBitLocker). This can help ensure that computers are encrypted from the start, even before users receive them. As part of the imaging process, a company could also decide to use SCCM to pre-set any desired [BitLocker Group Policy](./bitlocker-group-policy-settings.md). -Enterprises can use [Microsoft BitLocker Administration and Monitoring (MBAM)](/microsoft-desktop-optimization-pack/mbam-v25/) to manage client computers with BitLocker that are domain-joined on-premises until [mainstream support ends in July 2019](https://support.microsoft.com/lifecycle/search?alpha=Microsoft%20BitLocker%20Administration%20and%20Monitoring%202.5%20Service%20Pack%201/) or they can receive extended support until April 2026. Thus, over the next few years, a good strategy for enterprises will be to plan and move to cloud-based management for BitLocker. Refer to the [PowerShell examples](#powershell-examples) to see how to store recovery keys in Azure Active Directory (Azure AD). +Enterprises can use [Microsoft BitLocker Administration and Monitoring (MBAM)](/microsoft-desktop-optimization-pack/mbam-v25/) to manage client computers with BitLocker that are domain-joined on-premises until [mainstream support ends in July 2019](/lifecycle/products/?alpha=Microsoft%20BitLocker%20Administration%20and%20Monitoring%202.5%20Service%20Pack%201%2F) or they can receive extended support until April 2026. Thus, over the next few years, a good strategy for enterprises will be to plan and move to cloud-based management for BitLocker. Refer to the [PowerShell examples](#powershell-examples) to see how to store recovery keys in Azure Active Directory (Azure AD). ## Managing devices joined to Azure Active Directory diff --git a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.yml index 10287fc220..9828c35058 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.yml @@ -2,7 +2,7 @@ metadata: title: BitLocker Network Unlock FAQ (Windows 10) description: Familiarize yourself with BitLocker Network Unlock. Learn how it can make desktop and server management easier within domain environments. - ms.prod: w10 + ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml index a5650881cd..9836d4e902 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml @@ -3,7 +3,8 @@ metadata: title: BitLocker overview and requirements FAQ (Windows 10) description: This article for IT professionals answers frequently asked questions concerning the requirements to use BitLocker. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee - ms.prod: w10 + ms.reviewer: + ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index 97424e26dd..a5d4bf4e49 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -3,7 +3,7 @@ title: BitLocker (Windows 10) description: This topic provides a high-level overview of BitLocker, including a list of system requirements, practical applications, and deprecated features. ms.assetid: 40526fcc-3e0d-4d75-90e0-c7d0615f33b2 ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md index 0ac8b4877f..88a6971b32 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md @@ -2,7 +2,8 @@ title: BitLocker recovery guide (Windows 10) description: This article for IT professionals describes how to recover BitLocker keys from AD DS. ms.assetid: d0f722e9-1773-40bf-8456-63ee7a95ea14 -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-loop-break.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-loop-break.md index e1736269b5..c059f9b372 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-recovery-loop-break.md +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-loop-break.md @@ -2,7 +2,7 @@ title: Breaking out of a Bitlocker recovery loop description: This topic for IT professionals describes how to break out of a Bitlocker recovery loop. ms.assetid: #c40f87ac-17d3-47b2-afc6-6c641f72ecee -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-security-faq.yml index bb50bfcba5..b9edd5b644 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-security-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.yml @@ -4,7 +4,7 @@ metadata: description: Learn more about how BitLocker security works. Browse frequently asked questions, such as, "What form of encryption does BitLocker use?" ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee ms.reviewer: - ms.prod: w10 + ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.yml index e28fda09ee..c9d6d649c1 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.yml @@ -5,7 +5,7 @@ metadata: ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee ms.reviewer: ms.author: dansimp - ms.prod: w10 + ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.yml index 6cb7eaa23e..84f82e3483 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.yml @@ -2,7 +2,7 @@ metadata: title: BitLocker Upgrading FAQ (Windows 10) description: Learn more about upgrading systems that have BitLocker enabled. Find frequently asked questions, such as, "Can I upgrade to Windows 10 with BitLocker enabled?" - ms.prod: w10 + ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md index c70a1373ec..f33bdd77ff 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md @@ -2,7 +2,8 @@ title: BitLocker Use BitLocker Drive Encryption Tools to manage BitLocker (Windows 10) description: This article for the IT professional describes how to use tools to manage BitLocker. ms.assetid: e869db9c-e906-437b-8c70-741dd61b5ea6 -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security @@ -128,134 +129,20 @@ For more information about using repair-bde, see [Repair-bde](/previous-versions Windows PowerShell cmdlets provide a new way for administrators to use when working with BitLocker. Using Windows PowerShell's scripting capabilities, administrators can integrate BitLocker options into existing scripts with ease. The list below displays the available BitLocker cmdlets. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

        Name

        Parameters

        Add-BitLockerKeyProtector

        -ADAccountOrGroup

        -

        -ADAccountOrGroupProtector

        -

        -Confirm

        -

        -MountPoint

        -

        -Password

        -

        -PasswordProtector

        -

        -Pin

        -

        -RecoveryKeyPath

        -

        -RecoveryKeyProtector

        -

        -RecoveryPassword

        -

        -RecoveryPasswordProtector

        -

        -Service

        -

        -StartupKeyPath

        -

        -StartupKeyProtector

        -

        -TpmAndPinAndStartupKeyProtector

        -

        -TpmAndPinProtector

        -

        -TpmAndStartupKeyProtector

        -

        -TpmProtector

        -

        -WhatIf

        Backup-BitLockerKeyProtector

        -Confirm

        -

        -KeyProtectorId

        -

        -MountPoint

        -

        -WhatIf

        Disable-BitLocker

        -Confirm

        -

        -MountPoint

        -

        -WhatIf

        Disable-BitLockerAutoUnlock

        -Confirm

        -

        -MountPoint

        -

        -WhatIf

        Enable-BitLocker

        -AdAccountOrGroup

        -

        -AdAccountOrGroupProtector

        -

        -Confirm

        -

        -EncryptionMethod

        -

        -HardwareEncryption

        -

        -Password

        -

        -PasswordProtector

        -

        -Pin

        -

        -RecoveryKeyPath

        -

        -RecoveryKeyProtector

        -

        -RecoveryPassword

        -

        -RecoveryPasswordProtector

        -

        -Service

        -

        -SkipHardwareTest

        -

        -StartupKeyPath

        -

        -StartupKeyProtector

        -

        -TpmAndPinAndStartupKeyProtector

        -

        -TpmAndPinProtector

        -

        -TpmAndStartupKeyProtector

        -

        -TpmProtector

        -

        -UsedSpaceOnly

        -

        -WhatIf

        Enable-BitLockerAutoUnlock

        -Confirm

        -

        -MountPoint

        -

        -WhatIf

        Get-BitLockerVolume

        -MountPoint

        Lock-BitLocker

        -Confirm

        -

        -ForceDismount

        -

        -MountPoint

        -

        -WhatIf

        Remove-BitLockerKeyProtector

        -Confirm

        -

        -KeyProtectorId

        -

        -MountPoint

        -

        -WhatIf

        Resume-BitLocker

        -Confirm

        -

        -MountPoint

        -

        -WhatIf

        Suspend-BitLocker

        -Confirm

        -

        -MountPoint

        -

        -RebootCount

        -

        -WhatIf

        Unlock-BitLocker

        -AdAccountOrGroup

        -

        -Confirm

        -

        -MountPoint

        -

        -Password

        -

        -RecoveryKeyPath

        -

        -RecoveryPassword

        -

        -RecoveryPassword

        -

        -WhatIf

        +|Name|Parameters| +|--- |--- | +|**Add-BitLockerKeyProtector**|
      • ADAccountOrGroup
      • ADAccountOrGroupProtector
      • Confirm
      • MountPoint
      • Password
      • PasswordProtector
      • Pin
      • RecoveryKeyPath
      • RecoveryKeyProtector
      • RecoveryPassword
      • RecoveryPasswordProtector
      • Service
      • StartupKeyPath
      • StartupKeyProtector
      • TpmAndPinAndStartupKeyProtector
      • TpmAndPinProtector
      • TpmAndStartupKeyProtector
      • TpmProtector
      • WhatIf| +|**Backup-BitLockerKeyProtector**|
      • Confirm
      • KeyProtectorId
      • MountPoint
      • WhatIf| +|**Disable-BitLocker**|
      • Confirm
      • MountPoint
      • WhatIf| +|**Disable-BitLockerAutoUnlock**|
      • Confirm
      • MountPoint
      • WhatIf| +|**Enable-BitLocker**|
      • AdAccountOrGroup
      • AdAccountOrGroupProtector
      • Confirm
      • EncryptionMethod
      • HardwareEncryption
      • Password
      • PasswordProtector
      • Pin
      • RecoveryKeyPath
      • RecoveryKeyProtector
      • RecoveryPassword
      • RecoveryPasswordProtector
      • Service
      • SkipHardwareTest
      • StartupKeyPath
      • StartupKeyProtector
      • TpmAndPinAndStartupKeyProtector
      • TpmAndPinProtector
      • TpmAndStartupKeyProtector
      • TpmProtector
      • UsedSpaceOnly
      • WhatIf| +|**Enable-BitLockerAutoUnlock**|
      • Confirm
      • MountPoint
      • WhatIf| +|**Get-BitLockerVolume**|
      • MountPoint| +|**Lock-BitLocker**|
      • Confirm
      • ForceDismount
      • MountPoint
      • WhatIf| +|**Remove-BitLockerKeyProtector**|
      • Confirm
      • KeyProtectorId
      • MountPoint
      • WhatIf| +|**Resume-BitLocker**|
      • Confirm
      • MountPoint
      • WhatIf| +|**Suspend-BitLocker**|
      • Confirm
      • MountPoint
      • RebootCount
      • WhatIf| +|**Unlock-BitLocker**|
      • AdAccountOrGroup
      • Confirm
      • MountPoint
      • Password
      • RecoveryKeyPath
      • RecoveryPassword
      • RecoveryPassword
      • WhatIf| Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they are encrypting prior to running Windows PowerShell cmdlets. diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md index 7cc02625e5..9e53801a67 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md @@ -2,7 +2,8 @@ title: BitLocker Use BitLocker Recovery Password Viewer (Windows 10) description: This topic for the IT professional describes how to use the BitLocker Recovery Password Viewer. ms.assetid: 04c93ac5-5dac-415e-b636-de81435753a2 -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security @@ -29,7 +30,7 @@ ms.custom: bitlocker This topic for the IT professional describes how to use the BitLocker Recovery Password Viewer. -The BitLocker Recovery Password Viewer tool is an optional tool included with the Remote Server Administration Tools (RSAT). It lets you locate and view BitLocker recovery passwords that are stored in Active Directory Domain Services (AD DS). You can use this tool to help recover data that is stored on a drive that has been encrypted by using BitLocker. The BitLocker Active Directory Recovery Password Viewer tool is an extension for the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in. Using this tool, you can examine a computer object's **Properties** dialog box to view the corresponding BitLocker recovery passwords. Additionally, you can right-click a domain container and then search for a BitLocker recovery password across all the domains in the Active Directory forest. You can also search for a password by password identifier (ID). +The BitLocker Recovery Password Viewer tool is an optional tool included with the Remote Server Administration Tools (RSAT). It lets you locate and view BitLocker recovery passwords that are stored in Active Directory Domain Services (AD DS). You can use this tool to help recover data that is stored on a drive that has been encrypted by using BitLocker. The BitLocker Active Directory Recovery Password Viewer tool is an extension for the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in. Using this tool, you can examine a computer object's **Properties** dialog box to view the corresponding BitLocker recovery passwords. Additionally you can right-click a domain container and then search for a BitLocker recovery password across all the domains in the Active Directory forest. You can also search for a password by password identifier (ID). ## Before you start diff --git a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.yml index 1a02bc65c8..52150c7455 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.yml @@ -4,7 +4,7 @@ metadata: description: Learn how to integrate BitLocker with other software on your device. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee ms.reviewer: - ms.prod: w10 + ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md index e08c975702..ba7ecc2d18 100644 --- a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md +++ b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md @@ -2,7 +2,8 @@ title: Prepare your organization for BitLocker Planning and policies (Windows 10) description: This topic for the IT professional explains how can you plan your BitLocker deployment. ms.assetid: 6e3593b5-4e8a-40ac-808a-3fdbc948059d -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security @@ -29,17 +30,17 @@ ms.custom: bitlocker This topic for the IT professional explains how can you plan your BitLocker deployment. -When you design your BitLocker deployment strategy, define the appropriate policies and configuration requirements based on the business requirements of your organization. The following topics will help you collect information that you can use to frame your decision-making process about deploying and managing BitLocker systems. +When you design your BitLocker deployment strategy, define the appropriate policies and configuration requirements based on the business requirements of your organization. The following sections will help you collect information. Use this information to help with your decision-making process about deploying and managing BitLocker systems. ## Audit your environment -To plan your enterprise deployment of BitLocker, you must first understand your current environment. Conduct an informal audit to define your current policies, procedures, and hardware environment. Begin by reviewing your existing corporate security policies as they relate to disk encryption software. If your organization is not currently using disk encryption software, none of these policies will exist. If you are using disk encryption software, then you might need to modify your organization's policies to address the capabilities of BitLocker. +To plan your BitLocker deployment, understand your current environment. Do an informal audit to define your current policies, procedures, and hardware environment. Review your existing disk encryption software corporate security policies. If your organization isn't using disk encryption software, then none of these policies will exist. If you use disk encryption software, then you might need to change your organization's policies to use the BitLocker features. -Use the following questions to help you document your organization's current disk encryption security policies: +To help you document your organization's current disk encryption security policies, answer the following questions: -1. Are there policies to address which computers will use BitLocker and which computers will not use BitLocker? +1. Are there policies to determine which computers will use BitLocker and which computers won't use BitLocker? 2. What policies exist to control recovery password and recovery key storage? -3. What are the policies for validating the identity of users that need to perform BitLocker recovery? +3. What are the policies for validating the user identities that need to run BitLocker recovery? 4. What policies exist to control who in the organization has access to recovery data? 5. What policies exist to control computer decommissioning or retirement? @@ -50,11 +51,11 @@ BitLocker helps prevent unauthorized access to data on lost or stolen computers - Encrypting the entire Windows operating system volume on the hard disk. - Verifying the boot process integrity. -The trusted platform module (TPM) is a hardware component installed in many newer computers by the computer manufacturers. It works with BitLocker to help protect user data and to ensure that a computer has not been tampered with while the system was offline. +The trusted platform module (TPM) is a hardware component installed in many newer computers by the computer manufacturers. It works with BitLocker to help protect user data. And, help make sure a computer hasn't been tampered with while the system was offline. -In addition, BitLocker offers the option to lock the normal startup process until the user supplies a personal identification number (PIN) or inserts a removable USB device, such as a flash drive, that contains a startup key. These additional security measures provide multifactor authentication and assurance that the computer will not start or resume from hibernation until the correct PIN or startup key is presented. +Also, BitLocker can lock the normal startup process until the user supplies a personal identification number (PIN) or inserts a removable USB device, such as a flash drive, that contains a startup key. These extra security measures provide multifactor authentication. They also make sure that the computer won't start or resume from hibernation until the correct PIN or startup key is presented. -On computers that do not have a TPM version 1.2 or higher, you can still use BitLocker to encrypt the Windows operating system volume. However, this implementation will require the user to insert a USB startup key to start the computer or resume from hibernation, and does not provide the pre-startup system integrity verification offered by BitLocker working with a TPM. +On computers that don't have a TPM version 1.2 or higher, you can still use BitLocker to encrypt the Windows operating system volume. However, this implementation requires the user to insert a USB startup key to start the computer or resume from hibernation. It doesn't provide the pre-startup system integrity verification offered by BitLocker working with a TPM. ### BitLocker key protectors @@ -75,25 +76,25 @@ On computers that do not have a TPM version 1.2 or higher, you can still use Bi | TPM + PIN | Yes| TPM validates early boot components. The user must enter the correct PIN before the start-up process can continue, and before the drive can be unlocked. The TPM will enter lockout if the incorrect PIN is entered repeatedly to protect the PIN from brute force attacks. The number of repeated attempts that will trigger a lockout is variable.| | TPM + Network key | No | The TPM successfully validates early boot components, and a valid encrypted network key has been provided from the WDS server. This authentication method provides automatic unlock of operating system volumes at system reboot while still maintaining multifactor authentication. | | TPM + startup key| Yes| The TPM successfully validates early boot components, and a USB flash drive containing the startup key has been inserted.| -| Startup key only | Yes| The user is prompted to insert the USB flash drive that holds the recovery key and/or startup key and reboot the computer.| +| Startup key only | Yes| The user is prompted for the USB flash drive that has the recovery key and/or startup key, and then reboot the computer.| **Will you support computers without TPM version 1.2 or higher?** -Determine whether you will support computers that do not have a TPM version 1.2 or higher in your environment. If you choose to support BitLocker on this type of computer, a user must use a USB startup key to boot the system. This requires additional support processes similar to multifactor authentication. +Determine if you're support computers that don't have a TPM version 1.2 or higher. If you support BitLocker on this type of computer, a user must use a USB startup key to boot the system. This startup key requires extra support processes similar to multifactor authentication. **What areas of your organization need a baseline level of data protection?** The TPM-only authentication method will provide the most transparent user experience for organizations that need a baseline level of data protection to meet security policies. It has the lowest total cost of ownership. TPM-only might also be more appropriate for computers that are unattended or that must reboot unattended. -However, TPM-only authentication method offers the lowest level of data protection. This authentication method protects against attacks that modify early boot components, but the level of protection can be affected by potential weaknesses in hardware or in the early boot components. BitLocker’s multifactor authentication methods significantly increase the overall level of data protection. +However, TPM-only authentication method offers the lowest level of data protection. This authentication method protects against attacks that modify early boot components. But, the level of protection can be affected by potential weaknesses in hardware or in the early boot components. BitLocker’s multifactor authentication methods significantly increase the overall level of data protection. **What areas of your organization need a more secure level of data protection?** -If there are areas of your organization where data residing on user computers is considered highly sensitive, consider the best practice of deploying BitLocker with multifactor authentication on those systems. Requiring the user to input a PIN significantly increases the level of protection for the system. You can also use BitLocker Network Unlock to allow these computers to automatically unlock when connected to a trusted wired network that can provide the Network Unlock key. +If there are user computers with highly sensitive data, then deploy BitLocker with multifactor authentication on those systems. Requiring the user to input a PIN significantly increases the level of protection for the system. You can also use BitLocker Network Unlock to allow these computers to automatically unlock when connected to a trusted wired network that can provide the Network Unlock key. **What multifactor authentication method does your organization prefer?** -The protection differences provided by multifactor authentication methods cannot be easily quantified. Consider each authentication method's impact on Helpdesk support, user education, user productivity, and automated systems management processes. +The protection differences provided by multifactor authentication methods can't be easily quantified. Consider each authentication method's impact on Helpdesk support, user education, user productivity, and any automated systems management processes. ## TPM hardware configurations @@ -101,19 +102,19 @@ In your deployment plan, identify what TPM-based hardware platforms will be supp ### TPM 1.2 states and initialization -For TPM 1.2, there are multiple possible states. Windows automatically initializes the TPM, which brings it to an enabled, activated, and owned state. This is the state that BitLocker requires before it can use the TPM. +For TPM 1.2, there are multiple possible states. Windows automatically initializes the TPM, which brings it to an enabled, activated, and owned state. This state is the state that BitLocker requires before it can use the TPM. ### Endorsement keys -For a TPM to be usable by BitLocker, it must contain an endorsement key, which is an RSA key pair. The private half of the key pair is held inside the TPM and is never revealed or accessible outside the TPM. If the TPM does not contain an endorsement key, BitLocker will force the TPM to generate one automatically as part of BitLocker setup. +For a TPM to be usable by BitLocker, it must contain an endorsement key, which is an RSA key pair. The private half of the key pair is held inside the TPM and is never revealed or accessible outside the TPM. If the TPM doesn't have an endorsement key, BitLocker will force the TPM to generate one automatically as part of BitLocker setup. -An endorsement key can be created at various points in the TPM’s lifecycle, but needs to be created only once for the lifetime of the TPM. If an endorsement key does not exist for the TPM, it must be created before TPM ownership can be taken. +An endorsement key can be created at various points in the TPM’s lifecycle, but needs to be created only once for the lifetime of the TPM. If an endorsement key doesn't exist for the TPM, it must be created before TPM ownership can be taken. For more information about the TPM and the TCG, see the Trusted Computing Group: Trusted Platform Module (TPM) Specifications (). ## Non-TPM hardware configurations -Devices that do not include a TPM can still be protected by drive encryption. Windows To Go workspaces can be BitLocker protected using a startup password and PCs without a TPM can use a startup key. +Devices that don't include a TPM can still be protected by drive encryption. Windows To Go workspaces can be BitLocker protected using a startup password and PCs without a TPM can use a startup key. Use the following questions to identify issues that might affect your deployment in a non-TPM configuration: @@ -121,40 +122,40 @@ Use the following questions to identify issues that might affect your deployment - Do you have budget for USB flash drives for each of these computers? - Do your existing non-TPM devices support USB devices at boot time? -Test your individual hardware platforms with the BitLocker system check option while you are enabling BitLocker. The system check will ensure that BitLocker can read the recovery information from a USB device and encryption keys correctly before it encrypts the volume. CD and DVD drives cannot act as a block storage device and cannot be used to store the BitLocker recovery material. +Test your individual hardware platforms with the BitLocker system check option while you're enabling BitLocker. The system check makes sure that BitLocker can read the recovery information from a USB device and encryption keys correctly before it encrypts the volume. CD and DVD drives can't act as a block storage device and can't be used to store the BitLocker recovery material. ## Disk configuration considerations To function correctly, BitLocker requires a specific disk configuration. BitLocker requires two partitions that meet the following requirements: - The operating system partition contains the operating system and its support files; it must be formatted with the NTFS file system -- The system partition (or boot partition) contains the files that are needed to load Windows after the BIOS or UEFI firmware has prepared the system hardware. BitLocker is not enabled on this partition. For BitLocker to work, the system partition must not be encrypted and must be on a different partition than the operating system. On UEFI platforms, the system partition must be formatted with the FAT 32 file system. On BIOS platforms the system partition must be formatted with the NTFS file system. It should be at least 350 MB in size +- The system partition (or boot partition) includes the files needed to load Windows after the BIOS or UEFI firmware has prepared the system hardware. BitLocker isn't enabled on this partition. For BitLocker to work, the system partition must not be encrypted, and must be on a different partition than the operating system. On UEFI platforms, the system partition must be formatted with the FAT 32-file system. On BIOS platforms, the system partition must be formatted with the NTFS file system. It should be at least 350 MB in size. Windows setup will automatically configure the disk drives of your computer to support BitLocker encryption. -Windows Recovery Environment (Windows RE) is an extensible recovery platform that is based on Windows Pre-installation Environment (Windows PE). When the computer fails to start, Windows automatically transitions into this environment, and the Startup Repair tool in Windows RE automates the diagnosis and repair of an unbootable Windows installation. Windows RE also contains the drivers and tools that are needed to unlock a volume protected by BitLocker by providing a recovery key or recovery password. To use Windows RE in conjunction with BitLocker, the Windows RE boot image must reside on a volume that is not protected by BitLocker. +Windows Recovery Environment (Windows RE) is an extensible recovery platform that is based on Windows Pre-installation Environment (Windows PE). When the computer fails to start, Windows automatically transitions into this environment, and the Startup Repair tool in Windows RE automates the diagnosis and repair of an unbootable Windows installation. Windows RE also contains the drivers and tools that are needed to unlock a volume protected by BitLocker by providing a recovery key or recovery password. To use Windows RE with BitLocker, the Windows RE boot image must be on a volume that isn't protected by BitLocker. -Windows RE can also be used from boot media other than the local hard disk. If you choose not to install Windows RE on the local hard disk of BitLocker-enabled computers, you can use alternate boot methods, such as Windows Deployment Services, CD-ROM, or USB flash drive, for recovery. +Windows RE can also be used from boot media other than the local hard disk. If you don't install Windows RE on the local hard disk of BitLocker-enabled computers, then you can use different boot methods. For example, you can use Windows Deployment Services, CD-ROM, or USB flash drive for recovery. ## BitLocker provisioning -In Windows Vista and Windows 7, BitLocker was provisioned post installation for system and data volumes through either the manage-bde command line interface or the Control Panel user interface. With newer operating systems, BitLocker can be easily provisioned before the operating system is installed. Preprovisioning requires that the computer have a TPM. +In Windows Vista and Windows 7, BitLocker was provisioned after the installation for system and data volumes. It used the `manage-bde` command line interface or the Control Panel user interface. With newer operating systems, BitLocker can be provisioned before the operating system is installed. Preprovisioning requires the computer have a TPM. -To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet or Windows Explorer. A status of "Waiting For Activation" with a yellow exclamation icon means that the drive was preprovisioned for BitLocker. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume is not protected and needs to have a secure key added to the volume before the drive is considered fully protected. Administrators can use the control panel options, manage-bde tool, or WMI APIs to add an appropriate key protector and the volume status will be updated. +To check the BitLocker status of a particular volume, administrators can look at the drive status in the BitLocker control panel applet or Windows Explorer. The "Waiting For Activation" status with a yellow exclamation icon means that the drive was preprovisioned for BitLocker. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume isn't protected, and needs to have a secure key added to the volume before the drive is considered fully protected. Administrators can use the control panel options, `manage-bde` tool, or WMI APIs to add an appropriate key protector. The volume status will be updated. -When using the control panel options, administrators can choose to **Turn on BitLocker** and follow the steps in the wizard to add a protector, such as a PIN for an operating system volume (or a password if no TPM exists), or a password or smart card protector to a data volume. Then the drive security window is presented prior to changing the volume status. +When using the control panel options, administrators can choose to **Turn on BitLocker** and follow the steps in the wizard to add a protector, such as a PIN for an operating system volume (or a password if no TPM exists), or a password or smart card protector to a data volume. Then the drive security window is presented before changing the volume status. -Administrators can enable BitLocker prior to operating system deployment from the Windows Pre-installation Environment (WinPE). This is done with a randomly generated clear key protector applied to the formatted volume and encrypting the volume prior to running the Windows setup process. If the encryption uses the Used Disk Space Only option this step takes only a few seconds and so incorporates well into regular deployment processes. +Administrators can enable BitLocker before to operating system deployment from the Windows Pre-installation Environment (WinPE). This step is done with a randomly generated clear key protector applied to the formatted volume. It encrypts the volume before running the Windows setup process. If the encryption uses the Used Disk Space Only option, then this step takes only a few seconds. And, it incorporates into the regular deployment processes. ## Used Disk Space Only encryption The BitLocker Setup wizard provides administrators the ability to choose the Used Disk Space Only or Full encryption method when enabling BitLocker for a volume. Administrators can use the new BitLocker Group Policy setting to enforce either Used Disk Space Only or Full disk encryption. -Launching the BitLocker Setup wizard prompts for the authentication method to be used (password and smart card are available for data volumes). Once the method is chosen and the recovery key is saved, you are asked to choose the drive encryption type, either Used Disk Space Only or Full drive encryption. +Launching the BitLocker Setup wizard prompts for the authentication method to be used (password and smart card are available for data volumes). Once the method is chosen and the recovery key is saved, you're asked to choose the drive encryption type. Select Used Disk Space Only or Full drive encryption. -Used Disk Space Only means that only the portion of the drive that contains data will be encrypted, unused space will remain unencrypted. This causes the encryption process to be much faster, especially for new PCs and data drives. When BitLocker is enabled with this method as data is added to the drive the portion of the drive used will be encrypted, so there is never unencrypted data stored on the drive. +With Used Disk Space Only, only the portion of the drive that contains data will be encrypted. Unused space will remain unencrypted. This behavior causes the encryption process to be much faster, especially for new PCs and data drives. When BitLocker is enabled with this method, as data is added to the drive, the portion of the drive used is encrypted. So, there's never unencrypted data stored on the drive. -Full drive encryption means that the entire drive will be encrypted, regardless of whether data is stored on it or not. This is useful for drives that have been repurposed and may contain data remnants from their previous use. +With Full drive encryption, the entire drive is encrypted, whether data is stored on it or not. This option is useful for drives that have been repurposed, and may contain data remnants from their previous use. ## Active Directory Domain Services considerations @@ -179,9 +180,9 @@ The following recovery data is saved for each computer object: Functionality introduced in Windows Server 2012 R2 and Windows 8.1, allows BitLocker to be fully functional in FIPS mode. > [!NOTE] -> The United States Federal Information Processing Standard (FIPS) defines security and interoperability requirements for computer systems that are used by the U.S. federal government. The FIPS 140 standard defines approved cryptographic algorithms. The FIPS 140 standard also sets forth requirements for key generation and for key management. The National Institute of Standards and Technology (NIST) uses the Cryptographic Module Validation Program (CMVP) to determine whether a particular implementation of a cryptographic algorithm is compliant with the FIPS 140 standard. An implementation of a cryptographic algorithm is considered FIPS 140-compliant only if it has been submitted for and has passed NIST validation. An algorithm that has not been submitted cannot be considered FIPS-compliant even if the implementation produces identical data as a validated implementation of the same algorithm. +> The United States Federal Information Processing Standard (FIPS) defines security and interoperability requirements for computer systems that are used by the U.S. federal government. The FIPS 140 standard defines approved cryptographic algorithms. The FIPS 140 standard also sets forth requirements for key generation and for key management. The National Institute of Standards and Technology (NIST) uses the Cryptographic Module Validation Program (CMVP) to determine whether a particular implementation of a cryptographic algorithm is compliant with the FIPS 140 standard. An implementation of a cryptographic algorithm is considered FIPS 140-compliant only if it has been submitted for and has passed NIST validation. An algorithm that hasn't been submitted can't be considered FIPS-compliant, even if the implementation produces identical data as a validated implementation of the same algorithm. -Prior to these supported versions of Windows, when Windows was in FIPS mode, BitLocker prevented the creation or use of recovery passwords and instead forced the user to use recovery keys. For more information about these issues, see the support article [kb947249](https://support.microsoft.com/kb/947249). +Before these supported versions of Windows, when Windows was in FIPS mode, BitLocker prevented the creation or use of recovery passwords and instead forced the user to use recovery keys. For more information about these issues, see the support article [kb947249](/troubleshoot/windows-client/windows-security/bitlocker-recovery-password-not-fips-compliant). But on computers running these supported systems with BitLocker enabled: @@ -193,7 +194,7 @@ But on computers running these supported systems with BitLocker enabled: The BitLocker Group Policy settings for recovery passwords work the same for all Windows versions that support BitLocker, whether in FIPs mode or not. -However, you cannot use recovery passwords generated on a system in FIPS mode for systems earlier than Windows Server 2012 R2 and Windows 8.1. Recovery passwords created on Windows Server 2012 R2 and Windows 8.1 are incompatible with BitLocker on operating systems prior to Windows Server 2012 R2 and Windows 8.1; so recovery keys should be used instead. +On Windows Server 2012 R2 and Windows 8.1 and older, you can't use recovery passwords generated on a system in FIPS mode. Recovery passwords created on Windows Server 2012 R2 and Windows 8.1 are incompatible with BitLocker on operating systems older than Windows Server 2012 R2 and Windows 8.1. So, recovery keys should be used instead. ## More information @@ -202,4 +203,4 @@ However, you cannot use recovery passwords generated on a system in FIPS mode fo - [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.yml) - [BitLocker](bitlocker-overview.md) - [BitLocker Group Policy settings](bitlocker-group-policy-settings.md) -- [BitLocker basic deployment](bitlocker-basic-deployment.md) \ No newline at end of file +- [BitLocker basic deployment](bitlocker-basic-deployment.md) diff --git a/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md b/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md index ac8caab616..d176a4f457 100644 --- a/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md +++ b/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md @@ -3,7 +3,7 @@ title: Protecting cluster shared volumes and storage area networks with BitLocke description: This article for IT pros describes how to protect CSVs and SANs with BitLocker. ms.assetid: ecd25a10-42c7-4d31-8a7e-ea52c8ebc092 ms.reviewer: -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security @@ -33,14 +33,16 @@ BitLocker can protect both physical disk resources and cluster shared volumes ve BitLocker on volumes within a cluster are managed based on how the cluster service "views" the volume to be protected. The volume can be a physical disk resource such as a logical unit number (LUN) on a storage area network (SAN) or network attached storage (NAS). ->**Important**  SANs used with BitLocker must have obtained Windows Hardware Certification. For more info, see [Windows Hardware Lab Kit](/windows-hardware/drivers/). +> [!IMPORTANT] +> SANs used with BitLocker must have obtained Windows Hardware Certification. For more info, see [Windows Hardware Lab Kit](/windows-hardware/drivers/). Alternatively, the volume can be a cluster-shared volume, a shared namespace, within the cluster. Windows Server 2012 expanded the CSV architecture, now known as CSV2.0, to enable support for BitLocker. When using BitLocker with volumes designated for a cluster, the volume will need to turn on BitLocker before its addition to the storage pool within cluster or put the resource into maintenance mode before BitLocker operations will complete. Windows PowerShell or the manage-bde command-line interface is the preferred method to manage BitLocker on CSV2.0 volumes. This method is recommended over the BitLocker Control Panel item because CSV2.0 volumes are mount points. Mount points are an NTFS object that is used to provide an entry point to other volumes. Mount points do not require the use of a drive letter. Volumes that lack drive letters do not appear in the BitLocker Control Panel item. Additionally, the new Active Directory-based protector option required for cluster disk resource or CSV2.0 resources is not available in the Control Panel item. ->**Note:**  Mount points can be used to support remote mount points on SMB based network shares. This type of share is not supported for BitLocker encryption. +> [!NOTE] +> Mount points can be used to support remote mount points on SMB based network shares. This type of share is not supported for BitLocker encryption. For thinly provisioned storage, such as a Dynamic Virtual Hard Disk (VHD), BitLocker runs in Used Disk Space Only encryption mode. You cannot use the **manage-bde -WipeFreeSpace** command to transition the volume to full-volume encryption on these types of volumes. This action is blocked in order to avoid expanding thinly provisioned volumes to occupy the entire backing store while wiping the unoccupied (free) space. @@ -57,14 +59,17 @@ You can also use an Active Directory Domain Services (AD DS) protector for prote 4. Registry-based auto-unlock key ->**Note:**  A Windows Server 2012 or later domain controller is required for this feature to work properly. +> [!NOTE] +> A Windows Server 2012 or later domain controller is required for this feature to work properly. ### Turning on BitLocker before adding disks to a cluster using Windows PowerShell BitLocker encryption is available for disks before or after addition to a cluster storage pool. The advantage of encrypting volumes prior to adding them to a cluster is that the disk resource does not require suspending the resource to complete the operation. To turn on BitLocker for a disk before adding it to a cluster: 1. Install the BitLocker Drive Encryption feature if it is not already installed. + 2. Ensure the disk is formatted NTFS and has a drive letter assigned to it. + 3. Identify the name of the cluster with Windows PowerShell. ```powershell @@ -77,9 +82,11 @@ BitLocker encryption is available for disks before or after addition to a cluste Enable-BitLocker E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$ ``` - >**Warning:**  You must configure an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to fail over properly in a traditional failover cluster. + > [!WARNING] + > You must configure an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to fail over properly in a traditional failover cluster. 5. Repeat the preceding steps for each disk in the cluster. + 6. Add the volume(s) to the cluster. ### Turning on BitLocker for a clustered disk using Windows PowerShell @@ -110,7 +117,9 @@ When the cluster service owns a disk resource already, it needs to be set into m ```powershell Enable-BitLocker E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$ ``` - >**Warning:**  You must configure an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to fail over properly in a traditional failover cluster. + + > [!WARNING] + > You must configure an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to fail over properly in a traditional failover cluster. 6. Use **Resume-ClusterResource** to take the physical disk resource back out of maintenance mode: @@ -160,110 +169,23 @@ Unlike CSV2.0 volumes, physical disk resources can only be accessed by one clust The following table contains information about both Physical Disk Resources (that is, traditional failover cluster volumes) and Cluster Shared Volumes (CSV) and the actions that are allowed by BitLocker in each situation. - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

        Action

        On owner node of failover volume

        On Metadata Server (MDS) of CSV

        On (Data Server) DS of CSV

        Maintenance Mode

        Manage-bde –on

        Blocked

        Blocked

        Blocked

        Allowed

        Manage-bde –off

        Blocked

        Blocked

        Blocked

        Allowed

        Manage-bde Pause/Resume

        Blocked

        Blocked

        Blocked

        Allowed

        Manage-bde –lock

        Blocked

        Blocked

        Blocked

        Allowed

        manage-bde –wipe

        Blocked

        Blocked

        Blocked

        Allowed

        Unlock

        Automatic via cluster service

        Automatic via cluster service

        Automatic via cluster service

        Allowed

        manage-bde –protector –add

        Allowed

        Allowed

        Blocked

        Allowed

        manage-bde -protector -delete

        Allowed

        Allowed

        Blocked

        Allowed

        manage-bde –autounlock

        Allowed (not recommended)

        Allowed (not recommended)

        Blocked

        Allowed (not recommended)

        Manage-bde -upgrade

        Allowed

        Allowed

        Blocked

        Allowed

        Shrink

        Allowed

        Allowed

        Blocked

        Allowed

        Extend

        Allowed

        Allowed

        Blocked

        Allowed

        - ->Note:** Although the manage-bde -pause command is Blocked in clusters, the cluster service will automatically resume a paused encryption or decryption from the MDS node +| Action | On owner node of failover volume | On Metadata Server (MDS) of CSV | On (Data Server) DS of CSV | Maintenance Mode | +|--- |--- |--- |--- |--- | +|**Manage-bde –on**|Blocked|Blocked|Blocked|Allowed| +|**Manage-bde –off**|Blocked|Blocked|Blocked|Allowed| +|**Manage-bde Pause/Resume**|Blocked|Blocked**|Blocked|Allowed| +|**Manage-bde –lock**|Blocked|Blocked|Blocked|Allowed| +|**manage-bde –wipe**|Blocked|Blocked|Blocked|Allowed| +|**Unlock**|Automatic via cluster service|Automatic via cluster service|Automatic via cluster service|Allowed| +|**manage-bde –protector –add**|Allowed|Allowed|Blocked|Allowed| +|**manage-bde -protector -delete**|Allowed|Allowed|Blocked|Allowed| +|**manage-bde –autounlock**|Allowed (not recommended)|Allowed (not recommended)|Blocked|Allowed (not recommended)| +|**Manage-bde -upgrade**|Allowed|Allowed|Blocked|Allowed| +|**Shrink**|Allowed|Allowed|Blocked|Allowed| +|**Extend**|Allowed|Allowed|Blocked|Allowed| + +> [!NOTE] +> Although the manage-bde -pause command is Blocked in clusters, the cluster service will automatically resume a paused encryption or decryption from the MDS node In the case where a physical disk resource experiences a failover event during conversion, the new owning node will detect the conversion is not complete and will complete the conversion process. @@ -276,4 +198,4 @@ Also take these considerations into account for BitLocker on clustered storage: - If conversion is paused with encryption in progress and the CSV volume is offline from the cluster, the cluster thread (health check) will automatically resume conversion when the volume is online to the cluster. - If conversion is paused with encryption in progress and a physical disk resource volume is offline from the cluster, the BitLocker driver will automatically resume conversion when the volume is online to the cluster. - If conversion is paused with encryption in progress, while the CSV volume is in maintenance mode, the cluster thread (health check) will automatically resume conversion when moving the volume back from maintenance. -- If conversion is paused with encryption in progress, while the disk resource volume is in maintenance mode, the BitLocker driver will automatically resume conversion when the volume is moved back from maintenance mode. \ No newline at end of file +- If conversion is paused with encryption in progress, while the disk resource volume is in maintenance mode, the BitLocker driver will automatically resume conversion when the volume is moved back from maintenance mode. diff --git a/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md b/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md index 664fb40db0..89bcd638f5 100644 --- a/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md +++ b/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md @@ -2,12 +2,12 @@ title: Guidelines for troubleshooting BitLocker description: Describes approaches for investigating BitLocker issues, including how to gather diagnostic information ms.reviewer: kaushika -ms.technology: windows -ms.prod: w10 +ms.technology: windows-sec +ms.prod: m365-security ms.sitesec: library ms.localizationpriority: medium author: Teresa-Motiv -ms.author: v-tea +ms.author: v-tappelgate manager: kaushika audience: ITPro ms.collection: Windows Security Technologies\BitLocker @@ -34,7 +34,7 @@ Open Event Viewer and review the following logs under Applications and Services Additionally, review the Windows logs\\System log for events that were produced by the TPM and TPM-WMI event sources. -To filter and display or export logs, you can use the [wevtutil.exe](/windows-server/administration/windows-commands/wevtutil) command-line tool or the [Get-WinEvent](/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-6) cmdlet. +To filter and display or export logs, you can use the [wevtutil.exe](/windows-server/administration/windows-commands/wevtutil) command-line tool or the [Get-WinEvent](/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-6&preserve-view=true) cmdlet. For example, to use wevtutil to export the contents of the operational log from the BitLocker-API folder to a text file that is named BitLockerAPIOpsLog.txt, open a Command Prompt window, and run the following command: @@ -88,11 +88,11 @@ Open an elevated Windows PowerShell window, and run each of the following comman |Command |Notes | | --- | --- | -|[**get-tpm \> C:\\TPM.txt**](/powershell/module/trustedplatformmodule/get-tpm?view=win10-ps) |Exports information about the local computer's Trusted Platform Module (TPM). This cmdlet shows different values depending on whether the TPM chip is version 1.2 or 2.0. This cmdlet is not supported in Windows 7. | +|[**get-tpm \> C:\\TPM.txt**](/powershell/module/trustedplatformmodule/get-tpm?view=win10-ps&preserve-view=true) |Exports information about the local computer's Trusted Platform Module (TPM). This cmdlet shows different values depending on whether the TPM chip is version 1.2 or 2.0. This cmdlet is not supported in Windows 7. | |[**manage-bde –status \> C:\\BDEStatus.txt**](/windows-server/administration/windows-commands/manage-bde-status) |Exports information about the general encryption status of all drives on the computer. | |[**manage-bde c:
        -protectors -get \> C:\\Protectors**](/windows-server/administration/windows-commands/manage-bde-protectors) |Exports information about the protection methods that are used for the BitLocker encryption key. | |[**reagentc /info \> C:\\reagent.txt**](/windows-hardware/manufacture/desktop/reagentc-command-line-options) |Exports information about an online or offline image about the current status of the Windows Recovery Environment (WindowsRE) and any available recovery image. | -|[**get-BitLockerVolume \| fl**](/powershell/module/bitlocker/get-bitlockervolume?view=win10-ps) |Gets information about volumes that BitLocker Drive Encryption can protect. | +|[**get-BitLockerVolume \| fl**](/powershell/module/bitlocker/get-bitlockervolume?view=win10-ps&preserve-view=true) |Gets information about volumes that BitLocker Drive Encryption can protect. | ## Review the configuration information diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md index f2ed14e623..975f5a78cf 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md @@ -2,12 +2,12 @@ title: BitLocker cannot encrypt a drive known issues description: Provides guidance for troubleshooting known issues that may prevent BitLocker Drive Encryption from encrypting a drive ms.reviewer: kaushika -ms.technology: windows -ms.prod: w10 +ms.technology: windows-sec +ms.prod: m365-security ms.sitesec: library ms.localizationpriority: medium author: Teresa-Motiv -ms.author: v-tea +ms.author: v-tappelgate manager: kaushika audience: ITPro ms.collection: Windows Security Technologies\BitLocker diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md index 6aac911b2c..bf8bc4bec3 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md @@ -2,12 +2,12 @@ title: BitLocker cannot encrypt a drive known TPM issues description: Provides guidance for troubleshooting known issues that may prevent BitLocker Drive Encryption from encrypting a drive, and that you can attribute to the TPM ms.reviewer: kaushika -ms.technology: windows -ms.prod: w10 +ms.technology: windows-sec +ms.prod: m365-security ms.sitesec: library ms.localizationpriority: medium author: Teresa-Motiv -ms.author: v-tea +ms.author: v-tappelgate manager: kaushika audience: ITPro ms.collection: Windows Security Technologies\BitLocker diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md index 4142982e69..8694e1f531 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md @@ -2,12 +2,12 @@ title: BitLocker configuration known issues description: Describes common issues that involve your BitLocker configuration and BitLocker's general functionality, and provides guidance for addressing those issues. ms.reviewer: kaushika -ms.technology: windows -ms.prod: w10 +ms.technology: windows-sec +ms.prod: m365-security ms.sitesec: library ms.localizationpriority: medium author: Teresa-Motiv -ms.author: v-tea +ms.author: v-tappelgate manager: kaushika audience: ITPro ms.collection: Windows Security Technologies\BitLocker diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md index 9c0af342bc..101da7a83b 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md @@ -2,12 +2,12 @@ title: Decode Measured Boot logs to track PCR changes description: Provides instructions for installing and using a tool for analyzing log information to identify changes to PCRs ms.reviewer: kaushika -ms.technology: windows -ms.prod: w10 +ms.technology: windows-sec +ms.prod: m365-security ms.sitesec: library ms.localizationpriority: medium author: Teresa-Motiv -ms.author: v-tea +ms.author: v-tappelgate manager: kaushika audience: ITPro ms.collection: Windows Security Technologies\BitLocker diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md index ef9d46fc5b..03d5462401 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md @@ -2,12 +2,12 @@ title: Enforcing BitLocker policies by using Intune known issues description: provides assistance for issues that you may see if you use Microsoft Intune policy to manage silent BitLocker encryption on devices. ms.reviewer: kaushika -ms.technology: windows -ms.prod: w10 +ms.technology: windows-sec +ms.prod: m365-security ms.sitesec: library ms.localizationpriority: medium author: Teresa-Motiv -ms.author: v-tea +ms.author: v-tappelgate manager: kaushika audience: ITPro ms.collection: diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md index 48dacb659a..f5f495064d 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md @@ -2,12 +2,12 @@ title: BitLocker Network Unlock known issues description: Describes several known issues that you may encounter while using Network Unlock, and provided guidance for addressing those issues. ms.reviewer: kaushika -ms.technology: windows -ms.prod: w10 +ms.technology: windows-sec +ms.prod: m365-security ms.sitesec: library ms.localizationpriority: medium author: Teresa-Motiv -ms.author: v-tea +ms.author: v-tappelgate manager: kaushika audience: ITPro ms.collection: Windows Security Technologies\BitLocker diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md index 71b28fa19c..e32e261067 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md @@ -2,12 +2,12 @@ title: BitLocker recovery known issues description: Describes common issues that can occur that prevent BitLocker from behaving as expected when recovering a drive, or may cause BitLocker to start recovery unexpectedly. The article provides guidance for addressing those issues. ms.reviewer: kaushika -ms.technology: windows -ms.prod: w10 +ms.technology: windows-sec +ms.prod: m365-security ms.sitesec: library ms.localizationpriority: medium author: Teresa-Motiv -ms.author: v-tea +ms.author: v-tappelgate manager: kaushika audience: ITPro ms.collection: diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md index 6f05c69982..680cbb7c42 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md @@ -2,12 +2,12 @@ title: BitLocker and TPM other known issues description: Describes common issues that relate directly to the TPM, and provides guidance for resolving those issues. ms.reviewer: kaushika -ms.technology: windows -ms.prod: w10 +ms.technology: windows-sec +ms.prod: m365-security ms.sitesec: library ms.localizationpriority: medium author: Teresa-Motiv -ms.author: v-tea +ms.author: v-tappelgate manager: kaushika audience: ITPro ms.collection: Windows Security Technologies\BitLocker diff --git a/windows/security/information-protection/encrypted-hard-drive.md b/windows/security/information-protection/encrypted-hard-drive.md index 94d231d8f3..9bbeeb2de3 100644 --- a/windows/security/information-protection/encrypted-hard-drive.md +++ b/windows/security/information-protection/encrypted-hard-drive.md @@ -5,7 +5,7 @@ ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.reviewer: manager: dansimp ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/index.md b/windows/security/information-protection/index.md index e72f8d6c68..22875d7dbf 100644 --- a/windows/security/information-protection/index.md +++ b/windows/security/information-protection/index.md @@ -1,7 +1,7 @@ --- title: Information protection (Windows 10) description: Learn more about how to protect sensitive data across your organization. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index 065b6e5f39..5e605bd865 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -1,7 +1,7 @@ --- title: Kernel DMA Protection (Windows) description: Kernel DMA Protection protects PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -54,7 +54,7 @@ By default, peripherals with DMA Remapping incompatible drivers will be blocked ## User experience -![Kernel DMA protection user experience.](images/kernel-dma-protection-user-experience.png) +![Kernel DMA protection user experience](images/kernel-dma-protection-user-experience.png) By default, peripherals with DMA remapping compatible device drivers will be automatically enumerated and started. Peripherals with DMA Remapping incompatible drivers will be blocked from starting if the peripheral was plugged in before an authorized user logs in, or while the screen is locked. Once the system is unlocked, the peripheral driver will be started by the OS, and the peripheral will continue to function normally until the system is rebooted, or the peripheral is unplugged. The peripheral will continue to function normally if the user locks the screen or logs out of the system. @@ -114,11 +114,11 @@ No, Kernel DMA Protection only protects against drive-by DMA attacks after the O DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of two means that the device driver supports DMA-remapping. If the property is not available, then the policy is not set by the device driver (that is, the device driver does not support DMA-remapping). Check the driver instance for the device you are testing. Some drivers may have varying values depending on the location of the device (internal vs. external). -![Kernel DMA protection user experience.](images/device_details_tab_1903.png) +![A user's experience about Kernel DMA protection](images/device_details_tab_1903.png) *For Windows 10 versions 1803 and 1809, the property field in Device Manager uses a GUID, as highlighted in the following image. -![Kernel DMA protection user experience.](images/device-details-tab.png) +![Experience of a user about Kernel DMA protection](images/device-details-tab.png) ### When the drivers for PCI or Thunderbolt™ 3 peripherals do not support DMA-remapping? diff --git a/windows/security/information-protection/secure-the-windows-10-boot-process.md b/windows/security/information-protection/secure-the-windows-10-boot-process.md index de1fb03bea..654ea1271b 100644 --- a/windows/security/information-protection/secure-the-windows-10-boot-process.md +++ b/windows/security/information-protection/secure-the-windows-10-boot-process.md @@ -2,7 +2,7 @@ title: Secure the Windows boot process description: This article describes how Windows security features helps protect your PC from malware, including rootkits and other applications keywords: trusted boot, windows boot process -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: Explore ms.pagetype: security ms.sitesec: library diff --git a/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md b/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md index 9e8fb338ce..5356f4bc2d 100644 --- a/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md +++ b/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md @@ -3,7 +3,7 @@ title: Back up the TPM recovery information to AD DS (Windows) description: This topic for the IT professional describes backup of Trusted Platform Module (TPM) information. ms.assetid: 62bcec80-96a1-464e-8b3f-d177a7565ac5 ms.reviewer: -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/tpm/change-the-tpm-owner-password.md b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md index 143888e0fb..a43a8f75e9 100644 --- a/windows/security/information-protection/tpm/change-the-tpm-owner-password.md +++ b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md @@ -3,7 +3,7 @@ title: Change the TPM owner password (Windows) description: This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system. ms.assetid: e43dcff3-acb4-4a92-8816-d6b64b7f2f45 ms.reviewer: -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,7 +13,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 11/30/2021 +ms.date: 12/03/2021 --- # Change the TPM owner password @@ -30,7 +30,7 @@ This topic for the IT professional describes how to change the password or PIN f Starting with Windows 10, version 1607, or Windows 11, Windows will not retain the TPM owner password when provisioning the TPM. The password will be set to a random high entropy value and then discarded. > [!IMPORTANT] -> Although the TPM owner password is not retained starting with Windows 10, version 1607, or Windows 11, you can change a default registry key to retain it. However, we strongly recommend that you do not make this change. To retain the TPM owner password, set the registry key 'HKLM\\Software\\Policies\\Microsoft\\TPM' \[REG\_DWORD\] 'OSManagedAuthLevel' to 4. The default value for this key is 5, and unless it is changed to 4 before the TPM is provisioned, the owner password will not be saved. +> Although the TPM owner password is not retained starting with Windows 10, version 1607, or Windows 11, you can change a default registry key to retain it. However, we strongly recommend that you do not make this change. To retain the TPM owner password, set the registry key 'HKLM\\Software\\Policies\\Microsoft\\TPM' \[REG\_DWORD\] 'OSManagedAuthLevel' to 4. For Windows 10 versions newer than 1703 the default value for this key is 5. For TPM 2.0, a value of 5 means keep the lockout authorization. For TPM 1.2, it means discard the Full TPM owner authorization and retain only the Delegated authorization. Unless it is changed to 4 before the TPM is provisioned, the owner password will not be saved. Only one owner password exists for each TPM. The TPM owner password allows the ability to enable, disable, or clear the TPM without having physical access to the computer, for example, by using the command-line tools remotely. The TPM owner password also allows manipulation of the TPM dictionary attack logic. Taking ownership of the TPM is performed by Windows as part of the provisioning process on each boot. Ownership can change when you share the password or clear your ownership of the TPM so someone else can initialize it. diff --git a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md index ec318abd87..e12bbc3156 100644 --- a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md +++ b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md @@ -2,7 +2,8 @@ title: How Windows uses the TPM description: This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it to enhance security. ms.assetid: 0f7e779c-bd25-42a8-b8c1-69dfb54d0c7f -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md b/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md index f3e0a5c4f1..a4f56fec1e 100644 --- a/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md @@ -2,7 +2,8 @@ title: Troubleshoot the TPM (Windows) description: This article for the IT professional describes how to view status for, clear, or troubleshoot the Trusted Platform Module (TPM). ms.assetid: 1166efaf-7aa3-4420-9279-435d9c6ac6f8 -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/tpm/manage-tpm-commands.md b/windows/security/information-protection/tpm/manage-tpm-commands.md index e129717503..f998c94a96 100644 --- a/windows/security/information-protection/tpm/manage-tpm-commands.md +++ b/windows/security/information-protection/tpm/manage-tpm-commands.md @@ -3,7 +3,7 @@ title: Manage TPM commands (Windows) description: This topic for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users. ms.assetid: a78e751a-2806-43ae-9c20-2e7ca466b765 ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/tpm/manage-tpm-lockout.md b/windows/security/information-protection/tpm/manage-tpm-lockout.md index fe1fb8255c..814498c4c7 100644 --- a/windows/security/information-protection/tpm/manage-tpm-lockout.md +++ b/windows/security/information-protection/tpm/manage-tpm-lockout.md @@ -4,7 +4,7 @@ description: This topic for the IT professional describes how to manage the lock ms.assetid: bf27adbe-404c-4691-a644-29ec722a3f7b ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md index 5b27a18617..dff3ed5386 100644 --- a/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md +++ b/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md @@ -2,7 +2,8 @@ title: Understanding PCR banks on TPM 2.0 devices (Windows) description: This topic for the IT professional provides background about what happens when you switch PCR banks on TPM 2.0 devices. ms.assetid: 743FCCCB-99A9-4636-8F48-9ECB3A3D10DE -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/tpm/tpm-fundamentals.md b/windows/security/information-protection/tpm/tpm-fundamentals.md index 8eac7c2e01..844153ada6 100644 --- a/windows/security/information-protection/tpm/tpm-fundamentals.md +++ b/windows/security/information-protection/tpm/tpm-fundamentals.md @@ -2,7 +2,8 @@ title: Trusted Platform Module (TPM) fundamentals (Windows) description: Inform yourself about the components of the Trusted Platform Module (TPM 1.2 and TPM 2.0) and how they are used to mitigate dictionary attacks. ms.assetid: ac90f5f9-9a15-4e87-b00d-4adcf2ec3000 -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/tpm/tpm-recommendations.md b/windows/security/information-protection/tpm/tpm-recommendations.md index 8106125dc5..5a343e626c 100644 --- a/windows/security/information-protection/tpm/tpm-recommendations.md +++ b/windows/security/information-protection/tpm/tpm-recommendations.md @@ -2,7 +2,8 @@ title: TPM recommendations (Windows) description: This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows. ms.assetid: E85F11F5-4E6A-43E7-8205-672F77706561 -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/tpm/trusted-platform-module-overview.md b/windows/security/information-protection/tpm/trusted-platform-module-overview.md index 1c188569b7..40d7b72e87 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-overview.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-overview.md @@ -2,7 +2,8 @@ title: Trusted Platform Module Technology Overview (Windows) description: This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. ms.assetid: face8932-b034-4319-86ac-db1163d46538 -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md b/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md index 17056f4135..56600aa23a 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md @@ -2,7 +2,8 @@ title: TPM Group Policy settings (Windows) description: This topic describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. ms.assetid: 54ff1c1e-a210-4074-a44e-58fee26e4dbd -ms.prod: w10 +ms.reviewer: +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/tpm/trusted-platform-module-top-node.md b/windows/security/information-protection/tpm/trusted-platform-module-top-node.md index 426eee0478..c1799559bf 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-top-node.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-top-node.md @@ -1,7 +1,7 @@ --- title: Trusted Platform Module (Windows) description: This topic for the IT professional provides links to information about the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md b/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md index f1bededfaf..e69017b1e0 100644 --- a/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md @@ -2,7 +2,7 @@ title: Unenlightened and enlightened app behavior while using Windows Information Protection (WIP) (Windows 10) description: Learn how unenlightened and enlightened apps might behave, based on Windows Information Protection (WIP) network policies, app configuration, and other criteria keywords: WIP, Enterprise Data Protection, EDP, Windows Information Protection, unenlightened apps, enlightened apps -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security @@ -33,113 +33,27 @@ To avoid the automatic encryption of data, developers can enlighten apps by addi We strongly suggest that the only unenlightened apps you add to your allowed apps list are Line-of-Business (LOB) apps. ->[!IMPORTANT] ->After revoking WIP, unenlightened apps will have to be uninstalled and re-installed since their settings files will remain encrypted. - ->[!Note] ->For more info about creating enlightened apps, see the [Windows Information Protection (WIP)](/windows/uwp/enterprise/wip-hub) topic in the Windows Dev Center. +> [!IMPORTANT] +> After revoking WIP, unenlightened apps will have to be uninstalled and re-installed since their settings files will remain encrypted. For more info about creating enlightened apps, see the [Windows Information Protection (WIP)](/windows/uwp/enterprise/wip-hub) topic in the Windows Dev Center. ## Unenlightened app behavior This table includes info about how unenlightened apps might behave, based on your Windows Information Protection (WIP) networking policies, your app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames. - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        App rule settingNetworking policy configuration
         Name-based policies, without the /*AppCompat*/ stringName-based policies, using the /*AppCompat*/ string or proxy-based policies
        Not required. App connects to enterprise cloud resources directly, using an IP address. -
          -
        • App is entirely blocked from both personal and enterprise cloud resources.
          • -
        • No encryption is applied.
          • -
        • App can’t access local Work files.
          • -
        -         		-
          -
        • App can access both personal and enterprise cloud resources. However, you might encounter apps using policies that restrict access to enterprise cloud resources.
          • -
        • No encryption is applied.
          • -
        • App can’t access local Work files.
          • -
        -
        Not required. App connects to enterprise cloud resources, using a hostname. -
          -
        • App is blocked from accessing enterprise cloud resources, but can access other network resources.
          • -
        • No encryption is applied.
          • -
        • App can’t access local Work files.
          • -
        -
        Allow. App connects to enterprise cloud resources, using an IP address or a hostname. -
          -
        • App can access both personal and enterprise cloud resources.
          • -
        • Auto-encryption is applied.
          • -
        • App can access local Work files.
          • -
        -
        Exempt. App connects to enterprise cloud resources, using an IP address or a hostname. -
          -
        • App can access both personal and enterprise cloud resources.
          • -
        • No encryption is applied.
          • -
        • App can access local Work files.
          • -
        -
        +|App rule setting|Networking policy configuration| +|--- |--- | +|**Not required.** App connects to enterprise cloud resources directly, using an IP address.| **Name-based policies, without the `/*AppCompat*/` string:**
      • App is entirely blocked from both personal and enterprise cloud resources.
      • No encryption is applied.
      • App can’t access local Work files.

        **Name-based policies, using the `/*AppCompat*/` string or proxy-based policies:**
      • App can access both personal and enterprise cloud resources. However, you might encounter apps using policies that restrict access to enterprise cloud resources.
      • No encryption is applied.
      • App can’t access local Work files.| +|**Not required.** App connects to enterprise cloud resources, using a hostname.|
      • App is blocked from accessing enterprise cloud resources, but can access other network resources.
      • No encryption is applied.
      • App can’t access local Work files.| +|**Allow.** App connects to enterprise cloud resources, using an IP address or a hostname.|
      • App can access both personal and enterprise cloud resources.
      • Auto-encryption is applied.
      • App can access local Work files.| +|**Exempt.** App connects to enterprise cloud resources, using an IP address or a hostname.|
      • App can access both personal and enterprise cloud resources.
      • No encryption is applied.
      • App can access local Work files.| ## Enlightened app behavior This table includes info about how enlightened apps might behave, based on your Windows Information Protection (WIP) networking policies, your app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames. - - - - - - - - - - - - - - - - - -
        App rule settingNetworking policy configuration for name-based policies, possibly using the /*AppCompat*/ string, or proxy-based policies
        Not required. App connects to enterprise cloud resources, using an IP address or a hostname. -
          -
        • App is blocked from accessing enterprise cloud resources, but can access other network resources.
          • -
        • No encryption is applied.
          • -
        • App can't access local Work files.
          • -
        -
        Allow. App connects to enterprise cloud resources, using an IP address or a hostname. -
          -
        • App can access both personal and enterprise cloud resources.
          • -
        • App protects work data and leaves personal data unprotected.
          • -
        • App can access local Work files.
          • -
        -
        Exempt. App connects to enterprise cloud resources, using an IP address or a hostname. -
          -
        • App can access both personal and enterprise cloud resources.
          • -
        • App protects work data and leaves personal data unprotected.
          • -
        • App can access local Work files.
          • -
        -
        +|App rule setting|Networking policy configuration for name-based policies, possibly using the /*AppCompat*/ string, or proxy-based policies| +|--- |--- | +|**Not required.** App connects to enterprise cloud resources, using an IP address or a hostname.|
      • App is blocked from accessing enterprise cloud resources, but can access other network resources.
      • No encryption is applied.
      • App can't access local Work files.| +|**Allow.** App connects to enterprise cloud resources, using an IP address or a hostname.|
      • App can access both personal and enterprise cloud resources.
      • App protects work data and leaves personal data unprotected.
      • App can access local Work files.| +|**Exempt.** App connects to enterprise cloud resources, using an IP address or a hostname.|
      • App can access both personal and enterprise cloud resources.
      • App protects work data and leaves personal data unprotected.
      • App can access local Work files.| >[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file +>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). diff --git a/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md b/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md index 680008fcdc..22190edaa2 100644 --- a/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md +++ b/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md @@ -1,7 +1,7 @@ --- title: How to collect Windows Information Protection (WIP) audit event logs (Windows 10) description: How to collect & understand Windows Information Protection audit event logs via the Reporting configuration service provider (CSP) or Windows Event Forwarding. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index 5a5e12feb9..6c878e9d9c 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -2,7 +2,7 @@ title: Make & verify an EFS Data Recovery Agent certificate (Windows 10) description: Follow these steps to create, verify, and perform a quick recovery by using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. keywords: Windows Information Protection, WIP, EDP, Enterprise Data Protection -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md index 909073181d..7d32f0a68b 100644 --- a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md @@ -2,7 +2,7 @@ title: Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune (Windows 10) description: After you've created and deployed your Windows Information Protection (WIP) policy, use Microsoft Intune to link it to your Virtual Private Network (VPN) policy keywords: WIP, Enterprise Data Protection -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md index 32511b9cd5..8a0ecac521 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md @@ -4,7 +4,7 @@ description: Use Configuration Manager to make & deploy a Windows Information Pr ms.assetid: 85b99c20-1319-4aa3-8635-c1a87b244529 ms.reviewer: keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, SCCM, System Center Configuration Manager, Configuration Manager, MEMCM, Microsoft Endpoint Configuration Manager -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security @@ -155,40 +155,15 @@ For this example, we're going to add Internet Explorer, a desktop app, to the ** 5. Pick the options you want to include for the app rule (see table), and then click **OK**. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        OptionManages
        All fields left as "*"All files signed by any publisher. (Not recommended.)
        Publisher selectedAll files signed by the named publisher.

        This might be useful if your company is the publisher and signer of internal line-of-business apps.

        Publisher and Product Name selectedAll files for the specified product, signed by the named publisher.
        Publisher, Product Name, and Binary name selectedAny version of the named file or package for the specified product, signed by the named publisher.
        Publisher, Product Name, Binary name, and File Version, and above, selectedSpecified version or newer releases of the named file or package for the specified product, signed by the named publisher.

        This option is recommended for enlightened apps that weren't previously enlightened.

        Publisher, Product Name, Binary name, and File Version, And below selectedSpecified version or older releases of the named file or package for the specified product, signed by the named publisher.
        Publisher, Product Name, Binary name, and File Version, Exactly selectedSpecified version of the named file or package for the specified product, signed by the named publisher.
        + |Option|Manages| + |--- |--- | + |All fields left as "*"|All files signed by any publisher. (Not recommended.)| + |**Publisher** selected|All files signed by the named publisher.This might be useful if your company is the publisher and signer of internal line-of-business apps.| + |**Publisher** and **Product Name** selected|All files for the specified product, signed by the named publisher.| + |**Publisher**, **Product Name**, and **Binary name** selected|Any version of the named file or package for the specified product, signed by the named publisher.| + |**Publisher**, **Product Name**, **Binary name**, and **File Version, and above**, selected|Specified version or newer releases of the named file or package for the specified product, signed by the named publisher.This option is recommended for enlightened apps that weren't previously enlightened.| + |**Publisher**, **Product Name**, **Binary name**, and **File Version, And below** selected|Specified version or older releases of the named file or package for the specified product, signed by the named publisher.| + |**Publisher**, **Product Name**, **Binary name**, and **File Version, Exactly** selected|Specified version of the named file or package for the specified product, signed by the named publisher.| If you're unsure about what to include for the publisher, you can run this PowerShell command: @@ -374,46 +349,70 @@ There are no default locations included with WIP, you must add each of your netw ![Add or edit corporate network definition box, Add your enterprise network locations.](images/wip-configmgr-add-network-domain.png) - - - - - - - - - - - - - - - - - - - - - - - - -
        - - - - - - - - - - - - - - -
        Network location typeFormatDescription
        Enterprise Cloud ResourcesWith proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
        contoso.visualstudio.com,contoso.internalproxy2.com

        Without proxy: contoso.sharepoint.com|contoso.visualstudio.com

        		Specify the cloud resources to be treated as corporate and protected by WIP.

        For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.

        If you have multiple resources, you must separate them using the "|" delimiter. If you don't use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

        Important
        In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can't tell whether it's attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.

        Enterprise Network Domain Names (Required)corp.contoso.com,region.contoso.comSpecify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.

        This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.

        If you have multiple resources, you must separate them using the "," delimiter.

        Proxy serversproxy.contoso.com:80;proxy2.contoso.com:443Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you're connecting to are enterprise resources.

        This list shouldn't include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic.

        If you have multiple resources, you must separate them using the ";" delimiter.
        Internal proxy serverscontoso.internalproxy1.com;contoso.internalproxy2.comSpecify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you're connecting to are enterprise resources.

        This list shouldn't include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.

        If you have multiple resources, you must separate them using the ";" delimiter.
        Enterprise IPv4 Range (Required)Starting IPv4 Address: 3.4.0.1
        Ending IPv4 Address: 3.4.255.254
        Custom URI: 3.4.0.1-3.4.255.254,
        10.0.0.1-10.255.255.254        		Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

        If you have multiple ranges, you must separate them using the "," delimiter.

        Enterprise IPv6 RangeStarting IPv6 Address: 2a01:110::
        Ending IPv6 Address: 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
        Custom URI: 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
        fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff        		Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

        If you have multiple ranges, you must separate them using the "," delimiter.

        Neutral Resourcessts.contoso.com,sts.contoso2.comSpecify your authentication redirection endpoints for your company.

        These locations are considered enterprise or personal, based on the context of the connection before the redirection.

        If you have multiple resources, you must separate them using the "," delimiter.

        + - **Enterprise Cloud Resources**: Specify the cloud resources to be treated as corporate and protected by WIP. + + For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise. + + If you have multiple resources, you must separate them using the `|` delimiter. If you don't use proxy servers, you must also include the `,` delimiter just before the `|`. For example: URL `<,proxy>|URL <,proxy>`. + + **Format examples**: + + - **With proxy**: `contoso.sharepoint.com,contoso.internalproxy1.com|contoso.visualstudio.com,contoso.internalproxy2.com` + + - **Without proxy**: `contoso.sharepoint.com|contoso.visualstudio.com` + + >[!Important] + > In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can't tell whether it's attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/. + + - **Enterprise Network Domain Names (Required)**: Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. + + This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks. + + If you have multiple resources, you must separate them using the "," delimiter. + + **Format examples**: `corp.contoso.com,region.contoso.com` + + - **Proxy servers**: Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you're connecting to are enterprise resources. + + This list shouldn't include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic. + + If you have multiple resources, you must separate them using the ";" delimiter. + + **Format examples**: `proxy.contoso.com:80;proxy2.contoso.com:443` + + - **Internal proxy servers**: Specify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you're connecting to are enterprise resources. + + This list shouldn't include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic. + + If you have multiple resources, you must separate them using the ";" delimiter. + + **Format examples**: `contoso.internalproxy1.com;contoso.internalproxy2.com` + + - **Enterprise IPv4 Range (Required)**: Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries. + + If you have multiple ranges, you must separate them using the "," delimiter. + + **Format examples**: + + - **Starting IPv4 Address:** `3.4.0.1` + - **Ending IPv4 Address:** `3.4.255.254` + - **Custom URI:** `3.4.0.1-3.4.255.254, 10.0.0.1-10.255.255.254` + + - **Enterprise IPv6 Range**: Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries. + + If you have multiple ranges, you must separate them using the "," delimiter. + + **Format examples**: + + - **Starting IPv6 Address:** `2a01:110::` + - **Ending IPv6 Address:** `2a01:110:7fff:ffff:ffff:ffff:ffff:ffff` + - **Custom URI:** `2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff` + + - **Neutral Resources**: Specify your authentication redirection endpoints for your company. These locations are considered enterprise or personal, based on the context of the connection before the redirection. + + If you have multiple resources, you must separate them using the "," delimiter. + + **Format examples**: `sts.contoso.com,sts.contoso2.com` 3. Add as many locations as you need, and then click **OK**. @@ -485,4 +484,4 @@ After you've created your WIP policy, you'll need to deploy it to your organizat - [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) -- [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) \ No newline at end of file +- [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index 0442c3778a..26b8886645 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -1,7 +1,7 @@ --- title: Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune (Windows 10) description: Learn how to use the Azure portal for Microsoft Intune to create and deploy your Windows Information Protection (WIP) policy to protect data on your network. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security @@ -164,40 +164,15 @@ If you don't know the Store app publisher or product name, you can find them by To add **Desktop apps**, complete the following fields, based on what results you want returned. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        FieldManages
        All fields marked as “*”All files signed by any publisher. (Not recommended and may not work)
        Publisher onlyIf you only fill out this field, you’ll get all files signed by the named publisher.

        This might be useful if your company is the publisher and signer of internal line-of-business apps.
        Publisher and Name onlyIf you only fill out these fields, you’ll get all files for the specified product, signed by the named publisher.
        Publisher, Name, and File onlyIf you only fill out these fields, you’ll get any version of the named file or package for the specified product, signed by the named publisher.
        Publisher, Name, File, and Min version onlyIf you only fill out these fields, you’ll get the specified version or newer releases of the named file or package for the specified product, signed by the named publisher.

        This option is recommended for enlightened apps that weren't previously enlightened.
        Publisher, Name, File, and Max version onlyIf you only fill out these fields, you’ll get the specified version or older releases of the named file or package for the specified product, signed by the named publisher.
        All fields completedIf you fill out all fields, you’ll get the specified version of the named file or package for the specified product, signed by the named publisher.
        +|Field|Manages| +|--- |--- | +|All fields marked as “*”|All files signed by any publisher. (Not recommended and may not work)| +|Publisher only|If you only fill out this field, you’ll get all files signed by the named publisher.This might be useful if your company is the publisher and signer of internal line-of-business apps.| +|Publisher and Name only|If you only fill out these fields, you’ll get all files for the specified product, signed by the named publisher.| +|Publisher, Name, and File only|If you only fill out these fields, you’ll get any version of the named file or package for the specified product, signed by the named publisher.| +|Publisher, Name, File, and Min version only|If you only fill out these fields, you’ll get the specified version or newer releases of the named file or package for the specified product, signed by the named publisher.This option is recommended for enlightened apps that weren't previously enlightened.| +|Publisher, Name, File, and Max version only|If you only fill out these fields, you’ll get the specified version or older releases of the named file or package for the specified product, signed by the named publisher.| +|All fields completed|If you fill out all fields, you’ll get the specified version of the named file or package for the specified product, signed by the named publisher.| To add another Desktop app, click the ellipsis **…**. After you’ve entered the info into the fields, click **OK**. diff --git a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md index 8d929e1db4..1c9ca74eed 100644 --- a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md @@ -2,7 +2,7 @@ title: Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune (Windows 10) description: After you’ve created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices. keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, Intune -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md index 557fa276cb..6551bd495d 100644 --- a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md +++ b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md @@ -4,7 +4,7 @@ description: Learn the difference between enlightened and unenlightened apps. Fi ms.assetid: 17c85ea3-9b66-4b80-b511-8f277cb4345f ms.reviewer: keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md b/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md index bbfa13516c..4abadeccec 100644 --- a/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md +++ b/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md @@ -4,7 +4,7 @@ description: Find resources about apps that can work with Windows Information Pr ms.assetid: aa94e733-53be-49a7-938d-1660deaf52b0 ms.reviewer: keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/windows-information-protection/limitations-with-wip.md b/windows/security/information-protection/windows-information-protection/limitations-with-wip.md index 929975aa97..5462ca7f17 100644 --- a/windows/security/information-protection/windows-information-protection/limitations-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/limitations-with-wip.md @@ -2,7 +2,7 @@ title: Limitations while using Windows Information Protection (WIP) (Windows 10) description: This section includes info about the common problems you might encounter while using Windows Information Protection (WIP). keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security @@ -22,140 +22,134 @@ ms.localizationpriority: medium **Applies to:** - Windows 10, version 1607 and later -This table provides info about the most common problems you might encounter while running WIP in your organization. +This following list provides info about the most common problems you might encounter while running WIP in your organization. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        LimitationHow it appearsWorkaround
        Your enterprise data on USB drives might be tied to the device it was protected on, based on your Azure RMS configuration.If you’re using Azure RMS: Authenticated users can open enterprise data on USB drives, on computers running Windows 10, version 1703.

        If you’re not using Azure RMS: Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text.        		Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited.

        We strongly recommend educating employees about how to limit or eliminate the need for this decryption.
        Direct Access is incompatible with WIP.Direct Access might experience problems with how WIP enforces app behavior and data movement because of how WIP determines what is and isn’t a corporate network resource.We recommend that you use VPN for client access to your intranet resources.

        Note
        VPN is optional and isn’t required by WIP.
        NetworkIsolation Group Policy setting takes precedence over MDM Policy settings.The NetworkIsolation Group Policy setting can configure network settings that can also be configured by using MDM. WIP relies on these policies being correctly configured.If you use both Group Policy and MDM to configure your NetworkIsolation settings, you must make sure that those same settings are deployed to your organization using both Group Policy and MDM.
        Cortana can potentially allow data leakage if it’s on the allowed apps list.If Cortana is on the allowed list, some files might become unexpectedly encrypted after an employee performs a search using Cortana. Your employees will still be able to use Cortana to search and provide results on enterprise documents and locations, but results might be sent to Microsoft.We don’t recommend adding Cortana to your allowed apps list. However, if you wish to use Cortana and don't mind whether the results potentially go to Microsoft, you can make Cortana an Exempt app.
        WIP is designed for use by a single user per device.A secondary user on a device might experience app compatibility issues when unenlightened apps start to automatically encrypt for all users. Additionally, only the initial, enrolled user’s content can be revoked during the unenrollment process.We recommend only having one user per managed device.
        Installers copied from an enterprise network file share might not work properly.An app might fail to properly install because it can’t read a necessary configuration or data file, such as a .cab or .xml file needed for installation, which was protected by the copy action.To fix this, you can: -
          -
        • Start the installer directly from the file share.

          -OR-

          • -
        • Decrypt the locally copied files needed by the installer.

          -OR-

          • -
        • Mark the file share with the installation media as “personal”. To do this, you’ll need to set the Enterprise IP ranges as Authoritative and then exclude the IP address of the file server, or you’ll need to put the file server on the Enterprise Proxy Server list.
          • -
        Changing your primary Corporate Identity isn’t supported.You might experience various instabilities, including but not limited to network and file access failures, and potentially granting incorrect access.Turn off WIP for all devices before changing the primary Corporate Identity (first entry in the list), restarting, and finally redeploying.
        Redirected folders with Client-Side Caching are not compatible with WIP.Apps might encounter access errors while attempting to read a cached, offline file.Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business.

        Note
        For more info about Work Folders and Offline Files, see the blog, Work Folders and Offline Files support for Windows Information Protection. If you're having trouble opening files offline while using Offline Files and WIP, see the support article, Can't open files offline when you use Offline Files and Windows Information Protection.
        An unmanaged device can use Remote Desktop Protocol (RDP) to connect to a WIP-managed device.

        Data copied from the WIP-managed device is marked as Work.

        Data copied to the WIP-managed device is not marked as Work.

        Local Work data copied to the WIP-managed device remains Work data.

        Work data that is copied between two apps in the same session remains data.

        		Disable RDP to prevent access because there is no way to restrict access to only devices managed by WIP. RDP is disabled by default.
        You can't upload an enterprise file to a personal location using Microsoft Edge or Internet Explorer.A message appears stating that the content is marked as Work and the user isn't given an option to override to Personal.Open File Explorer and change the file ownership to Personal before you upload.
        ActiveX controls should be used with caution.Webpages that use ActiveX controls can potentially communicate with other outside processes that aren’t protected by using WIP.We recommend that you switch to using Microsoft Edge, the more secure and safer browser that prevents the use of ActiveX controls. We also recommend that you limit the usage of Internet Explorer 11 to only those line-of-business apps that require legacy technology.

        For more info, see Out-of-date ActiveX control blocking.
        Resilient File System (ReFS) isn't currently supported with WIP.Trying to save or transfer WIP files to ReFS will fail.Format drive for NTFS, or use a different drive.
        WIP isn’t turned on if any of the following folders have the MakeFolderAvailableOfflineDisabled option set to False: -
          -
        • AppDataRoaming
          • -
        • Desktop
          • -
        • StartMenu
          • -
        • Documents
          • -
        • Pictures
          • -
        • Music
          • -
        • Videos
          • -
        • Favorites
          • -
        • Contacts
          • -
        • Downloads
          • -
        • Links
          • -
        • Searches
          • -
        • SavedGames
          • -
        -         		WIP isn’t turned on for employees in your organization. Error code 0x807c0008 will result if WIP is deployed by using Microsoft Endpoint Configuration Manager.Don’t set the MakeFolderAvailableOfflineDisabled option to False for any of the specified folders. You can configure this parameter, as described here.

        If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after WIP is already in place, you might be unable to open your files offline. For more info about these potential access errors, see Can't open files offline when you use Offline Files and Windows Information Protection. -
        Only enlightened apps can be managed without device enrollment - If a user enrolls a device for Mobile Application Management (MAM) without device enrollment, only enlightened apps will be managed. This is by design to prevent personal files from being unintentionally encrypted by unenlighted apps. Unenlighted apps that need to access work using MAM need to be re-compiled as LOB apps or managed by using MDM with device enrollment.If all apps need to be managed, enroll the device for MDM. -
        By design, files in the Windows directory (%windir% or C:/Windows) cannot be encrypted because they need to be accessed by any user. If a file in the Windows directory gets encrypted by one user, other users can't access it.
        		Any attempt to encrypt a file in the Windows directory will return a file access denied error. But if you copy or drag and drop an encrypted file to the Windows directory, it will retain encryption to honor the intent of the owner. - If you need to save an encrypted file in the Windows directory, create and encrypt the file in a different directory and copy it. -
        OneNote notebooks on OneDrive for Business must be properly configured to work with WIP.OneNote might encounter errors syncing a OneDrive for Business notebook and suggest changing the file ownership to Personal. Attempting to view the notebook in OneNote Online in the browser will show an error and unable to view it."OneNote notebooks that are newly copied into the OneDrive for Business folder from File Explorer should get fixed automatically. To do this, follow these steps: -1. Close the notebook in OneNote. -2. Move the notebook folder via File Explorer out of the OneDrive for Business folder to another location, such as the Desktop. -3. Copy the notebook folder and Paste it back into the OneDrive for Business folder. +- **Limitation**: Your enterprise data on USB drives might be tied to the device it was protected on, based on your Azure RMS configuration. + - **How it appears**: + - If you’re using Azure RMS: Authenticated users can open enterprise data on USB drives, on computers running Windows 10, version 1703. + - If you’re not using Azure RMS: Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text. -Wait a few minutes to allow OneDrive to finish syncing & upgrading the notebook, and the folder should automatically convert to an Internet Shortcut. Opening the shortcut will open the notebook in the browser, which can then be opened in the OneNote client by using the “Open in app” button.
        Microsoft Office Outlook offline data files (PST and OST files) are not marked as Work files, and are therefore not protected. - If Microsoft Office Outlook is set to work in cached mode (default setting), or if some emails are stored in a local PST file, the data is unprotected. - It is recommended to use Microsoft Office Outlook in Online mode, or to use encryption to protect OST and PST files manually. -
        + - **Workaround**: Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited. + + We strongly recommend educating employees about how to limit or eliminate the need for this decryption. + +- **Limitation**: Direct Access is incompatible with WIP. + - **How it appears**: Direct Access might experience problems with how WIP enforces app behavior and data movement because of how WIP determines what is and isn’t a corporate network resource. + - **Workaround**: We recommend that you use VPN for client access to your intranet resources. + + > [!NOTE] + > VPN is optional and isn’t required by WIP. + +- **Limitation**: **NetworkIsolation** Group Policy setting takes precedence over MDM Policy settings. + - **How it appears**: The **NetworkIsolation** Group Policy setting can configure network settings that can also be configured by using MDM. WIP relies on these policies being correctly configured. + - **Workaround**: If you use both Group Policy and MDM to configure your **NetworkIsolation** settings, you must make sure that those same settings are deployed to your organization using both Group Policy and MDM. + +- **Limitation**: Cortana can potentially allow data leakage if it’s on the allowed apps list. + - **How it appears**: If Cortana is on the allowed list, some files might become unexpectedly encrypted after an employee performs a search using Cortana. Your employees will still be able to use Cortana to search and provide results on enterprise documents and locations, but results might be sent to Microsoft. + - **Workaround**: We don’t recommend adding Cortana to your allowed apps list. However, if you wish to use Cortana and don't mind whether the results potentially go to Microsoft, you can make Cortana an Exempt app. + +- **Limitation**: WIP is designed for use by a single user per device. + - **How it appears**: A secondary user on a device might experience app compatibility issues when unenlightened apps start to automatically encrypt for all users. Additionally, only the initial, enrolled user’s content can be revoked during the unenrollment process. + - **Workaround**: We recommend only having one user per managed device. + +- **Limitation**: Installers copied from an enterprise network file share might not work properly. + - **How it appears**: An app might fail to properly install because it can’t read a necessary configuration or data file, such as a .cab or .xml file needed for installation, which was protected by the copy action. + - **Workaround**: To fix this, you can: + - Start the installer directly from the file share. + + OR + + - Decrypt the locally copied files needed by the installer. + + OR + + - Mark the file share with the installation media as “personal”. To do this, you’ll need to set the Enterprise IP ranges as **Authoritative** and then exclude the IP address of the file server, or you’ll need to put the file server on the Enterprise Proxy Server list. + +- **Limitation**: Changing your primary Corporate Identity isn’t supported. + - **How it appears**: You might experience various instabilities, including but not limited to network and file access failures, and potentially granting incorrect access. + - **Workaround**: Turn off WIP for all devices before changing the primary Corporate Identity (first entry in the list), restarting, and finally redeploying. + +- **Limitation**: Redirected folders with Client-Side Caching are not compatible with WIP. + - **How it appears**: Apps might encounter access errors while attempting to read a cached, offline file. + - **Workaround**: Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business. + + > [!NOTE] + > For more info about Work Folders and Offline Files, see the [Work Folders and Offline Files support for Windows Information Protection blog](https://blogs.technet.microsoft.com/filecab/2016/08/29/work-folders-and-offline-files-support-for-windows-information-protection/). If you're having trouble opening files offline while using Offline Files and WIP, see [Can't open files offline when you use Offline Files and Windows Information Protection](/troubleshoot/windows-client/networking/error-open-files-offline-offline-files-wip). + +- **Limitation**: An unmanaged device can use Remote Desktop Protocol (RDP) to connect to a WIP-managed device. + - **How it appears**: + - Data copied from the WIP-managed device is marked as **Work**. + - Data copied to the WIP-managed device is not marked as **Work**. + - Local **Work** data copied to the WIP-managed device remains **Work** data. + - **Work** data that is copied between two apps in the same session remains ** data. + + - **Workaround**: Disable RDP to prevent access because there is no way to restrict access to only devices managed by WIP. RDP is disabled by default. + +- **Limitation**: You can't upload an enterprise file to a personal location using Microsoft Edge or Internet Explorer. + - **How it appears**: A message appears stating that the content is marked as **Work** and the user isn't given an option to override to **Personal**. + - **Workaround**: Open File Explorer and change the file ownership to **Personal** before you upload. + +- **Limitation**: ActiveX controls should be used with caution. + - **How it appears**: Webpages that use ActiveX controls can potentially communicate with other outside processes that aren’t protected by using WIP. + - **Workaround**: We recommend that you switch to using Microsoft Edge, the more secure and safer browser that prevents the use of ActiveX controls. We also recommend that you limit the usage of Internet Explorer 11 to only those line-of-business apps that require legacy technology. + + For more info, see [Out-of-date ActiveX control blocking](/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking). + +- **Limitation**: Resilient File System (ReFS) isn't currently supported with WIP. + - **How it appears**:Trying to save or transfer WIP files to ReFS will fail. + - **Workaround**: Format drive for NTFS, or use a different drive. + +- **Limitation**: WIP isn’t turned on if any of the following folders have the **MakeFolderAvailableOfflineDisabled** option set to **False**: + - AppDataRoaming + - Desktop + - StartMenu + - Documents + - Pictures + - Music + - Videos + - Favorites + - Contacts + - Downloads + - Links + - Searches + - SavedGames + +
        + + - **How it appears**: WIP isn’t turned on for employees in your organization. Error code 0x807c0008 will result if WIP is deployed by using Microsoft Endpoint Configuration Manager. + - **Workaround**: Don’t set the **MakeFolderAvailableOfflineDisabled** option to **False** for any of the specified folders. You can configure this parameter, as described [Disable Offline Files on individual redirected folders](/windows-server/storage/folder-redirection/disable-offline-files-on-folders). + + If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after WIP is already in place, you might be unable to open your files offline. + + For more info about these potential access errors, see [Can't open files offline when you use Offline Files and Windows Information Protection](/troubleshoot/windows-client/networking/error-open-files-offline-offline-files-wip). + +- **Limitation**: Only enlightened apps can be managed without device enrollment + - **How it appears**: If a user enrolls a device for Mobile Application Management (MAM) without device enrollment, only enlightened apps will be managed. This is by design to prevent personal files from being unintentionally encrypted by unenlighted apps. + + Unenlighted apps that need to access work using MAM need to be re-compiled as LOB apps or managed by using MDM with device enrollment. + + - **Workaround**: If all apps need to be managed, enroll the device for MDM. + +- **Limitation**: By design, files in the Windows directory (%windir% or C:/Windows) cannot be encrypted because they need to be accessed by any user. If a file in the Windows directory gets encrypted by one user, other users can't access it. + - **How it appears**: Any attempt to encrypt a file in the Windows directory will return a file access denied error. But if you copy or drag and drop an encrypted file to the Windows directory, it will retain encryption to honor the intent of the owner. + - **Workaround**: If you need to save an encrypted file in the Windows directory, create and encrypt the file in a different directory and copy it. + +- **Limitation**: OneNote notebooks on OneDrive for Business must be properly configured to work with WIP. + - **How it appears**: OneNote might encounter errors syncing a OneDrive for Business notebook and suggest changing the file ownership to Personal. Attempting to view the notebook in OneNote Online in the browser will show an error and unable to view it. + - **Workaround**: OneNote notebooks that are newly copied into the OneDrive for Business folder from File Explorer should get fixed automatically. To do this, follow these steps: + + 1. Close the notebook in OneNote. + 2. Move the notebook folder via File Explorer out of the OneDrive for Business folder to another location, such as the Desktop. + 3. Copy the notebook folder and Paste it back into the OneDrive for Business folder. + + Wait a few minutes to allow OneDrive to finish syncing & upgrading the notebook, and the folder should automatically convert to an Internet Shortcut. Opening the shortcut will open the notebook in the browser, which can then be opened in the OneNote client by using the “Open in app” button. + +- **Limitation**: Microsoft Office Outlook offline data files (PST and OST files) are not marked as **Work** files, and are therefore not protected. + - **How it appears**: If Microsoft Office Outlook is set to work in cached mode (default setting), or if some emails are stored in a local PST file, the data is unprotected. + - **Workaround**: It is recommended to use Microsoft Office Outlook in Online mode, or to use encryption to protect OST and PST files manually. > [!NOTE] -> When corporate data is written to disk, WIP uses the Windows-provided Encrypting File System (EFS) to protect it and associate it with your enterprise identity. One caveat to keep in mind is that the Preview Pane in File Explorer will not work for encrypted files. - - - - -> [!NOTE] -> Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to our content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file +> +> - When corporate data is written to disk, WIP uses the Windows-provided Encrypting File System (EFS) to protect it and associate it with your enterprise identity. One caveat to keep in mind is that the Preview Pane in File Explorer will not work for encrypted files. +> +> - Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to our content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). diff --git a/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md b/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md index 5114046477..1d28851374 100644 --- a/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md @@ -2,7 +2,7 @@ title: Mandatory tasks and settings required to turn on Windows Information Protection (WIP) (Windows 10) description: Review all of the tasks required for Windows to turn on Windows Information Protection (WIP), formerly enterprise data protection (EDP), in your enterprise. keywords: Windows Information Protection, WIP, EDP, Enterprise Data Protection, protected apps, protected app list, App Rules, Protected apps list -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md index 419f25c61c..6f0d4796b6 100644 --- a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md +++ b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md @@ -3,7 +3,7 @@ title: Create a Windows Information Protection (WIP) policy using Microsoft Endp description: Microsoft Endpoint Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 ms.reviewer: -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md index 42f746faba..238400ed86 100644 --- a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md +++ b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md @@ -3,7 +3,7 @@ title: Create a Windows Information Protection (WIP) policy using Microsoft Intu description: Microsoft Intune and Microsoft Endpoint Manager helps you create and deploy your enterprise data protection (WIP) policy. ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 ms.reviewer: -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md b/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md index 624bef6fa2..ec997e526a 100644 --- a/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md +++ b/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md @@ -3,7 +3,7 @@ title: Protect your enterprise data using Windows Information Protection (WIP) ( description: Learn how to prevent accidental enterprise data leaks through apps and services, such as email, social media, and the public cloud. ms.assetid: 6cca0119-5954-4757-b2bc-e0ea4d2c7032 keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, DLP, data loss prevention, data leakage protection -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md b/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md index 69b104f1b4..254e5b85bc 100644 --- a/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md @@ -2,7 +2,7 @@ title: Recommended URLs for Windows Information Protection (Windows 10) description: Recommended URLs to add to your Enterprise Cloud Resources and Neutral Resources network settings, when used with Windows Information Protection (WIP). keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Neutral Resources, WIP and Enterprise Cloud Resources -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md b/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md index c2b7cb2188..247a47ecf5 100644 --- a/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md @@ -4,7 +4,7 @@ description: A list of suggested testing scenarios that you can use to test Wind ms.assetid: 53db29d2-d99d-4db6-b494-90e2b3962ca2 ms.reviewer: keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security @@ -31,141 +31,128 @@ You can try any of the processes included in these scenarios, but you should foc >[!IMPORTANT] >If any of these scenarios does not work, first take note of whether WIP has been revoked. If it has, unenlightened apps will have to be uninstalled and re-installed since their settings files will remain encrypted. - - - - - - - - - - - -
        - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        ScenarioProcesses
        Encrypt and decrypt files using File Explorer.For desktop:

        -
          -
        1. Open File Explorer, right-click a work document, and then click Work from the File Ownership menu.
          Make sure the file is encrypted by right-clicking the file again, clicking Advanced from the General tab, and then clicking Details from the Compress or Encrypt attributes area. The file should show up under the heading, This enterprise domain can remove or revoke access: <your_enterprise_identity>. For example, contoso.com.
          2. -
        2. In File Explorer, right-click the same document, and then click Personal from the File Ownership menu.
          Make sure the file is decrypted by right-clicking the file again, clicking Advanced from the General tab, and then verifying that the Details button is unavailable.
          3. -
        - For mobile:

        -
          -
        1. Open the File Explorer app, browse to a file location, click the elipsis (...), and then click Select to mark at least one file as work-related.
          2. -
        2. Click the elipsis (...) again, click File ownership from the drop down menu, and then click Work.
          Make sure the file is encrypted, by locating the Briefcase icon next to the file name.
          3. -
        3. Select the same file, click File ownership from the drop down menu, and then click Personal.
          Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.
          4. -
        -
        Create work documents in enterprise-allowed apps.For desktop:

        - - For mobile:

        -
          -
        1. Start an allowed mobile app, such as Word Mobile, create a new document, and then save your changes as Work to a local, work-related location.
          Make sure the document is encrypted, by locating the Briefcase icon next to the file name.
          2. -
        2. Open the same document and attempt to save it to a non-work-related location.
          WIP should stop you from saving the file to this location.
          3. -
        3. Open the same document one last time, make a change to the contents, and then save it again using the Personal option.
          Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.
          4. -
        -
        Block enterprise data from non-enterprise apps. -
          -
        1. Start an app that doesn't appear on your allowed apps list, and then try to open a work-encrypted file.
          The app shouldn't be able to access the file.
          2. -
        2. Try double-clicking or tapping on the work-encrypted file.
          If your default app association is an app not on your allowed apps list, you should get an Access Denied error message.
          3. -
        -
        Copy and paste from enterprise apps to non-enterprise apps. -
          -
        1. Copy (CTRL+C) content from an app on your allowed apps list, and then try to paste (CTRL+V) the content into an app that doesn't appear on your allowed apps list.
          You should see a WIP-related warning box, asking you to click either Change to personal or Keep at work.
          2. -
        2. Click Keep at work.
          The content isn't pasted into the non-enterprise app.
          3. -
        3. Repeat Step 1, but this time click Change to personal, and try to paste the content again.
          The content is pasted into the non-enterprise app.
          4. -
        4. Try copying and pasting content between apps on your allowed apps list.
          The content should copy and paste between apps without any warning messages.
          5. -
        -
        Drag and drop from enterprise apps to non-enterprise apps. -
          -
        1. Drag content from an app on your allowed apps list, and then try to drop the content into an app that doesn't appear on your allowed apps list.
          You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
          2. -
        2. Click Keep at work.
          The content isn't dropped into the non-enterprise app.
          3. -
        3. Repeat Step 1, but this time click Change to personal, and try to drop the content again.
          The content is dropped into the non-enterprise app.
          4. -
        4. Try dragging and dropping content between apps on your allowed apps list.
          The content should move between the apps without any warning messages.
          5. -
        -
        Share between enterprise apps and non-enterprise apps. -
          -
        1. Open an app on your allowed apps list, like Microsoft Photos, and try to share content with an app that doesn't appear on your allowed apps list, like Facebook.
          You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
          2. -
        2. Click Keep at work.
          The content isn't shared into Facebook.
          3. -
        3. Repeat Step 1, but this time click Change to personal, and try to share the content again.
          The content is shared into Facebook.
          4. -
        4. Try sharing content between apps on your allowed apps list.
          The content should share between the apps without any warning messages.
          5. -
        -
        Verify that Windows system components can use WIP. -
          -
        1. Start Windows Journal and Internet Explorer 11, creating, editing, and saving files in both apps.
          Make sure that all of the files you worked with are encrypted to your configured Enterprise Identity. In some cases, you might need to close the file and wait a few moments for it to be automatically encrypted.
          2. -
        2. Open File Explorer and make sure your modified files are appearing with a Lock icon.
          3. -
        3. Try copying and pasting, dragging and dropping, and sharing using these apps with other apps that appear both on and off the allowed apps list.

          Note
          Most Windows-signed components like File Explorer (when running in the user's context), should have access to enterprise data.

          A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your allowed apps list.
          4. -
        -
        Use WIP on NTFS, FAT, and exFAT systems. -
          -
        1. Start an app that uses the FAT or exFAT file system (for example a SD card or USB flash drive), and appears on your allowed apps list.
          2. -
        2. Create, edit, write, save, copy, and move files.
          Basic file and folder operations like copy, move, rename, delete, and so on, should work properly on encrypted files.
          3. -
        -
        Verify your shared files can use WIP. -
          -
        1. Download a file from a protected file share, making sure the file is encrypted by locating the Briefcase icon next to the file name.
          2. -
        2. Open the same file, make a change, save it and then try to upload it back to the file share. Again, this should work without any warnings.
          3. -
        3. Open an app that doesn't appear on your allowed apps list and attempt to access a file on the WIP-enabled file share.
          The app shouldn't be able to access the file share.
          4. -
        -
        Verify your cloud resources can use WIP. -
          -
        1. Add both Internet Explorer 11 and Microsoft Edge to your allowed apps list.
          2. -
        2. Open SharePoint (or another cloud resource that's part of your policy) and access a WIP-enabled resource by using both IE11 and Microsoft Edge.
          Both browsers should respect the enterprise and personal boundary.
          3. -
        3. Remove Internet Explorer 11 from your allowed app list and then try to access an intranet site or enterprise-related cloud resource.
          IE11 shouldn't be able to access the sites.

          Note
          Any file downloaded from your work SharePoint site, or any other WIP-enabled cloud resource, is automatically marked as Work.
          4. -
        -
        Verify your Virtual Private Network (VPN) can be auto-triggered. -
          -
        1. Set up your VPN network to start based on the WIPModeID setting.
          For specific info about how to do this, see the Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune topic.
          2. -
        2. Start an app from your allowed apps list.
          The VPN network should automatically start.
          3. -
        3. Disconnect from your network and then start an app that isn't on your allowed apps list.
          The VPN shouldn't start and the app shouldn't be able to access your enterprise network.
          4. -
        -
        Unenroll client devices from WIP. -
          -
        • Unenroll a device from WIP by going to Settings, click Accounts, click Work, click the name of the device you want to unenroll, and then click Remove.
          The device should be removed and all of the enterprise content for that managed account should be gone.

          Important
          On desktop devices, the data isn't removed and can be recovered, so you must make sure the content is marked as Revoked and that access is denied for the employee. On mobile devices, the data is removed.
          • -
        -
        +- **Encrypt and decrypt files using File Explorer**: + + 1. Open File Explorer, right-click a work document, and then click **Work** from the **File Ownership** menu. + + Make sure the file is encrypted by right-clicking the file again, clicking **Advanced** from the **General** tab, and then clicking **Details** from the **Compress or Encrypt attributes** area. The file should show up under the heading, **This enterprise domain can remove or revoke access:** `**`. For example, `contoso.com`. + + 2. In File Explorer, right-click the same document, and then click **Personal** from the **File Ownership** menu. + + Make sure the file is decrypted by right-clicking the file again, clicking **Advanced** from the **General** tab, and then verifying that the **Details** button is unavailable. + +- **Create work documents in enterprise-allowed apps**: Start an unenlightened but allowed app, such as a line-of-business app, and then create a new document, saving your changes. + + Make sure the document is encrypted to your Enterprise Identity. This might take a few minutes and require you to close and re-open the file. + + > [!IMPORTANT] + > Certain file types like `.exe` and `.dll`, along with certain file paths, such as `%windir%` and `%programfiles%` are excluded from automatic encryption. + + For more info about your Enterprise Identity and adding apps to your allowed apps list, see either [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune-azure.md) or [Create a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager](create-wip-policy-using-configmgr.md), based on your deployment system. + +- **Block enterprise data from non-enterprise apps**: + + 1. Start an app that doesn't appear on your allowed apps list, and then try to open a work-encrypted file. + + The app shouldn't be able to access the file. + + 2. Try double-clicking or tapping on the work-encrypted file. If your default app association is an app not on your allowed apps list, you should get an **Access Denied** error message. + +- **Copy and paste from enterprise apps to non-enterprise apps**: + + 1. Copy (CTRL+C) content from an app on your allowed apps list, and then try to paste (CTRL+V) the content into an app that doesn't appear on your allowed apps list. + + You should see a WIP-related warning box, asking you to click either **Change to personal** or **Keep at work**. + + 2. Click **Keep at work**. The content isn't pasted into the non-enterprise app. + 3. Repeat Step 1, but this time click **Change to personal**, and try to paste the content again. + + The content is pasted into the non-enterprise app. + + 4. Try copying and pasting content between apps on your allowed apps list. The content should copy and paste between apps without any warning messages. + +- **Drag and drop from enterprise apps to non-enterprise apps**: + + 1. Drag content from an app on your allowed apps list, and then try to drop the content into an app that doesn't appear on your allowed apps list. + + You should see a WIP-related warning box, asking you to click either **Keep at work** or **Change to personal**. + + 2. Click **Keep at work**. The content isn't dropped into the non-enterprise app. + 3. Repeat Step 1, but this time click **Change to personal**, and try to drop the content again. + + The content is dropped into the non-enterprise app. + + 4. Try dragging and dropping content between apps on your allowed apps list. The content should move between the apps without any warning messages. + +- **Share between enterprise apps and non-enterprise apps**: + + 1. Open an app on your allowed apps list, like Microsoft Photos, and try to share content with an app that doesn't appear on your allowed apps list, like Facebook. + + You should see a WIP-related warning box, asking you to click either **Keep at work** or **Change to personal**. + + 2. Click **Keep at work**. The content isn't shared into Facebook. + 3. Repeat Step 1, but this time click **Change to personal**, and try to share the content again. + + The content is shared into Facebook. + + 4. Try sharing content between apps on your allowed apps list. The content should share between the apps without any warning messages. + +- **Verify that Windows system components can use WIP**: + + 1. Start Windows Journal and Internet Explorer 11, creating, editing, and saving files in both apps. + + Make sure that all of the files you worked with are encrypted to your configured Enterprise Identity. In some cases, you might need to close the file and wait a few moments for it to be automatically encrypted. + + 2. Open File Explorer and make sure your modified files are appearing with a **Lock** icon. + 3. Try copying and pasting, dragging and dropping, and sharing using these apps with other apps that appear both on and off the allowed apps list. + + > [!NOTE] + > Most Windows-signed components like File Explorer (when running in the user's context), should have access to enterprise data. + > + > A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your allowed apps list. + +- **Use WIP on NTFS, FAT, and exFAT systems**: + + 1. Start an app that uses the FAT or exFAT file system (for example a SD card or USB flash drive), and appears on your allowed apps list. + 2. Create, edit, write, save, copy, and move files. Basic file and folder operations like copy, move, rename, delete, and so on, should work properly on encrypted files. + +- **Verify your shared files can use WIP**: + + 1. Download a file from a protected file share, making sure the file is encrypted by locating the **Briefcase** icon next to the file name. + 2. Open the same file, make a change, save it and then try to upload it back to the file share. Again, this should work without any warnings. + 3. Open an app that doesn't appear on your allowed apps list and attempt to access a file on the WIP-enabled file share. + + The app shouldn't be able to access the file share. + +- **Verify your cloud resources can use WIP**: + + 1. Add both Internet Explorer 11 and Microsoft Edge to your allowed apps list. + 2. Open SharePoint (or another cloud resource that's part of your policy) and access a WIP-enabled resource by using both IE11 and Microsoft Edge. + + Both browsers should respect the enterprise and personal boundary. + + 3. Remove Internet Explorer 11 from your allowed app list and then try to access an intranet site or enterprise-related cloud resource. + + IE11 shouldn't be able to access the sites. + + > [!NOTE] + > Any file downloaded from your work SharePoint site, or any other WIP-enabled cloud resource, is automatically marked as **Work**. + +- **Verify your Virtual Private Network (VPN) can be auto-triggered**: + + 1. Set up your VPN network to start based on the **WIPModeID** setting. For specific info, see [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](create-vpn-and-wip-policy-using-intune-azure.md). + 2. Start an app from your allowed apps list. The VPN network should automatically start. + 3. Disconnect from your network and then start an app that isn't on your allowed apps list. + + The VPN shouldn't start and the app shouldn't be able to access your enterprise network. + +- **Unenroll client devices from WIP**: Unenroll a device from WIP by going to **Settings**, click **Accounts**, click **Work**, click the name of the device you want to unenroll, and then click **Remove**. + + The device should be removed and all of the enterprise content for that managed account should be gone. + + > [!IMPORTANT] + > On client devices, the data isn't removed and can be recovered. So, you must make sure the content is marked as **Revoked** and that access is denied for the employee. + >[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). +>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). diff --git a/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md b/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md index c7caa873dc..1b6f9a67bd 100644 --- a/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md @@ -2,7 +2,7 @@ title: Using Outlook on the web with WIP (Windows 10) description: Options for using Outlook on the web with Windows Information Protection (WIP). keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and OWA configuration, OWA, Outlook Web access -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md index dd3fb2529e..4a5b35da13 100644 --- a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md +++ b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md @@ -2,7 +2,7 @@ title: Determine the Enterprise Context of an app running in Windows Information Protection (WIP) (Windows 10) description: Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Task Manager, app context, enterprise context -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security diff --git a/windows/security/information-protection/windows-information-protection/wip-learning.md b/windows/security/information-protection/windows-information-protection/wip-learning.md index e2f9ce0a1f..65aaeda64c 100644 --- a/windows/security/information-protection/windows-information-protection/wip-learning.md +++ b/windows/security/information-protection/windows-information-protection/wip-learning.md @@ -4,7 +4,7 @@ description: How to access the WIP Learning report to monitor and apply Windows ms.assetid: 53db29d2-d99d-4db6-b494-90e2b4872ca2 ms.reviewer: keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP Learning -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: ms.sitesec: library ms.pagetype: security diff --git a/windows/security/threat-protection/auditing/audit-registry.md b/windows/security/threat-protection/auditing/audit-registry.md index 3c6407d9f5..6ab435279c 100644 --- a/windows/security/threat-protection/auditing/audit-registry.md +++ b/windows/security/threat-protection/auditing/audit-registry.md @@ -44,4 +44,8 @@ If success auditing is enabled, an audit entry is generated each time any accoun - [5039](event-5039.md)(-): A registry key was virtualized. -- [4670](event-4670.md)(S): Permissions on an object were changed. \ No newline at end of file +- [4670](event-4670.md)(S): Permissions on an object were changed. + +> [!NOTE] +> On creating a subkey for a parent, the expectation is to see a 4656 event for the newly created subkey. You will see this event only when "Audit Object Access" is enabled under **Local Policies** > **Audit Policy** in Local Security Policy. This event is not generated while using advanced audit policy configurations for registry specific events, such as using "auditpol.exe /set /subcategory:{0CCE921E-69AE-11D9-BED3-505054503030} /success:enable". While using regedit.exe for creating subkeys you will see an additional 4663 event because you perform NtEnumerateKeys on the newly created subkey. You might additionally see a 4663 event on the newly created key if you try to rename the subkey. While using reg.exe for creating subkeys you'll see an additional 4663 event because you perform NtSetValueKey on the newly created subkey. We recommend not relying on 4663 events for subkey creation as they are dependent on the type of permissions enabled on the parent and are not consistent across regedit.exe and reg.exe. + diff --git a/windows/security/threat-protection/auditing/basic-audit-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-logon-events.md index 01b1068234..c0be497365 100644 --- a/windows/security/threat-protection/auditing/basic-audit-logon-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-logon-events.md @@ -45,7 +45,7 @@ You can configure this security setting by opening the appropriate policy under | 4779 | A user disconnected a terminal server session without logging off. | -When event 528 is logged, a logon type is also listed in the event log. The following table describes each logon type. +When event 4624 (Legacy Windows Event ID 528) is logged, a logon type is also listed in the event log. The following table describes each logon type. | Logon type | Logon title | Description | | - | - | - | diff --git a/windows/security/threat-protection/auditing/event-1102.md b/windows/security/threat-protection/auditing/event-1102.md index 51ff35f0c9..d21241558c 100644 --- a/windows/security/threat-protection/auditing/event-1102.md +++ b/windows/security/threat-protection/auditing/event-1102.md @@ -84,7 +84,7 @@ This event generates every time Windows Security audit log was cleared. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4611.md b/windows/security/threat-protection/auditing/event-4611.md index fe6ba0faa7..503c8d0da2 100644 --- a/windows/security/threat-protection/auditing/event-4611.md +++ b/windows/security/threat-protection/auditing/event-4611.md @@ -89,7 +89,7 @@ You typically see these events during operating system startup or user logon and - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4616.md b/windows/security/threat-protection/auditing/event-4616.md index 4e13fb8824..34c71e2c56 100644 --- a/windows/security/threat-protection/auditing/event-4616.md +++ b/windows/security/threat-protection/auditing/event-4616.md @@ -98,7 +98,7 @@ You will typically see these events with “**Subject\\Security ID**” = “**L - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md index 985c5b0e59..38faea78d6 100644 --- a/windows/security/threat-protection/auditing/event-4624.md +++ b/windows/security/threat-protection/auditing/event-4624.md @@ -132,7 +132,7 @@ This event generates when a logon session is created (on destination machine). I - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY". + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY". - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: "Win81". @@ -196,7 +196,7 @@ This event generates when a logon session is created (on destination machine). I - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY". + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY". - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: "Win81". diff --git a/windows/security/threat-protection/auditing/event-4625.md b/windows/security/threat-protection/auditing/event-4625.md index 9f97418b4d..61e190ba1a 100644 --- a/windows/security/threat-protection/auditing/event-4625.md +++ b/windows/security/threat-protection/auditing/event-4625.md @@ -104,7 +104,7 @@ This event generates on domain controllers, member servers, and workstations. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. @@ -143,7 +143,7 @@ This event generates on domain controllers, member servers, and workstations. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4626.md b/windows/security/threat-protection/auditing/event-4626.md index be7bf13b02..cc5ab9874a 100644 --- a/windows/security/threat-protection/auditing/event-4626.md +++ b/windows/security/threat-protection/auditing/event-4626.md @@ -98,7 +98,7 @@ This event generates on the computer to which the logon was performed (target co - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. @@ -134,7 +134,7 @@ This event generates on the computer to which the logon was performed (target co - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4627.md b/windows/security/threat-protection/auditing/event-4627.md index b484de7d2d..b050838a58 100644 --- a/windows/security/threat-protection/auditing/event-4627.md +++ b/windows/security/threat-protection/auditing/event-4627.md @@ -97,7 +97,7 @@ Multiple events are generated if the group membership information cannot fit in - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. @@ -134,7 +134,7 @@ Multiple events are generated if the group membership information cannot fit in - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4634.md b/windows/security/threat-protection/auditing/event-4634.md index 71887eccc4..27f923aeaa 100644 --- a/windows/security/threat-protection/auditing/event-4634.md +++ b/windows/security/threat-protection/auditing/event-4634.md @@ -89,7 +89,7 @@ It may be positively correlated with a “[4624](event-4624.md): An account was - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4647.md b/windows/security/threat-protection/auditing/event-4647.md index b30de5ea3f..eabd7698b9 100644 --- a/windows/security/threat-protection/auditing/event-4647.md +++ b/windows/security/threat-protection/auditing/event-4647.md @@ -88,7 +88,7 @@ It may be positively correlated with a “[4624](event-4624.md): An account was - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4648.md b/windows/security/threat-protection/auditing/event-4648.md index 7f4517f3d0..04e69119ac 100644 --- a/windows/security/threat-protection/auditing/event-4648.md +++ b/windows/security/threat-protection/auditing/event-4648.md @@ -96,7 +96,7 @@ It is also a routine event which periodically occurs during normal operating sys - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. @@ -122,7 +122,7 @@ It is also a routine event which periodically occurs during normal operating sys - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4656.md b/windows/security/threat-protection/auditing/event-4656.md index 4da92be0ed..7f9dd2557b 100644 --- a/windows/security/threat-protection/auditing/event-4656.md +++ b/windows/security/threat-protection/auditing/event-4656.md @@ -107,7 +107,7 @@ This event shows that access was requested, and the results of the request, but - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4657.md b/windows/security/threat-protection/auditing/event-4657.md index 9e788eb845..7c8a7b6c54 100644 --- a/windows/security/threat-protection/auditing/event-4657.md +++ b/windows/security/threat-protection/auditing/event-4657.md @@ -94,7 +94,7 @@ This event generates only if “Set Value" auditing is set in registry key’s [ - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4658.md b/windows/security/threat-protection/auditing/event-4658.md index 8f88502248..957b595d7d 100644 --- a/windows/security/threat-protection/auditing/event-4658.md +++ b/windows/security/threat-protection/auditing/event-4658.md @@ -90,7 +90,7 @@ Typically this event is needed if you need to know how long the handle to the ob - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4660.md b/windows/security/threat-protection/auditing/event-4660.md index 0be89f17f1..7fa92fc68e 100644 --- a/windows/security/threat-protection/auditing/event-4660.md +++ b/windows/security/threat-protection/auditing/event-4660.md @@ -93,7 +93,7 @@ The advantage of this event is that it’s generated only during real delete ope - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4661.md b/windows/security/threat-protection/auditing/event-4661.md index 2485aae2b6..a254ab803c 100644 --- a/windows/security/threat-protection/auditing/event-4661.md +++ b/windows/security/threat-protection/auditing/event-4661.md @@ -97,7 +97,7 @@ This event generates only if Success auditing is enabled for the [Audit Handle M - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4662.md b/windows/security/threat-protection/auditing/event-4662.md index 5e9f6832a9..ab5968f778 100644 --- a/windows/security/threat-protection/auditing/event-4662.md +++ b/windows/security/threat-protection/auditing/event-4662.md @@ -97,7 +97,7 @@ You will get one 4662 for each operation type which was performed. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4663.md b/windows/security/threat-protection/auditing/event-4663.md index 8001bded3b..ada40db01d 100644 --- a/windows/security/threat-protection/auditing/event-4663.md +++ b/windows/security/threat-protection/auditing/event-4663.md @@ -101,7 +101,7 @@ The main difference with “[4656](event-4656.md): A handle to an object was req - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4664.md b/windows/security/threat-protection/auditing/event-4664.md index e998b508ce..b6a2a10e16 100644 --- a/windows/security/threat-protection/auditing/event-4664.md +++ b/windows/security/threat-protection/auditing/event-4664.md @@ -85,7 +85,7 @@ This event generates when an NTFS hard link was successfully created. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4670.md b/windows/security/threat-protection/auditing/event-4670.md index 059fde7e55..e0477b2e16 100644 --- a/windows/security/threat-protection/auditing/event-4670.md +++ b/windows/security/threat-protection/auditing/event-4670.md @@ -93,7 +93,7 @@ Before this event can generate, certain ACEs might need to be set in the object - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4672.md b/windows/security/threat-protection/auditing/event-4672.md index af47315a26..863cb342a4 100644 --- a/windows/security/threat-protection/auditing/event-4672.md +++ b/windows/security/threat-protection/auditing/event-4672.md @@ -110,7 +110,7 @@ You typically will see many of these events in the event log, because every logo - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4673.md b/windows/security/threat-protection/auditing/event-4673.md index 6252059b6d..f815be18a8 100644 --- a/windows/security/threat-protection/auditing/event-4673.md +++ b/windows/security/threat-protection/auditing/event-4673.md @@ -90,7 +90,7 @@ Failure event generates when service call attempt fails. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4674.md b/windows/security/threat-protection/auditing/event-4674.md index 9f1b9914da..038e21fa18 100644 --- a/windows/security/threat-protection/auditing/event-4674.md +++ b/windows/security/threat-protection/auditing/event-4674.md @@ -93,7 +93,7 @@ Failure event generates when operation attempt fails. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4688.md b/windows/security/threat-protection/auditing/event-4688.md index fd44f24170..651edeee10 100644 --- a/windows/security/threat-protection/auditing/event-4688.md +++ b/windows/security/threat-protection/auditing/event-4688.md @@ -108,7 +108,7 @@ This event generates every time a new process starts. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY". + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY". - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: "Win81". @@ -132,7 +132,7 @@ This event generates every time a new process starts. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY". + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY". - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: "Win81". diff --git a/windows/security/threat-protection/auditing/event-4689.md b/windows/security/threat-protection/auditing/event-4689.md index 74412386d9..3d50a5e80d 100644 --- a/windows/security/threat-protection/auditing/event-4689.md +++ b/windows/security/threat-protection/auditing/event-4689.md @@ -85,7 +85,7 @@ This event generates every time a process has exited. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4690.md b/windows/security/threat-protection/auditing/event-4690.md index f588b637ce..84686b24aa 100644 --- a/windows/security/threat-protection/auditing/event-4690.md +++ b/windows/security/threat-protection/auditing/event-4690.md @@ -86,7 +86,7 @@ This event generates if an attempt was made to duplicate a handle to an object. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4691.md b/windows/security/threat-protection/auditing/event-4691.md index 45e0209fc6..c8ce062789 100644 --- a/windows/security/threat-protection/auditing/event-4691.md +++ b/windows/security/threat-protection/auditing/event-4691.md @@ -89,7 +89,7 @@ These events are generated for [ALPC Ports](/windows/win32/etw/alpc) access requ - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4692.md b/windows/security/threat-protection/auditing/event-4692.md index f68457c377..639cac22bf 100644 --- a/windows/security/threat-protection/auditing/event-4692.md +++ b/windows/security/threat-protection/auditing/event-4692.md @@ -96,7 +96,7 @@ Failure event generates when a Master Key backup operation fails for some reason - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4693.md b/windows/security/threat-protection/auditing/event-4693.md index 21e769eae0..e816c4c45b 100644 --- a/windows/security/threat-protection/auditing/event-4693.md +++ b/windows/security/threat-protection/auditing/event-4693.md @@ -93,7 +93,7 @@ Failure event generates when a Master Key restore operation fails for some reaso - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4696.md b/windows/security/threat-protection/auditing/event-4696.md index 37ca02dd04..dd8e59af94 100644 --- a/windows/security/threat-protection/auditing/event-4696.md +++ b/windows/security/threat-protection/auditing/event-4696.md @@ -92,7 +92,7 @@ This event generates every time a process runs using the non-current access toke - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. @@ -134,7 +134,7 @@ This event generates every time a process runs using the non-current access toke - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4697.md b/windows/security/threat-protection/auditing/event-4697.md index 16ace0c0a6..32489e2c4d 100644 --- a/windows/security/threat-protection/auditing/event-4697.md +++ b/windows/security/threat-protection/auditing/event-4697.md @@ -87,7 +87,7 @@ This event generates when new service was installed in the system. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4698.md b/windows/security/threat-protection/auditing/event-4698.md index fae37ea9f2..32adfda2d6 100644 --- a/windows/security/threat-protection/auditing/event-4698.md +++ b/windows/security/threat-protection/auditing/event-4698.md @@ -95,7 +95,7 @@ This event generates every time a new scheduled task is created. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4699.md b/windows/security/threat-protection/auditing/event-4699.md index dcea15f17d..4e94788e1f 100644 --- a/windows/security/threat-protection/auditing/event-4699.md +++ b/windows/security/threat-protection/auditing/event-4699.md @@ -95,7 +95,7 @@ This event generates every time a scheduled task was deleted. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4700.md b/windows/security/threat-protection/auditing/event-4700.md index 2a46c16d19..9fb16aefd8 100644 --- a/windows/security/threat-protection/auditing/event-4700.md +++ b/windows/security/threat-protection/auditing/event-4700.md @@ -95,7 +95,7 @@ This event generates every time a scheduled task is enabled. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4701.md b/windows/security/threat-protection/auditing/event-4701.md index e7bc488cc8..f6c37f2fde 100644 --- a/windows/security/threat-protection/auditing/event-4701.md +++ b/windows/security/threat-protection/auditing/event-4701.md @@ -95,7 +95,7 @@ This event generates every time a scheduled task is disabled. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4702.md b/windows/security/threat-protection/auditing/event-4702.md index 78fee18be6..e42e4e116b 100644 --- a/windows/security/threat-protection/auditing/event-4702.md +++ b/windows/security/threat-protection/auditing/event-4702.md @@ -95,7 +95,7 @@ This event generates every time scheduled task was updated/changed. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4703.md b/windows/security/threat-protection/auditing/event-4703.md index 938491bf3a..692ef083f0 100644 --- a/windows/security/threat-protection/auditing/event-4703.md +++ b/windows/security/threat-protection/auditing/event-4703.md @@ -94,7 +94,7 @@ Token privileges provide the ability to take certain system-level actions that y - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. @@ -116,7 +116,7 @@ Token privileges provide the ability to take certain system-level actions that y - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4704.md b/windows/security/threat-protection/auditing/event-4704.md index b76c240efe..824a755e4b 100644 --- a/windows/security/threat-protection/auditing/event-4704.md +++ b/windows/security/threat-protection/auditing/event-4704.md @@ -86,7 +86,7 @@ You will see unique event for every user. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4705.md b/windows/security/threat-protection/auditing/event-4705.md index b4ecb04b99..6738fed5c9 100644 --- a/windows/security/threat-protection/auditing/event-4705.md +++ b/windows/security/threat-protection/auditing/event-4705.md @@ -86,7 +86,7 @@ You will see unique event for every user. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4706.md b/windows/security/threat-protection/auditing/event-4706.md index 5d2f62ef77..cf21247125 100644 --- a/windows/security/threat-protection/auditing/event-4706.md +++ b/windows/security/threat-protection/auditing/event-4706.md @@ -90,7 +90,7 @@ This event is generated only on domain controllers. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4707.md b/windows/security/threat-protection/auditing/event-4707.md index be0c79ea65..46cc4912f4 100644 --- a/windows/security/threat-protection/auditing/event-4707.md +++ b/windows/security/threat-protection/auditing/event-4707.md @@ -86,7 +86,7 @@ This event is generated only on domain controllers. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4713.md b/windows/security/threat-protection/auditing/event-4713.md index d54358f133..040a4757be 100644 --- a/windows/security/threat-protection/auditing/event-4713.md +++ b/windows/security/threat-protection/auditing/event-4713.md @@ -85,7 +85,7 @@ This event is generated only on domain controllers. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4715.md b/windows/security/threat-protection/auditing/event-4715.md index 6b6faa90fa..484f51c5ca 100644 --- a/windows/security/threat-protection/auditing/event-4715.md +++ b/windows/security/threat-protection/auditing/event-4715.md @@ -85,7 +85,7 @@ This event is always logged regardless of the "Audit Policy Change" sub-category - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4716.md b/windows/security/threat-protection/auditing/event-4716.md index 7f058962db..212334d05a 100644 --- a/windows/security/threat-protection/auditing/event-4716.md +++ b/windows/security/threat-protection/auditing/event-4716.md @@ -90,7 +90,7 @@ This event is generated only on domain controllers. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4717.md b/windows/security/threat-protection/auditing/event-4717.md index 33d3817929..22a4ae6f99 100644 --- a/windows/security/threat-protection/auditing/event-4717.md +++ b/windows/security/threat-protection/auditing/event-4717.md @@ -86,7 +86,7 @@ You will see unique event for every user if logon user rights were granted to mu - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4718.md b/windows/security/threat-protection/auditing/event-4718.md index a7e1307af2..a6b2d122b0 100644 --- a/windows/security/threat-protection/auditing/event-4718.md +++ b/windows/security/threat-protection/auditing/event-4718.md @@ -86,7 +86,7 @@ You will see unique event for every user if logon user rights were removed for m - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4719.md b/windows/security/threat-protection/auditing/event-4719.md index 1a2dabdc7e..b059b70570 100644 --- a/windows/security/threat-protection/auditing/event-4719.md +++ b/windows/security/threat-protection/auditing/event-4719.md @@ -88,7 +88,7 @@ This event is always logged regardless of the "Audit Policy Change" sub-category - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4720.md b/windows/security/threat-protection/auditing/event-4720.md index 7e6fc9cb68..f825fb7830 100644 --- a/windows/security/threat-protection/auditing/event-4720.md +++ b/windows/security/threat-protection/auditing/event-4720.md @@ -105,7 +105,7 @@ This event generates on domain controllers, member servers, and workstations. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. @@ -157,7 +157,7 @@ Typically, **Primary Group** field for new user accounts has the following value - 513 (Domain Users. For local accounts this RID means Users) – for domain and local users. - See this article for more information. This parameter contains the value of **primaryGroupID** attribute of new user object. + See this article for more information. This parameter contains the value of **primaryGroupID** attribute of new user object. diff --git a/windows/security/threat-protection/auditing/event-4722.md b/windows/security/threat-protection/auditing/event-4722.md index c29e7669bc..6f79a8db9d 100644 --- a/windows/security/threat-protection/auditing/event-4722.md +++ b/windows/security/threat-protection/auditing/event-4722.md @@ -89,7 +89,7 @@ For computer accounts, this event generates only on domain controllers. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/auditing/event-4723.md b/windows/security/threat-protection/auditing/event-4723.md index 1246930e5a..9c7be0c550 100644 --- a/windows/security/threat-protection/auditing/event-4723.md +++ b/windows/security/threat-protection/auditing/event-4723.md @@ -96,7 +96,7 @@ Typically you will see 4723 events with the same **Subject\\Security ID** and ** - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index 7baa36b1a0..c76ead4afc 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -29,23 +29,24 @@ In Windows client, hardware and software work together to help protect you from See the following articles to learn more about the different areas of Windows threat protection: -- [Microsoft Defender Application Guard](\windows\security\threat-protection\microsoft-defender-application-guard\md-app-guard-overview.md) -- [Virtualization-based protection of code integrity](\windows\security\threat-protection\device-guard\enable-virtualization-based-protection-of-code-integrity.md) -- [Application control](/windows-defender-application-control/windows-defender-application-control.md) +- [Application Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control) +- [Attack Surface Reduction Rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction) +- [Controlled Folder Access](/microsoft-365/security/defender-endpoint/controlled-folders) +- [Exploit Protection](/microsoft-365/security/defender-endpoint/exploit-protection) +- [Microsoft Defender Application Guard](/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview) - [Microsoft Defender Device Guard](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) -- [Exploit protection](/microsoft-365/security/defender-endpoint/exploit-protection) -- [Network protection](/microsoft-365/security/defender-endpoint/network-protection), [web protection](/microsoft-365/security/defender-endpoint/web-protection-overview) -- [Microsoft Defender SmartScreen](\windows\security\threat-protection\microsoft-defender-smartscreen\microsoft-defender-smartscreen-overview.md) -- [Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders) -- [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md) -- [Attack surface reduction rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction) -- [Windows Sandbox](\windows\security\threat-protection\windows-sandbox\windows-sandbox-overview.md) +- [Microsoft Defender SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview) +- [Network Protection](/microsoft-365/security/defender-endpoint/network-protection) +- [Virtualization-Based Protection of Code Integrity](/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) +- [Web Protection](/microsoft-365/security/defender-endpoint/web-protection-overview) +- [Windows Firewall](windows-firewall/windows-firewall-with-advanced-security.md) +- [Windows Sandbox](/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview) ### Next-generation protection Next-generation protection is designed to identify and block new and emerging threats. Powered by the cloud and machine learning, Microsoft Defender Antivirus can help stop attacks in real-time. +- [Automated sandbox service](/microsoft-365/security/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus) - [Behavior monitoring](/microsoft-365/security/defender-endpoint/configure-real-time-protection-microsoft-defender-antivirus) - [Cloud-based protection](/microsoft-365/security/defender-endpoint/configure-protection-features-microsoft-defender-antivirus) - [Machine learning](/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus) - [URL Protection](/microsoft-365/security/defender-endpoint/configure-network-connections-microsoft-defender-antivirus) -- [Automated sandbox service](/microsoft-365/security/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus) \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/phishing.md b/windows/security/threat-protection/intelligence/phishing.md index 215acf8c29..36de3f06bf 100644 --- a/windows/security/threat-protection/intelligence/phishing.md +++ b/windows/security/threat-protection/intelligence/phishing.md @@ -85,7 +85,7 @@ If you feel you've been a victim of a phishing attack: - Junk: junk@office365.microsoft.com - Phishing: phish@office365.microsoft.com - Drag and drop the junk or phishing message into the new message. This will save the junk or phishing message as an attachment in the new message. Don't copy and paste the content of the message or forward the message (we need the original message so we can inspect the message headers). For more information, see [Submit spam, non-spam, and phishing scam messages to Microsoft for analysis](/office365/SecurityCompliance/submit-spam-non-spam-and-phishing-scam-messages-to-microsoft-for-analysis). + Drag and drop the junk or phishing message into the new message. This will save the junk or phishing message as an attachment in the new message. Don't copy and paste the content of the message or forward the message (we need the original message so we can inspect the message headers). For more information, see [Report messages and files to Microsoft](/microsoft-365/security/office-365-security/report-junk-email-messages-to-microsoft). - **Anti-Phishing Working Group**: phishing-report@us-cert.gov. The group uses reports generated from emails sent to fight phishing scams and hackers. ISPs, security vendors, financial institutions, and law enforcement agencies are involved. diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md index 14c78b9fa8..39945ec254 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md @@ -26,195 +26,56 @@ See [Windows 10 (and Windows 11) settings to protect devices using Intune](/intu ## Group Policy settings SmartScreen uses registry-based Administrative Template policy settings. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        SettingSupported onDescription
        Windows 10, version 2004:
        Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure Windows Defender SmartScreen

        -

        		Windows 10, version 1703:
        Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure Windows Defender SmartScreen

        Windows 10, Version 1607 and earlier:
        Administrative Templates\Windows Components\File Explorer\Configure Windows SmartScreen

        -At least Windows Server 2012, Windows 8 or Windows RT

        		This policy setting turns on Microsoft Defender SmartScreen.

        If you enable this setting, it turns on Microsoft Defender SmartScreen and your employees are unable to turn it off. Additionally, when enabling this feature, you must also pick whether Microsoft Defender SmartScreen should Warn your employees or Warn and prevent bypassing the message (effectively blocking the employee from the site).

        If you disable this setting, it turns off Microsoft Defender SmartScreen and your employees are unable to turn it on.

        If you don't configure this setting, your employees can decide whether to use Microsoft Defender SmartScreen.

        Windows 10, version 2004:
        Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure App Install Control        		Windows 10, version 1703:
        Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure App Install Control        		This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet.

        This setting does not protect against malicious content from USB devices, network shares, or other non-internet sources.

        Important: Using a trustworthy browser helps ensure that these protections work as expected.

        Windows 10, version 2004:
        Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

        Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later)

        Windows 10, version 1703:
        Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

        Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later)

        Windows 10, Version 1607 and earlier:
        Administrative Templates\Windows Components\Microsoft Edge\Configure Windows SmartScreen

        		Microsoft Edge on Windows 10 or Windows 11This policy setting turns on Microsoft Defender SmartScreen.

        If you enable this setting, it turns on Microsoft Defender SmartScreen and your employees are unable to turn it off.

        If you disable this setting, it turns off Microsoft Defender SmartScreen and your employees are unable to turn it on.

        If you don't configure this setting, your employees can decide whether to use Microsoft Defender SmartScreen.

        Windows 10, version 2004:
        Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files (Microsoft Edge version 45 and earlier)

        Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads (Microsoft Edge version 77 or later)

        Windows 10, version 1703:
        Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files (Microsoft Edge version 45 and earlier)

        Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads (Microsoft Edge version 77 or later)

        Windows 10, Version 1511 and 1607:
        Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows SmartScreen prompts for files

        		Microsoft Edge on Windows 10, version 1511 or laterThis policy setting stops employees from bypassing the Microsoft Defender SmartScreen warnings about potentially malicious files.

        If you enable this setting, it stops employees from bypassing the warning, stopping the file download.

        If you disable or don't configure this setting, your employees can bypass the warnings and continue to download potentially malicious files.

        Windows 10, version 2004:
        Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 45 and earlier)

        Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing Microsoft Defender SmartScreen prompts for sites (Microsoft Edge version 77 or later)

        Windows 10, version 1703:
        Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 45 and earlier)

        Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing Microsoft Defender SmartScreen prompts for sites (Microsoft Edge version 77 or later)

        Windows 10, Version 1511 and 1607:
        Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows SmartScreen prompts for sites

        		Microsoft Edge on Windows 10, version 1511 or laterThis policy setting stops employees from bypassing the Microsoft Defender SmartScreen warnings about potentially malicious sites.

        If you enable this setting, it stops employees from bypassing the warning, stopping them from going to the site.

        If you disable or don't configure this setting, your employees can bypass the warnings and continue to visit a potentially malicious site.

        Administrative Templates\Windows Components\Internet Explorer\Prevent managing SmartScreen FilterInternet Explorer 9 or laterThis policy setting prevents the employee from managing Microsoft Defender SmartScreen.

        If you enable this policy setting, the employee isn't prompted to turn on Microsoft Defender SmartScreen. All website addresses that are not on the filter's allow list are sent automatically to Microsoft without prompting the employee.

        If you disable or don't configure this policy setting, the employee is prompted to decide whether to turn on Microsoft Defender SmartScreen during the first-run experience.

        Administrative Templates\Windows Components\Internet Explorer\Prevent bypassing SmartScreen Filter warningsInternet Explorer 8 or laterThis policy setting determines whether an employee can bypass warnings from Microsoft Defender SmartScreen.

        If you enable this policy setting, Microsoft Defender SmartScreen warnings block the employee.

        If you disable or don't configure this policy setting, the employee can bypass Microsoft Defender SmartScreen warnings.

        Administrative Templates\Windows Components\Internet Explorer\Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the InternetInternet Explorer 9 or laterThis policy setting determines whether the employee can bypass warnings from Microsoft Defender SmartScreen. Microsoft Defender SmartScreen warns the employee about executable files that Internet Explorer users do not commonly download from the Internet.

        If you enable this policy setting, Microsoft Defender SmartScreen warnings block the employee.

        If you disable or don't configure this policy setting, the employee can bypass Microsoft Defender SmartScreen warnings.

        + +Setting|Supported on|Description| +|--- |--- |--- | +|**Windows 10, version 2004:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure Windows Defender SmartScreen|**Windows 10, version 1703:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure Windows Defender SmartScreen

        **Windows 10, Version 1607 and earlier:** Administrative Templates\Windows Components\File Explorer\Configure Windows SmartScreen

        **At least Windows Server 2012, Windows 8 or Windows RT**|This policy setting turns on Microsoft Defender SmartScreen.

        If you enable this setting, it turns on Microsoft Defender SmartScreen and your employees are unable to turn it off. Additionally, when enabling this feature, you must also pick whether Microsoft Defender SmartScreen should Warn your employees or Warn and prevent bypassing the message (effectively blocking the employee from the site).

        If you disable this setting, it turns off Microsoft Defender SmartScreen and your employees are unable to turn it on.

        If you don't configure this setting, your employees can decide whether to use Microsoft Defender SmartScreen.| +|**Windows 10, version 2004:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure App Install Control|**Windows 10, version 1703:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure App Install Control|This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet.

        This setting does not protect against malicious content from USB devices, network shares, or other non-internet sources.

        **Important:** Using a trustworthy browser helps ensure that these protections work as expected.| +|**Windows 10, version 2004:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

        Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later)

        **Windows 10, version 1703:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

        Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later)

        **Windows 10, Version 1607 and earlier:** Administrative Templates\Windows Components\Microsoft Edge\Configure Windows SmartScreen|Microsoft Edge on Windows 10 or Windows 11|This policy setting turns on Microsoft Defender SmartScreen.

        If you enable this setting, it turns on Microsoft Defender SmartScreen and your employees are unable to turn it off.

        If you disable this setting, it turns off Microsoft Defender SmartScreen and your employees are unable to turn it on.

        If you don't configure this setting, your employees can decide whether to use Microsoft Defender SmartScreen.| +|**Windows 10, version 2004:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files (Microsoft Edge version 45 and earlier)

        Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads (Microsoft Edge version 77 or later)

        **Windows 10, version 1703:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files (Microsoft Edge version 45 and earlier)

        Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads (Microsoft Edge version 77 or later)

        **Windows 10, Version 1511 and 1607:** Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows SmartScreen prompts for files|Microsoft Edge on Windows 10, version 1511 or later|This policy setting stops employees from bypassing the Microsoft Defender SmartScreen warnings about potentially malicious files.

        If you enable this setting, it stops employees from bypassing the warning, stopping the file download.

        If you disable or don't configure this setting, your employees can bypass the warnings and continue to download potentially malicious files.| +|**Windows 10, version 2004:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 45 and earlier)

        Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing Microsoft Defender SmartScreen prompts for sites (Microsoft Edge version 77 or later)

        **Windows 10, version 1703:** Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 45 and earlier)

        Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing Microsoft Defender SmartScreen prompts for sites (Microsoft Edge version 77 or later)

        **Windows 10, Version 1511 and 1607:** Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows SmartScreen prompts for sites|Microsoft Edge on Windows 10, version 1511 or later|This policy setting stops employees from bypassing the Microsoft Defender SmartScreen warnings about potentially malicious sites.

        If you enable this setting, it stops employees from bypassing the warning, stopping them from going to the site.

        If you disable or don't configure this setting, your employees can bypass the warnings and continue to visit a potentially malicious site.| +|Administrative Templates\Windows Components\Internet Explorer\Prevent managing SmartScreen Filter|Internet Explorer 9 or later|This policy setting prevents the employee from managing Microsoft Defender SmartScreen.

        If you enable this policy setting, the employee isn't prompted to turn on Microsoft Defender SmartScreen. All website addresses that are not on the filter's allow list are sent automatically to Microsoft without prompting the employee.

        If you disable or don't configure this policy setting, the employee is prompted to decide whether to turn on Microsoft Defender SmartScreen during the first-run experience.| +|Administrative Templates\Windows Components\Internet Explorer\Prevent bypassing SmartScreen Filter warnings|Internet Explorer 8 or later|This policy setting determines whether an employee can bypass warnings from Microsoft Defender SmartScreen.

        If you enable this policy setting, Microsoft Defender SmartScreen warnings block the employee.

        If you disable or don't configure this policy setting, the employee can bypass Microsoft Defender SmartScreen warnings.| +|Administrative Templates\Windows Components\Internet Explorer\Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet|Internet Explorer 9 or later|This policy setting determines whether the employee can bypass warnings from Microsoft Defender SmartScreen. Microsoft Defender SmartScreen warns the employee about executable files that Internet Explorer users do not commonly download from the Internet.

        If you enable this policy setting, Microsoft Defender SmartScreen warnings block the employee.

        If you disable or don't configure this policy setting, the employee can bypass Microsoft Defender SmartScreen warnings.| + ## MDM settings If you manage your policies using Microsoft Intune, you'll want to use these MDM policy settings. All settings support desktop computers running Windows 10 Pro or Windows 10 Enterprise, enrolled with Microsoft Intune.

        For Microsoft Defender SmartScreen Edge MDM policies, see [Policy CSP - Browser](/windows/client-management/mdm/policy-csp-browser). - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        SettingSupported versionsDetails
        AllowSmartScreenWindows 10 -
          -
        • URI full path. ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen
          • -
        • Data type. Integer
          • -
        • Allowed values:
            -
          • 0 . Turns off Microsoft Defender SmartScreen in Edge.
            • -
          • 1. Turns on Microsoft Defender SmartScreen in Edge.
        -
        EnableAppInstallControlWindows 10, version 1703 -
          -
        • URI full path. ./Vendor/MSFT/Policy/Config/SmartScreen/EnableAppInstallControl
          • -
        • Data type. Integer
          • -
        • Allowed values:
            -
          • 0 . Turns off Application Installation Control, allowing users to download and install files from anywhere on the web.
            • -
          • 1. Turns on Application Installation Control, allowing users to install apps from the Microsoft Store only.
        -
        EnableSmartScreenInShellWindows 10, version 1703 -
          -
        • URI full path. ./Vendor/MSFT/Policy/Config/SmartScreen/EnableSmartScreenInShell
          • -
        • Data type. Integer
          • -
        • Allowed values:
            -
          • 0 . Turns off Microsoft Defender SmartScreen in Windows for app and file execution.
            • -
          • 1. Turns on Microsoft Defender SmartScreen in Windows for app and file execution.
        -
        PreventOverrideForFilesInShellWindows 10, version 1703 -
          -
        • URI full path. ./Vendor/MSFT/Policy/Config/SmartScreen/PreventOverrideForFilesInShell
          • -
        • Data type. Integer
          • -
        • Allowed values:
            -
          • 0 . Employees can ignore Microsoft Defender SmartScreen warnings and run malicious files.
            • -
          • 1. Employees can't ignore Microsoft Defender SmartScreen warnings and run malicious files.
        -
        PreventSmartScreenPromptOverrideWindows 10, Version 1511 and Windows 11 -
          -
        • URI full path. ./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride
          • -
        • Data type. Integer
          • -
        • Allowed values:
            -
          • 0 . Employees can ignore Microsoft Defender SmartScreen warnings.
            • -
          • 1. Employees can't ignore Microsoft Defender SmartScreen warnings.
        -
        PreventSmartScreenPromptOverrideForFilesWindows 10, Version 1511 and Windows 11 -
          -
        • URI full path. ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles
          • -
        • Data type. Integer
          • -
        • Allowed values:
            -
          • 0 . Employees can ignore Microsoft Defender SmartScreen warnings for files.
            • -
          • 1. Employees can't ignore Microsoft Defender SmartScreen warnings for files.
        -
        + +|Setting|Supported versions|Details| +|--- |--- |--- | +|AllowSmartScreen|Windows 10|
      • **URI full path.** ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen
      • **Data type.** Integer**Allowed values:**
        • **0 .** Turns off Microsoft Defender SmartScreen in Edge.
        • **1.** Turns on Microsoft Defender SmartScreen in Edge.| +|EnableAppInstallControl|Windows 10, version 1703|
        • **URI full path.** ./Vendor/MSFT/Policy/Config/SmartScreen/EnableAppInstallControl
        • **Data type.** Integer**Allowed values:**
          • **0 .** Turns off Application Installation Control, allowing users to download and install files from anywhere on the web.
          • **1.** Turns on Application Installation Control, allowing users to install apps from the Microsoft Store only.| +|EnableSmartScreenInShell|Windows 10, version 1703|
          • **URI full path.** ./Vendor/MSFT/Policy/Config/SmartScreen/EnableSmartScreenInShell
          • **Data type.** Integer**Allowed values:**
            • **0 .** Turns off Microsoft Defender SmartScreen in Windows for app and file execution.
            • **1.** Turns on Microsoft Defender SmartScreen in Windows for app and file execution.| +|PreventOverrideForFilesInShell|Windows 10, version 1703|
            • **URI full path.** ./Vendor/MSFT/Policy/Config/SmartScreen/PreventOverrideForFilesInShell
            • **Data type.** Integer**Allowed values:**
              • **0 .** Employees can ignore Microsoft Defender SmartScreen warnings and run malicious files.
              • **1.** Employees can't ignore Microsoft Defender SmartScreen warnings and run malicious files.| +|PreventSmartScreenPromptOverride|Windows 10, Version 1511 and Windows 11|
              • **URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride
              • **Data type.** Integer**Allowed values:**
                • **0 .** Employees can ignore Microsoft Defender SmartScreen warnings.
                • **1.** Employees can't ignore Microsoft Defender SmartScreen warnings.| +|PreventSmartScreenPromptOverrideForFiles|Windows 10, Version 1511 and Windows 11|
                • **URI full path.** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles
                • **Data type.** Integer**Allowed values:**
                  • **0 .** Employees can ignore Microsoft Defender SmartScreen warnings for files.
                  • **1.** Employees can't ignore Microsoft Defender SmartScreen warnings for files.| ## Recommended Group Policy and MDM settings for your organization By default, Microsoft Defender SmartScreen lets employees bypass warnings. Unfortunately, this feature can let employees continue to an unsafe site or to continue to download an unsafe file, even after being warned. Because of this possibility, we strongly recommend that you set up Microsoft Defender SmartScreen to block high-risk interactions instead of providing just a warning. To better help you protect your organization, we recommend turning on and using these specific Microsoft Defender SmartScreen Group Policy and MDM settings. - - - - - - - - - - - - - - - - - - - - - -
                    Group Policy settingRecommendation
                    Administrative Templates\Windows Components\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

                    Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later)

                    		Enable. Turns on Microsoft Defender SmartScreen.
                    Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 45 and earlier)

                    Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 77 or later)

                    		Enable. Stops employees from ignoring warning messages and continuing to a potentially malicious website.
                    Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files (Microsoft Edge version 45 and earlier)

                    Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads (Microsoft Edge version 77 or later)

                    		Enable. Stops employees from ignoring warning messages and continuing to download potentially malicious files.
                    Administrative Templates\Windows Components\File Explorer\Configure Windows Defender SmartScreenEnable with the Warn and prevent bypass option. Stops employees from ignoring warning messages about malicious files downloaded from the Internet.
                    -

                    - - - - - - - - - - - - - - - - - - - - - - - - - -
                    MDM settingRecommendation
                    Browser/AllowSmartScreen1. Turns on Microsoft Defender SmartScreen.
                    Browser/PreventSmartScreenPromptOverride1. Stops employees from ignoring warning messages and continuing to a potentially malicious website.
                    Browser/PreventSmartScreenPromptOverrideForFiles1. Stops employees from ignoring warning messages and continuing to download potentially malicious files.
                    SmartScreen/EnableSmartScreenInShell1. Turns on Microsoft Defender SmartScreen in Windows.

                    Requires at least Windows 10, version 1703.

                    SmartScreen/PreventOverrideForFilesInShell1. Stops employees from ignoring warning messages about malicious files downloaded from the Internet.

                    Requires at least Windows 10, version 1703.

                    + +|Group Policy setting|Recommendation| +|--- |--- | +|Administrative Templates\Windows Components\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

                    Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later)|**Enable.** Turns on Microsoft Defender SmartScreen.| +|Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 45 and earlier)

                    Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 77 or later)|**Enable.** Stops employees from ignoring warning messages and continuing to a potentially malicious website.| +|Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files (Microsoft Edge version 45 and earlier)

                    Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads (Microsoft Edge version 77 or later)|**Enable.** Stops employees from ignoring warning messages and continuing to download potentially malicious files.| +|Administrative Templates\Windows Components\File Explorer\Configure Windows Defender SmartScreen|**Enable with the Warn and prevent bypass option.** Stops employees from ignoring warning messages about malicious files downloaded from the Internet.| + +|MDM setting|Recommendation| +|--- |--- | +|Browser/AllowSmartScreen|**1.** Turns on Microsoft Defender SmartScreen.| +|Browser/PreventSmartScreenPromptOverride|**1.** Stops employees from ignoring warning messages and continuing to a potentially malicious website.| +|Browser/PreventSmartScreenPromptOverrideForFiles|**1.** Stops employees from ignoring warning messages and continuing to download potentially malicious files.| +|SmartScreen/EnableSmartScreenInShell|**1.** Turns on Microsoft Defender SmartScreen in Windows.

                    Requires at least Windows 10, version 1703.| +|SmartScreen/PreventOverrideForFilesInShell|**1.** Stops employees from ignoring warning messages about malicious files downloaded from the Internet.

                    Requires at least Windows 10, version 1703.| ## Related topics + - [Threat protection](../index.md) - [Microsoft Defender SmartScreen overview](microsoft-defender-smartscreen-overview.md) -- [Available Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](/microsoft-edge/deploy/available-policies) \ No newline at end of file +- [Available Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](/microsoft-edge/deploy/available-policies) diff --git a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md index 6bb026c848..1771f72297 100644 --- a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md +++ b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md @@ -308,58 +308,13 @@ The following table lists EMET features in relation to Windows 10 features. ### Table 5   EMET features in relation to Windows 10 features - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                    Specific EMET featuresHow these EMET features map
                    -to Windows 10 features
                      -

                    • DEP

                      • -

                    • SEHOP

                      • -

                    • ASLR (Force ASLR, Bottom-up ASLR)

                      • -

                    DEP, SEHOP, and ASLR are included in Windows 10 as configurable features. See Table 2, earlier in this topic.

                    -

                    You can install the ProcessMitigations PowerShell module to convert your EMET settings for these features into policies that you can apply to Windows 10.

                      -

                    • Load Library Check (LoadLib)

                      • -

                    • Memory Protection Check (MemProt)

                      • -
                    		LoadLib and MemProt are supported in Windows 10, for all applications that are written to use these functions. See Table 4, earlier in this topic.
                      -

                    • Null Page

                      • -
                    		Mitigations for this threat are built into Windows 10, as described in the "Memory reservations" item in Kernel pool protections, earlier in this topic.
                      -

                    • Heap Spray

                      • -

                    • EAF

                      • -

                    • EAF+

                      • -
                    		Windows 10 does not include mitigations that map specifically to these EMET features because they have low impact in the current threat landscape, and do not significantly increase the difficulty of exploiting vulnerabilities. Microsoft remains committed to monitoring the security environment as new exploits appear and taking steps to harden the operating system against them.
                      -

                    • Caller Check

                      • -

                    • Simulate Execution Flow

                      • -

                    • Stack Pivot

                      • -

                    • Deep Hooks (an ROP "Advanced Mitigation")

                      • -

                    • Anti Detours (an ROP "Advanced Mitigation")

                      • -

                    • Banned Functions (an ROP "Advanced Mitigation")

                      • -
                    		Mitigated in Windows 10 with applications compiled with Control Flow Guard, as described in Control Flow Guard, earlier in this topic.
                    +|Specific EMET features|How these EMET features map to Windows 10 features| +|--- |--- | +|

                  • DEP
                  • SEHOP
                  • ASLR (Force ASLR, Bottom-up ASLR)|DEP, SEHOP, and ASLR are included in Windows 10 as configurable features. See [Table 2](#table-2), earlier in this topic.You can install the ProcessMitigations PowerShell module to convert your EMET settings for these features into policies that you can apply to Windows 10.| +|
                  • Load Library Check (LoadLib)
                  • Memory Protection Check (MemProt)|LoadLib and MemProt are supported in Windows 10, for all applications that are written to use these functions. See [Table 4](#functions-that-software-vendors-can-use-to-build-mitigations-into-apps), earlier in this topic.| +|Null Page|Mitigations for this threat are built into Windows 10, as described in the "Memory reservations" item in [Kernel pool protections](#kernel-pool-protections), earlier in this topic.| +|
                  • Heap Spray
                  • EAF
                  • EAF+|Windows 10 does not include mitigations that map specifically to these EMET features because they have low impact in the current threat landscape, and do not significantly increase the difficulty of exploiting vulnerabilities. Microsoft remains committed to monitoring the security environment as new exploits appear and taking steps to harden the operating system against them.| +|
                  • Caller Check
                  • Simulate Execution Flow
                  • Stack Pivot
                  • Deep Hooks (an ROP "Advanced Mitigation")
                  • Anti Detours (an ROP "Advanced Mitigation")
                  • Banned Functions (an ROP "Advanced Mitigation")|Mitigated in Windows 10 with applications compiled with Control Flow Guard, as described in [Control Flow Guard](#control-flow-guard), earlier in this topic.| ### Converting an EMET XML settings file into Windows 10 mitigation policies diff --git a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index 29993c408e..958eae7a5c 100644 --- a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -336,49 +336,13 @@ For more information on device health attestation, see the [Detect an unhealthy The following table details the hardware requirements for both virtualization-based security services and the health attestation feature. For more information, see [Minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview). - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                    HardwareMotivation

                    UEFI 2.3.1 or later firmware with Secure Boot enabled

                    Required to support UEFI Secure Boot.

                    -

                    UEFI Secure Boot ensures that the device boots only authorized code.

                    -

                    Additionally, Boot Integrity (Platform Secure Boot) must be supported following the requirements in Hardware Compatibility Specification for Systems for Windows 10 under the subsection: “System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby”

                    Virtualization extensions, such as Intel VT-x, AMD-V, and SLAT must be enabled

                    Required to support virtualization-based security.

                    -
                    -Note

                    Device Guard can be enabled without using virtualization-based security.

                    -
                    -
                    - -

                    X64 processor

                    Required to support virtualization-based security that uses Windows Hypervisor. Hyper-V is supported only on x64 processor (and not on x86).

                    -

                    Direct Memory Access (DMA) protection can be enabled to provide additional memory protection but requires processors to include DMA protection technologies.

                    IOMMU, such as Intel VT-d, AMD-Vi

                    Support for the IOMMU in Windows 10 enhances system resiliency against DMA attacks.

                    Trusted Platform Module (TPM)

                    Required to support health attestation and necessary for additional key protections for virtualization-based security. TPM 2.0 is supported. Support for TPM 1.2 was added beginning in Windows 10, version 1607 (RS1)

                    +|Hardware|Motivation| +|--- |--- | +|UEFI 2.3.1 or later firmware with Secure Boot enabled|Required to support UEFI Secure Boot.

                    UEFI Secure Boot ensures that the device boots only authorized code.

                    Additionally, Boot Integrity (Platform Secure Boot) must be supported following the requirements in Hardware Compatibility Specification for Systems for Windows 10 under the subsection: “System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby”| +|Virtualization extensions, such as Intel VT-x, AMD-V, and SLAT must be enabled|Required to support virtualization-based security.

                    **Note:** Device Guard can be enabled without using virtualization-based security.
                    | +|X64 processor|Required to support virtualization-based security that uses Windows Hypervisor. Hyper-V is supported only on x64 processor (and not on x86).

                    Direct Memory Access (DMA) protection can be enabled to provide additional memory protection but requires processors to include DMA protection technologies.| +|IOMMU, such as Intel VT-d, AMD-Vi|Support for the IOMMU in Windows 10 enhances system resiliency against DMA attacks.| +|Trusted Platform Module (TPM)|Required to support health attestation and necessary for additional key protections for virtualization-based security. TPM 2.0 is supported. Support for TPM 1.2 was added beginning in Windows 10, version 1607 (RS1)| This section presented information about several closely related controls in Windows 10. The multi-layer defenses and in-depth approach helps to eradicate low-level malware during boot sequence. Virtualization-based security is a fundamental operating system architecture change that adds a new security boundary. Device Guard and Credential Guard respectively help to block untrusted code and protect corporate domain credentials from theft and reuse. This section also briefly discussed the importance of managing devices and patching vulnerabilities. All these technologies can be used to harden and lock down devices while limiting the risk of attackers compromising them. @@ -591,36 +555,9 @@ For completeness of the measurements, see [Health Attestation CSP](/windows/clie The following table presents some key items that can be reported back to MDM depending on the type of Windows 10-based device. - ---- - - - - - - - - - - - - - -
                    OS typeKey items that can be reported

                    Windows 10 for desktop editions

                      -

                    • PCR0 measurement

                      • -

                    • Secure Boot Enabled

                      • -

                    • Secure Boot db matches Expected

                      • -

                    • Secure Boot dbx is up to date

                      • -

                    • Secure Boot policy GUID matches Expected

                      • -

                    • BitLocker enabled

                      • -

                    • Virtualization-based security enabled

                      • -

                    • ELAM was loaded

                      • -

                    • Code Integrity version is up to date

                      • -

                    • Code Integrity policy hash matches Expected

                      • -
                    +|OS type|Key items that can be reported| +|--- |--- | +|Windows 10 for desktop editions|

                  • PCR0 measurement
                  • Secure Boot Enabled
                  • Secure Boot db matches Expected
                  • Secure Boot dbx is up to date
                  • Secure Boot policy GUID matches Expected
                  • BitLocker enabled
                  • Virtualization-based security enabled
                  • ELAM was loaded
                  • Code Integrity version is up to date
                  • Code Integrity policy hash matches Expected| ### Leverage MDM and the Health Attestation Service diff --git a/windows/security/threat-protection/security-compliance-toolkit-10.md b/windows/security/threat-protection/security-compliance-toolkit-10.md index f1504a61e6..c56d9a43c6 100644 --- a/windows/security/threat-protection/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/security-compliance-toolkit-10.md @@ -1,6 +1,6 @@ --- title: Microsoft Security Compliance Toolkit 1.0 -description: This article describes how to use the Microsoft Security Compliance Toolkit in your organization +description: This article describes how to use the Security Compliance Toolkit 1.0 in your organization keywords: virtualization, security, malware ms.prod: m365-security ms.mktglfcycl: deploy @@ -16,7 +16,7 @@ ms.reviewer: ms.technology: windows-sec --- -# Microsoft Security Compliance Toolkit 1.0 - Usage +# Microsoft Security Compliance Toolkit 1.0 Usage ## What is the Security Compliance Toolkit (SCT)? diff --git a/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md b/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md index dc462f0224..7cc7a09a81 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md +++ b/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md @@ -30,18 +30,9 @@ Describes the best practices, location, values, management practices, and securi The **Audit: Shut down system immediately if unable to log security audits** policy setting determines whether the system shuts down if it is unable to log security events. This policy setting is a requirement for Trusted Computer System Evaluation Criteria (TCSEC)-C2 and Common Criteria certification to prevent auditable events from occurring if the audit system is unable to log those events. Microsoft has chosen to meet this requirement by halting the system and displaying a Stop message in the case of a failure of the auditing system. Enabling this policy setting stops the system if a security audit cannot be logged for any reason. Typically, an event fails to be logged when the security audit log is full and the value of **Retention method for security log** is **Do not overwrite events (clear log manually)** or **Overwrite events by days**. With **Audit: Shut down system immediately if unable to log security audits** set to **Enabled**, if the security log is full and an existing entry cannot be overwritten, the following Stop message appears: - --- - - - - - -

                    STOP: C0000244 {Audit Failed}

                    -

                    An attempt to generate a security audit failed.

                    - + +**STOP: C0000244 {Audit Failed}**: An attempt to generate a security audit failed. + To recover, you must log on, archive the log (optional), clear the log, and reset this option as desired. If the computer is unable to record events to the security log, critical evidence or important troubleshooting information might not be available for review after a security incident. diff --git a/windows/security/threat-protection/security-policy-settings/includes/smb1-perf-note.md b/windows/security/threat-protection/security-policy-settings/includes/smb1-perf-note.md index 2e59de26d8..c85aa9183c 100644 --- a/windows/security/threat-protection/security-policy-settings/includes/smb1-perf-note.md +++ b/windows/security/threat-protection/security-policy-settings/includes/smb1-perf-note.md @@ -5,6 +5,6 @@ ms.date: 1/4/2019 ms.reviewer: manager: dansimp ms.topic: include -ms.prod: w10 +ms.prod: m365-security --- Using SMB packet signing can degrade performance on file service transactions, depending on the version of SMB and available CPU cycles. diff --git a/windows/security/threat-protection/windows-10-mobile-security-guide.md b/windows/security/threat-protection/windows-10-mobile-security-guide.md index 264a762b9c..cd44f7491b 100644 --- a/windows/security/threat-protection/windows-10-mobile-security-guide.md +++ b/windows/security/threat-protection/windows-10-mobile-security-guide.md @@ -44,7 +44,8 @@ Because Windows Hello is supported across all Windows 10 devices, organizations Windows Hello supports iris scan, fingerprint, and facial recognition-based authentication for devices that have biometric sensors. ->**Note:** When Windows 10 first shipped, it included **Microsoft Passport** and **Windows Hello**, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the **Windows Hello** name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. +> [!NOTE] +> When Windows 10 first shipped, it included **Microsoft Passport** and **Windows Hello**, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the **Windows Hello** name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. ### Secured credentials @@ -61,7 +62,8 @@ Windows Hello supports three biometric sensor scenarios: - **Fingerprint recognition** uses a sensor to scan the user’s fingerprint. Although fingerprint readers have been available for computers running the Windows operating system for years, the detection, anti-spoofing, and recognition algorithms in Windows 10 are more advanced than in previous Windows versions. Most existing fingerprint readers (whether external to or integrated into laptops or USB keyboards) that support the Windows Biometric Framework will work with Windows Hello. - **Iris scanning** uses cameras designed to scan the user’s iris, the colorful and highly detailed portion of the eye. Because the data must be accurate, iris scanning uses a combination of an IR light source and a high-quality camera. Microsoft Lumia 950 and 950 XL devices support this technology. ->Users must create an unlock PIN while they enroll a biometric gesture. The device uses this PIN as a fallback mechanism in situations where it cannot capture the biometric gesture. +> [!NOTE] +> Users must create an unlock PIN while they enroll a biometric gesture. The device uses this PIN as a fallback mechanism in situations where it cannot capture the biometric gesture. All three of these biometric factors – face, finger, and iris – are unique to an individual. To capture enough data to uniquely identify an individual, a biometric scanner might initially capture images in multiple conditions or with additional details. For example, an iris scanner will capture images of both eyes or both eyes with and without eyeglasses or contact lenses. @@ -156,59 +158,21 @@ Windows 10 Mobile supports both [FIPS 140 standards](http://csrc.nist.gov/groups The best way to fight malware is prevention. Windows 10 Mobile provides strong malware resistance through secured hardware, startup process defenses, core operating system architecture, and application-level protections. The table below outlines how Windows 10 Mobile mitigates specific malware threats. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                    ThreatWindows 10 Mobile mitigation

                    Firmware bootkits replace the firmware with malware.

                    All certified devices include Unified Extensible Firmware (UEFI) with Secure Boot, which requires signed firmware for updates to UEFI and Option ROMs.

                    Bootkits start malware before Windows starts.

                    UEFI with Secure Boot verifies Windows bootloader integrity to help ensure that no malicious operating system can start before Windows.

                    System or driver rootkits (typically malicious software that hides from the operating system) start kernel- level malware while Windows is starting, before antimalware solutions can start.

                    Windows Trusted Boot verifies Windows boot components, including Microsoft drivers. Measured Boot runs in parallel with Trusted Boot and can provide information to a remote server that verifies the boot state of the device to help ensure that Trusted Boot and other boot components successfully checked the system.

                    An app infects other apps or the operating system with malware.

                    All Windows 10 Mobile apps run inside an AppContainer that isolates them from all other processes and sensitive operating system components. Apps cannot access any resources outside their AppContainer.

                    An unauthorized app or malware attempts to start on the device.

                    All Windows 10 Mobile apps must come from Microsoft Store or Microsoft Store for Business. Device Guard enforces administrative policies to select exactly which apps are allowed to run.

                    User-level malware exploits a vulnerability in the system or an application and owns the device.

                    Improvements to address space layout randomization (ASLR), Data Execution Prevention (DEP), the heap architecture, and memory-management algorithms reduce the likelihood that vulnerabilities can enable successful exploits.

                    -

                    Protected Processes isolates non-trusted processes from each other and from sensitive operating system components.

                    Users access a dangerous website without knowledge of the risk.

                    The Windows Defender SmartScreen URL Reputation feature prevents users from going to a malicious website that may try to exploit the browser and take control of the device.

                    Malware exploits a vulnerability in a browser add-on.

                    Microsoft Edge is an app built on the Universal Windows Platform (UWP) that does not run legacy binary extensions, including Microsoft ActiveX and browser helper objects frequently used for toolbars, which eliminates these risks.

                    A website that includes malicious code exploits a vulnerability in the web browser to run malware on the client device.

                    Microsoft Edge includes Enhanced Protected Mode, which uses AppContainer-based sandboxing to help protect the system against vulnerabilities that at attacker may discover in the extensions running in the browser (for example, Adobe Flash, Java) or the browser itself.

                    +|Threat|Windows 10 Mobile mitigation| +|--- |--- | +|Firmware bootkits replace the firmware with malware.|All certified devices include Unified Extensible Firmware (UEFI) with Secure Boot, which requires signed firmware for updates to UEFI and Option ROMs.| +|Bootkits start malware before Windows starts.|UEFI with Secure Boot verifies Windows bootloader integrity to help ensure that no malicious operating system can start before Windows.| +|System or driver rootkits (typically malicious software that hides from the operating system) start kernel- level malware while Windows is starting, before antimalware solutions can start.|Windows Trusted Boot verifies Windows boot components, including Microsoft drivers. Measured Boot runs in parallel with Trusted Boot and can provide information to a remote server that verifies the boot state of the device to help ensure that Trusted Boot and other boot components successfully checked the system.| +|An app infects other apps or the operating system with malware.|All Windows 10 Mobile apps run inside an AppContainer that isolates them from all other processes and sensitive operating system components. Apps cannot access any resources outside their AppContainer.| +|An unauthorized app or malware attempts to start on the device.|All Windows 10 Mobile apps must come from Microsoft Store or Microsoft Store for Business. Device Guard enforces administrative policies to select exactly which apps are allowed to run.| +|User-level malware exploits a vulnerability in the system or an application and owns the device.|Improvements to address space layout randomization (ASLR), Data Execution Prevention (DEP), the heap architecture, and memory-management algorithms reduce the likelihood that vulnerabilities can enable successful exploits.

                    Protected Processes isolates non-trusted processes from each other and from sensitive operating system components.| +|Users access a dangerous website without knowledge of the risk.|The Windows Defender SmartScreen URL Reputation feature prevents users from going to a malicious website that may try to exploit the browser and take control of the device.| +|Malware exploits a vulnerability in a browser add-on.|Microsoft Edge is an app built on the Universal Windows Platform (UWP) that does not run legacy binary extensions, including Microsoft ActiveX and browser helper objects frequently used for toolbars, which eliminates these risks.| +|A website that includes malicious code exploits a vulnerability in the web browser to run malware on the client device.|Microsoft Edge includes Enhanced Protected Mode, which uses AppContainer-based sandboxing to help protect the system against vulnerabilities that at attacker may discover in the extensions running in the browser (for example, Adobe Flash, Java) or the browser itself.| ->**Note:** The Windows 10 Mobile devices use a System on a Chip (SoC) design provided by SoC vendors such as Qualcomm. With this architecture, the SoC vendor and device manufacturers provide the pre-UEFI bootloaders and the UEFI environment. The UEFI environment implements the UEFI Secure Boot standard described in section 27 of the UEFI specification, which can be found at [www.uefi.org/specs]( http://www.uefi.org/specs). This standard describes the process by which all UEFI drivers and applications are validated against keys provisioned into a UEFI-based device before they are executed. + +> [!NOTE] +> The Windows 10 Mobile devices use a System on a Chip (SoC) design provided by SoC vendors such as Qualcomm. With this architecture, the SoC vendor and device manufacturers provide the pre-UEFI bootloaders and the UEFI environment. The UEFI environment implements the UEFI Secure Boot standard described in section 27 of the UEFI specification, which can be found at [www.uefi.org/specs]( http://www.uefi.org/specs). This standard describes the process by which all UEFI drivers and applications are validated against keys provisioned into a UEFI-based device before they are executed. ### UEFI with Secure Boot @@ -237,7 +201,8 @@ Windows 10 Mobile supports TPM implementations that comply with the 2.0 standard Many assume that original equipment manufacturers (OEMs) must implant a TPM in hardware on a motherboard as a discrete module, but TPM can also be effective when implemented in firmware. Windows 10 Mobile supports only firmware TPM that complies with the 2.0 standard. Windows does not differentiate between discrete and firmware-based solutions because both must meet the same implementation and security requirements. Therefore, any Windows 10 feature that can take advantage of TPM can be used with Windows 10 Mobile. ->Microsoft requires TPM 2.0 on devices running any version of Windows 10 Mobile. For more information, see [minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview) +> [!NOTE] +> Microsoft requires TPM 2.0 on devices running any version of Windows 10 Mobile. For more information, see [minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview) Several Windows 10 Mobile security features require TPM: - Virtual smart cards diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.yml b/windows/security/threat-protection/windows-defender-application-control/TOC.yml index 024e87e042..c25b0dbb9a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.yml +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.yml @@ -50,6 +50,8 @@ href: create-wdac-policy-for-fully-managed-devices.md - name: Create a WDAC policy for fixed-workload devices href: create-initial-default-policy.md + - name: Create a WDAC deny list policy + href: create-wdac-deny-policy.md - name: Microsoft recommended block rules href: microsoft-recommended-block-rules.md - name: Microsoft recommended driver block rules diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md index f983e81eba..1c676d9236 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md @@ -50,77 +50,22 @@ You can perform this task by using the Group Policy Management Console for an Ap 3. On the **Before You Begin** page, select **Next**. 4. On the **Permissions** page, select the action (allow or deny) and the user or group that the rule should apply to, and then select **Next**. 5. On the **Publisher** page, you can select a specific reference for the packaged app rule and set the scope for the rule. The following table describes the reference options. - - - - - - - - - - - - - - - - - - - - - - - - - -
                    SelectionDescriptionExample

                    Use an installed packaged app as a reference

                    If selected, AppLocker requires you to choose an app that is already installed on which to base your new rule. AppLocker uses the publisher, package name and package version to define the rule.

                    You want the Sales group only to use the app named Microsoft.BingMaps for its outside sales calls. The Microsoft.BingMaps app is already installed on the device where you are creating the rule, so you choose this option, and select the app from the list of apps installed on the computer and create the rule using this app as a reference.

                    Use a packaged app installer as a reference

                    If selected, AppLocker requires you to choose an app installer on which to base your new rule. A packaged app installer has the .appx extension. AppLocker uses the publisher, package name, and package version of the installer to define the rule.

                    Your company has developed many internal line-of-business packaged apps. The app installers are stored on a common file share. Employees can install the required apps from that file share. You want to allow all your employees to install the Payroll app from this share. So you choose this option from the wizard, browse to the file share, and choose the installer for the Payroll app as a reference to create your rule.

                    -   + + |Selection|Description|Example| + |--- |--- |--- | + |**Use an installed packaged app as a reference**|If selected, AppLocker requires you to choose an app that is already installed on which to base your new rule. AppLocker uses the publisher, package name and package version to define the rule.|You want the Sales group only to use the app named Microsoft.BingMaps for its outside sales calls. The Microsoft.BingMaps app is already installed on the device where you are creating the rule, so you choose this option, and select the app from the list of apps installed on the computer and create the rule using this app as a reference.| + |**Use a packaged app installer as a reference**|If selected, AppLocker requires you to choose an app installer on which to base your new rule. A packaged app installer has the .appx extension. AppLocker uses the publisher, package name, and package version of the installer to define the rule.|Your company has developed many internal line-of-business packaged apps. The app installers are stored on a common file share. Employees can install the required apps from that file share. You want to allow all your employees to install the Payroll app from this share. So you choose this option from the wizard, browse to the file share, and choose the installer for the Payroll app as a reference to create your rule.| + The following table describes setting the scope for the packaged app rule. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                    SelectionDescriptionExample

                    Applies to Any publisher

                    This is the least restrictive scope condition for an Allow rule. It permits every packaged app to run or install.

                    -

                    Conversely, if this is a Deny rule, then this option is the most restrictive because it denies all apps from installing or running.

                    You want the Sales group to use any packaged app from any signed publisher. You set the permissions to allow the Sales group to be able to run any app.

                    Applies to a specific Publisher

                    This scopes the rule to all apps published by a particular publisher.

                    You want to allow all your users to install apps published by the publisher of Microsoft.BingMaps. You could select Microsoft.BingMaps as a reference and choose this rule scope.

                    Applies to a Package name

                    This scopes the rule to all packages that share the publisher name and package name as the reference file.

                    You want to allow your Sales group to install any version of the Microsoft.BingMaps app. You could select the Microsoft.BingMaps app as a reference and choose this rule scope.

                    Applies to a Package version

                    This scopes the rule to a particular version of the package.

                    You want to be very selective in what you allow. You do not want to implicitly trust all future updates of the Microsoft.BingMaps app. You can limit the scope of your rule to the version of the app currently installed on your reference computer.

                    Applying custom values to the rule

                    Selecting the Use custom values check box allows you to adjust the scope fields for your particular circumstance.

                    You want to allow users to install all Microsoft.Bing* applications, which include Microsoft.BingMaps, Microsoft.BingWeather, Microsoft.BingMoney. You can choose the Microsoft.BingMaps as a reference, select the Use custom values check box and edit the package name field by adding “Microsoft.Bing*” as the Package name.

                    -   + + |Selection|Description|Example| + |--- |--- |--- | + |Applies to **Any publisher**|This is the least restrictive scope condition for an **Allow** rule. It permits every packaged app to run or install.

                    Conversely, if this is a **Deny** rule, then this option is the most restrictive because it denies all apps from installing or running. | You want the Sales group to use any packaged app from any signed publisher. You set the permissions to allow the Sales group to be able to run any app.| + |Applies to a specific **Publisher** | This scopes the rule to all apps published by a particular publisher. | You want to allow all your users to install apps published by the publisher of Microsoft.BingMaps. You could select Microsoft.BingMaps as a reference and choose this rule scope. | + |Applies to a **Package name** | This scopes the rule to all packages that share the publisher name and package name as the reference file. | You want to allow your Sales group to install any version of the Microsoft.BingMaps app. You could select the Microsoft.BingMaps app as a reference and choose this rule scope. | + |Applies to a **Package version** | This scopes the rule to a particular version of the package. | You want to be very selective in what you allow. You do not want to implicitly trust all future updates of the Microsoft.BingMaps app. You can limit the scope of your rule to the version of the app currently installed on your reference computer. | + |Applying custom values to the rule | Selecting the **Use custom values** check box allows you to adjust the scope fields for your particular circumstance. | You want to allow users to install all *Microsoft.Bing* applications, which include Microsoft.BingMaps, Microsoft.BingWeather, Microsoft.BingMoney. You can choose the Microsoft.BingMaps as a reference, select the **Use custom values** check box and edit the package name field by adding “Microsoft.Bing*” as the Package name. | + 6. Select **Next**. 7. (Optional) On the **Exceptions** page, specify conditions by which to exclude files from being affected by the rule. This allows you to add exceptions based on the same rule reference and rule scope as you set before. Select **Next**. 8. On the **Name** page, either accept the automatically generated rule name or type a new rule name, and then select **Create**. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md index e4bdbbc2b7..bb43e3b175 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md @@ -37,137 +37,23 @@ There are management and maintenance costs associated with a list of allowed app Use the following table to develop your own objectives and determine which application control feature best addresses those objectives. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                    Application control functionSRPAppLocker

                    Scope

                    SRP policies can be applied to all Windows operating systems beginning with Windows XP and Windows Server 2003.

                    AppLocker policies apply only to the support versions of Windows listed in Requirements to use AppLocker.

                    Policy creation

                    SRP policies are maintained through Group Policy and only the administrator of the GPO can update the SRP policy. The administrator on the local computer can modify the SRP policies defined in the local GPO.

                    AppLocker policies are maintained through Group Policy and only the administrator of the GPO can update the policy. The administrator on the local computer can modify the AppLocker policies defined in the local GPO.

                    -

                    AppLocker permits customization of error messages to direct users to a Web page for help.

                    Policy maintenance

                    SRP policies must be updated by using the Local Security Policy snap-in (if the policies are created locally) or the Group Policy Management Console (GPMC).

                    AppLocker policies can be updated by using the Local Security Policy snap-in, if the policies are created locally, or the GPMC, or the Windows PowerShell AppLocker cmdlets.

                    Policy application

                    SRP policies are distributed through Group Policy.

                    AppLocker policies are distributed through Group Policy.

                    Enforcement mode

                    SRP works in the “deny list mode” where administrators can create rules for files that they don't want to allow in this Enterprise, but the rest of the files are allowed to run by default.

                    -

                    SRP can also be configured in the “allow list mode” such that by default all files are blocked and administrators need to create allow rules for files that they want to allow.

                    By default, AppLocker works in allow list mode. Only those files are allowed to run for which there's a matching allow rule.

                    File types that can be controlled

                    SRP can control the following file types:

                    -
                      -

                    • Executables

                      • -

                    • DLLs

                      • -

                    • Scripts

                      • -

                    • Windows Installers

                      • -
                    -

                    SRP cannot control each file type separately. All SRP rules are in a single rule collection.

                    AppLocker can control the following file types:

                    -
                      -

                    • Executables

                      • -

                    • DLLs

                      • -

                    • Scripts

                      • -

                    • Windows Installers

                      • -

                    • Packaged apps and installers

                      • -
                    -

                    AppLocker maintains a separate rule collection for each of the five file types.

                    Designated file types

                    SRP supports an extensible list of file types that are considered executable. You can add extensions for files that should be considered executable.

                    AppLocker doesn't support this. AppLocker currently supports the following file extensions:

                    -
                      -

                    • Executables (.exe, .com)

                      • -

                    • DLLs (.ocx, .dll)

                      • -

                    • Scripts (.vbs, .js, .ps1, .cmd, .bat)

                      • -

                    • Windows Installers (.msi, .mst, .msp)

                      • -

                    • Packaged app installers (.appx)

                      • -

                    Rule types

                    SRP supports four types of rules:

                    -
                      -

                    • Hash

                      • -

                    • Path

                      • -

                    • Signature

                      • -

                    • Internet zone

                      • -

                    AppLocker supports three types of rules:

                    -
                      -

                    • Hash

                      • -

                    • Path

                      • -

                    • Publisher

                      • -

                    Editing the hash value

                    SRP allows you to select a file to hash.

                    AppLocker computes the hash value itself. Internally it uses the SHA2 Authenticode hash for Portable Executables (exe and DLL) and Windows Installers and an SHA2 flat file hash for the rest.

                    Support for different security levels

                    With SRP, you can specify the permissions with which an app can run. Then configure a rule such that Notepad always runs with restricted permissions and never with administrative privileges.

                    -

                    SRP on Windows Vista and earlier supported multiple security levels. On Windows 7, that list was restricted to just two levels: Disallowed and Unrestricted (Basic User translates to Disallowed).

                    AppLocker does not support security levels.

                    Manage Packaged apps and Packaged app installers.

                    Unable

                    .appx is a valid file type which AppLocker can manage.

                    Targeting a rule to a user or a group of users

                    SRP rules apply to all users on a particular computer.

                    AppLocker rules can be targeted to a specific user or a group of users.

                    Support for rule exceptions

                    SRP does not support rule exceptions

                    AppLocker rules can have exceptions that allow administrators to create rules such as “Allow everything from Windows except for Regedit.exe”.

                    Support for audit mode

                    SRP doesn't support audit mode. The only way to test SRP policies is to set up a test environment and run a few experiments.

                    AppLocker supports audit mode that allows administrators to test the effect of their policy in the real production environment without impacting the user experience. Once you are satisfied with the results, you can start enforcing the policy.

                    Support for exporting and importing policies

                    SRP does not support policy import/export.

                    AppLocker supports the importing and exporting of policies. This allows you to create AppLocker policy on a sample computer, test it out and then export that policy and import it back into the desired GPO.

                    Rule enforcement

                    Internally, SRP rules enforcement happens in user-mode, which is less secure.

                    Internally, AppLocker rules for exes and dlls are enforced in kernel-mode, which is more secure than enforcing them in the user-mode.

                    +|Application control function|SRP|AppLocker| +|--- |--- |--- | +|Scope|SRP policies can be applied to all Windows operating systems beginning with Windows XP and Windows Server 2003.|AppLocker policies apply only to the support versions of Windows listed in[Requirements to use AppLocker](requirements-to-use-applocker.md).| +|Policy creation|SRP policies are maintained through Group Policy and only the administrator of the GPO can update the SRP policy. The administrator on the local computer can modify the SRP policies defined in the local GPO.|AppLocker policies are maintained through Group Policy and only the administrator of the GPO can update the policy. The administrator on the local computer can modify the AppLocker policies defined in the local GPO.

                    AppLocker permits customization of error messages to direct users to a Web page for help.| +|Policy maintenance|SRP policies must be updated by using the Local Security Policy snap-in (if the policies are created locally) or the Group Policy Management Console (GPMC).|AppLocker policies can be updated by using the Local Security Policy snap-in, if the policies are created locally, or the GPMC, or the Windows PowerShell AppLocker cmdlets.| +|Policy application|SRP policies are distributed through Group Policy.|AppLocker policies are distributed through Group Policy.| +|Enforcement mode|SRP works in the “deny list mode” where administrators can create rules for files that they don't want to allow in this Enterprise, but the rest of the files are allowed to run by default.

                    SRP can also be configured in the “allow list mode” such that by default all files are blocked and administrators need to create allow rules for files that they want to allow.|By default, AppLocker works in allow list mode. Only those files are allowed to run for which there's a matching allow rule.| +|File types that can be controlled|SRP can control the following file types:

                  • Executables
                  • DLLs
                  • Scripts
                  • Windows Installers

                    SRP cannot control each file type separately. All SRP rules are in a single rule collection.|AppLocker can control the following file types:
                  • Executables
                  • DLLs
                  • Scripts
                  • Windows Installers
                  • Packaged apps and installers

                    AppLocker maintains a separate rule collection for each of the five file types.| +|Designated file types|SRP supports an extensible list of file types that are considered executable. You can add extensions for files that should be considered executable.|AppLocker doesn't support this. AppLocker currently supports the following file extensions:
                  • Executables (.exe, .com)
                  • DLLs (.ocx, .dll)
                  • Scripts (.vbs, .js, .ps1, .cmd, .bat)
                  • Windows Installers (.msi, .mst, .msp)
                  • Packaged app installers (.appx)| +|Rule types|SRP supports four types of rules:
                  • Hash
                  • Path
                  • Signature

                    Internet zone|AppLocker supports three types of rules:
                  • Hash
                  • Path
                  • Publisher| +|Editing the hash value|SRP allows you to select a file to hash.|AppLocker computes the hash value itself. Internally it uses the SHA2 Authenticode hash for Portable Executables (exe and DLL) and Windows Installers and an SHA2 flat file hash for the rest.| +|Support for different security levels|With SRP, you can specify the permissions with which an app can run. Then configure a rule such that Notepad always runs with restricted permissions and never with administrative privileges.

                    SRP on Windows Vista and earlier supported multiple security levels. On Windows 7, that list was restricted to just two levels: Disallowed and Unrestricted (Basic User translates to Disallowed).|AppLocker does not support security levels.| +|Manage Packaged apps and Packaged app installers.|Unable|.appx is a valid file type which AppLocker can manage.| +|Targeting a rule to a user or a group of users|SRP rules apply to all users on a particular computer.|AppLocker rules can be targeted to a specific user or a group of users.| +|Support for rule exceptions|SRP does not support rule exceptions|AppLocker rules can have exceptions that allow administrators to create rules such as “Allow everything from Windows except for Regedit.exe”.| +|Support for audit mode|SRP doesn't support audit mode. The only way to test SRP policies is to set up a test environment and run a few experiments.|AppLocker supports audit mode that allows administrators to test the effect of their policy in the real production environment without impacting the user experience. Once you are satisfied with the results, you can start enforcing the policy.| +|Support for exporting and importing policies|SRP does not support policy import/export.|AppLocker supports the importing and exporting of policies. This allows you to create AppLocker policy on a sample computer, test it out and then export that policy and import it back into the desired GPO.| +|Rule enforcement|Internally, SRP rules enforcement happens in user-mode, which is less secure.|Internally, AppLocker rules for exes and dlls are enforced in kernel-mode, which is more secure than enforcing them in the user-mode.| For more general info, see AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md index 252fb96ede..f21a48c714 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md @@ -43,96 +43,16 @@ To complete this AppLocker planning document, you should first complete the foll After you determine how to structure your Group Policy Objects (GPOs) so that you can apply AppLocker policies, you should record your findings. You can use the following table to determine how many GPOs to create (or edit) and which objects they are linked to. If you decided to create custom rules to allow system files to run, note the high-level rule configuration in the **Use default rule or define new rule condition** column. The following table includes the sample data that was collected when you determined your enforcement settings and the GPO structure for your AppLocker policies. - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                    Business groupOrganizational unitImplement AppLocker?AppsInstallation pathUse default rule or define new rule conditionAllow or denyGPO name

                    Bank Tellers

                    Teller-East and Teller-West

                    Yes

                    Teller Software

                    C:\Program Files\Woodgrove\Teller.exe

                    File is signed; create a publisher condition

                    Allow

                    Tellers-AppLockerTellerRules

                    Windows files

                    C:\Windows

                    Create a path exception to the default rule to exclude \Windows\Temp

                    Allow

                    Human Resources

                    HR-All

                    Yes

                    Check Payout

                    C:\Program Files\Woodgrove\HR\Checkcut.exe

                    File is signed; create a publisher condition

                    Allow

                    HR-AppLockerHRRules

                    Time Sheet Organizer

                    -

                    C:\Program Files\Woodgrove\HR\Timesheet.exe

                    -

                    File is not signed; create a file hash condition

                    -

                    Allow

                    Internet Explorer 7

                    C:\Program Files\Internet Explorer</p>

                    File is signed; create a publisher condition

                    Deny

                    Windows files

                    C:\Windows

                    Use a default rule for the Windows path

                    Allow

                    - + +|Business group|Organizational unit|Implement AppLocker?|Apps|Installation path|Use default rule or define new rule condition|Allow or deny|GPO name| +|--- |--- |--- |--- |--- |--- |--- |--- | +|Bank Tellers|Teller-East and Teller-West|Yes|Teller Software|C:\Program Files\Woodgrove\Teller.exe|File is signed; create a publisher condition|Allow|Tellers-AppLockerTellerRules| +||||Windows files|C:\Windows|Create a path exception to the default rule to exclude \Windows\Temp|Allow|| +|Human Resources|HR-All|Yes|Check Payout|C:\Program Files\Woodgrove\HR\Checkcut.exe|File is signed; create a publisher condition|Allow|HR-AppLockerHRRules| +||||Time Sheet Organizer|C:\Program Files\Woodgrove\HR\Timesheet.exe|File is not signed; create a file hash condition|Allow|| +||||Internet Explorer 7|C:\Program Files\Internet Explorer

                    |File is signed; create a publisher condition|Deny|| +||||Windows files|C:\Windows|Use a default rule for the Windows path|Allow|| + ## Next steps After you have determined the Group Policy structure and rule enforcement strategy for each business group's apps, the following tasks remain: diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md index 33ffa59ce9..5f360731db 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md @@ -42,70 +42,18 @@ Record the name of the app, whether it is signed as indicated by the publisher's Record the installation path of the apps. For example, Microsoft Office 2016 installs files to *%programfiles%\\Microsoft Office\\Office16\\*, which is *C:\\Program Files\\Microsoft Office\\Office16\\* on most devices. The following table provides an example of how to list applications for each business group at the early stage of designing your application control policies. Eventually, as more planning information is added to the list, the information can be used to build AppLocker rules. - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                    Business groupOrganizational unitImplement AppLocker?AppsInstallation path

                    Bank Tellers

                    Teller-East and Teller-West

                    Yes

                    Teller Software

                    C:\Program Files\Woodgrove\Teller.exe

                    Windows files

                    C:\Windows

                    Human Resources

                    HR-All

                    Yes

                    Check Payout

                    C:\Program Files\Woodgrove\HR\Checkcut.exe

                    Time Sheet Organizer

                    C:\Program Files\Woodgrove\HR\Timesheet.exe

                    Internet Explorer 7

                    C:\Program Files\Internet Explorer</p>

                    Windows files

                    C:\Windows

                    - ->Note: AppLocker only supports publisher rules for Universal Windows apps. Therefore, collecting the installation path information for Universal Windows apps is not necessary. + +|Business group|Organizational unit|Implement AppLocker?|Apps|Installation path| +|--- |--- |--- |--- |--- | +|Bank Tellers|Teller-East and Teller-West|Yes|Teller Software|C:\Program Files\Woodgrove\Teller.exe| +||||Windows files|C:\Windows| +|Human Resources|HR-All|Yes|Check Payout|C:\Program Files\Woodgrove\HR\Checkcut.exe| +||||Time Sheet Organizer|C:\Program Files\Woodgrove\HR\Timesheet.exe| +||||Internet Explorer 7|C:\Program Files\Internet Explorer

                    | +||||Windows files|C:\Windows| + +>[!NOTE] +>AppLocker only supports publisher rules for Universal Windows apps. Therefore, collecting the installation path information for Universal Windows apps is not necessary. Event processing diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md index 2db8ca7042..151e00dc31 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md @@ -46,86 +46,15 @@ Document the following items for each business group or organizational unit: The following table details sample data for documenting rule type and rule condition findings. In addition, you should now consider whether to allow an app to run or deny permission for it to run. For info about these settings, see [Understanding AppLocker allow and deny actions on rules](understanding-applocker-allow-and-deny-actions-on-rules.md). - --------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                    Business groupOrganizational unitImplement AppLocker?ApplicationsInstallation pathUse default rule or define new rule conditionAllow or deny

                    Bank Tellers

                    Teller-East and Teller-West

                    Yes

                    Teller Software

                    C:\Program Files\Woodgrove\Teller.exe

                    File is signed; create a publisher condition

                    Windows files

                    C:\Windows

                    Create a path exception to the default rule to exclude \Windows\Temp

                    Human Resources

                    HR-All

                    Yes

                    Check Payout

                    C:\Program Files\Woodgrove\HR\Checkcut.exe

                    File is signed; create a publisher condition

                    Time Sheet Organizer

                    C:\Program Files\Woodgrove\HR\Timesheet.exe

                    File is not signed; create a file hash condition

                    Internet Explorer 7

                    C:\Program Files\Internet Explorer</p>

                    File is signed; create a publisher condition

                    Windows files

                    C:\Windows

                    Use the default rule for the Windows path

                    +|Business group|Organizational unit|Implement AppLocker?|Applications|Installation path|Use default rule or define new rule condition|Allow or deny| +|--- |--- |--- |--- |--- |--- |--- | +|Bank Tellers|Teller-East and Teller-West|Yes|Teller Software|C:\Program Files\Woodgrove\Teller.exe|File is signed; create a publisher condition|| +||||Windows files|C:\Windows|Create a path exception to the default rule to exclude \Windows\Temp|| +|Human Resources|HR-All|Yes|Check Payout|C:\Program Files\Woodgrove\HR\Checkcut.exe|File is signed; create a publisher condition|| +||||Time Sheet Organizer|C:\Program Files\Woodgrove\HR\Timesheet.exe|File is not signed; create a file hash condition|| +||||Internet Explorer 7|C:\Program Files\Internet Explorer

                    |File is signed; create a publisher condition|| +||||Windows files|C:\Windows|Use the default rule for the Windows path|| - ## Next steps For each rule, determine whether to use the allow or deny option, and then complete the following tasks: diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md index b114297f17..2f5df9dc7c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md @@ -87,7 +87,8 @@ As new apps are deployed or existing apps are updated by the software publisher, You can edit an AppLocker policy by adding, changing, or removing rules. However, you cannot specify a version for the policy by importing additional rules. To ensure version control when modifying an AppLocker policy, use Group Policy management software that allows you to create versions of Group Policy Objects (GPOs). An example of this type of software is the Advanced Group Policy Management feature from the Microsoft Desktop Optimization Pack. For more info about Advanced Group Policy Management, see [Advanced Group Policy Management Overview](https://go.microsoft.com/fwlink/p/?LinkId=145013) (https://go.microsoft.com/fwlink/p/?LinkId=145013). ->**Caution:**  You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. +> [!IMPORTANT] +> You should not edit an AppLocker rule collection while it is being enforced in Group Policy. Because AppLocker controls what files are allowed to run, making changes to a live policy can create unexpected behavior. **New version of a supported app** @@ -143,103 +144,15 @@ The three key areas to determine for AppLocker policy management are: The following table contains the added sample data that was collected when determining how to maintain and manage AppLocker policies. - ----------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                    Business groupOrganizational unitImplement AppLocker?AppsInstallation pathUse default rule or define new rule conditionAllow or denyGPO nameSupport policy

                    Bank Tellers

                    Teller-East and Teller-West

                    Yes

                    Teller Software

                    C:\Program Files\Woodgrove\Teller.exe

                    File is signed; create a publisher condition

                    Allow

                    Tellers-AppLockerTellerRules

                    Web help

                    Windows files

                    -

                    C:\Windows

                    Create a path exception to the default rule to exclude \Windows\Temp

                    Allow

                    Help desk

                    Human Resources

                    HR-All

                    Yes

                    Check Payout

                    C:\Program Files\Woodgrove\HR\Checkcut.exe

                    File is signed; create a publisher condition

                    Allow

                    HR-AppLockerHRRules

                    Web help

                    Time Sheet Organizer

                    C:\Program Files\Woodgrove\HR\Timesheet.exe

                    File is not signed; create a file hash condition

                    Allow

                    Web help

                    Internet Explorer 7

                    C:\Program Files\Internet Explorer</p>

                    File is signed; create a publisher condition

                    Deny

                    Web help

                    -

                    Windows files

                    C:\Windows

                    Use the default rule for the Windows path

                    Allow

                    Help desk

                    - +|Business group|Organizational unit|Implement AppLocker?|Apps|Installation path|Use default rule or define new rule condition|Allow or deny|GPO name|Support policy| +|--- |--- |--- |--- |--- |--- |--- |--- |--- | +|Bank Tellers|Teller-East and Teller-West|Yes|Teller Software|C:\Program Files\Woodgrove\Teller.exe|File is signed; create a publisher condition|Allow|Tellers-AppLockerTellerRules|Web help| +||||Windows files|C:\Windows|Create a path exception to the default rule to exclude \Windows\Temp|Allow||Help desk| +|Human Resources|HR-All|Yes|Check Payout|C:\Program Files\Woodgrove\HR\Checkcut.exe|File is signed; create a publisher condition|Allow|HR-AppLockerHRRules|Web help| +||||Time Sheet Organizer|C:\Program Files\Woodgrove\HR\Timesheet.exe|File is not signed; create a file hash condition|Allow||Web help| +||||Internet Explorer 7|C:\Program Files\Internet Explorer

                    |File is signed; create a publisher condition|Deny||Web help| +||||Windows files|C:\Windows|Use the default rule for the Windows path|Allow||Help desk| + The following two tables illustrate examples of documenting considerations to maintain and manage AppLocker policies. **Event processing policy** @@ -248,83 +161,17 @@ One discovery method for app usage is to set the AppLocker enforcement mode to * The following table is an example of what to consider and record. - ------- - - - - - - - - - - - - - - - - - - - - - - - - - -
                    Business groupAppLocker event collection locationArchival policyAnalyzed?Security policy

                    Bank Tellers

                    Forwarded to: AppLocker Event Repository on srvBT093

                    Standard

                    None

                    Standard

                    Human Resources

                    DO NOT FORWARD. srvHR004

                    60 months

                    Yes, summary reports monthly to managers

                    Standard

                    +|Business group|AppLocker event collection location|Archival policy|Analyzed?|Security policy| +|--- |--- |--- |--- |--- | +|Bank Tellers|Forwarded to: AppLocker Event Repository on srvBT093|Standard|None|Standard| +|Human Resources|DO NOT FORWARD. srvHR004|60 months|Yes, summary reports monthly to managers|Standard| Policy maintenance policy When applications are identified and policies are created for application control, then you can begin documenting how you intend to update those policies. The following table is an example of what to consider and record. - ------- - - - - - - - - - - - - - - - - - - - - - - - - - -
                    Business groupRule update policyApplication decommission policyApplication version policyApplication deployment policy

                    Bank Tellers

                    Planned: Monthly through business office triage

                    -

                    Emergency: Request through help desk

                    Through business office triage

                    -

                    30-day notice required

                    General policy: Keep past versions for 12 months

                    -

                    List policies for each application

                    Coordinated through business office

                    -

                    30-day notice required

                    Human Resources

                    Planned: Monthly through HR triage

                    -

                    Emergency: Request through help desk

                    Through HR triage

                    -

                    30-day notice required

                    General policy: Keep past versions for 60 months

                    -

                    List policies for each application

                    Coordinated through HR

                    -

                    30-day notice required

                    \ No newline at end of file + +|Business group|Rule update policy|Application decommission policy|Application version policy|Application deployment policy| +|--- |--- |--- |--- |--- | +|Bank Tellers|Planned: Monthly through business office triage

                    Emergency: Request through help desk|Through business office triage

                    30-day notice required|General policy: Keep past versions for 12 months

                    List policies for each application|Coordinated through business office

                    30-day notice required| +|Human Resources|Planned: Monthly through HR triage

                    Emergency: Request through help desk|Through HR triage

                    30-day notice required|General policy: Keep past versions for 60 months

                    List policies for each application|Coordinated through HR

                    30-day notice required| + diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md index 85f6eb11a3..4b22f44415 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md @@ -41,181 +41,28 @@ The following requirements must be met or addressed before you deploy your AppLo An AppLocker policy deployment plan is the result of investigating which applications are required and necessary in your organization, which apps are optional, and which apps are forbidden. To develop this plan, see [AppLocker Design Guide](applocker-policies-design-guide.md). The following table is an example of the data you need to collect and the decisions you need to make to successfully deploy AppLocker policies on the supported operating systems (as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md)). - ----------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                    Business groupOrganizational unitImplement AppLocker?AppsInstallation pathUse default rule or define new rule conditionAllow or denyGPO nameSupport policy

                    Bank Tellers

                    Teller-East and Teller-West

                    Yes

                    Teller software

                    C:\Program Files\Woodgrove\Teller.exe

                    File is signed; create a publisher condition

                    Allow

                    Tellers

                    Web help

                    Windows files

                    -

                    C:\Windows

                    Create a path exception to the default rule to exclude \Windows\Temp

                    Allow

                    Help Desk

                    Time Sheet Organizer

                    C:\Program Files\Woodgrove\HR\Timesheet.exe

                    File is not signed; create a file hash condition

                    Allow

                    Web help

                    Human Resources

                    HR-All

                    Yes

                    Check Payout

                    C:\Program Files\Woodgrove\HR\Checkcut.exe

                    File is signed; create a publisher condition

                    Allow

                    HR

                    Web help

                    Internet Explorer 7

                    C:\Program Files\Internet Explorer</p>

                    File is signed; create a publisher condition

                    Deny

                    Help Desk

                    Windows files

                    C:\Windows

                    Use the default rule for the Windows path

                    Allow

                    Help Desk

                    +|Business group|Organizational unit|Implement AppLocker?|Apps|Installation path|Use default rule or define new rule condition|Allow or deny|GPO name|Support policy| +|--- |--- |--- |--- |--- |--- |--- |--- |--- | +|Bank Tellers|Teller-East and Teller-West|Yes|Teller software|C:\Program Files\Woodgrove\Teller.exe|File is signed; create a publisher condition|Allow|Tellers|Web help| +||||Windows files|C:\Windows|Create a path exception to the default rule to exclude \Windows\Temp|Allow||Help Desk| +||||Time Sheet Organizer|C:\Program Files\Woodgrove\HR\Timesheet.exe|File is not signed; create a file hash condition|Allow||Web help| +|Human Resources|HR-All|Yes|Check Payout|C:\Program Files\Woodgrove\HR\Checkcut.exe|File is signed; create a publisher condition|Allow|HR|Web help| +||||Internet Explorer 7|C:\Program Files\Internet Explorer

                    |File is signed; create a publisher condition|Deny||Help Desk| +||||Windows files|C:\Windows|Use the default rule for the Windows path|Allow||Help Desk| Event processing policy - ------- - - - - - - - - - - - - - - - - - - - - - - - - - -
                    Business groupAppLocker event collection locationArchival policyAnalyzed?Security policy

                    Bank Tellers

                    Forwarded to: srvBT093

                    Standard

                    None

                    Standard

                    Human Resources

                    Do not forward

                    -

                    60 months

                    Yes; summary reports monthly to managers

                    Standard

                    +|Business group|AppLocker event collection location|Archival policy|Analyzed?|Security policy| +|--- |--- |--- |--- |--- | +|Bank Tellers|Forwarded to: srvBT093|Standard|None|Standard| +|Human Resources|Do not forward|60 months|Yes; summary reports monthly to managers|Standard| Policy maintenance policy - ------- - - - - - - - - - - - - - - - - - - - - - - - - - -
                    Business groupRule update policyApp decommission policyApp version policyApp deployment policy

                    Bank Tellers

                    Planned: Monthly through business office triage

                    -

                    Emergency: Request through Help Desk

                    Through business office triage; 30-day notice required

                    General policy: Keep past versions for 12 months

                    -

                    List policies for each application

                    Coordinated through business office; 30-day notice required

                    Human Resources

                    Planned: Through HR triage

                    -

                    Emergency: Request through Help Desk

                    Through HR triage; 30-day notice required

                    -

                    General policy: Keep past versions for 60 months

                    -

                    List policies for each application

                    Coordinated through HR; 30-day notice required

                    +|Business group|Rule update policy|App decommission policy|App version policy|App deployment policy| +|--- |--- |--- |--- |--- | +|Bank Tellers|Planned: Monthly through business office triage

                    Emergency: Request through Help Desk|Through business office triage; 30-day notice required|General policy: Keep past versions for 12 months

                    List policies for each application|Coordinated through business office; 30-day notice required| +|Human Resources|Planned: Through HR triage

                    Emergency: Request through Help Desk|Through HR triage; 30-day notice required|General policy: Keep past versions for 60 months

                    List policies for each application|Coordinated through HR; 30-day notice required| ### Supported operating systems diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md index 2d5fca2ebb..c14abfaefc 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md @@ -57,7 +57,8 @@ You might need to control a limited number of apps because they access sensitive | Control apps by computer, not user | AppLocker is a computer-based policy implementation. If your domain or site organizational structure is not based on a logical user structure, such as an OU, you might want to set up that structure before you begin your AppLocker planning. Otherwise, you will have to identify users, their computers, and their app access requirements.| |Understand app usage, but there is no need to control any apps yet | AppLocker policies can be set to audit app usage to help you track which apps are used in your organization. You can then use the AppLocker event log to create AppLocker policies.| ->**Important:** The following list contains files or types of files that cannot be managed by AppLocker: +> [!IMPORTANT] +> The following list contains files or types of files that cannot be managed by AppLocker: - AppLocker does not protect against running 16-bit DOS binaries in an NT Virtual DOS Machine (NTVDM). This technology allows running legacy DOS and 16-bit Windows programs on computers that are using Intel 80386 or higher when there is already another operating system running and controlling the hardware. The result is that 16-bit binaries can still run on Windows Server 2008 R2 and Windows 7 when AppLocker is configured to otherwise block binaries and libraries. If it is a requirement to prevent 16-bit applications from running, you must configure the Deny rule in the Executable rule collection for NTVDM.exe. @@ -65,7 +66,8 @@ You might need to control a limited number of apps because they access sensitive - AppLocker can only control VBScript, JScript, .bat files, .cmd files and Windows PowerShell scripts. It does not control all interpreted code that runs within a host process, for example Perl scripts and macros. Interpreted code is a form of executable code that runs within a host process. For example, Windows batch files (\*.bat) run within the context of the Windows Command Host (cmd.exe). To use AppLocker to control interpreted code, the host process must call AppLocker before it runs the interpreted code, and then enforce the decision that is returned by AppLocker. Not all host processes call into AppLocker. Therefore, AppLocker cannot control every kind of interpreted code, for example Microsoft Office macros. - >**Important:** You should configure the appropriate security settings of these host processes if you must allow them to run. For example, configure the security settings in Microsoft Office to ensure that only signed and trusted macros are loaded. + > [!IMPORTANT] + > You should configure the appropriate security settings of these host processes if you must allow them to run. For example, configure the security settings in Microsoft Office to ensure that only signed and trusted macros are loaded. - AppLocker rules allow or prevent an app from launching. AppLocker does not control the behavior of apps after they are launched. Applications could contain flags that are passed to functions that signal AppLocker to circumvent the rules and allow another .exe or .dll file to be loaded. In practice, an app that is allowed by AppLocker could use these flags to bypass AppLocker rules and launch child processes. You must follow a process that best suits your needs to thoroughly vet each app before allowing them to run using AppLocker rules. @@ -98,57 +100,11 @@ Most organizations have evolved app control policies and methods over time. With ### Which Windows desktop and server operating systems are running in your organization? If your organization supports multiple Windows operating systems, app control policy planning becomes more complex. Your initial design decisions should consider the security and management priorities of applications that are installed on each version of the operating system. - ---- - - - - - - - - - - - - - - - - -
                    Possible answersDesign considerations

                    Your organization's computers are running a combination of the following operating systems:

                    -
                      -

                    • Windows 11

                      • -

                    • Windows 10

                      • -

                    • Windows 8

                      • -

                    • Windows 7

                      • -

                    • Windows Vista

                      • -

                    • Windows XP

                      • -

                    • Windows Server 2012

                      • -

                    • Windows Server 2008 R2

                      • -

                    • Windows Server 2008

                      • -

                    • Windows Server 2003

                      • -

                    AppLocker rules are only applied to computers running the supported versions of Windows, but SRP rules can be applied to all versions of Windows beginning with Windows XP and Windows Server 2003. For specific operating system version requirements, see Requirements to use AppLocker.

                    -
                    -Note

                    If you are using the Basic User security level as assigned in SRP, those privileges are not supported on computers running that support AppLocker.

                    -
                    -
                    -
                    -

                    AppLocker policies as applied through a GPO take precedence over SRP policies in the same or linked GPO. SRP policies can be created and maintained the same way.

                    Your organization's computers are running only the following operating systems:

                    -
                      -

                    • Windows 11

                      • -

                    • Windows 10

                      • -

                    • Windows 8.1

                      • -

                    • Windows 8

                      • -

                    • Windows 7

                      • -

                    • Windows Server 2012 R2

                      • -

                    • Windows Server 2012

                      • -

                    • Windows Server 2008 R2

                      • -

                    Use AppLocker to create your application control policies.

                    +|Possible answers|Design considerations| +|--- |--- | +|Your organization's computers are running a combination of the following operating systems:

                  • Windows 11
                  • Windows 10
                  • Windows 8
                  • Windows 7
                  • Windows Vista
                  • Windows XP
                  • Windows Server 2012
                  • Windows Server 2008 R2
                  • Windows Server 2008
                  • Windows Server 2003|AppLocker rules are only applied to computers running the supported versions of Windows, but SRP rules can be applied to all versions of Windows beginning with Windows XP and Windows Server 2003. For specific operating system version requirements, see [Requirements to use AppLocker](requirements-to-use-applocker.md).

                    **Note:** If you are using the Basic User security level as assigned in SRP, those privileges are not supported on computers running that support AppLocker.

                    AppLocker policies as applied through a GPO take precedence over SRP policies in the same or linked GPO. SRP policies can be created and maintained the same way.| +|Your organization's computers are running only the following operating systems:
                  • Windows 11
                  • Windows 10
                  • Windows 8.1
                  • Windows 8
                  • Windows 7
                  • Windows Server 2012 R2
                  • Windows Server 2012
                  • Windows Server 2008 R2|Use AppLocker to create your application control policies.| ### Are there specific groups in your organization that need customized application control policies? @@ -223,7 +179,7 @@ AppLocker is very effective for organizations that have application restriction | Possible answers | Design considerations | | - | - | | Users run without administrative rights. | Apps are installed by using an installation deployment technology.| -| AppLocker can help reduce the total cost of ownership for business groups that typically use a finite set of apps, such as human resources and finance departments. At the same time, these departments access highly sensitive information, much of which contains confidential and proprietary information. By using AppLocker to create rules for specific apps that are allowed to run, you can help limit unauthorized applications from accessing this information.
                    **Note: **AppLocker can also be effective in helping create standardized desktops in organizations where users run as administrators. However, it is important to note that users with administrative credentials can add new rules to the local AppLocker policy.| Users must be able to install applications as needed. +| AppLocker can help reduce the total cost of ownership for business groups that typically use a finite set of apps, such as human resources and finance departments. At the same time, these departments access highly sensitive information, much of which contains confidential and proprietary information. By using AppLocker to create rules for specific apps that are allowed to run, you can help limit unauthorized applications from accessing this information.

                    **Note:** AppLocker can also be effective in helping create standardized desktops in organizations where users run as administrators. However, it is important to note that users with administrative credentials can add new rules to the local AppLocker policy.| Users must be able to install applications as needed. | Users currently have administrator access, and it would be difficult to change this.|Enforcing AppLocker rules is not suited for business groups that must be able to install apps as needed and without approval from the IT department. If one or more OUs in your organization has this requirement, you can choose not to enforce application rules in those OUs by using AppLocker or to implement the **Audit only** enforcement setting through AppLocker.| ### Is the structure in Active Directory Domain Services based on the organization's hierarchy? diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md index 0eb3e887ba..4aa28b9f43 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md @@ -35,30 +35,9 @@ The path condition identifies an application by its location in the file system When creating a rule that uses a deny action, path conditions are less secure than publisher and file hash conditions for preventing access to a file because a user could easily copy the file to a different location than the location specified in the rule. Because path rules specify locations within the file system, you should ensure that there are no subdirectories that are writable by non-administrators. For example, if you create a path rule for C:\\ with the allow action, any file under that location will be allowed to run, including within users' profiles. The following table describes the advantages and disadvantages of the path condition. - ---- - - - - - - - - - - - - -
                    Path condition advantagesPath condition disadvantages
                      -

                    • You can easily control many folders or a single file.

                      • -

                    • You can use the asterisk (*) as a wildcard character within path rules.

                      • -
                      -

                    • It might be less secure if a rule that is configured to use a folder path contains subfolders that are writable by non-administrators.

                      • -

                    • You must specify the full path to a file or folder when creating path rules so that the rule will be properly enforced.

                      • -
                    +|Path condition advantages|Path condition disadvantages| +|--- |--- | +|
                  • You can easily control many folders or a single file.
                  • You can use the asterisk (*) as a wildcard character within path rules.|
                  • It might be less secure if a rule that is configured to use a folder path contains subfolders that are writable by non-administrators.
                  • You must specify the full path to a file or folder when creating path rules so that the rule will be properly enforced.| AppLocker does not enforce rules that specify paths with short names. You should always specify the full path to a file or folder when creating path rules so that the rule will be properly enforced. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md index 86cc3ed874..55d9299a0f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md @@ -35,32 +35,9 @@ Publisher conditions can be made only for files that are digitally signed; this Publisher conditions are easier to maintain than file hash conditions and are generally more secure than path conditions. Rules that are specified to the version level might have to be updated when a new version of the file is released. The following table describes the advantages and disadvantages of the publisher condition. - ---- - - - - - - - - - - - - -
                    Publisher condition advantagesPublisher condition disadvantages
                      -

                    • Frequent updating is not required.

                      • -

                    • You can apply different values within a certificate.

                      • -

                    • A single rule can be used to allow an entire product suite.

                      • -

                    • You can use the asterisk (*) wildcard character within a publisher rule to specify that any value should be matched.

                      • -
                      -

                    • The file must be signed.

                      • -

                    • Although a single rule can be used to allow an entire product suite, all files in the suite must be signed uniformly.

                      • -
                    +|Publisher condition advantages|Publisher condition disadvantages| +|--- |--- | +|
                  • Frequent updating is not required.
                  • You can apply different values within a certificate.
                  • A single rule can be used to allow an entire product suite.
                  • You can use the asterisk (*) wildcard character within a publisher rule to specify that any value should be matched.|
                  • The file must be signed.
                  • Although a single rule can be used to allow an entire product suite, all files in the suite must be signed uniformly.| Wildcard characters can be used as values in the publisher rule fields according to the following specifications: diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md index a22f94b741..40d68279fe 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md @@ -38,139 +38,22 @@ Windows Server 2008 R2, Windows 7 and later. It is recommended that you auth Windows 7 and later, the SRP policies are ignored. The following table compares the features and functions of Software Restriction Policies (SRP) and AppLocker. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                    Application control functionSRPAppLocker

                    Scope

                    SRP policies can be applied to all Windows operating systems beginning with Windows XP and Windows Server 2003.

                    AppLocker policies apply only to Windows Server 2008 R2, Windows 7, and later.

                    Policy creation

                    SRP policies are maintained through Group Policy and only the administrator of the GPO can update the SRP policy. The administrator on the local computer can modify the SRP policies defined in the local GPO.

                    AppLocker policies are maintained through Group Policy and only the administrator of the GPO can update the policy. The administrator on the local computer can modify the AppLocker policies defined in the local GPO.

                    -

                    AppLocker permits customization of error messages to direct users to a Web page for help.

                    Policy maintenance

                    SRP policies must be updated by using the Local Security Policy snap-in (if the policies are created locally) or the Group Policy Management Console (GPMC).

                    AppLocker policies can be updated by using the Local Security Policy snap-in (if the policies are created locally), or the GPMC, or the Windows PowerShell AppLocker cmdlets.

                    Policy application

                    SRP policies are distributed through Group Policy.

                    AppLocker policies are distributed through Group Policy.

                    Enforcement mode

                    SRP works in the “deny list mode” where administrators can create rules for files that they do not want to allow in this Enterprise whereas the rest of the file is allowed to run by default.

                    -

                    SRP can also be configured in the “allowlist mode” so that by default all files are blocked and administrators need to create allow rules for files that they want to allow.

                    AppLocker by default works in the “allowlist mode” where only those files are allowed to run for which there is a matching allow rule.

                    File types that can be controlled

                    SRP can control the following file types:

                    -
                      -

                    • Executables

                      • -

                    • Dlls

                      • -

                    • Scripts

                      • -

                    • Windows Installers

                      • -
                    -

                    SRP cannot control each file type separately. All SRP rules are in a single rule collection.

                    AppLocker can control the following file types:

                    -
                      -

                    • Executables

                      • -

                    • Dlls

                      • -

                    • Scripts

                      • -

                    • Windows Installers

                      • -

                    • Packaged apps and installers

                      • -
                    -

                    AppLocker maintains a separate rule collection for each of the five file types.

                    Designated file types

                    SRP supports an extensible list of file types that are considered executable. Administrators can add extensions for files that should be considered executable.

                    AppLocker currently supports the following file extensions:

                    -
                      -

                    • Executables (.exe, .com)

                      • -

                    • Dlls (.ocx, .dll)

                      • -

                    • Scripts (.vbs, .js, .ps1, .cmd, .bat)

                      • -

                    • Windows Installers (.msi, .mst, .msp)

                      • -

                    • Packaged app installers (.appx)

                      • -

                    Rule types

                    SRP supports four types of rules:

                    -
                      -

                    • Hash

                      • -

                    • Path

                      • -

                    • Signature

                      • -

                    • Internet zone

                      • -

                    AppLocker supports three types of rules:

                    -
                      -

                    • File hash

                      • -

                    • Path

                      • -

                    • Publisher

                      • -

                    Editing the hash value

                    In Windows XP, you could use SRP to provide custom hash values.

                    -

                    Beginning with Windows 7 and Windows Server 2008 R2, you can only select the file to hash, not provide the hash value.

                    AppLocker computes the hash value itself. Internally, it uses the SHA2 Authenticode hash for Portable Executables (exe and dll) and Windows Installers and an SHA2 flat file hash for the rest.

                    Support for different security levels

                    With SRP, you can specify the permissions with which an app can run. So, you can configure a rule such that Notepad always runs with restricted permissions and never with administrative privileges.

                    -

                    SRP on Windows Vista and earlier supported multiple security levels. On Windows 7, that list was restricted to just two levels: Disallowed and Unrestricted (Basic User translates to Disallowed).

                    AppLocker does not support security levels.

                    Manage Packaged apps and Packaged app installers.

                    Not supported

                    .appx is a valid file type which AppLocker can manage.

                    Targeting a rule to a user or a group of users

                    SRP rules apply to all users on a particular computer.

                    AppLocker rules can be targeted to a specific user or a group of users.

                    Support for rule exceptions

                    SRP does not support rule exceptions.

                    AppLocker rules can have exceptions, which allow you to create rules such as “Allow everything from Windows except for regedit.exe”.

                    Support for audit mode

                    SRP does not support audit mode. The only way to test SRP policies is to set up a test environment and run a few experiments.

                    AppLocker supports audit mode, which allows you to test the effect of their policy in the real production environment without impacting the user experience. Once you are satisfied with the results, you can start enforcing the policy.

                    Support for exporting and importing policies

                    SRP does not support policy import/export.

                    AppLocker supports the importing and exporting of policies. This allows you to create AppLocker policy on a sample device, test it out and then export that policy and import it back into the desired GPO.

                    Rule enforcement

                    Internally, SRP rules enforcement happens in the user-mode, which is less secure.

                    Internally, AppLocker rules for .exe and .dll files are enforced in the kernel-mode, which is more secure than enforcing them in the user-mode.

                    -  -  -  + +|Application control function|SRP|AppLocker| +|--- |--- |--- | +|Scope|SRP policies can be applied to all Windows operating systems beginning with Windows XP and Windows Server 2003.|AppLocker policies apply only to Windows Server 2008 R2, Windows 7, and later.| +|Policy creation|SRP policies are maintained through Group Policy and only the administrator of the GPO can update the SRP policy. The administrator on the local computer can modify the SRP policies defined in the local GPO.|AppLocker policies are maintained through Group Policy and only the administrator of the GPO can update the policy. The administrator on the local computer can modify the AppLocker policies defined in the local GPO.

                    AppLocker permits customization of error messages to direct users to a Web page for help.| +|Policy maintenance|SRP policies must be updated by using the Local Security Policy snap-in (if the policies are created locally) or the Group Policy Management Console (GPMC).|AppLocker policies can be updated by using the Local Security Policy snap-in (if the policies are created locally), or the GPMC, or the Windows PowerShell AppLocker cmdlets.| +|Policy application|SRP policies are distributed through Group Policy.|AppLocker policies are distributed through Group Policy.| +|Enforcement mode|SRP works in the “deny list mode” where administrators can create rules for files that they do not want to allow in this Enterprise whereas the rest of the file is allowed to run by default.

                    SRP can also be configured in the “allowlist mode” so that by default all files are blocked and administrators need to create allow rules for files that they want to allow.|AppLocker by default works in the “allowlist mode” where only those files are allowed to run for which there is a matching allow rule.| +|File types that can be controlled|SRP can control the following file types:
                  • Executables
                  • Dlls
                  • Scripts
                  • Windows Installers

                    SRP cannot control each file type separately. All SRP rules are in a single rule collection.|AppLocker can control the following file types:
                  • Executables
                  • Dlls
                  • Scripts
                  • Windows Installers
                  • Packaged apps and installers

                    AppLocker maintains a separate rule collection for each of the five file types.| +|Designated file types|SRP supports an extensible list of file types that are considered executable. Administrators can add extensions for files that should be considered executable.|AppLocker currently supports the following file extensions:
                  • Executables (.exe, .com)
                  • Dlls (.ocx, .dll)
                  • Scripts (.vbs, .js, .ps1, .cmd, .bat)
                  • Windows Installers (.msi, .mst, .msp)
                  • Packaged app installers (.appx)| +|Rule types|SRP supports four types of rules:
                  • Hash
                  • Path
                  • Signature
                  • Internet zone|AppLocker supports three types of rules:
                  • File hash
                  • Path
                  • Publisher| +|Editing the hash value|In Windows XP, you could use SRP to provide custom hash values.

                    Beginning with Windows 7 and Windows Server 2008 R2, you can only select the file to hash, not provide the hash value.|AppLocker computes the hash value itself. Internally, it uses the SHA2 Authenticode hash for Portable Executables (exe and dll) and Windows Installers and an SHA2 flat file hash for the rest.| +|Support for different security levels|With SRP, you can specify the permissions with which an app can run. So, you can configure a rule such that Notepad always runs with restricted permissions and never with administrative privileges.

                    SRP on Windows Vista and earlier supported multiple security levels. On Windows 7, that list was restricted to just two levels: Disallowed and Unrestricted (Basic User translates to Disallowed).|AppLocker does not support security levels.| +|Manage Packaged apps and Packaged app installers.|Not supported|.appx is a valid file type which AppLocker can manage.| +|Targeting a rule to a user or a group of users|SRP rules apply to all users on a particular computer.|AppLocker rules can be targeted to a specific user or a group of users.| +|Support for rule exceptions|SRP does not support rule exceptions.|AppLocker rules can have exceptions, which allow you to create rules such as “Allow everything from Windows except for regedit.exe”.| +|Support for audit mode|SRP does not support audit mode. The only way to test SRP policies is to set up a test environment and run a few experiments.|AppLocker supports audit mode, which allows you to test the effect of their policy in the real production environment without impacting the user experience. Once you are satisfied with the results, you can start enforcing the policy.| +|Support for exporting and importing policies|SRP does not support policy import/export.|AppLocker supports the importing and exporting of policies. This allows you to create AppLocker policy on a sample device, test it out and then export that policy and import it back into the desired GPO.| +|Rule enforcement|Internally, SRP rules enforcement happens in the user-mode, which is less secure.|Internally, AppLocker rules for .exe and .dll files are enforced in the kernel-mode, which is more secure than enforcing them in the user-mode.| diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md index 3629a929f5..1196a83dee 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md @@ -53,145 +53,33 @@ For information about the application control scenarios that AppLocker addresses The following table compares AppLocker to Software Restriction Policies. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                    FeatureSoftware Restriction PoliciesAppLocker

                    Rule scope

                    All users

                    Specific user or group

                    Rule conditions provided

                    File hash, path, certificate, registry path, and Internet zone

                    File hash, path, and publisher

                    Rule types provided

                    Defined by the security levels:

                    -
                      -

                    • Disallowed

                      • -

                    • Basic User

                      • -

                    • Unrestricted

                      • -

                    Allow and deny

                    Default rule action

                    Unrestricted

                    Implicit deny

                    Audit-only mode

                    No

                    Yes

                    Wizard to create multiple rules at one time

                    No

                    Yes

                    Policy import or export

                    No

                    Yes

                    Rule collection

                    No

                    Yes

                    Windows PowerShell support

                    No

                    Yes

                    Custom error messages

                    No

                    Yes

                    +|Feature|Software Restriction Policies|AppLocker| +|--- |--- |--- | +|Rule scope|All users|Specific user or group| +|Rule conditions provided|File hash, path, certificate, registry path, and Internet zone|File hash, path, and publisher| +|Rule types provided|Defined by the security levels:
                  • Disallowed
                  • Basic User
                  • Unrestricted|Allow and deny| +|Default rule action|Unrestricted|Implicit deny| +|Audit-only mode|No|Yes| +|Wizard to create multiple rules at one time|No|Yes| +|Policy import or export|No|Yes| +|Rule collection|No|Yes| +|Windows PowerShell support|No|Yes| +|Custom error messages|No|Yes| Application control function differences The following table compares the application control functions of Software Restriction Policies (SRP) and AppLocker. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                    Application control functionSRPAppLocker

                    Operating system scope

                    SRP policies can be applied to all Windows operating systems beginning with Windows XP and Windows Server 2003.

                    AppLocker policies apply only to those supported operating system versions and editions listed in Requirements to use AppLocker. But these systems can also use SRP.

                    -
                    -Note

                    Use different GPOs for SRP and AppLocker rules.

                    -
                    -
                    -

                    User support

                    SRP allows users to install applications as an administrator.

                    AppLocker policies are maintained through Group Policy, and only the administrator of the device can update an AppLocker policy.

                    -

                    AppLocker permits customization of error messages to direct users to a Web page for help.

                    Policy maintenance

                    SRP policies are updated by using the Local Security Policy snap-in or the Group Policy Management Console (GPMC).

                    AppLocker policies are updated by using the Local Security Policy snap-in or the GPMC.

                    -

                    AppLocker supports a small set of PowerShell cmdlets to aid in administration and maintenance.

                    Policy management infrastructure

                    To manage SRP policies, SRP uses Group Policy within a domain and the Local Security Policy snap-in for a local computer.

                    To manage AppLocker policies, AppLocker uses Group Policy within a domain and the Local Security Policy snap-in for a local computer.

                    Block malicious scripts

                    Rules for blocking malicious scripts prevents all scripts associated with the Windows Script Host from running, except those that are digitally signed by your organization.

                    AppLocker rules can control the following file formats: .ps1, .bat, .cmd, .vbs, and .js. In addition, you can set exceptions to allow specific files to run.

                    Manage software installation

                    SRP can prevent all Windows Installer packages from installing. It allows .msi files that are digitally signed by your organization to be installed.

                    The Windows Installer rule collection is a set of rules created for Windows Installer file types (.mst, .msi and .msp) to allow you to control the installation of files on client computers and servers.

                    Manage all software on the computer

                    All software is managed in one rule set. By default, the policy for managing all software on a device disallows all software on the user's device, except software that is installed in the Windows folder, Program Files folder, or subfolders.

                    Unlike SRP, each AppLocker rule collection functions as an allowed list of files. Only the files that are listed within the rule collection will be allowed to run. This configuration makes it easier for administrators to determine what will occur when an AppLocker rule is applied.

                    Different policies for different users

                    Rules are applied uniformly to all users on a particular device.

                    On a device that is shared by multiple users, an administrator can specify the groups of users who can access the installed software. Using AppLocker, an administrator can specify the user to whom a specific rule should apply.

                    +|Application control function|SRP|AppLocker| +|--- |--- |--- | +|Operating system scope|SRP policies can be applied to all Windows operating systems beginning with Windows XP and Windows Server 2003.|AppLocker policies apply only to those supported operating system versions and editions listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). But these systems can also use SRP.
                    **Note:** Use different GPOs for SRP and AppLocker rules.
                    | +|User support|SRP allows users to install applications as an administrator.|AppLocker policies are maintained through Group Policy, and only the administrator of the device can update an AppLocker policy.

                    AppLocker permits customization of error messages to direct users to a Web page for help.| +|Policy maintenance|SRP policies are updated by using the Local Security Policy snap-in or the Group Policy Management Console (GPMC).|AppLocker policies are updated by using the Local Security Policy snap-in or the GPMC.

                    AppLocker supports a small set of PowerShell cmdlets to aid in administration and maintenance.| +|Policy management infrastructure|To manage SRP policies, SRP uses Group Policy within a domain and the Local Security Policy snap-in for a local computer.|To manage AppLocker policies, AppLocker uses Group Policy within a domain and the Local Security Policy snap-in for a local computer.| +|Block malicious scripts|Rules for blocking malicious scripts prevents all scripts associated with the Windows Script Host from running, except those that are digitally signed by your organization.|AppLocker rules can control the following file formats: .ps1, .bat, .cmd, .vbs, and .js. In addition, you can set exceptions to allow specific files to run.| +|Manage software installation|SRP can prevent all Windows Installer packages from installing. It allows .msi files that are digitally signed by your organization to be installed.|The Windows Installer rule collection is a set of rules created for Windows Installer file types (.mst, .msi and .msp) to allow you to control the installation of files on client computers and servers.| +|Manage all software on the computer|All software is managed in one rule set. By default, the policy for managing all software on a device disallows all software on the user's device, except software that is installed in the Windows folder, Program Files folder, or subfolders.|Unlike SRP, each AppLocker rule collection functions as an allowed list of files. Only the files that are listed within the rule collection will be allowed to run. This configuration makes it easier for administrators to determine what will occur when an AppLocker rule is applied.| +|Different policies for different users|Rules are applied uniformly to all users on a particular device.|On a device that is shared by multiple users, an administrator can specify the groups of users who can access the installed software. Using AppLocker, an administrator can specify the user to whom a specific rule should apply.| ## Related topics diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy.md new file mode 100644 index 0000000000..bc8dc984f9 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy.md @@ -0,0 +1,153 @@ +--- +title: Create WDAC Deny Policy +description: Explains how to create WDAC deny policies +keywords: WDAC, policy +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance +author: jgeurten +ms.reviewer: jsuther1974 +ms.author: dansimp +manager: dansimp +ms.date: 11/29/2021 +ms.technology: windows-sec +--- + +# Guidance on Creating WDAC Deny Policies + +With Windows Defender Application Control (WDAC), you can create application control policies to explicitly deny specific drivers and applications, as well as signatures and certificates and file paths. + +Topics this article will be discussing are: +1. File Rule Precedence Order +2. Adding Allow Rules +3. Singe Policy Considerations +4. Multiple Policy Considerations +5. Best Practices +6. Tutorial/Walkthrough + +## File Rule Precedence Order + +To create effective WDAC deny policies, it is crucial to understand how WDAC parses the policy. The WDAC engine evaluates files against the policy in the following order. + +1. Explicit deny rules - if there is an explicit deny rule, do not process the rest of the rules; the file is untrusted. + +2. Explicit allow rules. + +3. WDAC will then check for the [Managed Installer extended (EA)](configure-authorized-apps-deployed-with-a-managed-installer.md) or the [Intelligent Security Graph (ISG) EA](use-windows-defender-application-control-with-intelligent-security-graph.md) on the file. + +4. Lastly, WDAC will call the Intelligent Security Graph (ISG) to get reputation on file, if the policy has support for the ISG. + +Explicit allow and deny rules encompass rules at any level (for example hash rules, signer rules path rules, attribute rules, or package family name rules). If there is an explicit deny rule, WDAC does not process any other rules, meaning a deny rule always takes precedence in the case where a deny and allow rule would be at odds. + +## Interaction with Existing Policies +### Adding Allow Rules + +In the scenario where there is not an explicit allow rule, there is not a managed installer or ISG EA and ISG is not configured, WDAC will block the file as there is nothing in the policy vouching for trust of the file. + +If this deny policy is the only policy on the device, the following rule(s) need to be added to the policy in addition to the deny/block rules to trust for the driver files outside of the intended blocklisted ones: + +```xml + + + + + + + + + + + + +``` + +If the policy enables user mode code integrity via the ***Enabled:UMCI*** rule-option, the following section needs to be added to the policy in addition to the deny/block rules to trust for the driver and user mode files outside of the intended blocklisted ones: +```xml + + + + + + + + + + + + + + + + + + + + +``` +## Single Policy Considerations +If the set of deny rules is to be added into an existing policy with allow rules, then the above Allow All rules should not be added to the policy. Instead, the deny policy should be merged with the existing WDAC policy via the [WDAC Wizard](wdac-wizard-merging-policies.md) or using the following PowerShell command: + +```PowerShell +$DenyPolicy = +$ExistingPolicy = +Merge-CIPolicy -PolicyPaths $ DenyPolicy, $ExistingPolicy -OutputFilePath $ExistingPolicy +``` + +## Multiple Policy Considerations +If you are currently using [multiple policies](deploy-multiple-windows-defender-application-control-policies.md) on a device, there are two options for integrating the blocklist into your policy set. + +(Recommended) The first option is to keep the blocklist as its own policy isolated from your allow policies as it is easier to manage. Since applications need to be [allowed by both WDAC policies to run on the device](deploy-multiple-windows-defender-application-control-policies.md#base-and-supplemental-policy-interaction), you will need to add the Allow All rule(s) to your deny policy. This will not override the set of applications allowed by WDAC illustrated by the following example: + +Policy 1 is an allowlist of Windows and Microsoft-signed applications. Policy 2 is our new deny policy, which blocks MaliciousApp.exe with the Allow All rules. MaliciousApp.exe will be blocked since there is an explicit block rule in Policy 2. Windows and Microsoft applications will be allowed since there is an explicit allow rule in Policy 1 and Policy 2 (due to the Allow All rules). All other applications, if not Windows and Microsoft signed, for example, ExampleApp.exe, will not be allowed as this application is only trusted by Policy 2 (due to the Allow All rules) and not Policy 1. + +The second option involves merging the blocklist with your existing WDAC policy, regardless if the policy is an allowlist policy and contains allow and/or deny rules. + +## Best Practices + +1. **Starting with Audit Mode Policies** - as with all new policies, we recommend rolling out your new deny policy in Audit Mode and monitoring the [3077 block events](event-id-explanations.md#optional-intelligent-security-graph-isg-or-managed-installer-mi-diagnostic-events) to ensure only the applications you intended to block are being blocked. More information on monitoring block events via the Event Viewer logs and Advanced Hunting: [Managing and troubleshooting Windows Defender Application Control policies](windows-defender-application-control-operational-guide.md) + +2. **Recommended Deny Rules Types** - signer and file attribute rules are recommended from a security, manageability, and performance perspective. Hash rules should only be utilized where otherwise impossible. The hash of an application is updated for every new version released by the publisher, which quickly becomes impractical to manage and protect against new threats where the attacker is quickly iterating on the payload. Additionally, WDAC has optimized parsing of hash rules, but devices may see performance impacts at runtime evaluation when policies have tens of thousands or more hash rules. + + +## Creating a Deny Policy Tutorial + +Deny rules and policies can be created using the PowerShell cmdlets or the [WDAC Wizard](https://webapp-wdac-wizard.azurewebsites.net/). We recommend creating signer rules (PCACertificate, Publisher, and FilePublisher) wherever possible. In the cases of unsigned binaries, rules must be created on attributes of the file, such as the original filename, or the hash. + +### Software Publisher Based Deny Rule +```Powershell +$DenyRules += New-CIPolicyRule -Level FilePublisher -DriverFilePath -Deny -Fallback FileName,Hash +``` + +### Software Attributes Based Deny Rule +```Powershell +$DenyRules += New-CIPolicyRule -Level FileName -DriverFilePath -Deny -Fallback Hash +``` + +### Hash Based Deny Rule +```PowerShell + New-CIPolicyRule -Level Hash -DriverFilePath -Deny + ``` + +### Adding Allow All Rules +If necessary, as in the cases listed above, [Allow All Rules](#adding-allow-rules) may need to be added to the policy. The Allow All rules can be manually added to the policy xml or by merging with the Allow All xml present on the client system in the WDAC template folder: + +```PowerShell +$DenyPolicy = +$AllowAllPolicy = $Env:windir + "\schemas\CodeIntegrity\ExamplePolicies\AllowAll.xml" +Merge-CIPolicy -PolicyPaths $DenyPolicy, $AllowAllPolicy -OutputFilePath $DenyPolicy +``` +### Deploying the Deny Policy +Policies should be thoroughly evaluated and first rolled out in audit mode before strict enforcement. Policies can be deployed via multiple options: + +1. Mobile Device Management (MDM): [Deploy WDAC policies using Mobile Device Management (MDM) (Windows)](deploy-windows-defender-application-control-policies-using-intune.md) + +2. Microsoft Endpoint Configuration Manager (MEMCM): [Deploy Windows Defender Application Control (WDAC) policies by using Microsoft Endpoint Configuration Manager (MEMCM) (Windows)](deployment/deploy-wdac-policies-with-memcm.md) + +3. Scripting [Deploy Windows Defender Application Control (WDAC) policies using script (Windows)](deployment/deploy-wdac-policies-with-script.md) + +4. Group Policy: [Deploy WDAC policies via Group Policy (Windows)](deploy-windows-defender-application-control-policies-using-group-policy.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/index.yml b/windows/security/threat-protection/windows-defender-application-control/index.yml index ef5892459f..fb59f7473b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/index.yml +++ b/windows/security/threat-protection/windows-defender-application-control/index.yml @@ -52,6 +52,8 @@ landingContent: url: create-wdac-policy-for-fully-managed-devices.md - text: Create a WDAC policy for a fixed-workload url: create-initial-default-policy.md + - text: Create a WDAC deny list policy + url: create-wdac-deny-policy.md - text: Deploying catalog files for WDAC management url: deploy-catalog-files-to-support-windows-defender-application-control.md - text: Using the WDAC Wizard diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index 608da5aa98..cf94595896 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -3,7 +3,7 @@ title: Microsoft recommended driver block rules (Windows) description: View a list of recommended block rules to block vulnerable third-party drivers discovered by Microsoft and the security research community. keywords: security, malware, kernel mode, driver ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security diff --git a/windows/whats-new/windows-10-insider-preview.md b/windows/whats-new/windows-10-insider-preview.md index 6fd107bf08..2e6f2191f7 100644 --- a/windows/whats-new/windows-10-insider-preview.md +++ b/windows/whats-new/windows-10-insider-preview.md @@ -14,7 +14,8 @@ ms.topic: article # Documentation for Windows 10 Insider Preview -> [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ] +>[!NOTE] +> Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. This section contains preliminary documentation for some enterprise features in Windows 10 Insider Preview. Information in this section may change frequently.