deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 13:27:23 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #10010 from MicrosoftDocs/main

Browse Source 
Publish main to live, Tuesday 3:30PM PDT, 07/09
This commit is contained in:
Stacyrch140 2024-07-09 18:49:57 -04:00 committed by GitHub
commit aa3e4af9c1
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
16 changed files with 301 additions and 641 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
windows/configuration/provisioning-packages/diagnose-provisioning-packages.md
View File

@ -2,7 +2,7 @@
title: Diagnose Provisioning Packages title: Diagnose Provisioning Packages
description: Diagnose general failures in provisioning. description: Diagnose general failures in provisioning.
ms.topic: troubleshooting ms.topic: troubleshooting
ms.date: 01/18/2023 ms.date: 07/09/2024
--- ---
# Diagnose Provisioning Packages # Diagnose Provisioning Packages
@ -11,22 +11,20 @@ This article helps diagnose common issues with applying provisioning packages. Y
## Unable to apply power settings ## Unable to apply power settings
When applying a provisioning package (PPKG) containing power settings, elevated permissions are required. Because elevated permissions are required, power settings applied using the user context after the [initial setup](/windows/configuration/provisioning-packages/provisioning-apply-package#after-initial-setup) results in the error `STATUS_PRIVILEGE_NOT_HELD (HRESULT=0xc0000061)` because an incorrect security context was used. When you apply a provisioning package (PPKG) containing power settings, elevated permissions are required. Because elevated permissions are required, power settings applied using the user context after the [initial setup](/windows/configuration/provisioning-packages/provisioning-apply-package#after-initial-setup) results in the error `STATUS_PRIVILEGE_NOT_HELD (HRESULT=0xc0000061)` because an incorrect security context was used.
To apply the power settings successfully with the [correct security context](/windows/win32/services/localsystem-account), place the PPKG in `%WINDIR%/Provisioning/Packages` directory, and reboot the device. For more information, see [Configure power settings](/windows-hardware/customize/power-settings/configure-power-settings). To apply the power settings successfully with the [correct security context](/windows/win32/services/localsystem-account), place the PPKG in `%WINDIR%/Provisioning/Packages` directory, and reboot the device. For more information, see [Configure power settings](/windows-hardware/customize/power-settings/configure-power-settings).
<a name='unable-to-perform-bulk-enrollment-in-azure-ad'></a>
## Unable to perform bulk enrollment in Microsoft Entra ID ## Unable to perform bulk enrollment in Microsoft Entra ID
When [enrolling devices into Microsoft Entra ID using provisioning packages](https://techcommunity.microsoft.com/t5/intune-customer-success/bulk-join-a-windows-device-to-azure-ad-and-microsoft-endpoint/ba-p/2381400), the bulk token request is rejected, if the user requesting a bulk token isn't authorized to grant application consent. For more information, see [Configure how users consent to applications](/azure/active-directory/manage-apps/configure-user-consent). When you [enroll devices into Microsoft Entra ID using provisioning packages](https://techcommunity.microsoft.com/t5/intune-customer-success/bulk-join-a-windows-device-to-azure-ad-and-microsoft-endpoint/ba-p/2381400), the bulk token request is rejected, if the user requesting a bulk token isn't authorized to grant application consent. For more information, see [Configure how users consent to applications](/azure/active-directory/manage-apps/configure-user-consent).
> [!NOTE] > [!NOTE]
> When obtaining the bulk token, you should select "No, sign in to this app only" when prompted for authentication. If you select "OK" instead without also selecting "Allow my organization to manage my device", the bulk token request might be rejected. > When obtaining the bulk token, you should select "No, sign in to this app only" when prompted for authentication. If you select "OK" instead without also selecting "Allow my organization to manage my device", the bulk token request might be rejected.
## Unable to apply a multivariant provisioning package ## Unable to apply a multivariant provisioning package
When applying a [multivariant package](/windows/configuration/provisioning-packages/provisioning-multivariant), it might be difficult to diagnose why a certain target didn't get applied. There may have been improperly authored conditions that didn't evaluate as expected. When you apply a [multivariant package](/windows/configuration/provisioning-packages/provisioning-multivariant), it might be difficult to diagnose why a certain target didn't get applied. There may be improperly authored conditions that didn't evaluate as expected.
Starting in Windows 11, version 22H2, [MdmDiagnosticsTool](/windows/client-management/diagnose-mdm-failures-in-windows-10) includes multivariant condition values to diagnose problems with multivariant packages to determine why the package wasn't applied. Starting in Windows 11, version 22H2, [MdmDiagnosticsTool](/windows/client-management/diagnose-mdm-failures-in-windows-10) includes multivariant condition values to diagnose problems with multivariant packages to determine why the package wasn't applied.

144
windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md
View File

@ -2,12 +2,12 @@
title: Configuration service providers for IT pros title: Configuration service providers for IT pros
description: Describes how IT pros and system administrators can use configuration service providers (CSPs) to configure devices. description: Describes how IT pros and system administrators can use configuration service providers (CSPs) to configure devices.
ms.topic: how-to ms.topic: how-to
ms.date: 12/31/2017 ms.date: 07/09/2024
--- ---
# Configuration service providers for IT pros # Configuration service providers for IT pros
This article explains how IT pros and system administrators can take advantage of many settings available through configuration service providers (CSPs) to configure devices running Windows client in their organizations. CSPs expose device configuration settings in Windows client. The CSPs are used by mobile device management (MDM) service providers and are documented in the [Hardware Dev Center](/windows/client-management/mdm/configuration-service-provider-reference). This article explains how IT pros and system administrators can take advantage of many settings available through configuration service providers (CSPs) to configure devices running Windows client in their organizations. CSPs expose device configuration settings in Windows client. The CSPs are used by mobile device management (MDM) service providers and are documented in the [Configuration Service Provider reference](/windows/client-management/mdm/configuration-service-provider-reference).
## What is a CSP? ## What is a CSP?
@ -15,19 +15,15 @@ In the client operating system, a CSP is the interface between configuration set
On the Windows client platform, the management approach for desktop uses CSPs to configure and manage all devices running Windows client. On the Windows client platform, the management approach for desktop uses CSPs to configure and manage all devices running Windows client.
Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](/windows/client-management/mdm/wifi-csp) contains the settings to create a Wi-Fi profile. Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](/windows/client-management/mdm/wifi-csp) contains the settings to create a Wi-Fi profile. CSPs are behind many of the management tasks and policies for Windows client, both in Microsoft Intune and in non-Microsoft MDM service providers.
CSPs are behind many of the management tasks and policies for Windows client, both in Microsoft Intune and in non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider).
:::image type="content" source="images/policytocsp.png" alt-text="How intune maps to CSP":::
CSPs receive configuration policies in the XML-based Synchronization Markup Language (SyncML) format, pushed from an MDM-compliant management server, such as Microsoft Intune. Traditional enterprise management systems, such as Microsoft Configuration Manager, can also target CSPs, by using a client-side Windows Management Instrumentation (WMI)-to-CSP Bridge. CSPs receive configuration policies in the XML-based Synchronization Markup Language (SyncML) format, pushed from an MDM-compliant management server, such as Microsoft Intune. Traditional enterprise management systems, such as Microsoft Configuration Manager, can also target CSPs, by using a client-side Windows Management Instrumentation (WMI)-to-CSP Bridge.
### Synchronization Markup Language (SyncML) ## Synchronization Markup Language (SyncML)
The Open Mobile Alliance Device Management (OMA-DM) protocol uses the XML-based SyncML for data exchange between compliant servers and clients. SyncML offers an open standard to use as an alternative to vendor-specific management solutions (such as WMI). The value for enterprises adopting industry standard management protocols is that it allows the management of a broader set of vendor devices using a single platform (such as Microsoft Intune). Device policies, including VPN connection profiles, are delivered to client devices formatted as in SyncML. The target CSP reads this information and applies the necessary configurations. The Open Mobile Alliance Device Management (OMA-DM) protocol uses the XML-based SyncML for data exchange between compliant servers and clients. SyncML offers an open standard to use as an alternative to vendor-specific management solutions (such as WMI). The value for enterprises adopting industry standard management protocols is that it allows the management of a broader set of vendor devices using a single platform (such as Microsoft Intune). Device policies, including VPN connection profiles, are delivered to client devices formatted as in SyncML. The target CSP reads this information and applies the necessary configurations.
### The WMI-to-CSP Bridge ## The WMI-to-CSP Bridge
The WMI-to-CSP Bridge is a component allowing configuration of Windows client CSPs using scripts and traditional enterprise management software, such as Configuration Manager using WMI. The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device. The WMI-to-CSP Bridge is a component allowing configuration of Windows client CSPs using scripts and traditional enterprise management software, such as Configuration Manager using WMI. The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device.
@ -37,138 +33,20 @@ The WMI-to-CSP Bridge is a component allowing configuration of Windows client CS
Generally, enterprises rely on Group Policy or MDM to configure and manage devices. For devices running Windows, MDM services use CSPs to configure your devices. Generally, enterprises rely on Group Policy or MDM to configure and manage devices. For devices running Windows, MDM services use CSPs to configure your devices.
In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management. You may also want to apply custom settings that aren't available through your MDM service. The [CSP documentation](#bkmk-csp-doc) can help you understand the settings that can be configured or queried. You can also learn about all of the available configuration settings. In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management. You may also want to apply custom settings that aren't available through your MDM service. The [CSP documentation](/windows/client-management/mdm/configuration-service-provider-reference) can help you understand the settings that can be configured or queried. You can also learn about all of the available configuration settings.
### CSPs in Windows Configuration Designer ## CSPs in Windows Configuration Designer
You can use Windows Configuration Designer to create [provisioning packages](provisioning-packages.md) to apply settings to devices during the out-of-box-experience (OOBE), and after the devices are set up. You can also use provisioning packages to configure a device's connectivity and enroll the device in MDM. Many of the runtime settings in Windows Configuration Designer are based on CSPs. You can use Windows Configuration Designer to create [provisioning packages](provisioning-packages.md) to apply settings to devices during the out-of-box-experience (OOBE), and after the devices are set up. You can also use provisioning packages to configure a device's connectivity and enroll the device in MDM. Many of the runtime settings in Windows Configuration Designer are based on CSPs.
Many settings in Windows Configuration Designer will display documentation for that setting in the center pane, and will include a reference to the CSP if the setting uses one, as shown in the following image. Many settings in Windows Configuration Designer display documentation for that setting in the center pane, and include a reference to the CSP if the setting uses one.
:::image type="content" source="images/cspinicd.png" alt-text="In Windows Configuration Designer, how help content appears in ICD."::: :::image type="content" source="images/cspinicd.png" alt-text="In Windows Configuration Designer, how help content appears in ICD.":::
[Provisioning packages in Windows client](provisioning-packages.md) explains how to use the Windows Configuration Designer tool to create a runtime provisioning package. [Provisioning packages in Windows client](provisioning-packages.md) explains how to use the Windows Configuration Designer tool to create a runtime provisioning package.
### CSPs in MDM ## CSPs in MDM
Most, if not all, CSPs are surfaced through your MDM service. If you see a CSP that provides a capability that you want to make use of and cannot find that capability in your MDM service, contact your MDM provider for assistance. It might be named differently than you expected. You can see the CSPs supported by MDM in the [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference). Most, if not all, CSPs are surfaced through your MDM service. If you see a CSP that provides a capability that you want to make use of and can't find that capability in your MDM service, contact your MDM provider for assistance. It might be named differently than you expected. You can see the CSPs supported by MDM in the [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference).
When a CSP is available but is not explicitly included in your MDM solution, you may be able to make use of the CSP by using OMA-URI settings. In Intune, for example, you can use [custom policy settings](/mem/intune/configuration/custom-settings-configure) to deploy settings. Intune documents [a partial list of settings](/mem/intune/configuration/custom-settings-windows-10) that you can enter in the **OMA-URI Settings** section of a custom policy, if your MDM service provides that extension. You'll notice that the list doesn't explain the meanings of the allowed and default values, so use the [CSP reference documentation](/windows/client-management/mdm/configuration-service-provider-reference) to locate that information. When a CSP is available but isn't explicitly included in your MDM solution, you may be able to make use of the CSP by using OMA-URI settings. In Intune, for example, you can use [custom policy settings](/mem/intune/configuration/custom-settings-configure) to deploy settings. Intune documents [a partial list of settings](/mem/intune/configuration/custom-settings-windows-10) that you can enter in the **OMA-URI Settings** section of a custom policy, if your MDM service provides that extension. You'll notice that the list doesn't explain the meanings of the allowed and default values, so use the [CSP reference documentation](/windows/client-management/mdm/configuration-service-provider-reference) to locate that information.
### CSPs in Lockdown XML
## <a href="" id="bkmk-csp-doc"></a>How do you use the CSP documentation?
All CSPs are documented in the [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference).
The [CSP reference](/windows/client-management/mdm/configuration-service-provider-reference) tells you which CSPs are supported on each edition of Windows, and links to the documentation for each individual CSP.
:::image type="content" source="images/csptable.png" alt-text="The CSP reference shows the supported Windows editions":::
The documentation for each CSP follows the same structure. After an introduction that explains the purpose of the CSP, a diagram shows the parts of the CSP in tree format.
The full path to a specific configuration setting is represented by its Open Mobile Alliance - Uniform Resource Identifier (OMA-URI). The URI is relative to the devices' root node (MSFT, for example). Features supported by a particular CSP can be set by addressing the complete OMA-URI path.
The following example shows the diagram for the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). The diagram maps to the XML for that CSP. Notice the different shapes in the diagram: rounded elements are nodes, and rectangular elements are settings or policies for which a value must be supplied.
:::image type="content" source="images/provisioning-csp-assignedaccess.png" alt-text="The CSP reference shows the assigned access CSP tree.":::
The element in the tree diagram after the root node tells you the name of the CSP. Knowing this structure, you would recognize in XML the parts of the URI path for that CSP and, if you saw it in XML, you would know which CSP reference to look up. For example, in the following OMS-URI path for the kiosk mode app settings, you can see that it uses the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp).
```XML
./Vendor/MSFT/AssignedAccess/KioskModeApp
```
When an element in the diagram uses _italic_ font, it indicates a placeholder for specific information, such as the tenant ID in the following example.
:::image type="content" source="images/csp-placeholder.png" alt-text="The placeholder in the CSP tree":::
After the diagram, the documentation describes each element. For each policy or setting, the valid values are listed.
For example, in the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp), the setting is **KioskModeApp**. The documentation tells you that the value for **KioskModeApp** is a JSON string that contains the user account name and Application User Model ID (AUMID) of the Kiosk mode app.
The documentation for most CSPs will also include an XML example.
## CSP examples
CSPs provide access to many settings useful to enterprises. This section introduces the CSPs that an enterprise might find useful.
- [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider)
The Policy CSP enables the enterprise to configure policies on Windows client. Some of these policy settings can also be applied using Group Policy, and the CSP documentation lists the equivalent Group Policy settings.
Some of the settings available in the Policy CSP include the following:
- **Accounts**, such as whether a non-Microsoft account can be added to the device.
- **Application management**, such as whether only Microsoft Store apps are allowed.
- **Bluetooth**, such as the services allowed to use it.
- **Browser**, such as restricting InPrivate browsing.
- **Connectivity**, such as whether the device can be connected to a computer by USB.
- **Defender** (for desktop only), such as day and time to scan.
- **Device lock**, such as the type of PIN or password required to unlock the device.
- **Experience**, such as allowing Cortana.
- **Security**, such as whether provisioning packages are allowed.
- **Settings**, such as enabling the user to change VPN settings.
- **Start**, such as applying a standard Start layout.
- **System**, such as allowing the user to reset the device.
- **Text input**, such as allowing the device to send anonymized user text input data samples to Microsoft.
- **Update**, such as whether the device can use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store.
- **WiFi**, such as whether Internet sharing is enabled.
Here is a list of CSPs supported on Windows 10 Enterprise:
- [ActiveSync CSP](/windows/client-management/mdm/activesync-csp)
- [Application CSP](/windows/client-management/mdm/application-csp)
- [AppLocker CSP](/windows/client-management/mdm/applocker-csp)
- [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp)
- [Bootstrap CSP](/windows/client-management/mdm/bootstrap-csp)
- [BrowserFavorite CSP](/windows/client-management/mdm/browserfavorite-csp)
- [CellularSettings CSP](/windows/client-management/mdm/cellularsettings-csp)
- [CertificateStore CSP](/windows/client-management/mdm/certificatestore-csp)
- [ClientCertificateInstall CSP](/windows/client-management/mdm/clientcertificateinstall-csp)
- [CM\_CellularEntries CSP](/windows/client-management/mdm/cm-cellularentries-csp)
- [CM\_ProxyEntries CSP](/windows/client-management/mdm/cm-proxyentries-csp)
- [CMPolicy CSP](/windows/client-management/mdm/cmpolicy-csp)
- [Defender CSP](/windows/client-management/mdm/defender-csp)
- [DevDetail CSP](/windows/client-management/mdm/devdetail-csp)
- [DeviceInstanceService CSP](/windows/client-management/mdm/deviceinstanceservice-csp)
- [DeviceLock CSP](/windows/client-management/mdm/devicelock-csp)
- [DeviceStatus CSP](/windows/client-management/mdm/devicestatus-csp)
- [DevInfo CSP](/windows/client-management/mdm/devinfo-csp)
- [DiagnosticLog CSP](/windows/client-management/mdm/diagnosticlog-csp)
- [DMAcc CSP](/windows/client-management/mdm/dmacc-csp)
- [DMClient CSP](/windows/client-management/mdm/dmclient-csp)
- [Email2 CSP](/windows/client-management/mdm/email2-csp)
- [EnterpriseAPN CSP](/windows/client-management/mdm/enterpriseapn-csp)
- [EnterpriseAssignedAccess CSP](/windows/client-management/mdm/enterpriseassignedaccess-csp)
- [EnterpriseDesktopAppManagement CSP](/windows/client-management/mdm/enterprisedesktopappmanagement-csp)
- [EnterpriseExt CSP](/windows/client-management/mdm/enterpriseext-csp)
- [EnterpriseModernAppManagement CSP](/windows/client-management/mdm/enterprisemodernappmanagement-csp)
- [FileSystem CSP](/windows/client-management/mdm/filesystem-csp)
- [HealthAttestation CSP](/windows/client-management/mdm/healthattestation-csp)
- [HotSpot CSP](/windows/client-management/mdm/hotspot-csp)
- [Maps CSP](/windows/client-management/mdm/maps-csp)
- [NAP CSP](/windows/client-management/mdm/filesystem-csp)
- [NAPDEF CSP](/windows/client-management/mdm/napdef-csp)
- [NodeCache CSP](https://go.microsoft.com/fwlink/p/?LinkId=723265)
- [PassportForWork CSP](/windows/client-management/mdm/passportforwork-csp)
- [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider)
- [PolicyManager CSP](https://go.microsoft.com/fwlink/p/?LinkId=723418)
- [Provisioning CSP](/windows/client-management/mdm/provisioning-csp)
- [Proxy CSP](https://go.microsoft.com/fwlink/p/?LinkId=723372)
- [PXLOGICAL CSP](/windows/client-management/mdm/pxlogical-csp)
- [Registry CSP](/windows/client-management/mdm/registry-csp)
- [RemoteFind CSP](/windows/client-management/mdm/remotefind-csp)
- [RemoteWipe CSP](/windows/client-management/mdm/remotewipe-csp)
- [Reporting CSP](/windows/client-management/mdm/reporting-csp)
- [RootCATrustedCertificates CSP](/windows/client-management/mdm/rootcacertificates-csp)
- [SecurityPolicy CSP](/windows/client-management/mdm/securitypolicy-csp)
- [Storage CSP](/windows/client-management/mdm/storage-csp)
- [SUPL CSP](/windows/client-management/mdm/supl-csp)
- [UnifiedWriteFilter CSP](/windows/client-management/mdm/unifiedwritefilter-csp)
- [Update CSP](/windows/client-management/mdm/update-csp)
- [VPN CSP](/windows/client-management/mdm/vpn-csp)
- [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp)
- [Wi-Fi CSP](/windows/client-management/mdm/wifi-csp)
- [WindowsLicensing CSP](/windows/client-management/mdm/windowslicensing-csp)
- [WindowsSecurityAuditing CSP](/windows/client-management/mdm/windowssecurityauditing-csp)

BIN
windows/configuration/provisioning-packages/images/ICD.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 59 KiB

After

Width:  |  Height:  |  Size: 29 KiB

69
windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md
View File

@ -1,63 +1,47 @@
--- ---
title: Provision PCs with common settings title: Create a provisioning package (desktop wizard)
description: Create a provisioning package to apply common settings to a PC running Windows 10. description: Create a provisioning package to apply common settings to a PC running Windows.
ms.topic: how-to ms.topic: how-to
ms.date: 12/31/2017 ms.date: 07/09/2024
--- ---
# Provision PCs with common settings for initial deployment (desktop wizard) # Create a provisioning package (desktop wizard)
This topic explains how to create and apply a provisioning package that contains common enterprise settings to a device running all desktop editions of Windows client except Home. This article explains how to create and apply a provisioning package that contains common enterprise settings to a device running all desktop editions of Windows client except Home. You can apply a provisioning package on a USB drive to off-the-shelf devices during setup, making it fast and easy to configure new devices.
You can apply a provisioning package on a USB drive to off-the-shelf devices during setup, making it fast and easy to configure new devices. The following wizard options provide a simple interface for configuring common settings for desktop and kiosk devices:
## Advantages - [Instructions for the desktop wizard](#start-a-new-project)
- [Instructions for the kiosk wizard](../assigned-access/overview.md)
- [Instructions for the HoloLens wizard](/hololens/hololens-provisioning#provisioning-package-hololens-wizard)
- [Instructions for the Surface Hub wizard](/surface-hub/provisioning-packages-for-surface-hub)
- You can configure new devices without reimaging In this example, we use the **Provision desktop devices** option which helps you configure the following settings in a provisioning package:
- Works on desktop devices
- No network connectivity required
- Simple to apply
[Learn more about the benefits and uses of provisioning packages.](provisioning-packages.md)
## What does the desktop wizard do?
The desktop wizard helps you configure the following settings in a provisioning package:
- Set device name - Set device name
- Upgrade product edition - Upgrade product edition
- Configure the device for shared use - Configure the device for shared use
- Remove pre-installed software - Remove preinstalled software
- Configure Wi-Fi network - Configure Wi-Fi network
- Enroll device in Active Directory or Microsoft Entra ID - Enroll device in Active Directory or Microsoft Entra ID
- Create local administrator account - Create local administrator account
- Add applications and certificates - Add applications and certificates
>[!WARNING] > [IMPORTANT]
>You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. > You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards.
Provisioning packages can include management instructions and policies, installation of specific apps, customization of network connections and policies, and more. ## Start a new project
> [!TIP] 1. Open Windows Configuration Designer: From either the Start menu or Start menu search, type **Windows Configuration Designer**, and then select the **Windows Configuration Designer** shortcut.
> Use the desktop wizard to create a package with the common settings, then switch to the advanced editor to add other settings, apps, policies, etc.
>
> :::image type="content" source="images/icd-simple-edit.png" alt-text="In the desktop wizard, open the advanced editor.":::
## Create the provisioning package 1. Select **Provision desktop devices**.
Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-install-icd.md)
1. Open Windows Configuration Designer (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe).
1. Click **Provision desktop devices**.
:::image type="content" source="images/icd-create-options-1703.png" alt-text="In Windows Configuration Designer, see the ICD start options."::: :::image type="content" source="images/icd-create-options-1703.png" alt-text="In Windows Configuration Designer, see the ICD start options.":::
1. Name your project and click **Finish**. The pages for desktop provisioning will walk you through the following steps. 1. Name your project and select **Finish**. The pages for desktop provisioning walk you through the following steps.
:::image type="content" source="images/icd-desktop-1703.png" alt-text="In Windows Configuration Designer, select Finish, and see the ICD desktop provisioning."::: :::image type="content" source="images/icd-desktop-1703.png" alt-text="In Windows Configuration Designer, select Finish, and see the ICD desktop provisioning.":::
> [!IMPORTANT] > [!IMPORTANT]
> When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
@ -74,6 +58,9 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
- **Configure devices for shared use**: Select **Yes** or **No** to optimize the Windows client for shared use scenarios. - **Configure devices for shared use**: Select **Yes** or **No** to optimize the Windows client for shared use scenarios.
- **Remove pre-installed software**: Optional. Select **Yes** if you want to remove preinstalled software. - **Remove pre-installed software**: Optional. Select **Yes** if you want to remove preinstalled software.
> [!NOTE]
> To target devices running versions earlier than Windows 10, version 2004, ComputerName customization must be defined from the setting path: `Accounts/ComputerAccount/ComputerName` from the advanced editor. The default path from the simple editor uses a new CSP that isn't available on older systems.
1. Set up the network: 1. Set up the network:
:::image type="content" source="images/set-up-network-details-desktop.png" alt-text="In Windows Configuration Designer, turn on wireless connectivity, enter the network SSID, and network type."::: :::image type="content" source="images/set-up-network-details-desktop.png" alt-text="In Windows Configuration Designer, turn on wireless connectivity, enter the network SSID, and network type.":::
@ -81,7 +68,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
If you want to enable network setup, select **Set up network**, and configure the following settings: If you want to enable network setup, select **Set up network**, and configure the following settings:
- **Set up network**: To enable wireless connectivity, select **On**. - **Set up network**: To enable wireless connectivity, select **On**.
- **Network SSID**: Enter the Service Set IDentifier (SSID) of the network. - **Network SSID**: Enter the Service Set Identifier (SSID) of the network.
- **Network type**: Select **Open** or **WPA2-Personal**. If you select **WPA2-Personal**, enter the password for the wireless network. - **Network type**: Select **Open** or **WPA2-Personal**. If you select **WPA2-Personal**, enter the password for the wireless network.
1. Enable account management: 1. Enable account management:
@ -91,10 +78,11 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
If you want to enable account management, select **Account Management**, and configure the following settings: If you want to enable account management, select **Account Management**, and configure the following settings:
- **Manage organization/school accounts**: Choose how devices are enrolled. Your options: - **Manage organization/school accounts**: Choose how devices are enrolled. Your options:
- **Active Directory**: Enter the credentials for a least-privileged user account to join the device to the domain. - **Active Directory**: Enter the credentials for a least-privileged user account to join the device to the domain.
- **Microsoft Entra ID**: Before you use a Windows Configuration Designer wizard to configure bulk Microsoft Entra enrollment, [set up Microsoft Entra join in your organization](/azure/active-directory/active-directory-azureadjoin-setup). In your Microsoft Entra tenant, the **maximum number of devices per user** setting determines how many times the bulk token in the wizard can be used. - **Microsoft Entra ID**: Before you use a Windows Configuration Designer wizard to configure bulk Microsoft Entra enrollment, [set up Microsoft Entra join in your organization](/azure/active-directory/active-directory-azureadjoin-setup). In your Microsoft Entra tenant, the **maximum number of devices per user** setting determines how many times the bulk token in the wizard can be used.
If you select this option, enter a friendly name for the bulk token you get using the wizard. Set an expiration date for the token. The maximum is 180 days from the date you get the token. Select **Get bulk token**. In **Let's get you signed in**, enter an account that has permissions to join a device to Microsoft Entra ID, and then the password. Select **Accept** to give Windows Configuration Designer the necessary permissions. If you select this option, enter a friendly name for the bulk token retrieved using the wizard. Set an expiration date for the token. The maximum is 180 days from the date you get the token. Select **Get bulk token**. In **Let's get you signed in**, enter an account that has permissions to join a device to Microsoft Entra ID, and then the password. Select **Accept** to give Windows Configuration Designer the necessary permissions.
You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards.
@ -123,6 +111,11 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
- **Protect your package**: Select **Yes** or **No** to password protect your provisioning package. When you apply the provisioning package to a device, you must enter this password. - **Protect your package**: Select **Yes** or **No** to password protect your provisioning package. When you apply the provisioning package to a device, you must enter this password.
After you're done, click **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page. After you're done, select **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page.
**Next step**: [How to apply a provisioning package](provisioning-apply-package.md) ## Next steps
> [!div class="nextstepaction"]
> Learn more about applying a provisioning package:
>
> [Apply a provisioning package](provisioning-apply-package.md)

103
windows/configuration/provisioning-packages/provision-pcs-with-apps.md
View File

@ -2,21 +2,21 @@
title: Provision PCs with apps title: Provision PCs with apps
description: Learn how to install multiple Universal Windows Platform (UWP) apps and Windows desktop applications (Win32) in a provisioning package. description: Learn how to install multiple Universal Windows Platform (UWP) apps and Windows desktop applications (Win32) in a provisioning package.
ms.topic: how-to ms.topic: how-to
ms.date: 12/31/2017 ms.date: 07/09/2024
--- ---
# Provision PCs with apps # Provision PCs with apps
You can install multiple Universal Windows Platform (UWP) apps and Windows desktop applications (Win32) in a provisioning package. This article explains the various settings in [Windows Configuration Designer](provisioning-install-icd.md) for app install. You can install multiple Universal Windows Platform (UWP) apps and Windows desktop applications (Win32) in a provisioning package. This article explains the various settings in [Windows Configuration Designer](provisioning-install-icd.md) for app install.
When you add an app in a Windows Configuration Designer wizard, the appropriate settings are displayed based on the app that you select. For instructions on adding an app using the advanced editor in Windows Configuration Designer, see [Add an app using advanced editor](#adv). When you add an app in a Windows Configuration Designer wizard, the appropriate settings are displayed based on the app that you select. For instructions on adding an app using the advanced editor in Windows Configuration Designer, see [Add an app using advanced editor](#add-a-windows-desktop-application-using-advanced-editor).
>[!IMPORTANT] > [!IMPORTANT]
>If you plan to use Intune to manage your devices, we recommend using Intune to install Microsoft 365 Apps for enterprise 2016 apps (Access, Excel, OneDrive for Business, OneNote, Outlook, PowerPoint, Publisher, Skype for Business, Word, Project Desktop Client, and Visio Pro for Microsoft 365 Apps for enterprise). Apps that are installed using a provisioning package cannot be managed or modified using Intune. [Learn how to assign Microsoft 365 Apps for enterprise 2016 apps using Microsoft Intune.](/intune/apps-add-office365) > If you plan to use Intune to manage your devices, we recommend using Intune to install Microsoft 365 Apps for enterprise. Apps that are installed using a provisioning package cannot be managed or modified using Intune. [Learn how to add Microsoft 365 Apps to Windows devices with Microsoft Intune.](/intune/apps-add-office365)
## Settings for UWP apps ## Settings for UWP apps
- **License Path**: Specify the license file if it is an app from the Microsoft Store. This is optional if you have a certificate for the app. - **License Path**: Specify the license file if it's an app from the Microsoft Store. This is optional if you have a certificate for the app.
- **Package family name**: Specify the package family name if you don't specify a license. This field will be autopopulated after you specify a license. - **Package family name**: Specify the package family name if you don't specify a license. This field will be autopopulated after you specify a license.
- **Required appx dependencies**: Specify the appx dependency packages that are required for the installation of the app - **Required appx dependencies**: Specify the appx dependency packages that are required for the installation of the app
@ -24,32 +24,23 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate
### MSI installer ### MSI installer
- **Command line arguments**: Optionally, append more command arguments. The silent flag is appended for you. Example: PROPERTY=VALUE
- **Continue installations after failure**: Optionally, specify if you want to continue installing more apps if this app fails to install
- **Restart required**: Optionally, specify if you want to reboot after a successful install of this app
- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#extract-from-a-cab-example).
> [!NOTE] > [!NOTE]
> You can find more information about command-line options for Msiexec.exe [here](/windows/win32/msi/command-line-options). > You can find more information about command-line options for Msiexec.exe [here](/windows/win32/msi/command-line-options).
- **Command line arguments**: Optionally, append more command arguments. The silent flag is appended for you. Example: PROPERTY=VALUE
- **Continue installations after failure**: Optionally, specify if you want to continue installing more apps if this app fails to install
- **Restart required**: Optionally, specify if you want to reboot after a successful install of this app
- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#cab-extract).
### Exe or other installer ### Exe or other installer
- **Command line arguments**: Append the command line arguments with a silent flag (required). Optionally, append more flags - **Command line arguments**: Append the command line arguments with a silent flag (required). Optionally, append more flags
- **Return Codes**: Specify the return codes for success and success with restart (0 and 3010 by default respectively) Any return code that isn't listed is interpreted as failure. The text boxes are space delimited.
- **Return Codes**: Specify the return codes for success and success with restart (0 and 3010 by default respectively) Any return code that is not listed will be interpreted as failure. The text boxes are space delimited.
- **Continue installations after failure**: Optionally, specify if you want to continue installing more apps if this app fails to install - **Continue installations after failure**: Optionally, specify if you want to continue installing more apps if this app fails to install
- **Restart required**: Optionally, specify if you want to reboot after a successful install of this app - **Restart required**: Optionally, specify if you want to reboot after a successful install of this app
- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#extract-from-a-cab-example).
- **Required win32 app dependencies**: Optionally, specify more files that are required for the installation of the app. For installers that have multiple file dependencies or have directory structures, [create a cab file of the assets](provisioning-script-to-install-app.md#cab-the-application-assets). The installation script should [include expansion of the .cab file](provisioning-script-to-install-app.md#cab-extract). ## Add a Windows desktop application using advanced editor
<span id="adv" />
## Add a Windows desktop application using advanced editor in Windows Configuration Designer
1. In the **Available customizations** pane, go to **Runtime settings** > **ProvisioningCommands** > **PrimaryContext** > **Command**. 1. In the **Available customizations** pane, go to **Runtime settings** > **ProvisioningCommands** > **PrimaryContext** > **Command**.
@ -61,50 +52,32 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate
![enter settings for first app.](images/wcd-app-commands.png) ![enter settings for first app.](images/wcd-app-commands.png)
## Add a universal app to your package ## Add a universal app to your package using advanced editor
Universal apps that you can distribute in the provisioning package can be line-of-business (LOB) apps developed by your organization, Microsoft Store for Business apps that you acquire with [offline licensing](/microsoft-store/acquire-apps-windows-store-for-business), or third-party apps. This procedure will assume you are distributing apps from the Microsoft Store for Business. For other apps, obtain the necessary information (such as the package family name) from the app developer. Universal apps that you can distribute in the provisioning package can be line-of-business (LOB) apps developed by your organization, Microsoft Store for Business apps that you acquire with [offline licensing](/microsoft-store/acquire-apps-windows-store-for-business), or non-Microsoft apps. This procedure assumes you're distributing apps from the Microsoft Store for Business. For other apps, obtain the necessary information (such as the package family name) from the app developer.
1. In the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall**. 1. In the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall**.
1. For **DeviceContextApp**, specify the **PackageFamilyName** for the app. In Microsoft Store for Business, the package family name is listed in the **Package details** section of the download page. 1. For **DeviceContextApp**, specify the **PackageFamilyName** for the app. In Microsoft Store for Business, the package family name is listed in the **Package details** section of the download page.
1. For **ApplicationFile**, select **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). 1. For **ApplicationFile**, select **Browse** to find and select the target app (either an \*.appx or \*.appxbundle).
1. For **DependencyAppxFiles**, select **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page. 1. For **DependencyAppxFiles**, select **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page.
1. For **DeviceContextAppLicense**, enter the **LicenseProductID**. 1. For **DeviceContextAppLicense**, enter the **LicenseProductID**.
- In Microsoft Store for Business, generate the unencoded license for the app on the app's download page. - In Microsoft Store for Business, generate the unencoded license for the app on the app's download page.
- Open the license file and search for **LicenseID=** to get the GUID, enter the GUID in the **LicenseProductID** field and select **Add**. - Open the license file and search for **LicenseID=** to get the GUID, enter the GUID in the **LicenseProductID** field and select **Add**.
1. In the **Available customizations** pane, select the **LicenseProductId** that you just added. 1. In the **Available customizations** pane, select the **LicenseProductId** that you just added.
1. For **LicenseInstall**, select **Browse**, navigate to the license file that you renamed *\<file name>*.**ms-windows-store-license**, and select the license file. 1. For **LicenseInstall**, select **Browse**, navigate to the license file that you renamed *\<file name>*.**ms-windows-store-license**, and select the license file.
[Learn more about distributing offline apps from the Microsoft Store for Business.](/microsoft-store/distribute-offline-apps) [Learn more about distributing offline apps from the Microsoft Store for Business.](/microsoft-store/distribute-offline-apps)
> [!NOTE] > [!IMPORTANT]
> Removing a provisioning package will not remove any apps installed by device context in that provisioning package. > Removing a provisioning package will not remove any apps installed by device context in that provisioning package.
## Add a certificate to your package ## Add a certificate to your package
1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**. 1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**.
1. Enter a **CertificateName** and then select **Add**. 1. Enter a **CertificateName** and then select **Add**.
1. Enter the **CertificatePassword**. 1. Enter the **CertificatePassword**.
1. For **CertificatePath**, browse and select the certificate to be used. 1. For **CertificatePath**, browse and select the certificate to be used.
1. Set **ExportCertificate** to **False**. 1. Set **ExportCertificate** to **False**.
1. For **KeyLocation**, select **Software only**. 1. For **KeyLocation**, select **Software only**.
## Add other settings to your package ## Add other settings to your package
@ -113,15 +86,15 @@ For details about the settings you can customize in provisioning packages, see [
## Build your package ## Build your package
1. When you are done configuring the provisioning package, on the **File** menu, select **Save**. 1. After you configure the provisioning package, on the **File** menu, select **Save**.
1. Read the warning that project files may contain sensitive information, and select **OK**. 1. Read the warning that project files may contain sensitive information, and select **OK**.
When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location, and delete the project files when they're no longer needed. When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files aren't encrypted. Store the project files in a secure location, and delete the project files when they're no longer needed.
1. On the **Export** menu, select **Provisioning package**. 1. On the **Export** menu, select **Provisioning package**.
1. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** 1. Change **Owner** to **IT Admin**, which sets the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
1. Set a value for **Package Version**. 1. Set a value for **Package Version**.
@ -130,51 +103,33 @@ For details about the settings you can customize in provisioning packages, see [
1. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. 1. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing.
- **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - **Enable package encryption** - If you select this option, an autogenerated password is shown on the screen.
- **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select...** and choosing the certificate you want to use to sign the package. - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select...** and choosing the certificate you want to use to sign the package.
> [!TIP] > [!TIP]
> We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store. Any package signed with that certificate can be applied silently. > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store. Any package signed with that certificate can be applied silently.
1. Select **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.<p> 1. Select **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location. Optionally, you can select **Browse** to change the default output location.
Optionally, you can select **Browse** to change the default output location.
1. Select **Next**. 1. Select **Next**.
1. Select **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.<p> 1. Select **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status. If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
1. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.<p> 1. If your build fails, an error message shows up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. If your build is successful, the name of the provisioning package, output directory, and project directory is shown.
If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
- If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build. - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build.
- If you're done, select **Finish** to close the wizard and go back to the **Customizations Page**.
- If you are done, select **Finish** to close the wizard and go back to the **Customizations Page**.
1. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods: 1. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods:
- Shared network folder - Shared network folder
- SharePoint site - SharePoint site
- Removable media (USB/SD) - Removable media (USB/SD)
- Email - Email
**Next step**: [How to apply a provisioning package](provisioning-apply-package.md) ## Next steps
## Related articles > [!div class="nextstepaction"]
> Learn more about applying a provisioning package:
- [Provisioning packages for Windows client](provisioning-packages.md) >
- [How provisioning works in Windows client](provisioning-how-it-works.md) > [Apply a provisioning package](provisioning-apply-package.md)
- [Install Windows Configuration Designer](provisioning-install-icd.md)
- [Create a provisioning package](provisioning-create-package.md)
- [Apply a provisioning package](provisioning-apply-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)

29
windows/configuration/provisioning-packages/provisioning-apply-package.md
View File

@ -2,7 +2,7 @@
title: Apply a provisioning package title: Apply a provisioning package
description: Provisioning packages can be applied to a device during initial setup (OOBE) and after (runtime). description: Provisioning packages can be applied to a device during initial setup (OOBE) and after (runtime).
ms.topic: how-to ms.topic: how-to
ms.date: 12/31/2017 ms.date: 07/09/2024
--- ---
# Apply a provisioning package # Apply a provisioning package
@ -13,22 +13,20 @@ Provisioning packages can be applied to a device during initial setup (out-of-bo
> >
> - Applying a provisioning package to a desktop device requires administrator privileges on the device. > - Applying a provisioning package to a desktop device requires administrator privileges on the device.
> - You can interrupt a long-running provisioning process by pressing ESC. > - You can interrupt a long-running provisioning process by pressing ESC.
> - In addition to the following methods, you can use the PowerShell cmdlet [Install-ProvisioningPackage](/powershell/module/provisioning/Install-ProvisioningPackage) with `-LogsDirectoryPath` to get logs for the operation.
> [!TIP]
> In addition to the following methods, you can use the PowerShell cmdlet [Install-ProvisioningPackage](/powershell/module/provisioning/Install-ProvisioningPackage) with `-LogsDirectoryPath` to get logs for the operation.
## During initial setup ## During initial setup
To apply a provisioning package from a USB drive during initial setup: To apply a provisioning package from a USB drive during initial setup:
1. Start with a device on the initial setup screen. If the device has gone past this screen, reset the device to start over. To reset, go to **Settings** > **System** > [**Recovery**](ms-settings:recovery) > **Reset this PC**. 1. Start with a device on the initial setup screen. If the device goes past this screen, reset the device to start over. To reset, go to **Settings** > **System** > [**Recovery**](ms-settings:recovery) > **Reset this PC**.
:::image type="content" source="images/oobe.png" alt-text="The first screen when setting up a new PC."::: :::image type="content" source="images/oobe.png" alt-text="The first screen when setting up a new PC.":::
1. Insert the USB drive. If nothing happens when you insert the USB drive, press the Windows key five times. 1. Insert the USB drive. If nothing happens when you insert the USB drive, press the Windows key five times.
- If there's only one provisioning package on the USB drive, the provisioning package is applied. See step 5. - If there's only one provisioning package on the USB drive, the provisioning package is applied. See step 5.
- If there's more than one provisioning package on the USB drive, Windows setup recognizes the drive and ask how you want to provision the device. Select **Install provisioning package** and select **Next**. - If there's more than one provisioning package on the USB drive, Windows setup recognizes the drive and asks how you want to provision the device. Select **Install provisioning package** and select **Next**.
:::image type="content" source="images/provisioning-oobe-choice.png" alt-text="What would you like to do?"::: :::image type="content" source="images/provisioning-oobe-choice.png" alt-text="What would you like to do?":::
@ -36,11 +34,11 @@ To apply a provisioning package from a USB drive during initial setup:
:::image type="content" source="images/provisioning-oobe-choose-package.png" alt-text="Choose a package."::: :::image type="content" source="images/provisioning-oobe-choose-package.png" alt-text="Choose a package.":::
1. The selected provisioning package will install and apply to the device. 1. The selected provisioning package is applied to the device.
:::image type="content" source="images/provisioning-oobe-installing.png" alt-text="Setting up your PC."::: :::image type="content" source="images/provisioning-oobe-installing.png" alt-text="Setting up your PC.":::
1. Wait for the device to load and begin applying the provisioning package. Once you see "You can remove your removable media now!" you can remove your USB drive. Windows will continue provisioning the device. 1. Wait for the device to load and begin applying the provisioning package. After you see "You can remove your removable media now!" you can remove your USB drive. Windows continues to provision the device.
## After initial setup ## After initial setup
@ -60,7 +58,7 @@ Provisioning packages can be applied after initial setup through Windows setting
:::image type="content" source="images/provisioning-runtime-add-package.png" alt-text="Select and add a package."::: :::image type="content" source="images/provisioning-runtime-add-package.png" alt-text="Select and add a package.":::
1. Provisioning packages require administrator privileges as they can modify system policies and run scripts at the system level. Ensure you trust the package you're installing before accepting the UAC prompt. Select **Yes**. 1. Provisioning packages require administrator privileges as they can modify system policies and run scripts at the system level. Ensure you trust the package you're installing before accepting the User Account Control (UAC) prompt. Select **Yes**.
:::image type="content" source="images/provisioning-runtime-UAC.png" alt-text="Do you want to allow changes to your device?"::: :::image type="content" source="images/provisioning-runtime-UAC.png" alt-text="Do you want to allow changes to your device?":::
@ -83,16 +81,3 @@ To apply a provisioning package directly, such as from a USB drive, folder, netw
1. The provisioning runtime asks if the package is from a source you trust. Verify that you're applying the correct package and that it's trusted. Select **Yes, add it**. 1. The provisioning runtime asks if the package is from a source you trust. Verify that you're applying the correct package and that it's trusted. Select **Yes, add it**.
:::image type="content" source="images/provisioning-runtime-trust.png" alt-text="Do you trust this package?"::: :::image type="content" source="images/provisioning-runtime-trust.png" alt-text="Do you trust this package?":::
## Related articles
- [Provisioning packages for Windows client](provisioning-packages.md)
- [How provisioning works in Windows client](provisioning-how-it-works.md)
- [Install Windows Configuration Designer](provisioning-install-icd.md)
- [Create a provisioning package](provisioning-create-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)

27
windows/configuration/provisioning-packages/provisioning-command-line.md
View File

@ -1,20 +1,17 @@
--- ---
title: Windows Configuration Designer command line interface title: Windows Configuration Designer command line interface
description: Learn more about the ICD syntax, switches, and arguments that you can use in the Windows Configuration Designer command line interface for Windows10/11 client devices. description: Learn more about the ICD syntax, switches, and arguments that you can use in the Windows Configuration Designer command line interface for Windows devices.
ms.topic: how-to ms.topic: how-to
ms.date: 12/31/2017 ms.date: 07/09/2024
--- ---
# Windows Configuration Designer command line interface (reference) # Windows Configuration Designer command line interface
You can use the Windows Configuration Designer command line interface (CLI) to automate the building of provisioning packages. You can use the Windows Configuration Designer command line interface (CLI) to automate the building of provisioning packages.
- IT pros can use the Windows Configuration Designer CLI to require less retooling of existing processes. You must run the Windows Configuration Designer CLI from a command window with administrator privileges. - IT pros can use the Windows Configuration Designer CLI to require less retooling of existing processes. You must run the Windows Configuration Designer CLI from a command window with administrator privileges.
- You must use the Windows Configuration Designer CLI and edit the customizations.xml sources to create a provisioning package with multivariant support. You need the customizations.xml file as one of the inputs to the Windows Configuration Designer CLI to build a provisioning package. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md). - You must use the Windows Configuration Designer CLI and edit the customizations.xml sources to create a provisioning package with multivariant support. You need the customizations.xml file as one of the inputs to the Windows Configuration Designer CLI to build a provisioning package. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md).
## Syntax ## Syntax
``` cmd ``` cmd
@ -29,25 +26,9 @@ icd.exe /Build-ProvisioningPackage /CustomizationXML:<path_to_xml> /PackagePath:
| Switch | Required? | Arguments | | Switch | Required? | Arguments |
| --- | --- | --- | | --- | --- | --- |
| /CustomizationXML | No | Specifies the path to a Windows provisioning XML file that contains the customization assets and settings. For more information, see Windows provisioning answer file. | | /CustomizationXML | No | Specifies the path to a Windows provisioning XML file that contains the customization assets and settings. For more information, see Windows provisioning answer file. |
| /PackagePath | Yes | Specifies the path and the package name where the built provisioning package will be saved. | | /PackagePath | Yes | Specifies the path and the package name where the built provisioning package is saved. |
| /StoreFile | No</br></br></br>See Important note. | For partners using a settings store other than the default store(s) used by Windows Configuration Designer, use this parameter to specify the path to one or more comma-separated Windows settings store file. By default, if you don't specify a settings store file, the settings store that's common to all Windows editions is loaded by Windows Configuration Designer.</br></br></br>**Important** If you use this parameter, you must not use /MSPackageRoot or /OEMInputXML. | | /StoreFile | No</br></br></br>See Important note. | For partners using a settings store other than the default store(s) used by Windows Configuration Designer, use this parameter to specify the path to one or more comma-separated Windows settings store file. By default, if you don't specify a settings store file, the settings store that's common to all Windows editions is loaded by Windows Configuration Designer.</br></br></br>**Important** If you use this parameter, you must not use /MSPackageRoot or /OEMInputXML. |
| /Variables | No | Specifies a semicolon separated `<name>` and `<value>` macro pair. The format for the argument must be `<name>=<value>`. | | /Variables | No | Specifies a semicolon separated `<name>` and `<value>` macro pair. The format for the argument must be `<name>=<value>`. |
| Encrypted | No | Denotes whether the provisioning package should be built with encryption. Windows Configuration Designer autogenerates the decryption password and includes this information in the output. <br></br>Precede with `+` for encryption, or `-` for no encryption. The default is no encryption. | | Encrypted | No | Denotes whether the provisioning package should be built with encryption. Windows Configuration Designer autogenerates the decryption password and includes this information in the output. <br></br>Precede with `+` for encryption, or `-` for no encryption. The default is no encryption. |
| Overwrite | No | Denotes whether to overwrite an existing provisioning package. </br></br>Precede with + to overwrite an existing package or - if you don't want to overwrite an existing package. The default is false (don't overwrite). | | Overwrite | No | Denotes whether to overwrite an existing provisioning package. </br></br>Precede with + to overwrite an existing package or - if you don't want to overwrite an existing package. The default is false (don't overwrite). |
| /? | No | Lists the switches and their descriptions for the command-line tool or for certain commands. | | /? | No | Lists the switches and their descriptions for the command-line tool or for certain commands. |
## Related articles
- [Provisioning packages for Windows client](provisioning-packages.md)
- [How provisioning works in Windows client](provisioning-how-it-works.md)
- [Install Windows Configuration Designer](provisioning-install-icd.md)
- [Create a provisioning package](provisioning-create-package.md)
- [Apply a provisioning package](provisioning-apply-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)

81
windows/configuration/provisioning-packages/provisioning-create-package.md
View File

@ -1,16 +1,14 @@
--- ---
title: Create a provisioning package title: Create a provisioning package (advanced)
description: Learn how to create a provisioning package for Windows 10/11, which lets you quickly configure a device without having to install a new image. description: Learn how to create a provisioning package for Windows, which lets you quickly configure a device without having to install a new image.
ms.topic: how-to ms.topic: how-to
ms.date: 12/31/2017 ms.date: 07/09/2024
--- ---
# Create a provisioning package # Create a provisioning package (advanced)
You can use Windows Configuration Designer to create a provisioning package (`.ppkg`) that contains customization settings, and then apply the provisioning package to a device running Windows client. You can use Windows Configuration Designer to create a provisioning package (`.ppkg`) that contains customization settings, and then apply the provisioning package to a device running Windows client.
>[Learn how to install Windows Configuration Designer.](provisioning-install-icd.md)
> [!TIP] > [!TIP]
> We recommend creating a local admin account when you develop and test your provisioning package. We also recommend using a *least privileged* domain user account to join devices to the Active Directory domain. > We recommend creating a local admin account when you develop and test your provisioning package. We also recommend using a *least privileged* domain user account to join devices to the Active Directory domain.
@ -18,26 +16,11 @@ You can use Windows Configuration Designer to create a provisioning package (`.p
1. Open Windows Configuration Designer: From either the Start menu or Start menu search, type **Windows Configuration Designer**, and then select the **Windows Configuration Designer** shortcut. 1. Open Windows Configuration Designer: From either the Start menu or Start menu search, type **Windows Configuration Designer**, and then select the **Windows Configuration Designer** shortcut.
1. Select your desired option on the **Start** page, which offers multiple options for creating a provisioning package, as shown in the following image: 1. Select **Advanced provisioning** on the start page, which offers multiple options for creating a provisioning package, as shown in the following image:
![Configuration Designer wizards.](images/icd-create-options-1703.png) ![Configuration Designer wizards.](images/icd-create-options-1703.png)
- The following wizard options provide a simple interface for configuring common settings for desktop and kiosk devices: > [!TIP]
- [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md)
- [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard)
- [Instructions for HoloLens wizard](/hololens/hololens-provisioning)
- [Instructions for Surface Hub wizard](/surface-hub/provisioning-packages-for-surface-hub)
Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop and kiosk devices, see [What you can configure using Configuration Designer wizards](provisioning-packages.md#configuration-designer-wizards).
>[!NOTE]
>To target devices running versions earlier than Windows 10, version 2004, ComputerName customization must be defined from the setting path: `Accounts/ComputerAccount/ComputerName` from the advanced editor. The default path from the simple editor uses a new CSP that isn't available on older systems.
- The **Advanced provisioning** option opens a new project with all the runtime settings available. (The rest of this procedure uses advanced provisioning.)
>[!TIP]
> You can start a project in the simple wizard editor and then switch the project to the advanced editor. > You can start a project in the simple wizard editor and then switch the project to the advanced editor.
> >
> ![Switch to advanced editor.](images/icd-switch.png) > ![Switch to advanced editor.](images/icd-switch.png)
@ -67,7 +50,10 @@ For an advanced provisioning project, Windows Configuration Designer opens the *
![What the ICD interface looks like.](images/icd-runtime.png) ![What the ICD interface looks like.](images/icd-runtime.png)
The settings in Windows Configuration Designer are based on Windows client configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](./how-it-pros-can-use-configuration-service-providers.md). The settings in Windows Configuration Designer are based on Windows client configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](how-it-pros-can-use-configuration-service-providers.md).
> [!NOTE]
> To target devices running versions earlier than Windows 10, version 2004, ComputerName customization must be defined from the setting path: `Accounts/ComputerAccount/ComputerName` from the advanced editor. The default path from the simple editor uses a new CSP that isn't available on older systems.
The process for configuring settings is similar for all settings. The following table shows an example. The process for configuring settings is similar for all settings. The following table shows an example.
@ -83,11 +69,11 @@ The process for configuring settings is similar for all settings. The following
:::image type="content" source="images/icd-step3.png" alt-text="In Windows Configuration Designer, enter a name for the certificate."::: :::image type="content" source="images/icd-step3.png" alt-text="In Windows Configuration Designer, enter a name for the certificate.":::
1. Some settings, such as this example, require additional information. In **Available customizations**, select the value you just created, and more settings are displayed: 1. Some settings, such as this example, require additional information. In **Available customizations**, select the value you created, and more settings are displayed:
:::image type="content" source="images/icd-step4.png" alt-text="In Windows Configuration Designer, additional settings for client certificate are available."::: :::image type="content" source="images/icd-step4.png" alt-text="In Windows Configuration Designer, additional settings for client certificate are available.":::
1. When the setting is configured, it is displayed in the **Selected customizations** pane: 1. When the setting is configured, it's displayed in the **Selected customizations** pane:
:::image type="content" source="images/icd-step5.png" alt-text="In Windows Configuration Designer, the selected customizations pane shows your settings."::: :::image type="content" source="images/icd-step5.png" alt-text="In Windows Configuration Designer, the selected customizations pane shows your settings.":::
@ -97,27 +83,26 @@ For details on each specific setting, see [Windows Provisioning settings referen
## Build package ## Build package
1. After you're done configuring your customizations, select **Export**, and then select **Provisioning Package**. 1. After you configure your customizations, select **Export**, and then select **Provisioning Package**.
![Export on top bar.](images/icd-export-menu.png) ![Export on top bar.](images/icd-export-menu.png)
1. In the **Describe the provisioning package** window, enter the following information, and then select **Next**: 1. In the **Describe the provisioning package** window, enter the following information, and then select **Next**:
- **Name** - This field is pre-populated with the project name. You can change this value by entering a different name in the **Name** field.
- **Version (in Major.Minor format** - Optional. You can change the default package version by specifying a new value in the **Version** field.
- **Name** - This field is prepopulated with the project name. You can change this value by entering a different name in the **Name** field.
- **Version (in Major.Minor format** - Optional. You can change the default package version by specifying a new value in the **Version** field.
- **Owner** - Select **IT Admin**. For more information, see [Precedence for provisioning packages](provisioning-how-it-works.md#precedence-for-provisioning-packages). - **Owner** - Select **IT Admin**. For more information, see [Precedence for provisioning packages](provisioning-how-it-works.md#precedence-for-provisioning-packages).
- **Rank (between 0-99)** - Optional. You can select a value between 0 and 99, inclusive. The default package rank is 0. - **Rank (between 0-99)** - Optional. You can select a value between 0 and 99, inclusive. The default package rank is 0.
1. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate, and then select **Next**. Both selections are optional: 1. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate, and then select **Next**. Both selections are optional:
- **Encrypt package** - If you select this option, an autogenerated password will be shown on the screen. - **Encrypt package** - If you select this option, an autogenerated password is shown on the screen.
- **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select** and choosing the certificate you want to use to sign the package. - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select** and choosing the certificate you want to use to sign the package.
>[!NOTE] > [!NOTE]
>You should only configure provisioning package security when the package is used for device provisioning and when the package has content with sensitive security data, such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. > You should only configure provisioning package security when the package is used for device provisioning and when the package has content with sensitive security data, such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device.
> >
>If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner. > If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner.
1. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then select **Next**. By default, Windows Configuration Designer uses the project folder as the output location. 1. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then select **Next**. By default, Windows Configuration Designer uses the project folder as the output location.
@ -125,29 +110,17 @@ For details on each specific setting, see [Windows Provisioning settings referen
If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations** page. If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations** page.
1. If your build fails, an error message will appear that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. 1. If your build fails, an error message appears that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.
If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. If your build is successful, the name of the provisioning package, output directory, and project directory is shown.
If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build. If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build.
1. When you are done, select **Finish** to close the wizard and go back to the **Customizations** page. 1. When you're done, select **Finish** to close the wizard and go back to the **Customizations** page.
**Next step**: [How to apply a provisioning package](provisioning-apply-package.md) ## Next steps
## Learn more > [!div class="nextstepaction"]
> Learn more about applying a provisioning package:
- [How to bulk-enroll devices with On-premises Mobile Device Management in Microsoft Configuration Manager](/configmgr/mdm/deploy-use/bulk-enroll-devices-on-premises-mdm) >
> [Apply a provisioning package](provisioning-apply-package.md)
## Related articles
- [Provisioning packages for Windows client](provisioning-packages.md)
- [How provisioning works in Windows client](provisioning-how-it-works.md)
- [Install Windows Configuration Designer](provisioning-install-icd.md)
- [Apply a provisioning package](provisioning-apply-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)

24
windows/configuration/provisioning-packages/provisioning-how-it-works.md
View File

@ -1,13 +1,13 @@
--- ---
title: How provisioning works in Windows 10/11 title: How provisioning works in Windows
description: Learn more about how provisioning package work on Windows client devices. A provisioning package (.ppkg) is a container for a collection of configuration settings. description: Learn more about how provisioning package work on Windows client devices. A provisioning package (.ppkg) is a container for a collection of configuration settings.
ms.topic: conceptual ms.topic: conceptual
ms.date: 12/31/2017 ms.date: 07/09/2024
--- ---
# How provisioning works in Windows # How provisioning works in Windows
Provisioning packages in Windows client provide IT administrators with a simplified way to apply configuration settings to Windows client devices. Windows Configuration Designer is a tool that makes it easy to create a provisioning package. Windows Configuration Designer can be installed from <!-- the [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) or through the --> Microsoft Store. Provisioning packages in Windows client provide IT administrators with a simplified way to apply configuration settings to Windows client devices. Windows Configuration Designer is a tool that makes it easy to create a provisioning package. Windows Configuration Designer can be installed from the Microsoft Store.
## Provisioning packages ## Provisioning packages
@ -30,15 +30,10 @@ You can use provisioning packages for runtime device provisioning by accessing
When multiple provisioning packages are available for device provisioning, the combination of package owner type and package rank level defined in the package manifest is used to resolve setting conflicts. The pre-defined package owner types are listed below in the order of lowest to highest owner type precedence: When multiple provisioning packages are available for device provisioning, the combination of package owner type and package rank level defined in the package manifest is used to resolve setting conflicts. The pre-defined package owner types are listed below in the order of lowest to highest owner type precedence:
1. Microsoft 1. Microsoft
1. Silicon Vendor 1. Silicon Vendor
1. OEM 1. OEM
1. System Integrator 1. System Integrator
1. Mobile Operator 1. Mobile Operator
1. IT Admin 1. IT Admin
The valid value range of package rank level is 0 to 99. The valid value range of package rank level is 0 to 99.
@ -130,16 +125,3 @@ When applying provisioning packages from a removable media attached to the devic
When applying multiple provisioning packages to a device, the provisioning engine resolves settings with conflicting configuration values from different packages by evaluating the package ranking using the combination of package owner type and package rank level defined in the package metadata. A configuration setting applied from a provisioning package with the highest package ranking will be the final value applied to the device. When applying multiple provisioning packages to a device, the provisioning engine resolves settings with conflicting configuration values from different packages by evaluating the package ranking using the combination of package owner type and package rank level defined in the package metadata. A configuration setting applied from a provisioning package with the highest package ranking will be the final value applied to the device.
After a stand-alone provisioning package is applied to the device, the package is persisted in the `%ProgramData%\Microsoft\Provisioning` folder on the device. Provisioning packages can be removed by an administrator by using the **Add or remove a provisioning package** available under **Settings** > **Accounts** > **Access work or school**. After a stand-alone provisioning package is applied to the device, the package is persisted in the `%ProgramData%\Microsoft\Provisioning` folder on the device. Provisioning packages can be removed by an administrator by using the **Add or remove a provisioning package** available under **Settings** > **Accounts** > **Access work or school**.
## Related articles
- [Provisioning packages for Windows client](provisioning-packages.md)
- [Install Windows Configuration Designer](provisioning-install-icd.md)
- [Create a provisioning package](provisioning-create-package.md)
- [Apply a provisioning package](provisioning-apply-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)

47
windows/configuration/provisioning-packages/provisioning-install-icd.md
View File

@ -1,15 +1,17 @@
--- ---
title: Install Windows Configuration Designer title: Install Windows Configuration Designer
description: Learn how to install and use Windows Configuration Designer so you can easily configure devices running Windows 10/11. description: Learn how to install and use Windows Configuration Designer so you can easily configure devices running Windows.
ms.topic: how-to ms.topic: how-to
ms.reviewer: kevinsheehan ms.reviewer: kevinsheehan
ms.date: 12/31/2017 ms.date: 07/09/2024
--- ---
# Install Windows Configuration Designer, and learn about any limitations # Install Windows Configuration Designer
Use the Windows Configuration Designer tool to create provisioning packages to easily configure devices running Windows client. Windows Configuration Designer is primarily used by IT departments for business and educational institutions who need to provision bring-your-own-device (BYOD) and business-supplied devices. Use the Windows Configuration Designer tool to create provisioning packages to easily configure devices running Windows client. Windows Configuration Designer is primarily used by IT departments for business and educational institutions who need to provision bring-your-own-device (BYOD) and business-supplied devices.
On devices running Windows client, you can install [the Windows Configuration Designer app](https://www.microsoft.com/store/apps/9nblggh4tx22) from the Microsoft Store.
## Supported platforms ## Supported platforms
Windows Configuration Designer can create provisioning packages for Windows client desktop, including Windows IoT Core, Microsoft Surface Hub, and Microsoft HoloLens. You can run Windows Configuration Designer on the following operating systems: Windows Configuration Designer can create provisioning packages for Windows client desktop, including Windows IoT Core, Microsoft Surface Hub, and Microsoft HoloLens. You can run Windows Configuration Designer on the following operating systems:
@ -18,32 +20,22 @@ Windows Configuration Designer can create provisioning packages for Windows clie
- Windows 11 - Windows 11
- Windows 10 - x86 and amd64 - Windows 10 - x86 and amd64
- Windows 8.1 Update - x86 and amd64
- Windows 8.1 - x86 and amd64
- Windows 8 - x86 and amd64
- Windows 7 - x86 and amd64
**Server OS**: **Server OS**:
- Windows Server 2022
- Windows Server 2019
- Windows Server 2016 - Windows Server 2016
- Windows Server 2012 R2 Update
- Windows Server 2012 R2
- Windows Server 2012
- Windows Server 2008 R2
>[!WARNING] > [!WARNING]
>You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards. > You must run Windows Configuration Designer on Windows client to configure Microsoft Entra enrollment using any of the wizards.
## Install Windows Configuration Designer
On devices running Windows client, you can install [the Windows Configuration Designer app](https://www.microsoft.com/store/apps/9nblggh4tx22) from the Microsoft Store.
## Current Windows Configuration Designer limitations ## Current Windows Configuration Designer limitations
- When running Windows Configuration Designer on Windows releases earlier than Windows 10, version 2004 you might need to enable TLS 1.2, especially if using Bulk Enrollment Tokens. You may see the error message in the `icd.log` file: `Error: AADSTS1002016: You are using TLS version 1.0, 1.1 and/or 3DES cipher which are deprecated to improve the security posture of Azure AD` For more information, see [Enable TLS 1.2 on client or server operating systems](/troubleshoot/azure/active-directory/enable-support-tls-environment#enable-tls-12-on-client-or-server-operating-systems-). - When running Windows Configuration Designer on Windows releases earlier than Windows 10, version 2004 you might need to enable TLS 1.2, especially if using Bulk Enrollment Tokens. You may see the error message in the `icd.log` file: `Error: AADSTS1002016: You are using TLS version 1.0, 1.1 and/or 3DES cipher which are deprecated to improve the security posture of Azure AD` For more information, see [Enable TLS 1.2 on client or server operating systems](/troubleshoot/azure/active-directory/enable-support-tls-environment#enable-tls-12-on-client-or-server-operating-systems-).
- Windows Configuration Designer doesn't work properly when the Group Policy setting **Policies** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Zones: Use only machine settings** is enabled. When this policy is set, each step will display oversized buttons that fill the **Windows Configuration Designer** window. Additionally, the various options and descriptions that are normally to the right of the buttons won't be displayed because the buttons take up all of the space in the **Windows Configuration Designer** window. To resolve the problem, run Windows Configuration Designer on a device that doesn't have this policy enabled. - Windows Configuration Designer doesn't work properly when the Group Policy setting **Policies** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Zones: Use only machine settings** is enabled. When this policy is set, each step displays oversized buttons that fill the **Windows Configuration Designer** window. Additionally, the various options and descriptions that are normally to the right of the buttons aren't displayed because the buttons take up all of the space in the **Windows Configuration Designer** window. To resolve the problem, run Windows Configuration Designer on a device that doesn't have this policy enabled.
- You can only run one instance of Windows Configuration Designer on your computer at a time. - You can only run one instance of Windows Configuration Designer on your computer at a time.
@ -68,17 +60,10 @@ On devices running Windows client, you can install [the Windows Configuration De
- **Recommended**: Before starting, copy all source files to the PC running Windows Configuration Designer. Don't use external sources, like network shares or removable drives. Using local files reduces the risk of interrupting the build process from a network issue, or from disconnecting the USB device. - **Recommended**: Before starting, copy all source files to the PC running Windows Configuration Designer. Don't use external sources, like network shares or removable drives. Using local files reduces the risk of interrupting the build process from a network issue, or from disconnecting the USB device.
**Next step**: [How to create a provisioning package](provisioning-create-package.md) ## Next steps
## Related articles > [!div class="nextstepaction"]
> Learn more about creating a provisioning package:
- [Provisioning packages for Windows client](provisioning-packages.md) >
- [How provisioning works in Windows client](provisioning-how-it-works.md) > [Create a provisioning package (desktop wizard)](provision-pcs-for-initial-deployment.md)
- [Create a provisioning package](provisioning-create-package.md) > [Create a provisioning package (advanced)](provisioning-create-package.md)
- [Apply a provisioning package](provisioning-apply-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)

81
windows/configuration/provisioning-packages/provisioning-multivariant.md
View File

@ -2,18 +2,18 @@
title: Create a provisioning package with multivariant settings title: Create a provisioning package with multivariant settings
description: Create a provisioning package with multivariant settings to customize the provisioned settings for defined conditions. description: Create a provisioning package with multivariant settings to customize the provisioned settings for defined conditions.
ms.topic: how-to ms.topic: how-to
ms.date: 12/31/2017 ms.date: 07/09/2024
--- ---
# Create a provisioning package with multivariant settings # Create a provisioning package with multivariant settings
In your organization, you might have different configuration requirements for devices that you manage. You can create separate provisioning packages for each group of devices in your organization that have different requirements. Or, you can create a multivariant provisioning package, a single provisioning package that can work for multiple conditions. For example, in a single provisioning package, you can define one set of customization settings that will apply to devices set up for French and a different set of customization settings for devices set up for Japanese. In your organization, you might have different configuration requirements for devices that you manage. You can create separate provisioning packages for each group of devices in your organization that have different requirements. Or, you can create a multivariant provisioning package, a single provisioning package that can work for multiple conditions. For example, in a single provisioning package, you can define one set of customization settings that apply to devices set up for French and a different set of customization settings for devices set up for Japanese.
To provision multivariant settings, you use Windows Configuration Designer to create a provisioning package that contains all of the customization settings that you want to apply to any of your devices. Next, you manually edit the .XML file for that project to define each set of devices (a **Target**). For each **Target**, you specify at least one **Condition** with a value, which identifies the devices to receive the configuration. Finally, for each **Target**, you provide the customization settings to be applied to those devices. To provision multivariant settings, you use Windows Configuration Designer to create a provisioning package that contains all of the customization settings that you want to apply to any of your devices. Next, you manually edit the .XML file for that project to define each set of devices (a **Target**). For each **Target**, you specify at least one **Condition** with a value, which identifies the devices to receive the configuration. Finally, for each **Target**, you provide the customization settings to be applied to those devices.
Let's begin by learning how to define a **Target**. Let's begin by learning how to define a **Target**.
## Define a target ## Target
In the XML file, you provide an **Id**, or friendly name, for each **Target**. Each **Target** is defined by at least one **TargetState** which contains at least one **Condition**. A **Condition** element defines the matching type between the condition and the specified value. In the XML file, you provide an **Id**, or friendly name, for each **Target**. Each **Target** is defined by at least one **TargetState** which contains at least one **Condition**. A **Condition** element defines the matching type between the condition and the specified value.
@ -43,9 +43,9 @@ The following table shows the conditions supported in Windows client provisionin
| PNN | P0 | Supported | String | Use to target settings based on public land mobile network (PLMN) Network Name value. | | PNN | P0 | Supported | String | Use to target settings based on public land mobile network (PLMN) Network Name value. |
| GID1 | P0 | Supported | Digit string | Use to target settings based on the Group Identifier (level 1) value. | | GID1 | P0 | Supported | Digit string | Use to target settings based on the Group Identifier (level 1) value. |
| ICCID | P0 | Supported | Digit string | Use to target settings based on the Integrated Circuit Card Identifier (ICCID) value. | | ICCID | P0 | Supported | Digit string | Use to target settings based on the Integrated Circuit Card Identifier (ICCID) value. |
| Roaming | P0 | N/A | Boolean | Use to specify roaming. Set the value to **1** (roaming) or **0** (non-roaming). | | Roaming | P0 | N/A | Boolean | Use to specify roaming. Set the value to **1** (roaming) or **0** (nonroaming). |
| UICC | P0 | N/A | Enumeration | Use to specify the Universal Integrated Circuit Card (UICC) state. Set the value to one of the following:</br></br></br>- 0 - Empty</br>- 1 - Ready</br>- 2 - Locked | | UICC | P0 | N/A | Enumeration | Use to specify the Universal Integrated Circuit Card (UICC) state. Set the value to one of these values:<br>0 - Empty<br>1 - Ready<br>2 - Locked |
| UICCSLOT | P0 | N/A | Digit string | Use to specify the UICC slot. Set the value one of the following:</br></br></br>- 0 - Slot 0</br>- 1 - Slot 1 | | UICCSLOT | P0 | N/A | Digit string | Use to specify the UICC slot. Set the value one of these values:<br>0 - Slot 0<br>1 - Slot 1 |
| ProcessorType | P1 | Supported | String | Use to target settings based on the processor type. | | ProcessorType | P1 | Supported | String | Use to target settings based on the processor type. |
| ProcessorName | P1 | Supported | String | Use to target settings based on the processor name. | | ProcessorName | P1 | Supported | String | Use to target settings based on the processor name. |
| AoAc ("Always On, Always Connected") | P1 | Supported | Boolean | Set the value to **0** (false) or **1** (true). If this condition is TRUE, the system supports the S0 low power idle model. | | AoAc ("Always On, Always Connected") | P1 | Supported | Boolean | Set the value to **0** (false) or **1** (true). If this condition is TRUE, the system supports the S0 low power idle model. |
@ -53,17 +53,16 @@ The following table shows the conditions supported in Windows client provisionin
| SocIdentifier | P1 | Supported | String | Use to target settings based on the Soc Identifier. Available since 25301 OS build version. | | SocIdentifier | P1 | Supported | String | Use to target settings based on the Soc Identifier. Available since 25301 OS build version. |
| Architecture | P1 | Supported | String | Matches the PROCESSOR_ARCHITECTURE environment variable. | | Architecture | P1 | Supported | String | Matches the PROCESSOR_ARCHITECTURE environment variable. |
| Server | P1 | Supported | Boolean | Set the value to **0** (false) or **1** (true) to identify a server. | | Server | P1 | Supported | Boolean | Set the value to **0** (false) or **1** (true) to identify a server. |
| Region | P1 | Supported | Enumeration | Use to target settings based on country/region, using the 2-digit alpha ISO code per [ISO 3166-1 alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2). | | Region | P1 | Supported | Enumeration | Use to target settings based on region, using the two digit alpha ISO code per [ISO 3166-1 alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2). |
| Lang | P1 | Supported | Enumeration | Use to target settings based on language code, using the 2-digit [ISO 639 alpha-2 code](https://en.wikipedia.org/wiki/ISO_639). | | Lang | P1 | Supported | Enumeration | Use to target settings based on language code, using the two digit [ISO 639 alpha-2 code](https://en.wikipedia.org/wiki/ISO_639). |
The matching types supported in Windows client are: The matching types supported in Windows client are:
| Matching type | Syntax | Example | | Matching type | Syntax | Example |
| --- | --- | --- | |-----------------------------------|-------------------------------------------|------------------------------------------------------------------------|
| Straight match | Matching type is specified as-is | &lt;Condition Name="ProcessorName" Value="Barton" /&gt; | | Straight match | Matching type is specified as-is | `&lt;Condition Name="ProcessorName" Value="Barton" /&gt;` |
| Regular expression (Regex) match | Matching type is prefixed by "Pattern:" | &lt;Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" /&gt; | | Regular expressions (Regex) match | Matching type is prefixed with `Pattern:` | `&lt;Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" /&gt;` |
| Numeric range match | Matching type is prefixed by "!Range:" | &lt;Condition Name="MNC" Value="!Range:400, 550" /&gt; | | Numeric range match | Matching type is prefixed with `!Range:` | `&lt;Condition Name="MNC" Value="!Range:400, 550" /&gt;` |
### TargetState priorities ### TargetState priorities
@ -76,27 +75,18 @@ Settings that match more than one **TargetState** with equal priority are applie
The **TargetState** priority is assigned based on the condition's priority (see the [Conditions table](#conditions) for priorities). The priority evaluation rules are as followed: The **TargetState** priority is assigned based on the condition's priority (see the [Conditions table](#conditions) for priorities). The priority evaluation rules are as followed:
1. A **TargetState** with P0 conditions is higher than a **TargetState** without P0 conditions. 1. A **TargetState** with P0 conditions is higher than a **TargetState** without P0 conditions.
1. A **TargetState** with both P0 and P1 conditions is higher than a **TargetState** with only P0 conditions. 1. A **TargetState** with both P0 and P1 conditions is higher than a **TargetState** with only P0 conditions.
1. A **TargetState** with a greater number of matched P0 conditions is higher than **TargetState** with fewer matched P0 conditions, regardless of the number of P1 conditions matched. 1. A **TargetState** with a greater number of matched P0 conditions is higher than **TargetState** with fewer matched P0 conditions, regardless of the number of P1 conditions matched.
1. If the number of P0 conditions matched is equivalent, then the **TargetState** with the most matched P1 conditions has higher priority.
1. If the number of P0 conditions matched are equivalent, then the **TargetState** with the most matched P1 conditions has higher priority.
1. If both P0 and P1 conditions are equally matched, then the **TargetState** with the greatest total number of matched conditions has highest priority. 1. If both P0 and P1 conditions are equally matched, then the **TargetState** with the greatest total number of matched conditions has highest priority.
## Create a provisioning package with multivariant settings ## Create a provisioning package with multivariant settings
Follow these steps to create a provisioning package with multivariant capabilities. Follow these steps to create a provisioning package with multivariant capabilities.
1. Build a provisioning package and configure the customizations you want to apply during certain conditions. For more information, see [Create a provisioning package](provisioning-create-package.md). 1. Build a provisioning package and configure the customizations you want to apply during certain conditions. For more information, see [Create a provisioning package](provisioning-create-package.md).
1. After you [configure the settings](provisioning-create-package.md#configure-settings), save the project.
1. After you've [configured the settings](provisioning-create-package.md#configure-settings), save the project.
1. Open the project folder and copy the customizations.xml file to any local location. 1. Open the project folder and copy the customizations.xml file to any local location.
1. Use an XML or text editor to open the customizations.xml file. 1. Use an XML or text editor to open the customizations.xml file.
The customizations.xml file holds the package metadata (including the package owner and rank) and the settings that you configured when you created your provisioning package. The **Customizations** node of the file contains a **Common** section, which contains the customization settings. The customizations.xml file holds the package metadata (including the package owner and rank) and the settings that you configured when you created your provisioning package. The **Customizations** node of the file contains a **Common** section, which contains the customization settings.
@ -131,10 +121,9 @@ Follow these steps to create a provisioning package with multivariant capabiliti
``` ```
1. Edit the customizations.xml file to create a **Targets** section to describe the conditions that will handle your multivariant settings. 1. Edit the customizations.xml file to create a **Targets** section to describe the conditions that handle your multivariant settings.
The following example shows the customizations.xml, which has been modified to include several conditions including **ProcessorName**, **ProcessorType**, **MCC**, and **MNC**.
The following example shows the customizations.xml, which is modified to include several conditions including **ProcessorName**, **ProcessorType**, **MCC**, and **MNC**.
```XML ```XML
<?xml version="1.0" encoding="utf-8"?> <?xml version="1.0" encoding="utf-8"?>
@ -185,18 +174,15 @@ Follow these steps to create a provisioning package with multivariant capabiliti
1. In the customizations.xml file, create a **Variant** section for the settings you need to customize. To do this: 1. In the customizations.xml file, create a **Variant** section for the settings you need to customize. To do this:
a. Define a child **TargetRefs** element. a. Define a child **TargetRefs** element.
b. Within the **TargetRefs** element, define a **TargetRef** element. You can define multiple **TargetRef** elements for each **Id** that you need to apply to customized settings. b. Within the **TargetRefs** element, define a **TargetRef** element. You can define multiple **TargetRef** elements for each **Id** that you need to apply to customized settings.
c. Move compliant settings from the **Common** section to the **Variant** section. c. Move compliant settings from the **Common** section to the **Variant** section.
If any of the **TargetRef** elements matches the **Target**, all settings in the **Variant** are applied. If any of the **TargetRef** elements matches the **Target**, all settings in the **Variant** are applied.
>[!NOTE] > [!NOTE]
>You can define multiple **Variant** sections. Settings that reside in the **Common** section are applied unconditionally on every triggering event. > You can define multiple **Variant** sections. Settings that reside in the **Common** section are applied unconditionally on every triggering event.
The following example shows the customizations.xml updated to include a **Variant** section and the moved settings that will be applied if the conditions for the variant are met. The following example shows the customizations.xml updated to include a **Variant** section and the moved settings that are applied if the conditions for the variant are met.
```XML ```XML
<?xml version="1.0" encoding="utf-8"?> <?xml version="1.0" encoding="utf-8"?>
@ -249,10 +235,9 @@ Follow these steps to create a provisioning package with multivariant capabiliti
</Customizations> </Customizations>
</Settings> </Settings>
</WindowsCustomizations> </WindowsCustomizations>
``` ```
1. Save the updated customizations.xml file and note the path to this updated file. You will need the path as one of the values for the next step. 1. Save the updated customizations.xml file and note the path to this updated file. You'll need the path as one of the values for the next step.
1. Use the [Windows Configuration Designer command-line interface](provisioning-command-line.md) to create a provisioning package using the updated customizations.xml. 1. Use the [Windows Configuration Designer command-line interface](provisioning-command-line.md) to create a provisioning package using the updated customizations.xml.
@ -262,13 +247,10 @@ Follow these steps to create a provisioning package with multivariant capabiliti
icd.exe /Build-ProvisioningPackage /CustomizationXML:"C:\CustomProject\customizations.xml" /PackagePath:"C:\CustomProject\output.ppkg" /StoreFile:C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\Microsoft-Common-Provisioning.dat" icd.exe /Build-ProvisioningPackage /CustomizationXML:"C:\CustomProject\customizations.xml" /PackagePath:"C:\CustomProject\output.ppkg" /StoreFile:C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\Microsoft-Common-Provisioning.dat"
``` ```
In this example, the **StoreFile** corresponds to the location of the settings store that is used to create the package for the required Windows edition.
In this example, the **StoreFile** corresponds to the location of the settings store that will be used to create the package for the required Windows edition. > [!NOTE]
> The provisioning package created during this step contains the multivariant settings. You can use this package either as a standalone package that you can apply to a Windows device or use it as the base when starting another project.
>[!NOTE]
>The provisioning package created during this step will contain the multivariant settings. You can use this package either as a standalone package that you can apply to a Windows device or use it as the base when starting another project.
## Events that trigger provisioning ## Events that trigger provisioning
@ -277,25 +259,10 @@ When you install the multivariant provisioning package on a Windows client devic
The following events trigger provisioning on Windows client devices: The following events trigger provisioning on Windows client devices:
| Event | Windows client for desktop editions | | Event | Windows client for desktop editions |
| --- | --- | |---------------------------------------------------------|-------------------------------------|
| System boot | Supported | | System boot | Supported |
| Operating system update | Planned | | Operating system update | Planned |
| Package installation during device first run experience | Supported | | Package installation during device first run experience | Supported |
| Detection of SIM presence or update | Supported | | Detection of SIM presence or update | Supported |
| Package installation at runtime | Supported | | Package installation at runtime | Supported |
| Roaming detected | Not supported | | Roaming detected | Not supported |
## Related articles
- [Provisioning packages for Windows client](provisioning-packages.md)
- [How provisioning works in Windows client](provisioning-how-it-works.md)
- [Install Windows Configuration Designer](provisioning-install-icd.md)
- [Create a provisioning package](provisioning-create-package.md)
- [Apply a provisioning package](provisioning-apply-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)

122
windows/configuration/provisioning-packages/provisioning-packages.md
View File

@ -1,9 +1,9 @@
--- ---
title: Provisioning packages overview title: Provisioning packages overview
description: With Windows 10 and Windows 11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Learn about what provisioning packages, are and what they do. description: With Windows, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Learn about what provisioning packages are and what they do.
ms.reviewer: kevinsheehan ms.reviewer: kevinsheehan
ms.topic: conceptual ms.topic: conceptual
ms.date: 12/31/2017 ms.date: 07/08/2024
--- ---
# Provisioning packages for Windows # Provisioning packages for Windows
@ -12,29 +12,17 @@ Windows provisioning makes it easy for IT administrators to configure end-user d
A provisioning package (.ppkg) is a container for a collection of configuration settings. With Windows client, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. A provisioning package (.ppkg) is a container for a collection of configuration settings. With Windows client, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
Provisioning packages are simple enough that with a short set of written instructions, a student, or non-technical employee can use them to configure their device. It can result in a significant reduction in the time required to configure multiple devices in your organization. Provisioning packages are simple enough that with a short set of written instructions, a student, or nontechnical users can use them to configure their device. It can result in a significant reduction in the time required to configure multiple devices in your organization.
<!-- The [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) includes the Windows Configuration Designer, a tool for configuring provisioning packages.-->
Windows Configuration Designer is available as an [app in the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22). Windows Configuration Designer is available as an [app in the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22).
<!--## New in Windows 10, version 1703-->
<!-- - The tool for creating provisioning packages is renamed Windows Configuration Designer, replacing the Windows Configuration Designer (WCD) tool. The components for creating images have been removed from Windows Configuration Designer, which now provides access to runtime settings only. -->
<!-- - Windows Configuration Designer can still be installed from the Windows ADK. You can also install it from the Microsoft Store. -->
<!-- - Windows Configuration Designer adds more wizards to make it easier to create provisioning packages for specific scenarios. See [What you can configure](#configuration-designer-wizards) for wizard descriptions. -->
<!-- - The Provision desktop devices wizard (previously called Simple provisioning) now enables joining Azure Active Directory (Azure AD) domains and also allows you to remove non-Microsoft software from Windows desktop devices during provisioning. -->
<!-- - When provisioning packages are applied to a device, a status screen indicates successful or failed provisioning. -->
<!-- - Windows 10 includes PowerShell cmdlets that simplify scripted provisioning. Using these cmdlets, you can add provisioning packages, remove provisioning packages and generate log files to investigate provisioning errors.-->
<!-- - The Provision school devices wizard is removed from Windows Configuration Designer. Instead, use the [Setup School PCs app](https://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) from the Microsoft Store. -->
## Benefits of provisioning packages ## Benefits of provisioning packages
Provisioning packages let you: Provisioning packages let you:
- Quickly configure a new device without going through the process of installing a new image. - Quickly configure a new device without going through the process of installing a new image.
- Save time by configuring multiple devices using one provisioning package. - Save time by configuring multiple devices using one provisioning package.
- Quickly configure employee-owned devices in an organization without a mobile device management (MDM) infrastructure. - Quickly configure user-owned devices in an organization without a mobile device management (MDM) infrastructure.
- Set up a device without the device having network connectivity. - Set up a device without the device having network connectivity.
Provisioning packages can be: Provisioning packages can be:
@ -44,57 +32,7 @@ Provisioning packages can be:
- Downloaded from a network share. - Downloaded from a network share.
- Deployed in NFC tags or barcodes. - Deployed in NFC tags or barcodes.
## What you can configure ## Provisioning scenarios
### Configuration Designer wizards
The following table describes settings that you can configure using the wizards in Windows Configuration Designer to create provisioning packages.
| Step | Description | Desktop wizard | Kiosk wizard | HoloLens wizard |
| --- | --- | --- | --- | --- |
| Set up device | Assign device name, enter product key to upgrade Windows, configure shared use, remove pre-installed software | ✅ | ✅ | ✅ |
| Set up network | Connect to a Wi-Fi network | ✅ | ✅ | ✅ |
| Account management | Enroll device in Active Directory, enroll device in Microsoft Entra ID, or create a local administrator account | ✅ | ✅ | ✅ |
| Bulk Enrollment in Microsoft Entra ID | Enroll device in Microsoft Entra ID using Bulk Token</br></br> [Set up Microsoft Entra join in your organization](/azure/active-directory/active-directory-azureadjoin-setup), before you use Windows Configuration Designer wizard to configure bulk Microsoft Entra enrollment. | ✅ | ✅ | ✅ |
| Add applications | Install applications using the provisioning package. | ✅ | ✅ | ❌ |
| Add certificates | Include a certificate file in the provisioning package. | ✅ | ✅ | ✅ |
| Configure kiosk account and app | Create local account to run the kiosk mode app, specify the app to run in kiosk mode | ❌ | ✅ | ❌ |
| Configure kiosk common settings | Set tablet mode, configure welcome and shutdown screens, turn off timeout settings | ❌ | ✅ | ❌ |
| Developer Setup | Enable Developer Mode | ❌ | ❌ | ✅ |
- [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md)
- [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard)
- [Instructions for the HoloLens wizard](/hololens/hololens-provisioning#wizard)
>[!NOTE]
>After you start a project using a Windows Configuration Designer wizard, you can switch to the advanced editor to configure additional settings in the provisioning package.
### Configuration Designer advanced editor
The following table provides some examples of settings that you can configure using the Windows Configuration Designer advanced editor to create provisioning packages.
| Customization options | Examples |
|---|---|
| Bulk Active Directory join and device name | Join devices to Active Directory domain and assign device names using hardware-specific serial numbers or random characters |
| Applications | Windows apps, line-of-business applications |
| Bulk enrollment into MDM | Automatic enrollment into a third-party MDM service <br/><br/>Using a provisioning package for auto-enrollment to Microsoft Intune isn't supported. To enroll devices, use the Configuration Manager console. |
| Certificates | Root certification authority (CA), client certificates |
| Connectivity profiles | Wi-Fi, proxy settings, Email |
| Enterprise policies | Security restrictions (password, device lock, camera, and so on), encryption, update settings |
| Data assets | Documents, music, videos, pictures |
| Start menu customization | Start menu layout, application pinning |
| Other | Home and lock screen wallpaper, computer name, domain join, DNS settings, and so on |
For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012).
<!-- ## Changes to provisioning in Windows 10, version 1607 -->
<!-- > [!NOTE] -->
<!-- > This section is retained for customers using Windows 10, version 1607, on the Current Branch for Business. Some of this information is not applicable in Windows 10, version 1701. -->
WCD, simplified common provisioning scenarios.
:::image type="content" source="images/icd.png" alt-text="Configuration Designer options":::
WCD supports the following scenarios for IT administrators: WCD supports the following scenarios for IT administrators:
@ -111,8 +49,54 @@ WCD supports the following scenarios for IT administrators:
- MobileIron (password-string based enrollment) - MobileIron (password-string based enrollment)
- Other MDMs (cert-based enrollment) - Other MDMs (cert-based enrollment)
<!-- > [!NOTE] --> > [!NOTE]
<!-- > Windows ICD in Windows 10, version 1607, also provided a wizard to create provisioning packages for school PCs. To learn more, see [Set up students' PCs to join domain](/education/windows/). --> > The Provision school devices wizard is removed from Windows Configuration Designer. Instead, use the [Setup School PCs app](https://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) from the Microsoft Store.
:::image type="content" source="images/icd.png" alt-text="Configuration Designer options":::
## What you can configure
Windows Configuration Designer provides the following simple provisioning scenarios:
- [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md)
- [Instructions for the kiosk wizard](../assigned-access/overview.md)
- [Instructions for the HoloLens wizard](/hololens/hololens-provisioning#provisioning-package-hololens-wizard)
- [Instructions for the Surface Hub wizard](/surface-hub/provisioning-packages-for-surface-hub)
The following table describes settings that you can configure using the wizards in Windows Configuration Designer to create provisioning packages.
| Step | Description | Desktop wizard | Kiosk wizard | HoloLens wizard |
| --- | --- | --- | --- | --- |
| Set up device | Assign device name, enter product key to upgrade Windows, configure shared use, remove preinstalled software | ✅ | ✅ | ✅ |
| Set up network | Connect to a Wi-Fi network | ✅ | ✅ | ✅ |
| Account management | Enroll device in Active Directory, enroll device in Microsoft Entra ID, or create a local administrator account | ✅ | ✅ | ✅ |
| Bulk Enrollment in Microsoft Entra ID | Enroll device in Microsoft Entra ID using Bulk Token</br></br> [Set up Microsoft Entra join in your organization](/azure/active-directory/active-directory-azureadjoin-setup), before you use Windows Configuration Designer wizard to configure bulk Microsoft Entra enrollment. | ✅ | ✅ | ✅ |
| Add applications | Install applications using the provisioning package. | ✅ | ✅ | ❌ |
| Add certificates | Include a certificate file in the provisioning package. | ✅ | ✅ | ✅ |
| Configure kiosk account and app | Create local account to run the kiosk mode app, specify the app to run in kiosk mode | ❌ | ✅ | ❌ |
| Configure kiosk common settings | Set tablet mode, configure welcome and shutdown screens, turn off timeout settings | ❌ | ✅ | ❌ |
| Developer Setup | Enable Developer Mode | ❌ | ❌ | ✅ |
> [!TIP]
> After you start a project using a Windows Configuration Designer wizard, you can switch to the advanced editor to configure additional settings in the provisioning package.
## Configuration Designer advanced editor
The following table provides some examples of settings that you can configure using the Windows Configuration Designer advanced editor to create provisioning packages.
| Customization options | Examples |
|---|---|
| Bulk Active Directory join and device name | Join devices to Active Directory domain and assign device names using hardware-specific serial numbers or random characters |
| Applications | Windows apps, line-of-business applications |
| Bulk enrollment into MDM | Automatic enrollment into a third-party MDM service <br/><br/>Using a provisioning package for autoenrollment to Microsoft Intune isn't supported. To enroll devices, use the Configuration Manager console. |
| Certificates | Root certification authority (CA), client certificates |
| Connectivity profiles | Wi-Fi, proxy settings, Email |
| Enterprise policies | Security restrictions (password, device lock, camera, and so on), encryption, update settings |
| Data assets | Documents, music, videos, pictures |
| Start menu customization | Start menu layout, application pinning |
| Other | Home and lock screen wallpaper, computer name, domain join, DNS settings, and so on |
For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012).
## Related articles ## Related articles

32
windows/configuration/provisioning-packages/provisioning-powershell.md
View File

@ -1,17 +1,14 @@
--- ---
title: PowerShell cmdlets for provisioning Windows 10/11 title: PowerShell cmdlets for provisioning packages in Windows
description: Learn more about the Windows PowerShell cmdlets that you can use with Provisioning packages on Windows10/11 client desktop devices. description: Learn more about the Windows PowerShell cmdlets that you can use with Provisioning packages on Windows devices.
ms.topic: conceptual ms.topic: conceptual
ms.date: 07/09/2024
ms.date: 12/31/2017
--- ---
# PowerShell cmdlets for provisioning Windows client (reference) # PowerShell cmdlets for provisioning Windows client
Windows client includes Provisioning PowerShell cmdlets. These cmdlets make it easy to script the following functions. Windows client includes Provisioning PowerShell cmdlets. These cmdlets make it easy to script the following functions.
## cmdlets
- **Add-ProvisioningPackage**: Applies a provisioning package. - **Add-ProvisioningPackage**: Applies a provisioning package.
Syntax: Syntax:
@ -59,7 +56,7 @@ Windows client includes Provisioning PowerShell cmdlets. These cmdlets make it e
- `Uninstall-TrustedProvisioningCertificate <thumbprint>` - `Uninstall-TrustedProvisioningCertificate <thumbprint>`
>[!NOTE] > [!NOTE]
> You can use Get-Help to get usage help on any command. For example: `Get-Help Add-ProvisioningPackage` > You can use Get-Help to get usage help on any command. For example: `Get-Help Add-ProvisioningPackage`
Trace logs are captured when using cmdlets. The following logs are available in the logs folder after the cmdlet completes: Trace logs are captured when using cmdlets. The following logs are available in the logs folder after the cmdlet completes:
@ -69,20 +66,5 @@ Trace logs are captured when using cmdlets. The following logs are available in
- ProvTrace.&lt;timestamp&gt;.TXT - TEXT file containing trace output formatted for easy reading, filtered to only show events logged by providers in the WPRP file - ProvTrace.&lt;timestamp&gt;.TXT - TEXT file containing trace output formatted for easy reading, filtered to only show events logged by providers in the WPRP file
- ProvLogReport.&lt;timestamp&gt;.XLS - Excel file containing trace output, filtered to only show events logged by providers in WPRP file - ProvLogReport.&lt;timestamp&gt;.XLS - Excel file containing trace output, filtered to only show events logged by providers in WPRP file
> [!NOTE]
> When applying provisioning packages using Powershell cmdlets, the default behavior is to suppress the prompt that appears when applying an unsigned provisioning package. This is by design so that provisioning packages can be applied as part of existing scripts.
>[!NOTE]
>When applying provisioning packages using Powershell cmdlets, the default behavior is to suppress the prompt that appears when applying an unsigned provisioning package. This is by design so that provisioning packages can be applied as part of existing scripts.
## Related articles
- [How provisioning works in Windows client](provisioning-how-it-works.md)
- [Install Windows Configuration Designer](provisioning-install-icd.md)
- [Create a provisioning package](provisioning-create-package.md)
- [Apply a provisioning package](provisioning-apply-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)

34
windows/configuration/provisioning-packages/provisioning-script-to-install-app.md
View File

@ -1,8 +1,8 @@
--- ---
title: Use a script to install a desktop app in provisioning packages title: Use a script to install a desktop app in provisioning packages
description: With Windows 10/11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. description: With Windows, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
ms.topic: how-to ms.topic: how-to
ms.date: 12/31/2017 ms.date: 07/09/2024
--- ---
# Use a script to install a desktop app in provisioning packages # Use a script to install a desktop app in provisioning packages
@ -57,14 +57,14 @@ Create a script to perform whatever work is needed to install the application(s)
You don't need to create an orchestrator script. You can have one command line per app. If necessary, you can create a script that logs the output per app, as mentioned below (rather than one orchestrator script for the entire provisioning package). You don't need to create an orchestrator script. You can have one command line per app. If necessary, you can create a script that logs the output per app, as mentioned below (rather than one orchestrator script for the entire provisioning package).
>[!NOTE] > [!NOTE]
>All actions performed by the script must happen silently, showing no UI and requiring no user interaction.
> >
>The scripts will be run on the device in system context. > - All actions performed by the script must happen silently, showing no UI and requiring no user interaction.
> - The scripts will be run on the device in system context.
### Debugging example ### Debugging example
Granular logging isn't built in, so the logging must be built into the script itself. Here's an example script that logs 'Hello World' to a logfile. When run on the device, the logfile will be available after provisioning is completed. As you'll see in the following examples, it's recommended that you log each action that your script performs. Granular logging isn't built in, so the logging must be built into the script itself. Here's an example script that logs `Hello World` to a logfile. When run on the device, the logfile will be available after provisioning is completed. As you'll see in the following examples, it's recommended that you log each action that your script performs.
```log ```log
set LOGFILE=%SystemDrive%\HelloWorld.log set LOGFILE=%SystemDrive%\HelloWorld.log
@ -105,8 +105,6 @@ PsExec.exe -accepteula -i -s cmd.exe /c 'powershell.exe my_powershell_script.ps1
echo result: %ERRORLEVEL% >> %LOGFILE% echo result: %ERRORLEVEL% >> %LOGFILE%
``` ```
<span id="cab-extract" />
### Extract from a .CAB example ### Extract from a .CAB example
This example script shows expansion of a .cab from the provisioning commands script, and installation of the expanded setup.exe This example script shows expansion of a .cab from the provisioning commands script, and installation of the expanded setup.exe
@ -178,20 +176,14 @@ When you're done, [build the package](provisioning-create-package.md#build-packa
1. The command line will be executed with the directory the CommandFiles were deployed to as the working directory. This means you do not need to specific the full path to assets in the command line or from within any script. 1. The command line will be executed with the directory the CommandFiles were deployed to as the working directory. This means you do not need to specific the full path to assets in the command line or from within any script.
1. The runtime provisioning component will attempt to run the scripts from the provisioning package at the earliest point possible, depending on the stage when the PPKG was added. For example, if the package was added during the Out-of-Box Experience, it will be run immediately after the package is applied, while the out of box experience is still happening. This is before the user account configuration options are presented to the user. A spinning progress dialog will appear and "please wait" will be displayed on the screen. 1. The runtime provisioning component will attempt to run the scripts from the provisioning package at the earliest point possible, depending on the stage when the PPKG was added. For example, if the package was added during the Out-of-Box Experience, it will be run immediately after the package is applied, while the out of box experience is still happening. This is before the user account configuration options are presented to the user. A spinning progress dialog will appear and "please wait" will be displayed on the screen.
>[!NOTE] > [!NOTE]
>There is a timeout of 30 minutes for the provisioning process at this point. All scripts and installs need to complete within this time. > There is a timeout of 30 minutes for the provisioning process at this point. All scripts and installs need to complete within this time.
1. The scripts are executed in the background as the rest of provisioning continues to run. For packages added on existing systems using the double-click to install, there's no notification that provisioning or script execution has completed 1. The scripts are executed in the background as the rest of provisioning continues to run. For packages added on existing systems using the double-click to install, there's no notification that provisioning or script execution has completed
## Related articles ## Next steps
- [Provisioning packages for Windows client](provisioning-packages.md) > [!div class="nextstepaction"]
- [How provisioning works in Windows client](provisioning-how-it-works.md) > Learn more about applying a provisioning package:
- [Install Windows Configuration Designer](provisioning-install-icd.md) >
- [Create a provisioning package](provisioning-create-package.md) > [Apply a provisioning package](provisioning-apply-package.md)
- [Apply a provisioning package](provisioning-apply-package.md)
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
- [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md)
- [PowerShell cmdlets for provisioning Windows client (reference)](provisioning-powershell.md)
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)

61
windows/configuration/provisioning-packages/provisioning-uninstall-package.md
View File

@ -1,19 +1,18 @@
--- ---
title: Uninstall a provisioning package - reverted settings title: Settings changed when you uninstall a provisioning package
description: This article lists the settings that are reverted when you uninstall a provisioning package on Windows 10/11 desktop client devices. description: This article lists the settings that are reverted when you uninstall a provisioning package on Windows desktop client devices.
ms.topic: conceptual ms.topic: conceptual
ms.date: 12/31/2017 ms.date: 07/09/2024
--- ---
# Settings changed when you uninstall a provisioning package # Settings changed when you uninstall a provisioning package
When you uninstall a provisioning package, only certain settings are revertible. This article lists the settings that are reverted when you uninstall a provisioning package. When you uninstall a provisioning package, only certain settings are revertible. This article lists the settings that are reverted when you uninstall a provisioning package. As an administrator, you can uninstall by using the **Add or remove a package for work or school** option available under **Settings** > **Accounts** > **Access work or school**.
As an administrator, you can uninstall by using the **Add or remove a package for work or school** option available under **Settings** > **Accounts** > **Access work or school**.
When a provisioning package is uninstalled, some of its settings are reverted, which means the value for the setting is changed to the next available or default value. Not all settings, however, are revertible. When a provisioning package is uninstalled, some of its settings are reverted, which means the value for the setting is changed to the next available or default value. Not all settings, however, are revertible.
Only settings in the following lists are revertible. > [!IMPORTANT]
> Only settings in the following lists are revertible.
## Registry-based settings ## Registry-based settings
@ -21,8 +20,8 @@ The registry-based settings that are revertible when a provisioning package is u
- [Wi-Fi Sense](../wcd/wcd-connectivityprofiles.md#wifisense) - [Wi-Fi Sense](../wcd/wcd-connectivityprofiles.md#wifisense)
- [CountryAndRegion](../wcd/wcd-countryandregion.md) - [CountryAndRegion](../wcd/wcd-countryandregion.md)
- DeviceManagement / PGList/ LogicalProxyName - [DeviceManagement / PGList / LogicalProxyName](../wcd/wcd-devicemanagement.md#pglist)
- UniversalAppInstall / LaunchAppAtLogin - [UniversalAppInstall](../wcd/wcd-universalappinstall.md) / LaunchAppAtLogin
- [Power](/previous-versions//dn953704(v=vs.85)) - [Power](/previous-versions//dn953704(v=vs.85))
- [TabletMode](../wcd/wcd-tabletmode.md) - [TabletMode](../wcd/wcd-tabletmode.md)
- [Maps](../wcd/wcd-maps.md) - [Maps](../wcd/wcd-maps.md)
@ -33,26 +32,26 @@ The registry-based settings that are revertible when a provisioning package is u
## CSP-based settings ## CSP-based settings
Here is the list of revertible settings based on configuration service providers (CSPs). Here's the list of revertible settings based on configuration service providers (CSPs).
[ActiveSync CSP](/windows/client-management/mdm/activesync-csp) - [ActiveSync CSP](/windows/client-management/mdm/activesync-csp)
[AppLocker CSP](/windows/client-management/mdm/applocker-csp) - [AppLocker CSP](/windows/client-management/mdm/applocker-csp)
[BrowserFavorite CSP](/windows/client-management/mdm/browserfavorite-csp) - [BrowserFavorite CSP](/windows/client-management/mdm/browserfavorite-csp)
[CertificateStore CSP](/windows/client-management/mdm/certificatestore-csp) - [CertificateStore CSP](/windows/client-management/mdm/certificatestore-csp)
[ClientCertificateInstall CSP](/windows/client-management/mdm/clientcertificateinstall-csp) - [ClientCertificateInstall CSP](/windows/client-management/mdm/clientcertificateinstall-csp)
[RootCATrustedCertificates CSP](/windows/client-management/mdm/rootcacertificates-csp) - [RootCATrustedCertificates CSP](/windows/client-management/mdm/rootcacertificates-csp)
[CM_CellularEntries CSP](/windows/client-management/mdm/cm-cellularentries-csp) - [CM_CellularEntries CSP](/windows/client-management/mdm/cm-cellularentries-csp)
[CM_ProxyEntries CSP](/windows/client-management/mdm/cm-proxyentries-csp) - [CM_ProxyEntries CSP](/windows/client-management/mdm/cm-proxyentries-csp)
[CMPolicy CSP](/windows/client-management/mdm/cmpolicy-csp) - [CMPolicy CSP](/windows/client-management/mdm/cmpolicy-csp)
[CMPolicyEnterprise CSP](/windows/client-management/mdm/cmpolicyenterprise-csp) - [CMPolicyEnterprise CSP](/windows/client-management/mdm/cmpolicyenterprise-csp)
[EMAIL2 CSP](/windows/client-management/mdm/email2-csp) - [EMAIL2 CSP](/windows/client-management/mdm/email2-csp)
[EnterpriseAPN CSP](/windows/client-management/mdm/enterpriseapn-csp) - [EnterpriseAPN CSP](/windows/client-management/mdm/enterpriseapn-csp)
[EnterpriseDesktopAppManagement CSP](/windows/client-management/mdm/enterprisedesktopappmanagement-csp) - [EnterpriseDesktopAppManagement CSP](/windows/client-management/mdm/enterprisedesktopappmanagement-csp)
[EnterpriseModernAppManagement CSP](/windows/client-management/mdm/enterprisemodernappmanagement-csp) - [EnterpriseModernAppManagement CSP](/windows/client-management/mdm/enterprisemodernappmanagement-csp)
[NAP CSP](/windows/client-management/mdm/nap-csp) - [NAP CSP](/windows/client-management/mdm/nap-csp)
[PassportForWork CSP](/windows/client-management/mdm/passportforwork-csp) - [PassportForWork CSP](/windows/client-management/mdm/passportforwork-csp)
[Provisioning CSP](/windows/client-management/mdm/provisioning-csp) - [Provisioning CSP](/windows/client-management/mdm/provisioning-csp)
[SecureAssessment CSP](/windows/client-management/mdm/secureassessment-csp) - [SecureAssessment CSP](/windows/client-management/mdm/secureassessment-csp)
[VPN CSP](/windows/client-management/mdm/vpn-csp) - [VPN CSP](/windows/client-management/mdm/vpn-csp)
[VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) - [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp)
[WiFi CSP](/windows/client-management/mdm/wifi-csp) - [WiFi CSP](/windows/client-management/mdm/wifi-csp)

32
windows/configuration/provisioning-packages/toc.yml
View File

@ -1,29 +1,35 @@
items: items:
- name: Overview - name: Overview
href: provisioning-packages.md href: provisioning-packages.md
- name: How provisioning works in Windows client - name: How provisioning works
href: provisioning-how-it-works.md href: provisioning-how-it-works.md
- name: Introduction to configuration service providers (CSPs) - name: Quickstarts
href: how-it-pros-can-use-configuration-service-providers.md items:
- name: Install Windows Configuration Designer - name: Install Windows Configuration Designer
href: provisioning-install-icd.md href: provisioning-install-icd.md
- name: Create a provisioning package - name: Create a provisioning package (desktop wizard)
href: provision-pcs-for-initial-deployment.md
- name: Create a provisioning package (advanced)
href: provisioning-create-package.md href: provisioning-create-package.md
- name: Apply a provisioning package - name: Apply a provisioning package
href: provisioning-apply-package.md href: provisioning-apply-package.md
- name: Settings changed when you uninstall a provisioning package - name: Provision apps
href: provisioning-uninstall-package.md items:
- name: Provision PCs with common settings for initial deployment (desktop wizard) - name: Provision apps
href: provision-pcs-for-initial-deployment.md
- name: Provision PCs with apps
href: provision-pcs-with-apps.md href: provision-pcs-with-apps.md
- name: Use a script to install a desktop app in provisioning packages - name: Use a script to install a desktop app
href: provisioning-script-to-install-app.md href: provisioning-script-to-install-app.md
- name: Create a provisioning package with multivariant settings - name: Create a provisioning package with multivariant settings
href: provisioning-multivariant.md href: provisioning-multivariant.md
- name: PowerShell cmdlets for provisioning Windows client (reference)
href: provisioning-powershell.md
- name: Diagnose provisioning packages - name: Diagnose provisioning packages
href: diagnose-provisioning-packages.md href: diagnose-provisioning-packages.md
- name: Windows Configuration Designer command-line interface (reference) - name: Settings changed when you uninstall a provisioning package
href: provisioning-uninstall-package.md
- name: Reference
items:
- name: Introduction to configuration service providers (CSPs)
href: how-it-pros-can-use-configuration-service-providers.md
- name: Windows Configuration Designer command-line interface
href: provisioning-command-line.md href: provisioning-command-line.md
- name: PowerShell cmdlets for provisioning Windows client
href: provisioning-powershell.md