diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 6b0407617e..9dda6989f1 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -20629,6 +20629,26 @@ "source_path": "windows/security/threat-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md", "redirect_url": "/windows/security", "redirect_document_id": false + }, + { + "source_path": "education/windows/s-mode-switch-to-edu.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/change-to-pro-education.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/test-windows10s-for-edu.md", + "redirect_url": "/windows/deployment/s-mode", + "redirect_document_id": false + }, + { + "source_path": "education/windows/enable-s-mode-on-surface-go-devices.md", + "redirect_url": "/windows/deployment/s-mode", + "redirect_document_id": false } ] } diff --git a/education/breadcrumb/toc.yml b/education/breadcrumb/toc.yml index 15833fa467..23a57d2206 100644 --- a/education/breadcrumb/toc.yml +++ b/education/breadcrumb/toc.yml @@ -16,3 +16,9 @@ items: - name: Windows tocHref: /windows/configuration/ topicHref: /education/windows/index + - name: Windows + tocHref: /windows/deployment/ + topicHref: /education/windows/index + - name: Windows + tocHref: /windows/Security/Application Control for Windows/ + topicHref: /education/windows/index diff --git a/education/windows/TOC.yml b/education/windows/TOC.yml index b732e77d6d..69693b6fdf 100644 --- a/education/windows/TOC.yml +++ b/education/windows/TOC.yml @@ -18,10 +18,12 @@ items: href: windows-11-se-faq.yml - name: Windows in S Mode items: - - name: Test Windows 10 in S mode on existing Windows 10 education devices - href: test-windows10s-for-edu.md - - name: Enable Windows 10 in S mode on Surface Go devices - href: enable-s-mode-on-surface-go-devices.md + - name: Overview + href: /windows/deployment/s-mode?context=/education/context/context + - name: Switch Windows edition from S mode + href: /windows/deployment/windows-10-pro-in-s-mode?context=/education/context/context + - name: Deploy Win32 apps to S Mode devices + href: /windows/security/threat-protection/windows-defender-application-control/lob-win32-apps-on-s?context=/education/context/context - name: Windows 10 editions for education customers href: windows-editions-for-education-customers.md - name: Considerations for shared and guest devices @@ -50,14 +52,8 @@ items: href: get-minecraft-for-education.md - name: Use the Set up School PCs app href: use-set-up-school-pcs-app.md - - name: Change Windows edition - items: - - name: Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode - href: s-mode-switch-to-edu.md - - name: Change to Windows 10 Pro Education from Windows 10 Pro - href: change-to-pro-education.md - - name: Upgrade Windows Home to Windows Education on student-owned devices - href: change-home-to-edu.md + - name: Upgrade Windows Home to Windows Education on student-owned devices + href: change-home-to-edu.md - name: Migrate from Chromebook to Windows items: - name: Chromebook migration guide diff --git a/education/windows/change-to-pro-education.md b/education/windows/change-to-pro-education.md deleted file mode 100644 index a134019d38..0000000000 --- a/education/windows/change-to-pro-education.md +++ /dev/null @@ -1,303 +0,0 @@ ---- -title: Change to Windows 10 Education from Windows 10 Pro -description: Learn how IT Pros can opt into changing to Windows 10 Pro Education from Windows 10 Pro. -ms.topic: how-to -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 -ms.collection: - - highpri - - tier2 - - education ---- - -# Change to Windows 10 Pro Education from Windows 10 Pro -Windows 10 Pro Education is a new offering in Windows 10, version 1607. This edition builds on the commercial version of Windows 10 Pro and provides important management controls needed in schools by providing education-specific default settings. - -If you have an education tenant and use devices with Windows 10 Pro, global administrators can opt in to a free change to Windows 10 Pro Education depending on your scenario. -- [Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode](./s-mode-switch-to-edu.md) - -To take advantage of this offering, make sure you meet the [requirements for changing](#requirements-for-changing). For academic customers who are eligible to change to Windows 10 Pro Education, but are unable to use the above methods, contact Microsoft Support for assistance. - ->[!IMPORTANT] ->If you change a Windows 10 Pro device to Windows 10 Pro Education using Microsoft Store for Education, [subscription activation](/windows/deployment/windows-10-subscription-activation) won't work. - -## Requirements for changing -Before you change to Windows 10 Pro Education, make sure you meet these requirements: -- Devices must be running Windows 10 Pro, version 1607 or higher. -- Devices must be Azure Active Directory-joined, or domain joined with Azure AD Connect. Customers who are federated with Azure AD are also eligible. For more information, see [Review requirements on devices](#review-requirements-on-devices). - - If you haven't domain joined your devices already, [prepare for deployment of Windows 10 Pro Education licenses](#preparing-for-deployment-of-windows-10-pro-education-licenses). - -- The Azure AD tenant must be recognized as an education approved tenant. -- You must have a Microsoft Store for Education account. -- The user making the changes must be a member of the Azure AD global administrator group. - -## Compare Windows 10 Pro and Pro Education editions -You can [compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare) to find out more about the features we support in other editions of Windows 10. - -For more info about Windows 10 default settings and recommendations for education customers, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). - -## Change from Windows 10 Pro to Windows 10 Pro Education - -For schools that want to standardize all their Windows 10 Pro devices to Windows 10 Pro Education, a global admin for the school can opt in to a free change through the Microsoft Store for Education. - -In this scenario: - -- The IT admin of the tenant chooses to turn on the change for all Azure AD-joined devices. -- Any device that joins the Azure AD will change automatically to Windows 10 Pro Education. -- The IT admin has the option to automatically roll back to Windows 10 Pro, if desired. See [Roll back Windows 10 Pro Education to Windows 10 Pro](#roll-back-windows-10-pro-education-to-windows-10-pro). - -See [change using Microsoft Store for Education](#change-using-microsoft-store-for-education) for details on how to turn on the change. - -### Change using Intune for Education - -1. In Intune for Education, select **Groups** and then choose the group that you want to apply the MAK license key to. - - For example, to apply the change for all teachers, select **All Teachers** and then select **Settings**. - -2. In the settings page, find **Edition upgrade** and then: - 1. Select the edition in the **Edition to upgrade to** field - 2. Enter the MAK license key in the **Product key** field - - **Figure 1** - Enter the details for the Windows edition change - - ![Enter the details for the Windows edition change.](images/i4e_editionupgrade.png) - -3. The change will automatically be applied to the group you selected. - - -### Change using Windows Configuration Designer -You can use Windows Configuration Designer to create a provisioning package that you can use to change the Windows edition for your device(s). [Install Windows Configuration Designer from the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22) to create a provisioning package. - -1. In Windows Configuration Designer, select **Provision desktop devices** to open the simple editor and create a provisioning package for Windows desktop editions. -2. In the **Set up device** page, enter the MAK license key in the **Enter product key** field to change to Windows 10 Pro Education. - - **Figure 2** - Enter the license key - - ![Enter the license key to change to Windows 10 Pro Education.](images/wcd/wcd_productkey.png) - -3. Complete the rest of the process for creating a provisioning package and then apply the package to the devices you want to change to Windows 10 Pro Education. - - For more information about using Windows Configuration Designer, see [Set up student PCs to join domain](./set-up-students-pcs-to-join-domain.md). - - -### Change using the Activation page - -1. On the Windows device that you want to change, open the **Settings** app. -2. Select **Update & security** > **Activation**, and then click **Change product key**. -3. In the **Enter a product key** window, enter the MAK key for Windows 10 Pro Education and click **Next**. - - -## Education customers with Azure AD-joined devices - -Academic institutions can easily move from Windows 10 Pro to Windows 10 Pro Education without using activation keys or reboots. When one of your users enters their Azure AD credentials associated with a Windows 10 Pro Education license, the operating system changes to Windows 10 Pro Education and all the appropriate Windows 10 Pro Education features are unlocked. Previously, only schools or organizations purchasing devices as part of the Shape the Future K-12 program or with a Microsoft Volume Licensing Agreement could deploy Windows 10 Pro Education to their users. Now, if you have an Azure AD for your organization, you can take advantage of the Windows 10 Pro Education features. - -When you change to Windows 10 Pro Education, you get the following benefits: - -- **Windows 10 Pro Education edition**. Devices currently running Windows 10 Pro, version 1607 or higher, or Windows 10 S mode, version 1703, can get Windows 10 Pro Education Current Branch (CB). This benefit doesn't include Long Term Service Branch (LTSB). -- **Support from one to hundreds of users**. The Windows 10 Pro Education program doesn't have a limitation on the number of licenses an organization can have. -- **Roll back options to Windows 10 Pro** - - When a user leaves the domain or you turn off the setting to automatically change to Windows 10 Pro Education, the device reverts seamlessly to Windows 10 Pro edition (after a grace period of up to 30 days). - - For devices that originally had Windows 10 Pro edition installed, when a license expires or is transferred to another user, the Windows 10 Pro Education device seamlessly steps back down to Windows 10 Pro. - - See [Roll back Windows 10 Pro Education to Windows 10 Pro](#roll-back-windows-10-pro-education-to-windows-10-pro) for more info. - - -### Change using Microsoft Store for Education -Once you enable the setting to change to Windows 10 Pro Education, the change will begin only after a user signs in to their device. The setting applies to the entire organization or tenant, so you can't select which users will receive the change. The change will only apply to Windows 10 Pro devices. - -**To turn on the automatic change to Windows 10 Pro Education** - -1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your work or school account. - - If you're signing into the Microsoft Store for Education for the first time, you'll be prompted to accept the Microsoft Store for Education Terms of Use. - -2. Click **Manage** from the top menu and then select the **Benefits tile**. -3. In the **Benefits** tile, look for the **Change to Windows 10 Pro Education for free** link and then click it. - -4. In the **Change all your devices to Windows 10 Pro Education for free** page, check box next to **I understand enabling this setting will change all domain-joined devices running Windows 10 Pro in my organization**. - - **Figure 3** - Check the box to confirm - - ![Check the box to confirm.](images/msfe_manage_benefits_checktoconfirm.png) - -5. Click **Change all my devices**. - - A confirmation window pops up to let you know that an email has been sent to you to enable the change. - -6. Close the confirmation window and check the email to proceed to the next step. -7. In the email, click the link to **Change to Windows 10 Pro Education**. Once you click the link, you are taken back to the Microsoft Store for Education portal. - -8. Click **Change now** in the **changing your device to Windows 10 Pro Education for free** page in the Microsoft Store. - - You'll see a window that confirms you've successfully changed all the devices in your organization to Windows 10 Pro Education, and each Azure AD joined device running Windows 10 Pro will automatically change the next time someone in your organization signs in to the device. - -9. Click **Close** in the **Success** window. - -Enabling the automatic change also triggers an email message notifying all global administrators in your organization about the change. It also contains a link that enables any global administrators to cancel the change if they choose. For more info about rolling back or canceling the change, see [Roll back Windows 10 Pro Education to Windows 10 Pro](#roll-back-windows-10-pro-education-to-windows-10-pro). - - -## Explore the change experience - -So what will users experience? How will they change their devices? - -### For existing Azure AD-joined devices -Existing Azure AD domain joined devices will be changed to Windows 10 Pro Education the next time the user logs in. That's it! No other steps are needed. - -### For new devices that are not Azure AD joined -Now that you've turned on the setting to automatically change to Windows 10 Pro Education, the users are ready to change their devices running Windows 10 Pro, version 1607 or higher, version 1703 to Windows 10 Pro Education edition. - -#### Step 1: Join users' devices to Azure AD - -Users can join a device to Azure AD the first time they start the device (during setup), or they can join a device that they already use running Windows 10 Pro, version 1607 or higher, version 1703. - -**To join a device to Azure AD the first time the device is started** - -There are different methods you can use to join a device to Azure AD: -- For multiple devices, we recommend using the [Set up School PCs app](use-set-up-school-pcs-app.md) to create a provisioning package to quickly provision and set up Windows 10 devices for education. -- For individual devices, you can use the Set up School PCs app or go through the Windows 10 device setup experience. If you choose this option, see the following steps. - -**To join a device to Azure AD using Windows device setup** - -If the Windows device is running Windows 10, version 1703, follow these steps. - -1. During initial device setup, on the **How would you like to set up?** page, select **Set up for an organization**, and then click **Next**. - -2. On the **Sign in with Microsoft** page, enter the username and password to use with Office 365 or other services from Microsoft, and then click **Next**. - -3. Go through the rest of Windows device setup. Once you're done, the device will be Azure AD joined to your school's subscription. - - -**To join a device to Azure AD when the device already has Windows 10 Pro, version 1703 installed and set up** - -If the Windows device is running Windows 10, version 1703, follow these steps. - -1. Go to **Settings > Accounts > Access work or school**. - - **Figure 6** - Go to **Access work or school** in Settings - - ![Go to Access work or school in Settings.](images/settings_workorschool_1.png) - -2. In **Access work or school**, click **Connect**. -3. In the **Set up a work or school account** window, click the **Join this device to Azure Active Directory** option at the bottom. - - **Figure 7** - Select the option to join the device to Azure Active Directory - - ![Select the option to join the device to Azure Active Directory.](images/settings_setupworkorschoolaccount_2.png) - -4. On the **Let's get you signed in** window, enter the Azure AD credentials (username and password) and sign in. The device is joined with the school's Azure AD. -5. To verify that the device was successfully joined to Azure AD, go back to **Settings > Accounts > Access work or school**. You should now see a connection under the **Connect to work or school** section that indicates the device is connected to Azure AD. - - **Figure 8** - Verify the device connected to Azure AD - - ![Verify the device is connected to Azure AD.](images/settings_connectedtoazuread_3.png) - - -#### Step 2: Sign in using Azure AD account - -Once the device is joined to your Azure AD subscription, users will sign in by using their Azure AD account. The Windows 10 Pro Education license associated with the user will enable Windows 10 Pro Education edition capabilities on the device. - - -#### Step 3: Verify that Pro Education edition is enabled - -You can verify the Windows 10 Pro Education in **Settings > Update & Security > Activation**. - -**Figure 9** - Windows 10 Pro Education in Settings - -Windows 10 activated and subscription active - -If there are any problems with the Windows 10 Pro Education license or the activation of the license, the **Activation** panel will display the appropriate error message or status. You can use this information to help you diagnose the licensing and activation process. - -### Troubleshoot the user experience - -In some instances, users may experience problems with the Windows 10 Pro Education change. The most common problems that users may experience are as follows: - -- The existing operating system (Windows 10 Pro, version 1607 or higher, or version 1703) isn't activated. -- The Windows 10 Pro Education change has lapsed or has been removed. - -Use the following figures to help you troubleshoot when users experience these common problems: - -**Figure 10** - Illustrates a device in a healthy state, where the existing operating system is activated, and the Windows 10 Pro Education change is active. - -Windows 10 activated and subscription active

- - -**Figure 11** - Illustrates a device on which the existing operating system isn't activated, but the Windows 10 Pro Education change is active. - -Windows 10 not activated and subscription active

- - -### Review requirements on devices - -Devices must be running Windows 10 Pro, version 1607 or higher, or domain joined with Azure AD Connect. Customers who are federated with Azure AD are also eligible. You can use the following procedures to review whether a particular device meets requirements. - -**To determine if a device is Azure AD joined** - -1. Open a command prompt and type the following command: - - ``` - dsregcmd /status - ``` - -2. Review the output under Device State. If the **AzureAdJoined** status is YES, the device is Azure Active Directory-joined. - -**To determine the version of Windows 10** - -- At a command prompt, type: - - ``` - winver - ``` - - A popup window will display the Windows 10 version number and detailed OS build information. - - > [!NOTE] - > If a device is running a previous version of Windows 10 Pro (for example, version 1511), it will not be changed to Windows 10 Pro Education when a user signs in, even if the user has been assigned a license. - -### Roll back Windows 10 Pro Education to Windows 10 Pro - -If your organization has the Windows 10 Pro to Windows 10 Pro Education change enabled, and you decide to roll back to Windows 10 Pro or to cancel the change, perform the following task: - -- Log into Microsoft Store for Education page and turning off the automatic change. -- Selecting the link to turn off the automatic change from the notification email sent to all global administrators. - -Once the automatic change to Windows 10 Pro Education is turned off, the change is effective immediately. Devices that were changed will revert to Windows 10 Pro only after the license has been refreshed (every 30 days) and the next time the user signs in. Therefore, users whose device was changed may not immediately see Windows 10 Pro Education rolled back to Windows 10 Pro for up to 30 days. However, users who haven't signed in during the time that a change was enabled and then turned off will never see their device change from Windows 10 Pro. - -> [!NOTE] -> Devices that were changed from mode to Windows 10 Pro Education can't roll back to Windows 10 Pro Education S mode. - -**To roll back Windows 10 Pro Education to Windows 10 Pro** - -1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your school or work account, or follow the link from the notification email to turn off the automatic change. -2. Select **Manage > Benefits** and locate the section **Windows 10 Pro Education** and follow the link. -3. In the **Revert to Windows 10 Pro** page, click **Revert to Windows 10 Pro**. - - **Figure 12** - Revert to Windows 10 Pro - - ![Revert to Windows 10 Pro.](images/msfe_manage_reverttowin10pro.png) - -4. You'll be asked if you're sure that you want to turn off automatic changes to Windows 10 Pro Education. Click **Yes**. -5. Click **Close** in the **Success** page. - - All global admins get a confirmation email that a request was made to roll back your organization to Windows 10 Pro. If you, or another global admin, decide later that you want to turn on automatic changes again, you can do this by selecting **change to Windows 10 Pro Education for free** from the **Manage > Benefits** in the Microsoft Store for Education. - - -## Preparing for deployment of Windows 10 Pro Education licenses - -If you have on-premises Active Directory Domain Services (AD DS) domains, users will use their domain-based credentials to sign in to the AD DS domain. Before you start deploying Windows 10 Pro Education to users, you need to synchronize the identities in the on-premises AD DS domain with Azure AD. - -You need to synchronize these identities so that users will have a *single identity* that they can use to access their on-premises apps and cloud services that use Azure AD (such as Windows 10 Pro Education). This means that users can use their existing credentials to sign in to Azure AD and access the cloud services that you provide and manage for them. - -(Azure AD Connect) is responsible for synchronization of identities between the on-premises AD DS domain and Azure AD. Azure AD Connect is a service that you can install on-premises or in a virtual machine in Azure. - -For more information about integrating on-premises AD DS domains with Azure AD, see these resources: -- [Integrating your on-premises identities with Azure Active Directory](/azure/active-directory/hybrid/whatis-hybrid-identity) -- [Azure AD + Domain Join + Windows 10](https://blogs.technet.microsoft.com/enterprisemobility/2016/02/17/azure-ad-domain-join-windows-10/) - -## Related topics - -[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) -[Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md) -[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare) -[Windows 10 subscription activation](/windows/deployment/windows-10-subscription-activation) \ No newline at end of file diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md index 587d279c84..f736b5adc6 100644 --- a/education/windows/configure-windows-for-education.md +++ b/education/windows/configure-windows-for-education.md @@ -10,7 +10,7 @@ appliesto: Privacy is important to us, we want to provide you with ways to customize the OS diagnostic data, consumer experiences, Cortana, search, and some of the preinstalled apps, for usage with [education editions of Windows 10](windows-editions-for-education-customers.md) in education environments. These features work on all Windows 10 editions, but education editions of Windows 10 have the settings preconfigured. We recommend that all Windows 10 devices in an education setting be configured with **[SetEduPolicies](#setedupolicies)** enabled. For more information, see the following table. To learn more about Microsoft's commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). -We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store for Education, and use devices running Windows 10 S, will be able to configure the device at no extra charge to Windows 10 Pro Education. To learn more about the steps to configure this device, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md). +We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store, and use devices running Windows 10 S, will be able to configure the device at no extra charge to Windows 10 Pro Education. To learn more about the steps to configure this device, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md). In Windows 10, version 1703 (Creators Update), it's straightforward to configure Windows to be education ready. @@ -45,7 +45,7 @@ It's easy to be education ready when using Microsoft products. We recommend the 3. Enroll the PCs in MDM. * If you've activated Intune for Education in your Azure AD tenant, enrollment will happen automatically when the PC is joined to Azure AD. Intune for Education will automatically set **SetEduPolicies** to True and **AllowCortana** to False. 4. Ensure that needed assistive technology apps can be used. - * If you've students or school personnel who rely on assistive technology apps that aren't available in the Microsoft Store for Education, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) for more info. + * If you've students or school personnel who rely on assistive technology apps that aren't available in the Microsoft Store, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) for more info. 4. Distribute the PCs to students. diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md index 392497fa7d..fc74fcd614 100644 --- a/education/windows/edu-deployment-recommendations.md +++ b/education/windows/edu-deployment-recommendations.md @@ -9,9 +9,9 @@ appliesto: # Deployment recommendations for school IT administrators -Your privacy is important to us, so we want to provide you with ways to customize the OS privacy settings, and some of the apps, so that you can choose what information is shared with Microsoft. To learn more about Microsoft’s commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). The following sections provide some best practices and specific privacy settings we’d like you to be aware of. For more information about ways to customize the OS diagnostic data, consumer experiences, Cortana, and search, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). +Your privacy is important to us, so we want to provide you with ways to customize the OS privacy settings, and some of the apps, so that you can choose what information is shared with Microsoft. To learn more about Microsoft's commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). The following sections provide some best practices and specific privacy settings we'd like you to be aware of. For more information about ways to customize the OS diagnostic data, consumer experiences, Cortana, and search, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). -We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store for Education, and use devices running Windows 10 S, will be able to configure the device at no extra charge to Windows 10 Pro Education. To learn more about the steps to configure this device, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md). +We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store, and use devices running Windows 10 S, will be able to configure the device at no extra charge to Windows 10 Pro Education. To learn more about the steps to configure this device, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md). ## Deployment best practices @@ -20,16 +20,16 @@ Keep these best practices in mind when deploying any edition of Windows 10 in sc * A Microsoft account is only intended for consumer services. Enterprises and educational institutions should use enterprise versions where possible, such as Skype for Business, OneDrive for Business, and so on. For schools, consider using mobile device management (MDM) or Group Policy to block students from adding a Microsoft account as a secondary account * If schools allow the use of personal accounts by their students to access personal services, schools should be aware that these accounts belong to individuals, not the school * IT administrators, school officials, and teachers should also consider ratings when picking apps from the Microsoft Store -* If you've students or school personnel who rely on assistive technology apps that aren't available in the Microsoft Store for Education, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) for more info +* If you've students or school personnel who rely on assistive technology apps that aren't available in the Microsoft Store, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) for more info ## Windows 10 Contacts privacy settings -If you’re an IT administrator who deploys Windows 10 in a school or district, we recommend that you review these deployment resources to make informed decisions about how you can configure telemetry for your school or district: +If you're an IT administrator who deploys Windows 10 in a school or district, we recommend that you review these deployment resources to make informed decisions about how you can configure telemetry for your school or district: * [Configure Windows telemetry in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization) - Describes the types of telemetry we gather and the ways you can manage this data * [Manage connections from Windows operating system components to Microsoft services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) - Learn about network connections that Windows components make to Microsoft and also the privacy settings (such as location, camera, messaging, and more) that affect data that is shared with either Microsoft or apps and how you can manage this data -In particular, the **Contacts** area in the **Settings** > **Privacy** section lets you choose which apps can access a student’s contacts list. By default, this setting is turned on. +In particular, the **Contacts** area in the **Settings** > **Privacy** section lets you choose which apps can access a student's contacts list. By default, this setting is turned on. To change the setting, you can: * [Turn off access to contacts for all apps](#turn-off-access-to-contacts-for-all-apps) @@ -78,7 +78,7 @@ If the school allows the use of personal or Microsoft account in addition to org #### Skype -Skype uses the user’s contact details to deliver important information about the account and it also lets friends find each other on Skype. +Skype uses the user's contact details to deliver important information about the account and it also lets friends find each other on Skype. To manage and edit your profile in the Skype UWP app, follow these steps: @@ -101,20 +101,20 @@ To manage and edit your profile in the Skype UWP app, follow these steps: #### Xbox -A user’s Xbox friends and their friends’ friends can see their real name and profile. By default, the Xbox privacy settings enforce that no personal identifying information of a minor is shared on the Xbox Live network, although adults in the child’s family can change these default settings to allow it to be more permissive. +A user's Xbox friends and their friends' friends can see their real name and profile. By default, the Xbox privacy settings enforce that no personal identifying information of a minor is shared on the Xbox Live network, although adults in the child's family can change these default settings to allow it to be more permissive. To learn more about how families can manage security and privacy settings on Xbox, see this [Xbox article on security](https://go.microsoft.com/fwlink/?LinkId=821445). ### Delete an account if username is identifying -If you want to delete either (or both) the Skype and the Xbox accounts, here’s how to do it. +If you want to delete either (or both) the Skype and the Xbox accounts, here's how to do it. #### Skype To delete a Skype account, you can follow the instructions here: [How do I close my Skype account?](https://go.microsoft.com/fwlink/?LinkId=816515) -If you need help with deleting the account, you can contact Skype customer service by going to the [Skype support request page](https://go.microsoft.com/fwlink/?LinkId=816519). You may need to sign in and specify a Skype account. Once you’ve signed in, you can: +If you need help with deleting the account, you can contact Skype customer service by going to the [Skype support request page](https://go.microsoft.com/fwlink/?LinkId=816519). You may need to sign in and specify a Skype account. Once you've signed in, you can: 1. Select a help topic (**Account and Password**) 1. Select a related problem (**Deleting an account**) diff --git a/education/windows/enable-s-mode-on-surface-go-devices.md b/education/windows/enable-s-mode-on-surface-go-devices.md deleted file mode 100644 index 6fa45fd3e7..0000000000 --- a/education/windows/enable-s-mode-on-surface-go-devices.md +++ /dev/null @@ -1,138 +0,0 @@ ---- -title: Enable S mode on Surface Go devices for Education -description: Learn how to enable S mode on Surface Go devices. -ms.date: 08/10/2022 -ms.topic: how-to -appliesto: - - ✅ Windows 10 ---- - -# Surface Go for Education - Enabling S mode - -Surface Go devices are available with both Windows 10 Home in S mode and Windows 10 Pro configurations. Education customers who purchase Surface Go devices with Windows 10 Pro may wish to take advantage of S mode on their Pro devices. These customers can create their own S mode image for Surface Go or enable S mode on a per-device basis. - -## Prerequisites - -Here are some things you’ll need before attempting any of these procedures: - -- A Surface Go device or Surface Go device image based on Windows 10 Pro - (1803) -- General understanding of [Windows deployment scenarios and related - tools](/windows/deployment/windows-deployment-scenarios-and-tools) -- [Windows ADK for Windows 10 - 1803](/windows/deployment/windows-adk-scenarios-for-it-pros) -- [Bootable Windows Preinstall Environment - (WinPE)](/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive) - -## Enabling S Mode – Windows Image (WIM) - -Like enterprise administrators performing large-scale deployment of customized Windows images, education customers can create their own customized Windows images for deployment to multiple classroom devices. An education customer who plans to follow [a traditional image-based deployment -process](/windows/deployment/windows-10-deployment-scenarios#traditional-deployment) using a Windows 10 Pro (1803) image for Surface Go devices can enable S mode as follows: - -1. Use DISM to mount your offline Windows 10 Pro (1803) image. - - ``` - dism /Mount-image /imagefile:\ {/Index:\ | /Name:\} /MountDir:\ - ``` - -2. Create an unattend.xml answer file, adding the - amd64_Microsoft_Windows_CodeIntegrity component to Pass 2 offline Servicing - and setting amd64_Microsoft_Windows_CodeIntegrity\\SkuPolicyRequired to “1”. - The resulting xml should look like this… - - Copy - ``` - - - 1 - - - ``` -3. Save the answer file in the **Windows\Panther** folder of your mounted image as unattend.xml. -4. Use DISM to apply the unattend.xml file and enable S Mode: - - Copy - ``` - dism /image:C:\mount\windows /apply-unattend:C:\mount\windows\windows\panther\unattend.xml - ``` - - > Note: in the above example, C:\\mount\\ is the local directory used to mount - > the offline image. -5. Commit the image changes and unmount the image - - Copy - ``` - dism /Unmount-image /MountDir:C:\\mount /Commit - ``` - >Note: don’t forget the /Commit parameter to ensure you don’t lose your - changes. - -Your Windows 10 Pro (1803) image now has S mode enabled and is ready to deploy to Surface Go devices. - -## Enabling S Mode – Per Device - -Education customers who wish to avoid the additional overhead associated with Windows image creation, customization, and deployment can enable S mode on a per-device basis. Performing the following steps on a Surface Go device will enable S mode on an existing installation of Windows 10 Pro (1803). - -1. Create a bootable WinPE media. See [Create a bootable Windows PE USB - drive](/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive) for details. - -2. Create an unattend.xml answer file, adding the - amd64_Microsoft_Windows_CodeIntegrity component to Pass 2 offline Servicing - and setting amd64_Microsoft_Windows_CodeIntegrity\\SkuPolicyRequired to “1”. The resulting xml should look like this… - - Copy - ``` - - - 1 - - - ``` - -3. Attach your bootable WinPE USB drive to a Surface Go device and perform a USB boot (hold the **volume down** button while powering on the device… continue to hold until the Surface logo appears) -4. Wait for WinPE to launch a command window (*X:\\windows\\system32\\cmd.exe*). -5. Apply the unattend.xml created in step 2 using DISM. - - Copy - ``` - dism /image:C:\ /apply-unattend:D:\unattend.xml - ``` - > Note: in the above example, C:\\ is the local OS drive (offline). D:\ is where the S mode unattend.xml file (from Step 2) resides. - -6. Once DISM has successfully applied the unattend.xml, reboot the Surface Go device. -Upon reboot, you should find your Surface Go device now is now in S mode. - -## Troubleshooting - -|ISSUE | RESOLUTION | -|------------------------ |-----------------------| -|DISM fails to apply the unattend.xml because the OS drive is encrypted. | This is one reason why it’s best to enable S mode before setting up and configuring a device. If the OS drive has already been encrypted, you’ll need to fully decrypt the drive before you can enable S mode. | -|Unattend.xml has been applied and dism reports success. However, when I boot the device, it’s not in S mode. This can happen when a device was booted to Windows 10 Pro before S mode was enabled. To resolve this issue, do the following: | 1. **Run** “shutdown.exe -p -f” to force a complete shutdown.
2. Hold the **vol-up** button while pressing the **power** button to power on the device. Continue to hold **vol-up** until you see the Surface UEFI settings.
3. Under **Security** find the **Secure Boot** option and disable it.
4. With SecureBoot disabled choose **exit** -\> **restart now** to exit UEFI settings and reboot the device back to Windows.
5. Confirm that S mode is now properly enabled.
6. Once you’ve confirmed S mode, you should re-enable Secure Boot… repeat the above steps, choosing to **Enable** Secure Boot from the UEFI securitysettings. - -## Additional Info - -[Windows 10 deployment scenarios](/windows/deployment/windows-10-deployment-scenarios) - -[Windows 10 deployment scenarios and tools](/windows/deployment/windows-deployment-scenarios-and-tools) - -[Download and install the Windows ADK](/windows-hardware/get-started/adk-install) - -[Windows ADK for Windows 10 scenarios for IT Pros](/windows/deployment/windows-adk-scenarios-for-it-pros) - -[Modify a Windows Image Using DISM](/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism) - -[Service a Windows Image Using DISM](/windows-hardware/manufacture/desktop/service-a-windows-image-using-dism) - -[DISM Image Management Command-Line Options](/windows-hardware/manufacture/desktop/dism-image-management-command-line-options-s14) \ No newline at end of file diff --git a/education/windows/s-mode-switch-to-edu.md b/education/windows/s-mode-switch-to-edu.md deleted file mode 100644 index fafc2716c8..0000000000 --- a/education/windows/s-mode-switch-to-edu.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode -description: Learn how to switch out of Windows 10 Pro in S mode to Windows 10 Pro Education. -ms.topic: how-to -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- - -# Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode -The S mode switch motion enables users to switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode. This gives users access to the Microsoft Store for Education and to other Education offers. - -## Benefits of Windows 10 Pro in S mode for Education - -S mode is an enhanced security mode of Windows 10 – streamlined for security and superior performance. With Windows 10 in S mode, everyone can download and install Microsoft-verified apps from the Microsoft Store for Education – this mode keeps devices running fast and secure day in and day out. - -- **Microsoft-verified security** - It reduces risk of malware and exploitations that harm students and educators, because only Microsoft-verified apps can be installed. -- **Performance that lasts** - Provides all-day battery life to keep students on task and not tripping over cords. Also, verified apps won’t degrade device performance over time. -- **Streamlined for Speed** - Offers faster log-in times so teachers spend less time waiting and more time teaching. - - -| |Home |S mode |Pro/Pro Education |Enterprise/Education | -|:---------|:---:|:---:|:---:|:---:| -|**Start Menu/Hello/Cortana/
Windows Ink/Microsoft Edge** | X | X | X | X | -|**Store apps (including Windows
desktop bridge apps)** | X | X | X | X | -|**Windows Update** | X | X | X | X | -|**Device Encryption** | X | X | X | X | -|**BitLocker** | | X | X | X | -|**Windows Update for Business** | | X | X | X | -|**Microsoft Store for Education** | | X | X | X | -|**Mobile Device Management**
**and Azure AD join** | | X | X | X | -|**Group Policy management and**
**Active Directory Domain Services** | | | X | X | -|**Desktop (Windows 32) Apps** | X | | X | X | -|**Change App Defaults**
**Search/Browser/Photos/etc.** | X | | X | X | -|**Credential Guard** | | | | X | -|**Device Guard** | | | | X | - -### Windows 10 in S mode is safe, secure, and fast. -However, in some limited scenarios, you might need to switch to Windows 10 Education. You can switch devices running Windows 10, version 1709 or later. Use the following information to switch to Windows 10 Pro through the Microsoft Store. - -## How to switch - -### Devices running Windows 10, version 1803 - -**Switch using the Microsoft Store for Education**
-There are two switch options available using the Microsoft Store for Education: - -Tenant-wide Windows 10 Pro in S mode > Pro Education in S mode
-Tenant-wide Windows 10 Pro > Pro Education - -> [!IMPORTANT] -> While it’s free to switch to Windows 10 Pro, it’s not reversible. The only way to roll back this kind of switch is through a [bare metal recovery (BMR)](/windows-hardware/manufacture/desktop/create-media-to-run-push-button-reset-features-s14) reset. This restores a Windows device to the factory state, even if the user needs to replace the hard drive or completely wipe the drive clean. If a device is switched out of S mode via the Microsoft Store, it will remain out of S mode even after the device is reset. - -### Devices running Windows 10, version 1709 - -1. **Bulk switch through Microsoft Store for Education** - In this scenario, the global admin for the Azure AD education tenant can use Microsoft Store to switch all Windows 10 Pro in S mode devices on the tenant to Windows 10 Pro Education. (Devices running Windows 10, version 1803 will switch to Windows 10 Pro EDU in S mode.) - -2. **Key acquisition options** - For schools with **active Microsoft Volume Licensing** agreements, global admins can obtain free MAK keys for Windows 10 Pro Education. For schools without an active Microsoft Volume Licensing agreement, the global admin can contact CSS, fill out a form and provide a proof of purchase to receive MAK keys for Windows 10 Pro Education. - -> [!NOTE] -> There is currently no "bulk-switch" option for devices running Windows 10, version 1803. - -## Related Topics -[FAQs](https://support.microsoft.com/help/4020089/windows-10-in-s-mode-faq)
-[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)
-[Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md)
-[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare) \ No newline at end of file diff --git a/education/windows/test-windows10s-for-edu.md b/education/windows/test-windows10s-for-edu.md deleted file mode 100644 index eaeda25979..0000000000 --- a/education/windows/test-windows10s-for-edu.md +++ /dev/null @@ -1,232 +0,0 @@ ---- -title: Test Windows 10 in S mode on existing Windows 10 education devices -description: Provides guidance on downloading and testing Windows 10 in S mode for existing Windows 10 education devices. -ms.topic: conceptual -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 -ms.collection: - - highpri - - education - - tier2 ---- - -# Test Windows 10 in S mode on existing Windows 10 education devices - -The Windows 10 in S mode self-installer will allow you to test Windows 10 in S mode on various individual Windows 10 devices (except Windows 10 Home) with a genuine, activated license[1](#footnote1). Test Windows 10 in S mode on various devices in your school and share your feedback with us. - -Windows 10 in S mode is built to give schools the familiar, robust, and productive experiences you count on from Windows in an experience that's been streamlined for security and performance in the classroom, and built to work with Microsoft Education[2](#footnote2). - -Windows 10 in S mode is different from other editions of Windows 10 as everything that runs on the device is verified by Microsoft for security and performance. Therefore, Windows 10 in S mode works exclusively with apps from the Microsoft Store. Some accessories and apps compatible with Windows 10 may not work and performance may vary. Certain default settings, features, and apps can't be changed. When you install Windows 10 in S mode, your existing applications and settings will be deleted, and you'll only be able to install apps from the Microsoft Store. - -**Configuring Windows 10 in S mode for school use is easy:** Education customers must configure **SetEduPolicies** for use in K-12 schools. For more information on how to do these configurations, see [Use the Set up School PCs app](use-set-up-school-pcs-app.md) and [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). - -**Installing Office 365 for Windows 10 in S mode (Education preview)**: To install the Office applications in a school environment, you must use the free Setup School PCs app, which is available on the Microsoft Store for Education and from the Microsoft Store. - -As we finalize development of Office 365 for Windows 10 in S mode (Education preview), the applications will be updated automatically. You must have an Office license to activate the applications once they're installed. For more information about Office 365 for Education plans, see [Office on Windows 10 in S mode](https://support.microsoft.com/office/office-on-windows-10-in-s-mode-717193b5-ff9f-4388-84c0-277ddf07fe3f?ui=en-us&rs=en-us&ad=us). - -## Before you install Windows 10 in S mode - -### Important information - -Before you install Windows 10 in S mode, understand that non-Microsoft Store apps won't work, peripherals that require custom drivers may not work, and other errors may occur. In particular, this release of Windows 10 in S mode: - -- Is intended for education customers to test compatibility with existing hardware -- May not work with some device drivers, which may not yet be ready for Windows 10 in S mode and may cause some loss in functionality -- May not be compatible with all peripherals that require custom drivers and, even if compatible, may cause aspects of the peripheral to not function -- Has software and feature limitations compared to other Windows 10 editions, primarily that Windows 10 in S mode is limited to Store apps only - - > [!WARNING] - > You can install Windows 10 in S mode on devices running other editions of Windows 10. For more information, see [Supported devices](#supported-devices). However, we don't recommend installing Windows 10 in S mode on Windows 10 Home devices as you won't be able to activate it. - -- Won't run current Win32 software and might result in the loss of any data associated with that software, which might include software already purchased - -Due to these reasons, we recommend that you use the installation tool and avoid doing a clean install from an ISO media. - -Before you install Windows 10 in S mode on your existing Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, or Windows 10 Enterprise device: - -- Make sure that you updated your existing device to Windows 10, version 1703. - - To update your device to Windows 10, version 1703, see [Download Windows 10](https://www.microsoft.com/software-download/windows10). You can verify your current version in **Settings > System > About**. - -- Install the latest Windows Update. - - To do this task, go to **Settings > Update & security > Windows Update**. - -- Create a system backup in case you would like to return to your previously installed version of Windows 10 after trying Windows 10 in S mode. - - For more information on how to create the system backup, see [Create a recovery drive](#create-a-recovery-drive). - -## Supported devices - -The Windows 10 in S mode install will install and activate on the following editions of Windows 10 in use by schools: - -- Windows 10 Pro -- Windows 10 Pro Education -- Windows 10 Education -- Windows 10 Enterprise - -Other Windows 10 editions can't be activated and aren't supported. If your device isn't running one of these supported Windows 10 editions, don't proceed with using the Windows 10 in S mode installer. Windows 10-N editions and running in virtual machines aren't supported by the Windows 10 in S mode installer. - -### Preparing your device to install drivers - -Make sure all drivers are installed and working properly on your device running Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, or Windows 10 Enterprise before installing Windows 10 in S mode. - -### Supported devices and drivers - -Check with your device manufacturer before trying Windows 10 in S mode on your device to see if the drivers are available and supported by the device manufacturer. - -## Kept files - -Back up all your data before installing Windows 10 in S mode. Only personal files may be kept during installation. Your settings and apps will be deleted. - -> [!NOTE] -> All existing Win32 applications and data will be deleted. Save any data or installation files in case you may need to access that data again or need to reinstall these applications later. - -## Domain join - -Windows 10 in S mode doesn't support non-Azure Active Directory domain accounts. Before installing Windows 10 in S mode, you must have at least one of these administrator accounts: - -- Local administrator -- Microsoft account administrator -- Azure Active Directory administrator - -> [!WARNING] -> If you don't have one of these administrator accounts accessible before migration, you'll not be able to sign in to your device after migrating to Windows 10 in S mode. - -We recommend [creating a recovery drive](#create-a-recovery-drive) before migrating to Windows 10 in S mode in case you run into this issue. - -## Installing Office applications - -After installing Windows 10 in S mode, use the free [Set up School PCs app](use-set-up-school-pcs-app.md) to install Office 365 for Windows 10 in S mode (Education preview). You must have an Office license to activate the applications once they're installed. - -## Switch to previously installed Windows 10 editions - -If Windows 10 in S mode isn't right for you, you can switch to the Windows 10 edition previously installed on your device(s). - -- Education customers can switch devices to Windows 10 Pro Education using the Microsoft Store for Education. For more information, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 in S mode](change-to-pro-education.md). -- If you try Windows 10 in S mode and decide to switch back to the previously installed edition within 10 days, you can go back to the previously installed edition using the Windows Recovery option in Settings. For more info, see [Go back to your previous edition of Windows 10](#go-back-to-your-previous-edition-of-windows-10). - -## Device recovery - -Before installing Windows 10 in S mode, we recommend that you create a system backup in case you would like to return to Windows 10 Pro or Windows 10 Pro Education after trying Windows 10 in S mode. - -### Create a recovery drive - -To create a recovery drive, follow these steps. - -1. From the taskbar, search for **Create a recovery drive** and then select it. You might be asked to enter an admin password or confirm your choice. -2. In the **Recovery drive** tool, make sure **Back up system files to the recovery drive** is selected and then select **Next**. -3. Connect a USB drive to your PC, select it, and then select **Next > Create**. - - Many files need to be copied to the recovery drive; so this process might take a while. - -4. When it's done, you might see a **Delete the recovery partition from your PC** link on the final screen. If you want to free up drive space on your PC, select the link, and then select **Delete**. If not, select **Finish**. - -### Go back to your previous edition of Windows 10 - -Alternatively, for 10 days after you install Windows 10 in S mode, you can go back to your previous edition of Windows 10 from **Settings > Update & security > Recovery**. This revert operation will keep your personal files, but it will remove installed apps and any changes you made to **Settings**. - -To go back, you need to: - -- Keep everything in the `windows.old` and `$windows.~bt` folders after the upgrade. -- Remove any user accounts you added after the upgrade. - -If going back isn't available: - -- Check if you can restore your PC to factory settings. This restoration will reinstall the version of Windows that came with your PC and remove personal files, apps, and drivers you installed and any changes you made to **Settings**. Go to **Settings > Update & security > Recovery > Reset this PC > Get started** and look for **Restore factory settings**. -- If you've a product key for your previous version of Windows, use the media creation tool. It can create installation media of your previous Windows 10 edition, and do a clean install. - -After going back to your previous edition of Windows 10, you may receive the following message when launching Win32 apps: - -> For security and performance, this mode of Windows only runs verified apps from the Store. - -If you see this message, follow these steps to stop receiving the message: - -1. If you've BitLocker enabled, disable it first in the Control Panel. Go to **Manage BitLocker** and select **Turn off BitLocker**. -2. Open Windows **Settings** and go to **Update & security > Recovery**. -3. In the **Recovery** page, find **Advanced startup** and select **Restart now** to start your PC. -4. After restarting, in the **Choose an option** page, select **Troubleshoot**. -5. In the **Troubleshoot** page, select **Advanced options**, and in the **Advanced options** page select **UEFI Firmware Settings**. -6. In the **UEFI Firmware Settings** page, select **Restart** to get to the device-specific UEFI/BIOS menu. -7. Once you've accessed UEFI, look for the menu item labeled **Security** or **Security Settings**, and navigate to it. -8. Look for an option called **Secure boot configuration**, **Secure boot**, or **UEFI Boot**. If you can't find one of these options, check the **Boot** menu. -9. Disable the secure boot/UEFI boot option. -10. Save your settings and then exit UEFI. This exit action will restart your PC. -11. After Windows is done booting up, confirm that you no longer see the message. - - > [!NOTE] - > We recommend following these steps again to re-enable the **Secure boot configuration**, **Secure boot**, or **UEFI Boot** option, which you disabled in step 9, and then subsequently re-enable BitLocker (if you previously had this enabled). - -### Use installation media to reinstall Windows 10 - -> [!WARNING] -> This will remove all your personal files, apps, and installed drivers. apps and customizations from your PC manufacturer, and changes you made to **Settings**. - -To use an installation media to reinstall Windows 10, follow these steps. - -1. On a working PC, go to the [Microsoft software download website](https://www.microsoft.com/software-download/windows10). -2. Download the Media Creation Tool and then run it. -3. Select **Create installation media for another PC**. -4. Choose a language, edition, and architecture (64-bit or 32-bit). -5. Follow the steps to create an installation media and then select **Finish**. -6. Connect the installation media that you created to your non-functional PC, and then turn it on. -7. On the initial setup screen, enter your language and other preferences, and then select **Next**. - - If you're not seeing the setup screen, your PC might not be set up to boot from a drive. Check your PC manufacturer's website for information on how to change your PC's boot order, and then try again. - -8. Select **Install now**. -9. On the **Enter the product key to active Windows** page, enter a product key if you've one. If you upgraded to Windows 10 for free, or bought and activated Windows 10 from the Microsoft Store, select **Skip** and Windows will automatically activate later. For more information, see [Activate Windows](https://support.microsoft.com/windows/activate-windows-c39005d4-95ee-b91e-b399-2820fda32227). -10. On the **License terms** page, select **I accept the license terms** if you agree, and then select **Next**. -11. On the **Which type of installation do you want?** page, select **Custom**. -12. On the **where do you want to install Windows?** page, select a partition, select a formatting option (if necessary), and then follow the instructions. -13. When you're done formatting, select **Next**. -14. Follow the rest of the setup instructions to finish installing Windows 10. - -## Download Windows 10 in S mode - -Ready to test Windows 10 in S mode on your existing Windows 10 Pro or Windows 10 Pro Education device? Make sure you read the [important pre-installation information](#important-information) and all the above information. - -When you're ready, you can download the Windows 10 in S mode installer by clicking the **Download installer** button below: - -> [!div class="nextstepaction" style="center"] -> [Download installer](https://go.microsoft.com/fwlink/?linkid=853240) - -After you install Windows 10 in S mode, the OS defaults to the English version. To change the UI and show the localized UI, go to **Settings > Time & language > Region & language >** in **Languages**, select **Add a language** to add a new language or select an existing language, and set it as the default. - -## Terms and Conditions - -Because you're installing Windows 10 in S mode on a running version of Windows 10, you've already accepted the Windows 10 Terms and Conditions. you'ren't required to accept it again and the Windows 10 installer doesn't show a Terms and Conditions page during installation. - -## Support - -Thank you for testing Windows 10 in S mode. Your best experience will be running on a supported device as mentioned above. However, we invite you to try Windows 10 in S mode on existing devices with an eligible operating system. If you're having difficulty installing or running Windows 10 in S mode, use the Windows **Feedback Hub** to report your experience to Microsoft. This feedback is the best way to help improve Windows 10 in S mode with your feedback. - -Common support questions for the Windows 10 in S mode test program: - -### How do I activate if I don't have a Windows 10 in S mode product key? - -As stated above, devices running Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, or Windows 10 Enterprise can install and run Windows 10 in S mode and it will automatically activate. Testing Windows 10 in S mode on a device running Windows 10 Home isn't recommended and supported at this time. - -### Will my OEM help me run Windows 10 in S mode? - -OEMs typically only support their devices with the operating system that was pre-installed. See [Supported devices](#supported-devices) for OEM devices that are best suited for testing Windows 10 in S mode. When testing Windows 10 in S mode, be ready to restore your own PC back to factory settings without assistance. Steps to return to your previous installation of Windows 10 are covered above. - -### What happens when I run Reset or Fresh Start on Windows 10 in S mode? - -**Reset** or **Fresh Start** will operate correctly and keep you on Windows 10 in S mode. They also remove the 10-day go back ability. See [Switch to previously installed Windows 10 editions](#switch-to-previously-installed-windows-10-editions) to return to your previous installation of Windows 10 if you wish to discontinue using Windows 10 in S mode. - -### What if I want to move from Windows 10 in S mode to Windows 10 Pro? - -If you want to discontinue using Windows 10 in S mode, follow the instructions to return to your previous installation of Windows 10. If you already had Windows 10 Pro or Windows 10 Pro Education on the device you're testing on, you should be able to move to Windows 10 Pro or Windows 10 Pro Education at no charge with the instructions in this document. Otherwise, there may be a cost to acquire a Windows 10 Pro license in the Store. - -For help with activation issues, select the appropriate link below for support options. - -- For Volume Licensing Agreement or Shape the Future program customers, go to the [Microsoft Commercial Support](https://support.microsoft.com/gp/commercialsupport) website and select the country/region in which you're seeking commercial support to contact our commercial support team. -- If you don't have a Volume Licensing Agreement, go to the [Microsoft Support](https://support.microsoft.com/contactus/) website and choose a support option. - -

-1 Internet access fees may apply.
-2 Devices must be configured for educational use by applying SetEduPolicies using the Setup School PCs app.
- -

diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 298d67d708..c5e12804f1 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -4,7 +4,7 @@ description: Learn more about the Defender Area in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 02/10/2023 +ms.date: 03/08/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -700,9 +700,9 @@ Allows or disallows Windows Defender Realtime Monitoring functionality. This policy setting allows you to configure scanning for network files. It is recommended that you do not enable this setting. -- If you enable this setting, network files will be scanned. +- If you enable this setting or do not configure this setting, network files will be scanned. -- If you disable or do not configure this setting, network files will not be scanned. +- If you disable this setting, network files will not be scanned. @@ -955,7 +955,7 @@ After enabling this setting, you can set each rule to the following in the Optio - Not Configured: the rule is enabled with default values - Warn: the rule will be applied and the end-user will have the option to bypass the block -Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules will the value of not configured. +Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules with the value of not configured. Enabled: Specify the state for each ASR rule under the Options section for this setting. @@ -2194,7 +2194,7 @@ This policy setting allows you to specify the scan type to use during a schedule - If you enable this setting, the scan type will be set to the specified value. -- If you disable or do not configure this setting, the default scan type will used. +- If you disable or do not configure this setting, the default scan type will be used. @@ -2692,7 +2692,7 @@ This policy setting allows you to specify an interval at which to check for secu -This policy setting configures behaviour of samples submission when opt-in for MAPS telemetry is set. +This policy setting configures behavior of samples submission when opt-in for MAPS telemetry is set. Possible options are: (0x0) Always prompt diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md index 44eecc6ae9..4669b6c300 100644 --- a/windows/client-management/mdm/policy-csp-networklistmanager.md +++ b/windows/client-management/mdm/policy-csp-networklistmanager.md @@ -37,23 +37,24 @@ ms.topic: reference -List of URLs (seperated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated. +List of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated. - -When entering a list of TLS endpoints in Microsoft Intune, use the following format, even in the UI: - -`` - +- When entering a list of TLS endpoints in Microsoft Intune using a configuration profile with a custom template and the OMA URI, use the following format: `` - The HTTPS endpoint must not have any more authentication checks, such as sign-in or multi-factor authentication. - - The HTTPS endpoint must be an internal address not accessible from outside the organizational network. - - The client must trust the server certificate. So the CA certificate that the HTTPS server certificate chains to must be present in the client machine's root certificate store. - - A certificate shouldn't be a public certificate. + +To test the URL, use a PowerShell command similar to below: + +```powershell +Invoke-WebRequest -Uri https://nls.corp.contoso.com -Method get -UseBasicParsing -MaximumRedirection 0 +``` + +`StatusCode` return by the command must be 200 (`HTTP_STATUS_OK`). diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index e9921d6795..6aac2cbd12 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -3252,6 +3252,17 @@ Enabling this policy for EDU devices that remain on Carts overnight will skip po +Enabling this policy will restrict updates to download and install outside of Active Hours. Updates will be allowed to start even if there is a signed-in user or the device is on battery power, providing there is more than 70% battery capacity. Windows will schedule the device to wake from sleep 1 hour after the [ActiveHoursEnd](#activehoursend) time with a 60-minute random delay. Devices will reboot immediately after the updates are installed. If there are still pending updates, the device will continue to retry every hour for 4 hours. + +The following rules are followed regarding battery power: +- Above 70% - allowed to start work; +- Above 40% - allowed to reboot; +- Above 20% - allowed to continue work. + +This setting overrides the install deferral behaviour of [AllowAutoUpdate](#allowautoupdate). + +These settings are designed for education devices that remain in carts overnight that are left in sleep mode. It is not designed for 1:1 devices. + diff --git a/windows/deployment/windows-autopatch/TOC.yml b/windows/deployment/windows-autopatch/TOC.yml index fa4844aef5..cadaa5a926 100644 --- a/windows/deployment/windows-autopatch/TOC.yml +++ b/windows/deployment/windows-autopatch/TOC.yml @@ -47,6 +47,8 @@ - name: Windows updates href: items: + - name: Customize Windows Update settings + href: operate/windows-autopatch-windows-update.md - name: Windows quality updates href: operate/windows-autopatch-windows-quality-update-overview.md items: diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md index d0242dd5a2..ce6d60f33d 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-feature-update-overview.md @@ -109,7 +109,7 @@ If you've paused an update, the specified release will have the **Customer Pause Windows Autopatch doesn’t support the rollback of Windows feature updates. > [!CAUTION] -> It's only recommended to use Windows Autopatch's end-user experience to pause and resume [Windows quality](../operate/windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). +> It's recommended to only use Windows Autopatch's Release management blade to pause and resume [Windows quality](../operate/windows-autopatch-windows-quality-update-overview.md#pausing-and-resuming-a-release) and [Windows feature updates](#pausing-and-resuming-a-release). If you need assistance with pausing and resuming updates, please [submit a support request](../operate/windows-autopatch-support-request.md). ## Contact support diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md new file mode 100644 index 0000000000..508c99fa46 --- /dev/null +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-windows-update.md @@ -0,0 +1,113 @@ +--- +title: Customize Windows Update settings +description: This article explains how to customize Windows Updates in Windows Autopatch +ms.date: 03/08/2023 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +ms.reviewer: rekhanr +--- + +# Customize Windows Update settings (public preview) + +> [!IMPORTANT] +> This feature is in **public preview**. The feature is being actively developed, and may not be complete. You can test and use these features in production environments and provide feedback. + +You can customize the Windows Update deployment schedule for each deployment ring per your business and organizational needs. We recommend that you use the Windows Autopatch service default. However, you may have devices that need different schedules for updates deployment. + +When the deployment cadence is customized, Windows Autopatch will override our service defaults with your preferred deployment cadence. Depending on the selected options, devices with [customized schedules](#scheduled-install) may not count towards the Windows Autopatch [Windows quality update service level objective](../operate/windows-autopatch-windows-quality-update-overview.md#service-level-objective). + +## Deployment cadence + +### Cadence types + +For each tenant, at the deployment ring level, there are two cadence types to configure and manage your Windows Update deployments for all the devices in those deployment rings: + +- [Deadline-driven](#deadline-driven) +- [Scheduled install](#scheduled-install) + +#### Deadline-driven + +With the deadline-drive cadence type, you can control and customize the deferral, deadline, and grace period to meet your specific business needs and organizational requirements. + +There are certain limits that Windows Autopatch defines and you'll only be able to make changes with those boundaries. The following boundaries are implemented so that Windows Autopatch can maintain update compliance. + +| Boundary | Description | +| ----- | ----- | +| Deferrals and deadlines | Windows Autopatch will enforce that deadline plus deferral days for a deployment ring to be less than or equal to 14 days. | +| Grace period | The permitted customization range is zero to seven days. | + +> [!NOTE] +> The configured grace period will apply to both Windows quality updates and Windows feature updates. + +Each deployment ring can be scheduled independent of the others, and there are no dependencies that the previous deployment ring must be scheduled before the next ring. Further, if the cadence type is set as **Deadline-driven**, the automatic update behavior setting, **Reset to default** in the Windows Update for Business policy, will be applied. + +It's possible for you to change the cadence from the Windows Autopatch Release management blade while update deployments are in progress. Windows Autopatch will abide by the principle to always respect your preferences over service-defined values. + +However, if an update has already started for a particular deployment ring, Windows Autopatch won't be able to change the cadence for that ring during that ongoing update cycle. The changes will only be effective in the next update cycle. + +#### Scheduled install + +> [!NOTE] +> If you select the Schedule install cadence type, the devices in that ring won’t be counted towards the [Windows quality update service level objective](../operate/windows-autopatch-windows-quality-update-overview.md#service-level-objective). + +While the Windows Autopatch default options will meet the majority of the needs for regular users with corporate devices, we understand there are devices that run critical activities and can only receive Windows Updates at specific times. The **Scheduled install** cadence type will prevent forced restarts and interruptions to critical business activities for end users, thereby minimizing disruptions. Upon selecting the **Scheduled install** cadence type, any previously set deadlines and grace periods will be removed. The expectation is that devices would only update and restart according to the time specified. + +> [!NOTE] +> The compliance deadline and grace period for Windows quality updates won't be configured for the Scheduled Install cadence type. + +Devices **must** be active and available at the time when the device is scheduled for installation to ensure the optimal experience. If the device is consistently unavailable during the scheduled install time, the device can remain unprotected and unsecured, or the device may have the Windows Update scan and install during active hours. + +##### Scheduled install types + +> [!NOTE] +> For devices with **Active hours** configured, if the device is consistently unavailable, Windows will attempt to keep the devices up to date, including installation of updates during Active hours.

For Windows 10 devices, Windows Update can start 30 minutes prior to the specified install time. If the installation start time is specified at 2:00 AM, some of the devices may start the installation 30 mins prior.

+ +The Scheduled install cadence has two options: + +| Option | Description | +| ----- | ----- | +| Active hours | The period (daily) that the user normally does their work, or the device is busy performing business critical actions.

The time outside of active hours is when the device is available for Windows to perform an update and restart the device (daily). The max range for Active hours is 18 hours. The six-hour period outside of the active hours is the deployment period, when Windows Update for Business will scan, install and restart the device.

+| Schedule install and restart | Use this option to prevent the service from installing Windows Updates except during the specified start time. You can specify the following occurrence options:
  • Weekly
  • Bi-weekly
  • Monthly

Select a time when the device has low activity for the updates to complete. Ensure that the Windows Update has three to four hours to complete the installation and restart the device.

| + +> [!NOTE] +> Changes made in one deployment ring won't impact other rings in your tenant.

Configured **Active hours** and **Scheduled install and restart** options will apply to both Windows quality updates and Windows feature updates.

+ +### User notifications + +In addition to the cadence type, you can also manage the end user notification settings. End users will receive all update notifications by default. For critical devices or devices where notifications need to be hidden, use the **Manage notifications** option to configure notifications. For each tenant, at the deployment ring level, there are four options for you to configure end user update notification settings: + +- Not configured +- Use the default Windows Update notifications +- Turn off all notifications excluding restart warnings +- Turn off all notifications including restart warnings + +For more information, see [Windows Update settings you can manage with Intune update ring policies for Windows 10/11 devices](/mem/intune/protect/windows-update-settings). + +## Customize the Windows Update deployment cadence + +**To customize the Windows Update deployment cadence:** + +1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +2. Navigate to **Devices** > **Windows Autopatch** > **Release management** > **Release settings** select **Customize Windows Update cadence (preview)**. The page lists the existing settings for each of the rings in the tenant. +3. Select the **horizontal ellipses (…)** across each ring to manage the deployment cadence or notification settings. +4. Select [**Manage deployment cadence**](#cadence-types) to customize Windows Update settings. + 1. Select one of the cadence types for the ring: + 1. Select **Deadline-driven** to configure the deferral, deadline, and grace periods. This option will enforce forced restarts based on the selected deadline and grace period. In the event you want to switch back to the service recommended defaults, for each of the settings, select the option tagged as "default". + 1. Select **Scheduled install** to opt-out of deadline-based forced restart. + 1. Select either **Active hours** or **Schedule install and restart time**. + 2. Select **Save**. +5. Select **Manage notifications**. A fly-in pane opens. + 1. Select one of following [Windows Update restart notifications](#user-notifications) for your devices that are part of the selected deployment ring. By default, Windows Autopatch recommends that you enable all notifications. + 1. Not configured + 1. Use the default Windows Update notifications + 1. Turn off all notifications excluding restart warnings + 1. Turn off all notifications included restart warnings + 1. Select **Save** once you select the preferred setting. +6. Repeat the same process to customize each of the rings. Once done, select **Next**. +7. In **Review + apply**, you’ll be able to review the selected settings for each of the rings. +8. Select **Apply** to apply the changes to the ring policy. Once the settings are applied, the saved changes can be verified in the **Release schedule** tab. The Windows quality update schedule on the **Release schedule** tab will be updated as per the customized settings. diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md index 99cec5d626..9092acc2af 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md @@ -1,7 +1,7 @@ --- title: Roles and responsibilities description: This article describes the roles and responsibilities provided by Windows Autopatch and what the customer must do -ms.date: 02/28/2023 +ms.date: 03/08/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual @@ -41,9 +41,10 @@ This article outlines your responsibilities and Windows Autopatch's responsibili | [Add and verify admin contacts](../deploy/windows-autopatch-admin-contacts.md) in Microsoft Intune | :heavy_check_mark: | :x: | | [Deploy and configure Windows Autopatch service configuration](../references/windows-autopatch-changes-to-tenant.md) | :x: | :heavy_check_mark: | | Educate users on the Windows Autopatch end user update experience
  • [Windows quality update end user experience](../operate/windows-autopatch-windows-quality-update-end-user-exp.md)
  • [Windows feature update end user experience](../operate/windows-autopatch-windows-feature-update-end-user-exp.md)
  • [Microsoft 365 Apps for enterprise end user experience](../operate/windows-autopatch-microsoft-365-apps-enterprise.md#end-user-experience)
  • [Microsoft Teams end user experience](../operate/windows-autopatch-teams.md#end-user-experience)
| :heavy_check_mark: | :x: | -| Remove your devices from existing unsupported [Windows update](../references/windows-autopatch-windows-update-unsupported-policies.md) and [Microsoft 365](../references/windows-autopatch-microsoft-365-policies.md) policies | :heavy_check_mark: | :x: | +| Remove your devices from existing unsupported [Windows update](../references/windows-autopatch-windows-update-unsupported-policies.md) and [Microsoft 365](../references/windows-autopatch-microsoft-365-policies.md) policies | :heavy_check_mark: | :x: | | [Turn on or off expedited Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md#expedited-releases) | :heavy_check_mark: | :x: | | [Allow or block Microsoft 365 Apps for enterprise updates](../operate/windows-autopatch-microsoft-365-apps-enterprise.md#allow-or-block-microsoft-365-app-updates) | :heavy_check_mark: | :x: | +| [Customize Windows Update settings](../operate/windows-autopatch-windows-update.md) | :heavy_check_mark: | :x: | | [Register devices/add devices to the Windows Autopatch Device Registration group](../deploy/windows-autopatch-register-devices.md#steps-to-register-devices) | :heavy_check_mark: | :x: | | [Run the pre-registration device readiness checks](../deploy/windows-autopatch-register-devices.md#about-the-ready-not-ready-and-not-registered-tabs) | :x: | :heavy_check_mark: | | [Automatically assign devices to First, Fast & Broad deployment rings at device registration](../operate/windows-autopatch-update-management.md#deployment-ring-calculation-logic) | :x: | :heavy_check_mark: | @@ -65,7 +66,8 @@ This article outlines your responsibilities and Windows Autopatch's responsibili | [Maintain the Test deployment ring membership](../operate/windows-autopatch-update-management.md#deployment-ring-calculation-logic) | :heavy_check_mark: | :x: | | Monitor [Windows update signals](../operate/windows-autopatch-windows-quality-update-signals.md) for safe update release | :x: | :heavy_check_mark: | | Test specific [business update scenarios](../operate/windows-autopatch-windows-quality-update-signals.md) | :heavy_check_mark: | :x: | -| [Define and implement release schedule](../operate/windows-autopatch-windows-quality-update-overview.md) | :x: | :heavy_check_mark: | +| [Customize Windows Update settings](../operate/windows-autopatch-windows-update.md) | :heavy_check_mark: | :x: | +| [Define and implement service default release schedule](../operate/windows-autopatch-windows-quality-update-overview.md) | :x: | :heavy_check_mark: | | Communicate the update [release schedule](../operate/windows-autopatch-windows-quality-update-communications.md) | :x: | :heavy_check_mark: | | Release updates (as scheduled)
  • [Windows quality updates](../operate/windows-autopatch-windows-quality-update-overview.md#windows-quality-update-releases)
  • [Microsoft 365 Apps for enterprise](../operate/windows-autopatch-microsoft-365-apps-enterprise.md#update-release-schedule)
  • [Microsoft Edge](../operate/windows-autopatch-edge.md#update-release-schedule)
  • [Microsoft Teams](../operate/windows-autopatch-teams.md#update-release-schedule)
      • | :x: | :heavy_check_mark: | | [Release updates (expedited)](../operate/windows-autopatch-windows-quality-update-overview.md#expedited-releases) | :x: | :heavy_check_mark: | diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index 6cea21afbf..ee5217f848 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -1,7 +1,7 @@ --- title: What's new 2023 description: This article lists the 2023 feature releases and any corresponding Message center post numbers. -ms.date: 03/03/2023 +ms.date: 03/08/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: whats-new @@ -18,6 +18,20 @@ This article lists new and updated feature releases, and service releases, with Minor corrections such as typos, style, or formatting issues aren't listed. +## March 2023 + +### March feature releases or updates + +| Article | Description | +| ----- | ----- | +| [Customize Windows Update settings](../operate/windows-autopatch-windows-update.md) | New [Customize Windows Update settings](../operate/windows-autopatch-windows-update.md) feature. This feature is in public preview. | + +### March service release + +| Message center post number | Description | +| ----- | ----- | +| [MC524715](https://admin.microsoft.com/adminportal/home#/MessageCenter) | Public preview - Customize Windows Update settings | + ## February 2023 ### February feature releases or updates diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md index aab983edfc..e081fcb3f0 100644 --- a/windows/security/threat-protection/auditing/event-4624.md +++ b/windows/security/threat-protection/auditing/event-4624.md @@ -121,10 +121,12 @@ This event generates when a logon session is created (on destination machine). I **Subject:** -- **Security ID** [Type = SID]**:** SID of account that reported information about successful logon or invokes it. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. +- **Security ID** [Type = SID]**:** SID of account that reported information about successful logon or invokes it. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID can't be resolved, you will see the source data in the event. + + This field may also contain no subject user information, but the NULL Sid "S-1-0-0" and no user or domain information. > [!NOTE] - > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). + > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it can't ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). - **Account Name** [Type = UnicodeString]**:** the name of the account that reported information about successful logon. @@ -316,6 +318,6 @@ For 4624(S): An account was successfully logged on. - If the **Authentication Package** is NTLM. In this case, monitor for **Key Length** not equal to 128, because all Windows operating systems starting with Windows 2000 support 128-bit Key Length. -- If you monitor for potentially malicious software, or software that is not authorized to request logon actions, monitor this event for **Process Name**. +- If you monitor for potentially malicious software, or software that isn't authorized to request logon actions, monitor this event for **Process Name**. -- If you have a trusted logon processes list, monitor for a **Logon Process** that is not from the list. +- If you have a trusted logon processes list, monitor for a **Logon Process** that isn't from the list. diff --git a/windows/security/threat-protection/auditing/event-4625.md b/windows/security/threat-protection/auditing/event-4625.md index 425447b217..45f8a019b0 100644 --- a/windows/security/threat-protection/auditing/event-4625.md +++ b/windows/security/threat-protection/auditing/event-4625.md @@ -157,40 +157,12 @@ This event generates on domain controllers, member servers, and workstations. - **Failure Reason** \[Type = UnicodeString\]**:** textual explanation of **Status** field value. For this event, it typically has "**Account locked out**" value. -- **Status** \[Type = HexInt32\]**:** the reason why logon failed. For this event, it typically has "**0xC0000234**" value. The most common status codes are listed in Table 12. Windows logon status codes. +- **Status** \[Type = HexInt32\]**:** the reason why logon failed. For this event, it typically has "**0xC0000234**" value. - **Table 12: Windows logon status codes.** - - | Status\\Sub-Status Code | Description | - |-------------------------|------------------------------------------------------------------------------------------------------| - | 0XC000005E | There are currently no logon servers available to service the logon request. | - | 0xC0000064 | User logon with misspelled or bad user account | - | 0xC000006A | User logon with misspelled or bad password | - | 0XC000006D | The cause is either a bad username or authentication information | - | 0XC000006E | Indicates a referenced user name and authentication information are valid, but some user account restriction has prevented successful authentication (such as time-of-day restrictions). | - | 0xC000006F | User logon outside authorized hours | - | 0xC0000070 | User logon from unauthorized workstation | - | 0xC0000071 | User logon with expired password | - | 0xC0000072 | User logon to account disabled by administrator | - | 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. | - | 0XC0000133 | Clocks between DC and other computer too far out of sync | - | 0XC000015B | The user has not been granted the requested logon type (also called the *logon right*) at this machine | - | 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. | - | 0XC0000192 | An attempt was made to logon, but the **Netlogon** service was not started. | - | 0xC0000193 | User logon with expired account | - | 0XC0000224 | User is required to change password at next logon | - | 0XC0000225 | Evidently a bug in Windows and not a risk | - | 0xC0000234 | User logon with account locked | - | 0XC00002EE | Failure Reason: An Error occurred during Logon | - | 0XC0000413 | Logon Failure: The machine you are logging on to is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. | - | 0x0 | Status OK. | +- **Sub Status** \[Type = HexInt32\]**:** additional information about logon failure. > [!NOTE] -> To see the meaning of other status or substatus codes, you might also check for status code in the Windows header file ntstatus.h in Windows SDK. - -More information: - -- **Sub Status** \[Type = HexInt32\]**:** additional information about logon failure. The most common substatus codes listed in the "Table 12. Windows logon status codes.". +> For more information about various Status or Sub Status codes, see [NTSTATUS Values](/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55). **Process Information:** diff --git a/windows/security/threat-protection/auditing/event-4716.md b/windows/security/threat-protection/auditing/event-4716.md index 64f3140ad0..3d1ec5f975 100644 --- a/windows/security/threat-protection/auditing/event-4716.md +++ b/windows/security/threat-protection/auditing/event-4716.md @@ -175,7 +175,32 @@ Subject: Logon ID: 0x3E6 ``` -After the event, one more event ID is generated: +After event 4716, you may see either event 4724 or event 4742 or both: + +``` +Log Name: Security +Source: Microsoft-Windows-Security-Auditing +Date: