mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-19 12:23:37 +00:00
Merge remote-tracking branch 'refs/remotes/origin/master' into atp-feedback
This commit is contained in:
Joey Caparas
@ -1,5 +1,6 @@
|
||||
# [Surface](index.md)
|
||||
## [Deploy Surface devices](deploy.md)
|
||||
### [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md)
|
||||
### [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md)
|
||||
### [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md)
|
||||
### [Customize the OOBE for Surface deployments](customize-the-oobe-for-surface-deployments.md)
|
||||
@ -21,5 +22,6 @@
|
||||
### [Unenroll Surface devices from SEMM](unenroll-surface-devices-from-semm.md)
|
||||
## [Surface Diagnostic Toolkit](surface-diagnostic-toolkit.md)
|
||||
## [Surface Data Eraser](microsoft-surface-data-eraser.md)
|
||||
## [Change history for Surface documentation](change-history-for-surface.md)
|
||||
|
||||
|
||||
|
||||
@ -28,7 +28,8 @@ To update the UEFI on Surface Pro 3, you can download and install the Surface UE
|
||||
## Manually configure additional security settings
|
||||
|
||||
|
||||
>**Note:** To enter firmware setup on a Surface device, begin with the device powered off, press and hold the **Volume Up** button, then press and release the **Power** button, then release the **Volume Up** button after the device has begun to boot.
|
||||
>[!NOTE]
|
||||
>To enter firmware setup on a Surface device, begin with the device powered off, press and hold the **Volume Up** button, then press and release the **Power** button, then release the **Volume Up** button after the device has begun to boot.
|
||||
|
||||
After the v3.11.760.0 UEFI update is installed on a Surface device, an additional UEFI menu named **Advanced Device Security** becomes available. If you click this menu, the following options are displayed:
|
||||
|
||||
|
||||
23
devices/surface/change-history-for-surface.md
Normal file
23
devices/surface/change-history-for-surface.md
Normal file
@ -0,0 +1,23 @@
|
||||
---
|
||||
title: Change history for Surface documentation (Windows 10)
|
||||
description: This topic lists new and updated topics in the Surface documentation library.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: jdeckerMS
|
||||
---
|
||||
|
||||
# Change history for Surface documentation
|
||||
|
||||
This topic lists new and updated topics in the Surface documentation library.
|
||||
|
||||
## October 2016
|
||||
|
||||
| New or changed topic | Description |
|
||||
| --- | --- |
|
||||
| [Long-term servicing branch for Surface devices](ltsb-for-surface.md) | New |
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -16,6 +16,7 @@ Get deployment guidance for your Surface devices including information about MDT
|
||||
|
||||
| Topic | Description |
|
||||
| --- | --- |
|
||||
| [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md) | Explains that LTSB is not supported for general-purpose Surface devices and should be used for specialized devices only. |
|
||||
| [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) | Walk through the recommended process of how to deploy Windows 10 to your Surface devices with the Microsoft Deployment Toolkit.|
|
||||
| [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md)| Find out how to perform a Windows 10 upgrade deployment to your Surface devices. |
|
||||
| [Customize the OOBE for Surface deployments](customize-the-oobe-for-surface-deployments.md)| Walk through the process of customizing the Surface out-of-box experience for end users in your organization.|
|
||||
|
||||
@ -13,7 +13,7 @@ author: heatherpoulsen
|
||||
# Surface
|
||||
|
||||
|
||||
This library provides guidance to help you deploy Windows on Surface devices, keep those devices up to date, and easily manage and support Surface devices in your organization.
|
||||
This library provides guidance to help you deploy Windows on Microsoft Surface devices, keep those devices up to date, and easily manage and support Surface devices in your organization.
|
||||
|
||||
For more information on planning for, deploying, and managing Surface devices in your organization, see the [Surface TechCenter](https://technet.microsoft.com/en-us/windows/surface).
|
||||
|
||||
@ -29,6 +29,7 @@ For more information on planning for, deploying, and managing Surface devices in
|
||||
| [Surface Enterprise Management Mode](surface-enterprise-management-mode.md) | See how this feature of Surface devices with Surface UEFI allows you to secure and manage firmware settings within your organization. |
|
||||
| [Surface Diagnostic Toolkit](surface-diagnostic-toolkit.md) | Find out how you can use the Microsoft Surface Diagnostic Toolkit to test the hardware of your Surface device. |
|
||||
| [Surface Data Eraser](microsoft-surface-data-eraser.md) | Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices. |
|
||||
| [Change history for Surface documentation](change-history-for-surface.md) | This topic lists new and updated topics in the Surface documentation library. |
|
||||
|
||||
|
||||
|
||||
|
||||
44
devices/surface/ltsb-for-surface.md
Normal file
44
devices/surface/ltsb-for-surface.md
Normal file
@ -0,0 +1,44 @@
|
||||
---
|
||||
title: Long-Term Servicing Branch for Surface devices (Surface)
|
||||
description: LTSB is not supported for general-purpose Surface devices and should be used for specialized devices only.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.pagetype: surface, devices
|
||||
ms.sitesec: library
|
||||
author: jdeckerMS
|
||||
---
|
||||
|
||||
# Long-Term Servicing Branch (LTSB) for Surface devices
|
||||
|
||||
|
||||
General-purpose Surface devices running Long-Term Servicing Branch (LTSB) are not supported. As a general guideline, if a Surface device runs productivity software, such as Microsoft Office, it is a general-purpose device that does not qualify for LTSB and should instead run Current Branch (CB) or Current Branch for Business (CBB).
|
||||
|
||||
>[!NOTE]
|
||||
>For more information about the servicing branches, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview).
|
||||
|
||||
LTSB prevents Surface devices from receiving critical Windows 10 feature updates and certain non-security servicing updates. Customers with poor experiences using Surface devices in the LTSB configuration will be instructed to upgrade to CB or CBB. Furthermore, the Windows 10 Enterprise LTSB edition removes core features of Surface devices, including seamless inking and touch-friendly applications. It does not contain key in-box applications including Microsoft Edge, OneNote, Calendar or Camera. Therefore, productivity is impacted and functionality is limited. LTSB is not supported as a suitable servicing solution for general-purpose Surface devices.
|
||||
|
||||
General-purpose Surface devices are intended to run CB or CBB to receive full servicing and firmware updates and forward compatibility with the introduction of new Surface features. With CB, feature updates are available as soon as Microsoft releases them. Customers in the CBB servicing model receive the same build of Windows 10 as those in CB, at a later date.
|
||||
|
||||
Surface devices in specialized scenarios–such as PCs that control medical equipment, point-of-sale systems, and ATMs–may consider the use of LTSB. These special-purpose systems typically perform a single task and do not require feature updates as frequently as other devices in the organization.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Surface TechCenter](https://technet.microsoft.com/windows/surface)
|
||||
|
||||
- [Surface for IT pros blog](http://blogs.technet.com/b/surface/)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -6,7 +6,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: edu
|
||||
author: jdeckerMS
|
||||
author: CelesteDG
|
||||
---
|
||||
|
||||
# Windows 10 for Education
|
||||
|
||||
@ -16,10 +16,12 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md
|
||||
|
||||
| New or changed topic | Description |
|
||||
| --- | --- |
|
||||
|[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) and [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Updated the text about the icon overlay option. This icon now only appears on corporate files in the Save As and File Explore views. |
|
||||
|[List of enlightened Microsoft apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) |Added Microsoft Remote Desktop information. |
|
||||
|[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) and [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Updated the text about the icon overlay option. This icon now only appears on corporate files in the Save As and File Explore views |
|
||||
|[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |Added content about using ActiveX controls.|
|
||||
|[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |New |
|
||||
|[VPN technical guide](vpn-guide.md) | Multiple new topics, replacing previous **VPN profile options** topic |
|
||||
| [Windows security baselines](windows-security-baselines.md) | Added Windows 10, version 1607 and Windows Server 2016 baseline |
|
||||
|
||||
## September 2016
|
||||
|
||||
|
||||
@ -457,11 +457,11 @@ After you've decided where your protected apps can access enterprise data on you
|
||||
|
||||
- **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps.
|
||||
|
||||
- **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explore views. The options are:
|
||||
- **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explorer views. The options are:
|
||||
|
||||
- **Yes (recommended).** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explore views.
|
||||
- **Yes.** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu.
|
||||
|
||||
- **No, or not configured.** Stops the Windows Information Protection icon overlay from appearing on corporate files in the Save As and File Explore views.
|
||||
- **No, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but allowed apps. Not configured is the default option.
|
||||
|
||||
2. Click **Save Policy**.
|
||||
|
||||
|
||||
@ -401,13 +401,8 @@ There are no default locations included with WIP, you must add each of your netw
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Proxy Servers</td>
|
||||
<<<<<<< HEAD
|
||||
<td>proxy.contoso.com:80;proxy2.contoso.com:137</td>
|
||||
<td>Specify your externally-facing proxy server addresses, along with the port through which traffic accesses the Internet.<p>This list must not include any servers listed in the Enterprise Internal Proxy Servers list, because they’re used for WIP-protected traffic.<p>TThis setting is also required if there’s a chance you could end up behind a proxy server on another network. In this situation, if you don't have a proxy server pre-defined, you might find that enterprise resources are unavailable to your client device, such as when you’re visiting another company and not on the guest network. To make sure this doesn’t happen, the client device also needs to be able to reach the pre-defined proxy server through the VPN network.<p>If you have multiple resources, you must separate them using the ";" delimiter.</td>
|
||||
=======
|
||||
<td>proxy.contoso.com:80;proxy2.contoso.com:443</td>
|
||||
<td>Specify your externally-facing proxy server addresses, along with the port through which traffic is allowed and protected with WIP.<p>This list shouldn’t include any servers listed in the Enterprise Internal Proxy Servers list, which are used for WIP-protected traffic.<p>This setting is also required if you use a proxy in your network. If you don't have a proxy server, you might find that enterprise resources are unavailable when a client is behind a proxy, such as when you’re visiting another company and not on that company’s guest network.<p>If you have multiple resources, you must separate them using the ";" delimiter.</td>
|
||||
>>>>>>> refs/remotes/origin/master
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Internal Proxy Servers</td>
|
||||
@ -435,15 +430,15 @@ There are no default locations included with WIP, you must add each of your netw
|
||||
|
||||
The **Add or edit corporate network definition** box closes.
|
||||
|
||||
4. Decide if you want to Windows to look for additional network settings.
|
||||
4. Decide if you want to Windows to look for additional network settings and if you want to show the WIP icon on your corporate files while in File Explorer.
|
||||
|
||||
|
||||
|
||||
- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network.
|
||||
- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. Not configured is the default option.
|
||||
|
||||
- **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network.
|
||||
- **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. Not configured is the default option.
|
||||
|
||||
- **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate file icons in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explore views.
|
||||
- **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. Not configured is the default option.
|
||||
|
||||
5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy.
|
||||
|
||||
|
||||
@ -22,63 +22,41 @@ Hardware-based security features, also called virtualization-based security or V
|
||||
|
||||
3. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see the following section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security).
|
||||
|
||||
4. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see [Enable virtualization-based security (VBS)](#enable-virtualization-based-security-vbs), later in this topic.
|
||||
4. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see [Enable virtualization-based security (VBS)](#enable-virtualization-based-security-vbs-and-device-guard), later in this topic.
|
||||
|
||||
For information about enabling Credential Guard, see [Protect derived domain credentials with Credential Guard](credential-guard.md).
|
||||
|
||||
## Windows feature requirements for virtualization-based security
|
||||
## Windows feature requirements for virtualization-based security and Device Guard
|
||||
|
||||
In addition to the hardware requirements found in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard), you must enable certain operating system features before you can enable VBS:
|
||||
In addition to the hardware requirements found in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard), you must confirm that certain operating system features are enabled before you can enable VBS:
|
||||
|
||||
- With Windows 10, version 1607 or Windows Server 2016:<br>
|
||||
Hyper-V Hypervisor (shown in Figure 1).
|
||||
Hyper-V Hypervisor, which is enabled automatically. No further action is needed.
|
||||
|
||||
- With an earlier version of Windows 10, or Windows Server 2016 Technical Preview 5 or earlier:<br>
|
||||
Hyper-V Hypervisor and Isolated User Mode (not shown).
|
||||
Hyper-V Hypervisor and Isolated User Mode (shown in Figure 1).
|
||||
|
||||
> **Note** You can configure these features manually by using Windows PowerShell or Deployment Image Servicing and Management. For specific information about these methods, see [Protect derived domain credentials with Credential Guard](credential-guard.md).
|
||||
> **Note** You can configure these features by using Group Policy or Deployment Image Servicing and Management, or manually by using Windows PowerShell or the Windows Features dialog box.
|
||||
|
||||
|
||||
|
||||
Figure 1. Enable operating system feature for VBS
|
||||
**Figure 1. Enable operating system features for VBS, Windows 10, version 1511**
|
||||
|
||||
After you enable the feature or features, you can enable VBS for Device Guard, as described in the following sections.
|
||||
|
||||
## Enable Virtualization Based Security (VBS)
|
||||
## Enable Virtualization Based Security (VBS) and Device Guard
|
||||
|
||||
Before you begin this process, verify that the target device meets the hardware and firmware requirements for the features that you want, as described in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). Also, confirm that you have enabled the Windows features discussed in the previous section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security).
|
||||
|
||||
There are multiple ways to configure VBS features for Device Guard. You can use the [readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) rather than the procedures in this topic, or you can use the following procedures, either to configure the appropriate registry keys manually or to use Group Policy.
|
||||
There are multiple ways to configure VBS features for Device Guard:
|
||||
|
||||
> **Important**
|
||||
> - The settings in the following procedure include **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you simply choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.<br>In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can still have code integrity policies enabled.<br>For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats).<br>
|
||||
> - All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable these features on a group of test computers before you enable them on users' computers.
|
||||
|
||||
**To configure VBS manually**
|
||||
|
||||
1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey.
|
||||
|
||||
2. Set the **EnableVirtualizationBasedSecurity DWORD** value to **1**.
|
||||
|
||||
3. Set the **RequirePlatformSecurityFeatures DWORD** value as appropriate:
|
||||
|
||||
| **With Windows 10, version 1607, <br>or Windows Server 2016** | **With an earlier version of Windows 10, <br>or Windows Server 2016 Technical Preview 5 or earlier** |
|
||||
| ---------------- | ---------------- |
|
||||
| **1** enables the **Secure Boot** option<br>**3** enables the **Secure Boot and DMA protection** option | **1** enables the **Secure Boot** option<br>**2** enables the **Secure Boot and DMA protection** option |
|
||||
|
||||
4. With a supported operating system earlier than Windows 10, version 1607, or Windows Server 2016, skip this step, and remain in the same registry subkey.
|
||||
|
||||
With Windows 10, version 1607, or Windows Server 2016, navigate to **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios**.
|
||||
|
||||
5. Set the **HypervisorEnforcedCodeIntegrity DWORD** value to **1**.
|
||||
|
||||
6. Restart the client computer.
|
||||
|
||||
Unfortunately, it would be time consuming to perform these steps manually on every protected computer in your enterprise. Group Policy offers a much simpler way to deploy these features to your organization. This example creates a test organizational unit (OU) called *DG Enabled PCs*. If you want, you can instead link the policy to an existing OU, and then scope the GPO by using appropriately named computer security groups.
|
||||
- You can use the [readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) rather than the procedures in this topic.
|
||||
- You can use Group Policy, as described in the procedure that follows.
|
||||
- You can configure VBS manually, as described in [Use registry keys to enable VBS and Device Guard](#use-registry-keys-to-enable-vbs-and-device-guard), later in this topic.
|
||||
|
||||
> **Note** We recommend that you test-enable these features on a group of test computers before you enable them on users' computers. If untested, there is a possibility that this feature can cause system instability and ultimately cause the client operating system to fail.
|
||||
|
||||
### Use Group Policy to enable VBS
|
||||
### Use Group Policy to enable VBS and Device Guard
|
||||
|
||||
1. To create a new GPO, right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**.
|
||||
|
||||
@ -104,7 +82,12 @@ Unfortunately, it would be time consuming to perform these steps manually on eve
|
||||
|
||||
> **Important** These settings include **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.<br>In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can have code integrity policies enabled.<br>For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats).
|
||||
|
||||
6. For **Virtualization Based Protection of Code Integrity**, select the appropriate option:
|
||||
6. For **Virtualization Based Protection of Code Integrity**, select the appropriate option.
|
||||
|
||||
> [!WARNING]
|
||||
> Virtualization-based protection of code integrity may be incompatible with some devices and applications. We strongly recommend testing this configuration in your lab before enabling virtualization-based protection of code integrity on production systems. Failure to do so may result in unexpected failures up to and including data loss or a blue screen error (also called a stop error).
|
||||
|
||||
Select an option as follows:
|
||||
|
||||
- With Windows 10, version 1607 or Windows Server 2016, choose an appropriate option:<br>For an initial deployment or test deployment, we recommend **Enabled without lock**.<br>When your deployment is stable in your environment, we recommend changing to **Enabled with lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person.
|
||||
|
||||
@ -120,6 +103,116 @@ Unfortunately, it would be time consuming to perform these steps manually on eve
|
||||
|
||||
Processed Device Guard policies are logged in event viewer at **Applications and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational**. When the **Turn On Virtualization Based Security** policy is successfully processed, event ID 7000 is logged, which contains the selected settings within the policy.
|
||||
|
||||
>**Note** Events will be logged in this event channel only when Group Policy is used to enable Device Guard features, not through other methods. If other methods such as registry keys are used, Device Guard features will be enabled but the events won’t be logged in this event channel.
|
||||
|
||||
### Use registry keys to enable VBS and Device Guard
|
||||
|
||||
Set the following registry keys to enable VBS and Device Guard. This provides exactly the same set of configuration options provided by Group Policy.
|
||||
|
||||
> [!WARNING]
|
||||
> Virtualization-based protection of code integrity (controlled through the registry key **HypervisorEnforcedCodeIntegrity**) may be incompatible with some devices and applications. We strongly recommend testing this configuration in your lab before enabling virtualization-based protection of code integrity on production systems. Failure to do so may result in unexpected failures up to and including data loss or a blue screen error (also called a stop error).
|
||||
|
||||
<!--This comment ensures that the Important above and the Warning below don't merge together. -->
|
||||
|
||||
> **Important**
|
||||
> - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you simply choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.<br>In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can still have code integrity policies enabled.<br>For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats).<br>
|
||||
> - All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable these features on a group of test computers before you enable them on users' computers.
|
||||
|
||||
#### For Windows 1607 and above
|
||||
|
||||
Recommended settings (to enable virtualization-based protection of Code Integrity policies, without UEFI Lock):
|
||||
|
||||
``` commands
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
|
||||
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
|
||||
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f
|
||||
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f
|
||||
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f
|
||||
```
|
||||
|
||||
If you want to customize the preceding recommended settings, use the following settings.
|
||||
|
||||
**To enable VBS**
|
||||
|
||||
``` command
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
|
||||
```
|
||||
|
||||
**To enable VBS and require Secure boot only (value 1)**
|
||||
|
||||
``` command
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
|
||||
```
|
||||
|
||||
> To enable **VBS with Secure Boot and DMA (value 2)**, in the preceding command, change **/d 1** to **/d 2**.
|
||||
|
||||
**To enable VBS without UEFI lock (value 0)**
|
||||
|
||||
``` command
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f
|
||||
```
|
||||
|
||||
> To enable **VBS with UEFI lock (value 1)**, in the preceding command, change **/d 0** to **/d 1**.
|
||||
|
||||
**To enable virtualization-based protection of Code Integrity policies**
|
||||
|
||||
``` command
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f
|
||||
```
|
||||
|
||||
**To enable virtualization-based protection of Code Integrity policies without UEFI lock (value 0)**
|
||||
|
||||
``` command
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f
|
||||
```
|
||||
|
||||
> To enable **virtualization-based protection of Code Integrity policies with UEFI lock (value 1)**, in the preceding command, change **/d 0** to **/d 1**.
|
||||
|
||||
#### For Windows 1511 and below
|
||||
|
||||
Recommended settings (to enable virtualization-based protection of Code Integrity policies, without UEFI Lock):
|
||||
|
||||
``` command
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
|
||||
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
|
||||
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f
|
||||
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v " Unlocked" /t REG_DWORD /d 1 /f
|
||||
```
|
||||
|
||||
If you want to customize the preceding recommended settings, use the following settings.
|
||||
|
||||
**To enable VBS (it is always locked to UEFI)**
|
||||
|
||||
``` command
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
|
||||
```
|
||||
|
||||
**To enable VBS and require Secure boot only (value 1)**
|
||||
|
||||
``` command
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
|
||||
```
|
||||
|
||||
> To enable **VBS with Secure Boot and DMA (value 2)**, in the preceding command, change **/d 1** to **/d 2**.
|
||||
|
||||
**To enable virtualization-based protection of Code Integrity policies (with the default, UEFI lock)**
|
||||
|
||||
``` command
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f
|
||||
```
|
||||
|
||||
**To enable virtualization-based protection of Code Integrity policies without UEFI lock**
|
||||
|
||||
``` command
|
||||
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v " Unlocked" /t REG_DWORD /d 1 /f
|
||||
```
|
||||
|
||||
### Validate enabled Device Guard hardware-based security features
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ localizationpriority: high
|
||||
Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list.
|
||||
|
||||
## Enlightened versus unenlightened apps
|
||||
Apps can be enlightened (policy-aware) or unenlightened (policy-unaware).
|
||||
Apps can be enlightened (also referred to as WIP-aware) or unenlightened (also referred to as WIP-unaware).
|
||||
|
||||
- **Enlightened apps** can differentiate between corporate and personal data, correctly determining which to protect, based on your policies.
|
||||
|
||||
@ -56,6 +56,8 @@ Microsoft has made a concerted effort to enlighten several of our more popular a
|
||||
|
||||
- Microsoft Messaging
|
||||
|
||||
- Microsoft Remote Desktop
|
||||
|
||||
## Adding enlightened Microsoft apps to the allowed apps list
|
||||
You can add any or all of the enlightened Microsoft apps to your allowed apps list. Included here is the **Publisher name**, **Product or File name**, and **App Type** info for both Microsoft Intune and System Center Configuration Manager.
|
||||
|
||||
@ -76,3 +78,4 @@ You can add any or all of the enlightened Microsoft apps to your allowed apps li
|
||||
|Microsoft OneDrive |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** onedrive.exe<br>**App Type:** Desktop app|
|
||||
|Notepad |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** notepad.exe<br>**App Type:** Desktop app |
|
||||
|Microsoft Paint |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** mspaint.exe<br>**App Type:** Desktop app |
|
||||
|Microsoft Remote Desktop |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** mstsc.exe<br>**App Type:** Desktop app |
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 22 KiB After Width: | Height: | Size: 17 KiB |
@ -35,7 +35,7 @@ A malicious user might install malware that looks like the standard logon dialog
|
||||
|
||||
### Best practices
|
||||
|
||||
- It is advisable to set **Disable CTRL+ALT+DEL requirement for logon** to **Disabled**. Unless they are using a smart card to log on, users will have to simultaneously press three keys before the logon dialog box appears.
|
||||
- It is advisable to set **Disable CTRL+ALT+DEL requirement for logon** to **Not configured**.
|
||||
|
||||
### Location
|
||||
|
||||
|
||||
@ -53,5 +53,9 @@ This topic provides a roadmap for planning and getting started on the Device Gua
|
||||
- [Enforce code integrity policies](deploy-code-integrity-policies-steps.md#enforce-code-integrity-policies)
|
||||
- [Deploy and manage code integrity policies with Group Policy](deploy-code-integrity-policies-steps.md#deploy-and-manage-code-integrity-policies-with-group-policy)<br>
|
||||
|
||||
8. **Enable desired hardware (VBS) security features**. Hardware-based security features—also called virtualization-based security (VBS) features—strengthen the protections offered by code integrity policies, as described in [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). For information about enabling VBS features, see [Deploy Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md).
|
||||
8. **Enable desired hardware (VBS) security features**. Hardware-based security features—also called virtualization-based security (VBS) features—strengthen the protections offered by code integrity policies, as described in [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats).
|
||||
|
||||
> [!WARNING]
|
||||
> Virtualization-based protection of code integrity may be incompatible with some devices and applications. We strongly recommend testing this configuration in your lab before enabling virtualization-based protection of code integrity on production systems. Failure to do so may result in unexpected failures up to and including data loss or a blue screen error (also called a stop error).
|
||||
|
||||
For information about enabling VBS features, see [Deploy Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md).
|
||||
|
||||
@ -20,6 +20,7 @@ This article describes the following:
|
||||
- [Device Guard requirements for baseline protections](#device-guard-requirements-for-baseline-protections)
|
||||
- [Device Guard requirements for improved security](#device-guard-requirements-for-improved-security)
|
||||
- [Device Guard deployment in different scenarios: types of devices](#device-guard-deployment-in-different-scenarios-types-of-devices)
|
||||
- [Device Guard deployment in virtual machines](#device-guard-deployment-in-virtual-machines)
|
||||
- [Reviewing your applications: application signing and catalog files](#reviewing-your-applications-application-signing-and-catalog-files)
|
||||
- [Code integrity policy formats and signing](#code-integrity-policy-formats-and-signing)
|
||||
|
||||
@ -35,6 +36,9 @@ For example, hardware that includes CPU virtualization extensions and SLAT will
|
||||
|
||||
You can deploy Device Guard in phases, and plan these phases in relation to the computer purchases you plan for your next hardware refresh.
|
||||
|
||||
> [!WARNING]
|
||||
> Virtualization-based protection of code integrity may be incompatible with some devices and applications. We strongly recommend testing this configuration in your lab before enabling virtualization-based protection of code integrity on production systems. Failure to do so may result in unexpected failures up to and including data loss or a blue screen error (also called a stop error).
|
||||
|
||||
The following tables provide more information about the hardware, firmware, and software required for deployment of various Device Guard features. The tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, available in 2016, and announced as options for 2017.
|
||||
|
||||
> **Notes**
|
||||
@ -96,6 +100,19 @@ Typically, deployment of Device Guard happens best in phases, rather than being
|
||||
| **Lightly managed devices**: Company-owned, but users are free to install software.<br>Devices are required to run organization's antivirus solution and client management tools. | Device Guard can be used to help protect the kernel, and to monitor (audit) for problem applications rather than limiting the applications that can be run. | - VBS (hardware-based) protections, enabled. When enabled with a code integrity policy in audit mode only, VBS means the hypervisor helps enforce the default kernel-mode code integrity policy, which protects against unsigned drivers or system files.<br><br>- Code integrity policies, with UMCI enabled, but running in audit mode only. This means applications are not blocked—the policy just logs an event whenever an application outside the policy is started. |
|
||||
| **Bring Your Own Device**: Employees are allowed to bring their own devices, and also use those devices away from work. | Device Guard does not apply. Instead, you can explore other hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. | N/A |
|
||||
|
||||
## Device Guard deployment in virtual machines
|
||||
|
||||
Device Guard can protect a Hyper-V virtual machine, just as it would a physical machine. The enablement steps are the same from within the virtual machine.
|
||||
|
||||
Device Guard protects against malware running in the guest virtual machine. It does not provide additional protection from the host administrator. From the host, you can disable Device Guard for a virtual machine:
|
||||
|
||||
` Set-VMSecurity -VMName <VMName> -VirtualizationBasedSecurityOptOut $true`
|
||||
|
||||
|
||||
### Requirements for running Device Guard in Hyper-V virtual machines
|
||||
- The Hyper-V host must run at least Windows Server 2016 or Windows 10 version 1607.
|
||||
- The Hyper-V virtual machine must be Generation 2, and running at least Windows Server 2016 or Windows 10.
|
||||
|
||||
## Reviewing your applications: application signing and catalog files
|
||||
|
||||
Typically, code integrity policies are configured to use the application's signing certificate as part or all of what identifies the application as trusted. This means that applications must either use embedded signing—where the signature is part of the binary—or catalog signing, where you generate a “catalog file” from the applications, sign it, and through the signed catalog file, configure the code integrity policy to recognize the applications as signed.
|
||||
|
||||
@ -40,7 +40,8 @@ OEMs implement the TPM as a component in a trusted computing platform, such as a
|
||||
The TCG designed the TPM as a low-cost, mass-market security solution that addresses the requirements of different customer segments. There are variations in the security properties of different TPM implementations just as there are variations in customer and regulatory requirements for different sectors. In public-sector procurement, for example, some governments have clearly defined security requirements for TPMs whereas others do not.
|
||||
|
||||
>**Note:** Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
|
||||
|
||||
## TPM 1.2 vs. 2.0 comparison
|
||||
|
||||
From an industry standard, Microsoft has been an industry leader in moving and standardizing on TPM 2.0, which has many key realized benefits across algorithms, crypto, hierarchy, root keys, authorization and NV RAM.
|
||||
@ -59,47 +60,30 @@ TPM 2.0 products and systems have important security advantages over TPM 1.2, in
|
||||
|
||||
- TPM 2.0 offers a more **consistent experience** across different implementations.
|
||||
|
||||
- TPM 1.2 implementations across both discrete and firmware vary in policy settings. This may result in support issues as lockout policies vary.
|
||||
- TPM 2.0 standardized policy requirement helps establish a consistent lockout experience across devices, as such, Windows can offer a better user experience end to end.
|
||||
- TPM 1.2 implementations vary in policy settings. This may result in support issues as lockout policies vary.
|
||||
- TPM 2.0 lockout policy is configured by Windows, ensuring a consistent dictionary attack protection guarantee.
|
||||
|
||||
- While TPM 1.2 parts were discrete silicon components typically soldered on the motherboard, TPM 2.0 is available both as a **discrete (dTPM)** silicon component and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on the system’s main SoC:
|
||||
- While TPM 1.2 parts are discrete silicon components which are typically soldered on the motherboard, TPM 2.0 is available as a **discrete (dTPM)** silicon component in a sinple semiconductor package, an **integrated** component incorporated in one or more semiconductor packages - alongside other logic units in the same package(s) - and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on a general purpose SoC.
|
||||
|
||||
- On Intel chips, it is the Intel Management Engine (ME) or Converged Security Engine (CSE).
|
||||
- For AMD chips, it is the AMD Security Processor
|
||||
- For ARM chips, it is a Trustzone Trusted Application (TA).
|
||||
- In the case of firmware TPM for desktop Windows systems, the chip vendor provides the firmware TPM implementation along with the other chip firmware to OEMs.
|
||||
## Discrete, Integrated or Firmware TPM?
|
||||
|
||||
## Discrete or firmware TPM?
|
||||
There are three implementation options for TPMs:
|
||||
|
||||
Windows uses discrete and firmware TPM in the same way. Windows gains no functional advantage or disadvantage from either option.
|
||||
- Discrete TPM chip as a separate component in its own semiconductor package
|
||||
- Integrated TPM solution, using dedicated hardware integrated into one or more semiconductor packages alongside, but logically separate from, other components
|
||||
- Firmware TPM solution, running the TPM in firmware in a Trusted Execution mode of a general purpose computation unit
|
||||
|
||||
From a security standpoint, discrete and firmware share the same characteristics;
|
||||
|
||||
- Both use hardware based secure execution.
|
||||
- Both use firmware for portions of the TPM functionality.
|
||||
- Both are equipped with tamper resistance capabilities.
|
||||
- Both have unique security limitations/risks.
|
||||
|
||||
For more info, see [fTPM: A Firmware-based TPM 2.0 Implementation](http://research.microsoft.com/apps/pubs/?id=258236).
|
||||
Windows uses any compatible TPM in the same way. Microsoft does not take a position on which way a TPM should be implemented and there is a wide ecosystem of available TPM solutions which should suit all needs.
|
||||
|
||||
## Is there any importance for TPM for consumer?
|
||||
|
||||
For end consumers, TPM is behind the scenes but still very relevant for Hello, Passport and in the future, many other key features in Windows 10. It offers the best Passport experience, helps encrypt passwords, and builds on our overall Windows 10 experience story for security as a critical pillar. Using Windows on a system with a TPM enables a deeper and broader level of security coverage.
|
||||
For end consumers, TPM is behind the scenes but is still very relevant. TPM is used for Windows Hello, Windows Hello for Business and in the future, will be a components of many other key security features in Windows. TPM secures the PIN, helps encrypt passwords, and builds on our overall Windows 10 experience story for security as a critical pillar. Using Windows on a system with a TPM enables a deeper and broader level of security coverage.
|
||||
|
||||
## TPM 2.0 Compliance for Windows 10
|
||||
|
||||
### Windows 10 for desktop editions (Home, Pro, Enterprise, and Education)
|
||||
|
||||
- As of July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7, https://msdn.microsoft.com/library/windows/hardware/dn915086(v=vs.85).aspx)
|
||||
|
||||
## Two implementation options:
|
||||
|
||||
- Discrete TPM chip as a separate discrete component
|
||||
- Firmware TPM solution using Intel PTT (platform trust technology) or AMD
|
||||
|
||||
### Windows 10 Mobile
|
||||
|
||||
- All devices shipping with Windows 10 Mobile must implement TPM 2.0 and ship with the TPM 2.0 enabled.
|
||||
- Since July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7, https://msdn.microsoft.com/library/windows/hardware/dn915086(v=vs.85).aspx)
|
||||
|
||||
### IoT Core
|
||||
|
||||
@ -226,7 +210,7 @@ The following table defines which Windows features require TPM support. Some fea
|
||||
</table>
|
||||
|
||||
## Chipset options for TPM 2.0
|
||||
There are a variety of TPM manufacturers for both discrete and firmware.
|
||||
There is a vibrant ecosystem of TPM manufacturers.
|
||||
### Discrete TPM
|
||||
<table>
|
||||
<colgroup>
|
||||
@ -250,6 +234,33 @@ There are a variety of TPM manufacturers for both discrete and firmware.
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### Integrated TPM
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="100%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Supplier</th>
|
||||
<th align="left">Chipset</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="even">
|
||||
<td align="left">Intel</td>
|
||||
<td align="left"><ul>
|
||||
<li>Atom (CloverTrail)
|
||||
<li>Baytrail</li>
|
||||
<li>Braswell</li>
|
||||
<li>4th generation Core (Haswell)</li>
|
||||
<li>5th generation Core (Broadwell)</li>
|
||||
<li>6th generation Core (Skylake)</li>
|
||||
<li>7th generation Core (Kaby Lake)</li>
|
||||
</ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### Firmware TPM
|
||||
<table>
|
||||
<colgroup>
|
||||
@ -272,17 +283,6 @@ There are a variety of TPM manufacturers for both discrete and firmware.
|
||||
</ul></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left">Intel</td>
|
||||
<td align="left"><ul>
|
||||
<li>Atom (CloverTrail)
|
||||
<li>Baytrail</li>
|
||||
<li>4th generation(Haswell)</li>
|
||||
<li>5th generation(Broadwell)</li>
|
||||
<li>Braswell</li>
|
||||
<li>Skylake</li>
|
||||
</ul></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left">Qualcomm</td>
|
||||
<td align="left"><ul>
|
||||
<li>MSM8994</li>
|
||||
|
||||
@ -14,6 +14,7 @@ author: brianlic-msft
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
- Windows Server 2012 R2
|
||||
|
||||
Microsoft is dedicated to provide our customers with a secure operating system, such as Windows 10 and Windows Server, as well as secure apps, such as Microsoft Edge. In addition to the security assurance of its products, Microsoft also enables you to have fine control of your environments by providing various configuration capabilities. Even though Windows and Windows Server are designed to be secure out-of-the-box, a large number of organizations still want more granular control of their security configurations. To navigate these large number of controls, organizations need guidance for configuring various security features. Microsoft provides this guidance in the form of security baselines.
|
||||
@ -56,11 +57,13 @@ To help faster deployments and increase the ease of managing Windows, Microsoft
|
||||
|
||||
### Windows 10 security baselines
|
||||
|
||||
- [Windows 10, version 1607 and Windows Server 2016 security baseline](https://go.microsoft.com/fwlink/?linkid=831663)
|
||||
- [Windows 10, Version 1511 security baseline](https://go.microsoft.com/fwlink/p/?LinkID=799381)
|
||||
- [Windows 10, Version 1507 security baseline](https://go.microsoft.com/fwlink/p/?LinkID=799380)
|
||||
|
||||
### Windows Server security baselines
|
||||
|
||||
- [Windows 10, version 1607 and Windows Server 2016 security baseline](https://go.microsoft.com/fwlink/?linkid=831663)
|
||||
- [Windows Server 2012 R2 security baseline](https://go.microsoft.com/fwlink/p/?LinkID=799382)
|
||||
|
||||
## How can I monitor security baseline deployments?
|
||||
|
||||
@ -33,7 +33,7 @@ There are a couple of things we need to know when you pay for apps. You can add
|
||||
You can add payment info on **Account information**. If you don’t have one saved with your account, you’ll be prompted to provide one when you buy an app.
|
||||
|
||||
## Acquire apps
|
||||
To acquire an app
|
||||
**To acquire an app**
|
||||
1. Log in to http://businessstore.microsoft.com
|
||||
2. Click Shop, or use Search to find an app.
|
||||
3. Click the app you want to purchase.
|
||||
@ -42,7 +42,7 @@ To acquire an app
|
||||
6. If you don’t have a payment method saved in Account settings, Store for Business will prompt you for one.
|
||||
7. Add your credit card or debit card info, and click **Next**. Your card info is saved as a payment option on **Account information**.
|
||||
|
||||
You’ll also need to have your business address saved on **Account information**. The address is used to generate tax rates. For more information on taxes for apps, see organization tax information.
|
||||
You’ll also need to have your business address saved on **Account information**. The address is used to generate tax rates. For more information on taxes for apps, see [organization tax information](https://technet.microsoft.com/itpro/windows/manage/update-windows-store-for-business-account-settings#organization-tax-information).
|
||||
|
||||
Store for Business adds the app to your inventory. From **Inventory**, you can:
|
||||
- Distribute the app: add to private store, or assign licenses
|
||||
|
||||
@ -30,17 +30,19 @@ MSI packages that were generated using an App-V sequencer from previous versions
|
||||
|
||||
- For the standalone Windows 10 SDK without other tools, see [Standalone Windows 10 SDK](https://developer.microsoft.com/en-US/windows/downloads/windows-10-sdk).
|
||||
|
||||
3. From an elevated Windows PowerShell prompt, navigate to the following folder:
|
||||
3. Copy msidb.exe from the default path of the Windows SDK installation (**C:\Program Files (x86)\Windows Kits\10**) to a different directory. For example: **C:\MyMsiTools\bin**
|
||||
|
||||
4. From an elevated Windows PowerShell prompt, navigate to the following folder:
|
||||
|
||||
<Windows Kits 10 installation folder>**\Microsoft Application Virtualization\Sequencer\**
|
||||
|
||||
By default, this path will be:<br>**C:\Program Files (x86)\Windows Kits\10\Microsoft Application Virtualization\Sequencer**
|
||||
|
||||
4. Run the following command:
|
||||
5. Run the following command:
|
||||
|
||||
`Update-AppvPackageMsi -MsiPackage "<path to App-V Package .msi file>" -MsSdkPath "<path to Windows SDK installation>"`
|
||||
`Update-AppvPackageMsi -MsiPackage "<path to App-V Package .msi file>" -MsSdkPath "<path>"`
|
||||
|
||||
By default, the path to the Windows SDK installation will be:<br>**C:\Program Files (x86)\Windows Kits\10**
|
||||
where the path is to the new directory (**C:\MyMsiTools\ for this example**).
|
||||
|
||||
## Error occurs during publishing refresh between App-V 5.0 SP3 Management Server and App-V Client on Windows 10
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 127 KiB After Width: | Height: | Size: 127 KiB |
@ -7,7 +7,7 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: devices
|
||||
author: jdeckerMS
|
||||
localizationpriority: medium
|
||||
localizationpriority: high
|
||||
---
|
||||
|
||||
# Manage Windows 10 in your organization - transitioning to modern management
|
||||
@ -34,7 +34,7 @@ Windows 10 offers a range of management options, as shown in the following diagr
|
||||
|
||||
<img src="images/windows-10-management-range-of-options.png" alt="The path to modern IT" width="766" height="654" />
|
||||
|
||||
As indicated in the diagram, Microsoft continues to provide support for deep manageability and security through technologies like Group Policy, Active Directory, and System Center Configuration Manager. It also delivers a “mobile-first, cloud-first” approach of simplified, modern management using cloud-based device management solutions such as Microsoft Enterprise Mobility + Security (EMS). Future Windows innovations, delivered through Windows as a Service, are complemented by cloud services like Microsoft Intune, Azure Active Directory, Azure Rights Management Service, Office 365, and the Windows Store for Business.
|
||||
As indicated in the diagram, Microsoft continues to provide support for deep manageability and security through technologies like Group Policy, Active Directory, and System Center Configuration Manager. It also delivers a “mobile-first, cloud-first” approach of simplified, modern management using cloud-based device management solutions such as Microsoft Enterprise Mobility + Security (EMS). Future Windows innovations, delivered through Windows as a Service, are complemented by cloud services like Microsoft Intune, Azure Active Directory, Azure Information Protection, Office 365, and the Windows Store for Business.
|
||||
|
||||
## Deployment and Provisioning
|
||||
|
||||
@ -44,38 +44,38 @@ With Windows 10, you can continue to use traditional OS deployment, but you can
|
||||
|
||||
- Avoid reimaging by using dynamic provisioning, enabled by a cloud-based device management services like Microsoft Intune.
|
||||
|
||||
- Create self-contained provisioning packages built with the Windows Imaging and Configuration Designer (ICD).
|
||||
- Create self-contained provisioning packages built with the [Windows Imaging and Configuration Designer (ICD)](https://msdn.microsoft.com/library/windows/hardware/dn916113(v=vs.85).aspx).
|
||||
|
||||
- Use traditional imaging techniques such as deploying custom images using System Center Configuration Manager.
|
||||
- Use traditional imaging techniques such as deploying custom images using [System Center Configuration Manager](https://docs.microsoft.com/sccm/core/understand/introduction).
|
||||
|
||||
You have multiple options for upgrading to Windows 10. For existing devices running Windows 7 or Windows 8.1, you can use the robust in-place upgrade process for a fast, reliable move to Windows 10 while automatically preserving all the existing apps, data, and settings. This can mean significantly lower deployment costs, as well as improved productivity as end users can be immediately productive – everything is right where they left it. Of course, you can also use a traditional wipe-and-load approach if you prefer, using the same tools that you use today with Windows 7.
|
||||
You have multiple options for [upgrading to Windows 10](https://technet.microsoft.com/itpro/windows/deploy/windows-10-deployment-scenarios). For existing devices running Windows 7 or Windows 8.1, you can use the robust in-place upgrade process for a fast, reliable move to Windows 10 while automatically preserving all the existing apps, data, and settings. This can mean significantly lower deployment costs, as well as improved productivity as end users can be immediately productive – everything is right where they left it. Of course, you can also use a traditional wipe-and-load approach if you prefer, using the same tools that you use today with Windows 7.
|
||||
|
||||
## Identity and Authentication
|
||||
|
||||
You can use Windows 10 and services like Azure Active Directory in new ways for cloud-based identity, authentication, and management. You can offer your users the ability to **“bring your own device” (BYOD)** or to **“choose your own device” (CYOD)** from a selection you make available. At the same time, you might be managing PCs and tablets that must be domain-joined because of specific applications or resources that are used on them.
|
||||
You can use Windows 10 and services like [Azure Active Directory](https://azure.microsoft.com/documentation/articles/active-directory-whatis/) in new ways for cloud-based identity, authentication, and management. You can offer your users the ability to **“bring your own device” (BYOD)** or to **“choose your own device” (CYOD)** from a selection you make available. At the same time, you might be managing PCs and tablets that must be domain-joined because of specific applications or resources that are used on them.
|
||||
|
||||
You can envision user and device management as falling into these two categories:
|
||||
|
||||
- **Corporate (CYOD) or personal (BYOD) devices used by mobile users for SaaS apps such as Office 365.** With Windows 10, your employees can self-provision their devices:
|
||||
|
||||
- For corporate devices, they can set up corporate access with Azure AD Join. When you offer them Azure AD Join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://blogs.technet.microsoft.com/ad/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/), all from the cloud.<br>Azure AD Join is also a great solution for temporary staff, partners, or other part-time employees. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources.
|
||||
- For corporate devices, they can set up corporate access with [Azure AD Join](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-overview/). When you offer them Azure AD Join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://blogs.technet.microsoft.com/ad/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/), all from the cloud.<br>Azure AD Join is also a great solution for temporary staff, partners, or other part-time employees. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources.
|
||||
|
||||
- Likewise, for personal devices, employees can use a new, simplified BYOD experience to add their work account to Windows, then access work resources on the device.
|
||||
- Likewise, for personal devices, employees can use a new, simplified [BYOD experience](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-windows10-devices/) to add their work account to Windows, then access work resources on the device.
|
||||
|
||||
- **Domain joined PCs and tablets used for traditional applications and access to important resources.** These may be traditional applications and resources that require authentication or accessing highly sensitive or classified resources on-premises.
|
||||
With Windows 10, if you have an on-premises Active Directory domain that’s integrated with Azure AD, when employee devices are joined, they automatically register with Azure AD. This provides:
|
||||
With Windows 10, if you have an on-premises [Active Directory](https://technet.microsoft.com/windows-server-docs/identity/whats-new-active-directory-domain-services) domain that’s [integrated with Azure AD](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-devices-group-policy/), when employee devices are joined, they automatically register with Azure AD. This provides:
|
||||
|
||||
- Single sign-on to cloud and on-premises resources from everywhere
|
||||
|
||||
- Enterprise roaming of settings
|
||||
- [Enterprise roaming of settings](https://azure.microsoft.com/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/)
|
||||
|
||||
- Conditional access to corporate resources based on the health or configuration of the device
|
||||
- [Conditional access](https://azure.microsoft.com/documentation/articles/active-directory-conditional-access/) to corporate resources based on the health or configuration of the device
|
||||
|
||||
- Windows Hello for Business
|
||||
- [Windows Hello for Business](https://technet.microsoft.com/itpro/windows/keep-secure/manage-identity-verification-using-microsoft-passport)
|
||||
|
||||
- Windows Hello
|
||||
|
||||
Domain joined PCs and tablets can continue to be managed with the System Center Configuration Manager client or Group Policy.
|
||||
Domain joined PCs and tablets can continue to be managed with the [System Center Configuration Manager](https://docs.microsoft.com/sccm/core/understand/introduction) client or Group Policy.
|
||||
|
||||
For more information about how Windows 10 and Azure AD optimize access to work resources across a mix of devices and scenarios, see [Using Windows 10 devices in your workplace](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-windows10-devices/).
|
||||
|
||||
@ -87,7 +87,7 @@ As you review the roles in your organization, you can use the following generali
|
||||
|
||||
Your configuration requirements are defined by multiple factors, including the level of management needed, the devices and data managed, and your industry requirements. Meanwhile, employees are frequently concerned about IT applying strict policies to their personal devices, but they still want access to corporate email and documents. With Windows 10, you can create a consistent set of configurations across PCs, tablets, and phones through the common MDM layer.
|
||||
|
||||
**MDM**: MDM gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, Group Policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. This makes MDM the best choice for devices that are constantly on the go.
|
||||
**MDM**: [MDM](https://www.microsoft.com/en-us/cloud-platform/mobile-device-management) gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, Group Policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. This makes MDM the best choice for devices that are constantly on the go.
|
||||
|
||||
**Group Policy** and **System Center Configuration Manager**: Your organization might still need to manage domain joined computers at a granular level such as Internet Explorer’s 1,500 configurable Group Policy settings, or very specific Windows Firewall rules. If so, Group Policy and System Center Configuration Manager continue to be excellent management choices:
|
||||
|
||||
@ -101,7 +101,7 @@ You can use the following generalized decision tree to review the management cho
|
||||
|
||||
## Updating and Servicing
|
||||
|
||||
With Windows as a Service, your IT department no longer needs to perform complex imaging (wipe-and-load) processes with each new Windows release. Whether on current branch (CB) or current branch for business (CBB), devices receive the latest feature and quality updates through simple – often automatic – patching processes.
|
||||
With Windows as a Service, your IT department no longer needs to perform complex imaging (wipe-and-load) processes with each new Windows release. Whether on current branch (CB) or current branch for business (CBB), devices receive the latest feature and quality updates through simple – often automatic – patching processes. For more information, see [Windows 10 deployment scenarios](https://technet.microsoft.com/itpro/windows/deploy/windows-10-deployment-scenarios).
|
||||
|
||||
MDM with Intune provide tools for applying Windows updates to client computers in your organization. Configuration Manager allows rich management and tracking capabilities of these updates, including maintenance windows and automatic deployment rules.
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ Table 1 provides an example of the deployment rings you might use.
|
||||
|
||||
**Table 1**
|
||||
|
||||
| Deployment ring | Servicing branch | Total weeks after Current Branch (CB) or Current Brandh for Business (CBB) release |
|
||||
| Deployment ring | Servicing branch | Total weeks after Current Branch (CB) or Current Branch for Business (CBB) release |
|
||||
| --- | --- | --- |
|
||||
| Preview | Windows Insider | Pre-CB |
|
||||
| Ring 1 Pilot IT | CB | CB + 0 weeks |
|
||||
|
||||
Reference in New Issue
Block a user