mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 05:17:22 +00:00
Merge pull request #5009 from ShrCaJesmo/patch-1
Schedule task hidden from standard users
This commit is contained in:
Manika Dhiman
GitHub
commit
ae1e862cf3
@ -36,8 +36,7 @@ You can set the policy using one of these methods:
|
||||
|
||||
- MDM provider
|
||||
|
||||
- Autopilot Reset in Intune for Education is coming soon. In a future update of Intune for Education, new tenants will automatically have the Autopilot Reset setting enabled by default on the **All devices** group as part of initial tenant configuration. You will also be able to manage this setting to target different groups in the admin console.
|
||||
- If you're using an MDM provider other than Intune for Education, check your MDM provider documentation on how to set this policy. If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set.
|
||||
-Check your MDM provider documentation on how to set this policy. If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set.
|
||||
|
||||
For example, in Intune, create a new configuration policy and add an OMA-URI.
|
||||
- OMA-URI: ./Vendor/MSFT/Policy/Config/CredentialProviders/DisableAutomaticReDeploymentCredentials
|
||||
@ -93,6 +92,7 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo
|
||||
Once provisioning is complete, the device is again ready for use.
|
||||
|
||||
<span id="winre"/>
|
||||
|
||||
## Troubleshoot Autopilot Reset
|
||||
|
||||
Autopilot Reset will fail when the [Windows Recovery Environment (WinRE)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference) is not enabled on the device. You will see `Error code: ERROR_NOT_SUPPORTED (0x80070032)`.
|
||||
|
||||
@ -198,6 +198,9 @@ To collect Event Viewer logs:
|
||||
The auto-enrollment process is triggered by a task (Microsoft > Windows > EnterpriseMgmt) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (Computer Configuration > Policies > Administrative Templates > Windows Components > MDM) is successfully deployed to the target machine as shown in the following screenshot:
|
||||
|
||||
|
||||
> [!Note]
|
||||
> This task isn't visible to standard users - run Scheduled Tasks with administrative credentials to find the task.
|
||||
|
||||
This task runs every 5 minutes for the duration of 1 day. To confirm if the task succeeded, check the task scheduler event logs:
|
||||
Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational.
|
||||
Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from AAD is triggered by event ID 107.
|
||||
|
||||
@ -151,7 +151,7 @@ Certain Windows Analytics features have additional settings you can use.
|
||||
|
||||
- For devices running Windows 10, version 1607 or earlier, Windows diagnostic data must also be set to Enhanced (see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#enhanced-level)) in order to be compatible with Windows Defender Antivirus. See the [Windows Defender Antivirus in Windows 10 and Windows Server 2016](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) for more information about enabling, configuring, and validating Windows Defender AV.
|
||||
|
||||
- **Device Health** is only compatible with Windows 10 desktop devices (workstations and laptops) and Windows Server 2016. The solution requires that at least the Enhanced level of diagnostic data is enabled on all devices that are intended to be displayed in the solution. In Windows 10, version 1709, a new policy was added to "limit enhanced telemetry to the minimum required by Windows Analytics". To learn more about Windows diagnostic data, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization).
|
||||
- **Device Health** is only compatible with Windows 10 desktop devices (workstations and laptops). The solution requires that at least the Enhanced level of diagnostic data is enabled on all devices that are intended to be displayed in the solution. In Windows 10, version 1709, a new policy was added to "limit enhanced telemetry to the minimum required by Windows Analytics". To learn more about Windows diagnostic data, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization).
|
||||
|
||||
- **IE site discovery** is an optional feature of Upgrade Readiness that provides an inventory of websites that are accessed by client devices using Internet Explorer on Windows 7, Windows 8.1, and Windows 10. To enable IE site discovery, make sure the required updates are installed (per previous section) and enable IE site discovery in the deployment script batch file.
|
||||
|
||||
|
||||
@ -8,7 +8,8 @@ ms.author: greglin
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
audience: itpro
author: greg-lindsay
|
||||
audience: itpro
|
||||
author: greg-lindsay
|
||||
ms.date: 04/19/2017
|
||||
ms.topic: article
|
||||
---
|
||||
@ -247,7 +248,7 @@ USMT provides several command-line options that you can use to analyze problems
|
||||
<td align="left"><p><strong>/progress:</strong>[<em>Path</em>]<em>FileName</em></p></td>
|
||||
<td align="left"><p>Creates the optional progress log. You cannot store any of the log files in <em>StorePath</em>. <em>Path</em> can be either a relative or full path. If you do not specify the <em>Path</em> variable, then <em>FileName</em> will be created in the current directory.</p>
|
||||
<p>For example:</p>
|
||||
<p><code>loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:scanlog.log</code></p></td>
|
||||
<p><code>loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:loadlog.log</code></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><strong>/c</strong></p></td>
|
||||
|
||||
@ -9,7 +9,8 @@ ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: low
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
audience: itpro
author: greg-lindsay
|
||||
audience: itpro
|
||||
author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
@ -109,7 +110,7 @@ A [glossary](#glossary) of abbreviations used in this topic is provided at the e
|
||||
| --- | --- |
|
||||
| Must we use Intune for our MDM? | No. No, any MDM will work with Autopilot, but others probably won’t have the same full suite of Windows Autopilot features as Intune. You’ll get the best experience from Intune. |
|
||||
| Can Intune support Win32 app preinstalls? | Yes. Starting with the Windows 10 October Update (version 1809), Intune supports Win32 apps using .msi (and .msix) wrappers. |
|
||||
| What is co-management? | Co-management is when you use a combination of a cloud MDM tool (Intune) and an on-premise configuration tool like System Center Configuration Manager (SCCM). You only need to use SCCM if Intune can’t support what you want to do with your profile. If you choose to co-manage using Intune + SCCM, you do it by including an SCCM agent in your Intune profile. When that profile is pushed to the device, the device will see the SCCM agent and go out to SCCM to pull down any additional profile settings. |
|
||||
| What is co-management? | Co-management is when you use a combination of a cloud MDM tool (Intune) and an on-premises configuration tool like System Center Configuration Manager (SCCM). You only need to use SCCM if Intune can’t support what you want to do with your profile. If you choose to co-manage using Intune + SCCM, you do it by including an SCCM agent in your Intune profile. When that profile is pushed to the device, the device will see the SCCM agent and go out to SCCM to pull down any additional profile settings. |
|
||||
| Must we use System Center Configuration Manager (SCCM) for Windows Autopilot | No. Co-management (described above) is optional. |
|
||||
|
||||
|
||||
@ -118,7 +119,7 @@ A [glossary](#glossary) of abbreviations used in this topic is provided at the e
|
||||
| Question | Answer |
|
||||
| --- | --- |
|
||||
| Self-deploying mode | A new version of Windows Autopilot where the user only turns on the device, and nothing else. It’s useful for scenarios where a standard user account isn’t needed (e.g., shared devices, or KIOSK devices). |
|
||||
| Hybrid Azure Active Directory join | Allows Windows Autopilot devices to connect to an on-premise Active Directory domain controller (in addition to being Azure AD joined). |
|
||||
| Hybrid Azure Active Directory join | Allows Windows Autopilot devices to connect to an on-premises Active Directory domain controller (in addition to being Azure AD joined). |
|
||||
| Windows Autopilot reset | Removes user apps and settings from a device, but maintains AAD domain join and MDM enrollment. Useful for when transferring a device from one user to another. |
|
||||
| Personalization | Adds the following to the OOBE experience: A personalized welcome message can be created A username hint can be added Sign-in page text can be personalized The company’s logo can be included |
|
||||
| [Autopilot for existing devices](existing-devices.md) | Offers an upgrade path to Windows Autopilot for all existing Win 7/8 devices. |
|
||||
|
||||
@ -110,10 +110,10 @@ You can do this by using either the Control Panel or the Deployment Image Servic
|
||||
|
||||
### Enable Windows Defender Credential Guard by using the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool
|
||||
|
||||
You can also enable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337).
|
||||
You can also enable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](dg_readiness_tool.md).
|
||||
|
||||
```
|
||||
DG_Readiness_Tool_v3.6.ps1 -Enable -AutoReboot
|
||||
DG_Readiness_Tool.ps1 -Enable -AutoReboot
|
||||
```
|
||||
> [!IMPORTANT]
|
||||
> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
||||
|
||||
File diff suppressed because one or more lines are too long
@ -69,7 +69,13 @@ For security reasons, the package used to Offboard machines will expire 30 days
|
||||
|
||||
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP_valid_until_YYYY-MM-DD.offboarding*.
|
||||
|
||||
3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune).
|
||||
3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings.
|
||||
|
||||
OMA-URI: ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding
|
||||
Date type: String
|
||||
Value: [Copy and paste the value from the content of the WindowsDefenderATP_valid_until_YYYY-MM-DD.offboarding file]
|
||||
|
||||
For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune).
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
|
||||
@ -25,6 +25,11 @@ ms.topic: article
|
||||
Ensure that your machines:
|
||||
- Are onboarded to Microsoft Defender Advanced Threat Protection
|
||||
- Run with Windows 10 1709 (Fall Creators Update) or later
|
||||
- Download the following set of optional security updates and deploy them in your network to boost your vulnerability detection rates:
|
||||
-- KB 4512941
|
||||
-- KB 4516077
|
||||
-- KB 4516045
|
||||
-- KB 4516071
|
||||
|
||||
>[!NOTE]
|
||||
>Threat & Vulnerability Management can also scan machines that run on Windows 7 and Windows Server 2019 operating systems and detects vulnerabilities addressed in patch Tuesday.
|
||||
|
||||
@ -19,15 +19,19 @@ ms.date: 04/19/2017
|
||||
|
||||
# Interactive logon: Message text for users attempting to log on
|
||||
|
||||
**Applies to**
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
|
||||
Describes the best practices, location, values, management, and security considerations for the **Interactive logon: Message text for users attempting to log on** security policy setting.
|
||||
|
||||
## Reference
|
||||
|
||||
The **Interactive logon: Message text for users attempting to log on** and [Interactive logon: Message title for users attempting to log on](interactive-logon-message-title-for-users-attempting-to-log-on.md) policy settings are closely related. **Interactive logon: Message text for users attempting to log on** specifies a text message to be displayed to users when they log on. Interactive logon: Message title for users attempting to log on specifies a title to appear in the title bar of the window that contains the text message. This text is often used for legal reasons—for example, to warn
|
||||
users about the ramifications of misusing company information, or to warn them that their actions might be audited.
|
||||
The **Interactive logon: Message text for users attempting to log on** and [Interactive logon: Message title for users attempting to log on](interactive-logon-message-title-for-users-attempting-to-log-on.md) policy settings are closely related.
|
||||
|
||||
**Interactive logon: Message text for users attempting to log on** specifies a text message to be displayed to users when they log on.
|
||||
|
||||
**Interactive logon: Message title for users attempting to log on** specifies a title to appear in the title bar of the window that contains the text message. This text is often used for legal reasons — for example, to warn users about the ramifications of misusing company information, or to warn them that their actions might be audited.
|
||||
|
||||
Not using this warning-message policy setting leaves your organization legally vulnerable to trespassers who unlawfully penetrate your network. Legal precedents have established that organizations that display warnings to users who connect to their servers over a network have a higher rate of successfully prosecuting trespassers.
|
||||
|
||||
@ -46,7 +50,8 @@ The possible values for this setting are:
|
||||
|
||||
1. IT IS AN OFFENSE TO CONTINUE WITHOUT PROPER AUTHORIZATION.
|
||||
2. This system is restricted to authorized users. Individuals who attempt unauthorized access will be prosecuted. If you are unauthorized, terminate access now. Click OK to indicate your acceptance of this information.
|
||||
>**Important:** Any warning that you display in the title or text should be approved by representatives from your organization's legal and human resources departments.
|
||||
> [!IMPORTANT]
|
||||
> Any warning that you display in the title or text should be approved by representatives from your organization's legal and human resources departments.
|
||||
|
||||
### Location
|
||||
|
||||
@ -92,12 +97,10 @@ Users often do not understand the importance of security practices. However, the
|
||||
|
||||
Configure the **Interactive logon: Message text for users attempting to log on** and [Interactive logon: Message title for users attempting to log on](interactive-logon-message-title-for-users-attempting-to-log-on.md) settings to an appropriate value for your organization.
|
||||
|
||||
>**Note:** Any warning message that displays should be approved by your organization's legal and human resources representatives.
|
||||
|
||||
### Potential impact
|
||||
|
||||
Users see a message in a dialog box before they can log on to the server console.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Security Options](security-options.md)
|
||||
- [Security Options](security-options.md)
|
||||
|
||||
@ -28,6 +28,8 @@ These settings, located at **Computer Configuration\Administrative Templates\Net
|
||||
>[!NOTE]
|
||||
>You must configure either the Enterprise resource domains hosted in the cloud or Private network ranges for apps settings on your employee devices to successfully turn on Application Guard using enterprise mode.
|
||||
|
||||
>Proxy servers must be a neutral resource listed in the "Domains categorized as both work and personal" policy.
|
||||
|
||||
|
||||
|
||||
|Policy name|Supported versions|Description|
|
||||
|
||||
@ -68,7 +68,7 @@ Answering frequently asked questions about Windows Defender Application Guard (A
|
||||
| | |
|
||||
|--------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| **Q:** | How do I configure WDAG to work with my network proxy (IP-Literal Addresses)? |
|
||||
| **A:** | WDAG requires proxies to have a symbolic name, not just an IP address. IP-Literal proxy settings such as “192.168.1.4:81” can be annotated as “itproxy:81” or using a record such as “P19216810010” for a proxy with an IP address of 192.168.100.10. This applies to Windows 10 Enterprise edition, 1709 or higher. |
|
||||
| **A:** | WDAG requires proxies to have a symbolic name, not just an IP address. IP-Literal proxy settings such as “192.168.1.4:81” can be annotated as “itproxy:81” or using a record such as “P19216810010” for a proxy with an IP address of 192.168.100.10. This applies to Windows 10 Enterprise edition, 1709 or higher. These would be for the proxy policies under Network Isolation in Group Policy or Intune. |
|
||||
|
||||
<br>
|
||||
|
||||
@ -100,7 +100,7 @@ Answering frequently asked questions about Windows Defender Application Guard (A
|
||||
| | |
|
||||
|--------|-----------------------------------------------------------------------------------------------|
|
||||
| **Q:** | How do I trust a subdomain in my site list? |
|
||||
| **A:** | To trust a subdomain, you must precede your domain with two dots, for example: ..contoso.com. |
|
||||
| **A:** | To trust a subdomain, you must precede your domain with two dots, for example: ..contoso.com will ensure mail.contoso.com or news.contoso.com are trusted. The first dot represents the strings for the subdomain name (mail or news), the second dot recognizes the start of the domain name (contoso.com). This prevents sites such as fakesitecontoso.com from being trusted.|
|
||||
|
||||
<br>
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user