Screenshots for UEFI and changes in checklist

devices/surface-hub/TOC.md

@@ -33,7 +33,7 @@
 ### [Managing Surface Hub 2S with Microsoft Intune](surface-hub-2s-manage-intune.md)
 ### [Local management for Surface Hub 2S settings](local-management-surface-hub-settings.md)
 ### [Manage device account password rotation](surface-hub-2s-manage-passwords.md)
-### [Servicing and updating for Surface Hub 2S](surface-hub-2s-service-update.md)
+### [Manage Windows updates](manage-windows-updates-for-surface-hub.md)
 ### [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md)
 ### [Save your BitLocker key](save-bitlocker-key-surface-hub.md)
 ### [Microsoft Exchange properties](exchange-properties-for-surface-hub-device-accounts.md)

devices/surface-hub/surface-hub-2s-deploy-checklist.md

@@ -15,49 +15,49 @@ ms.localizationpriority: Normal
 
 ## Surface Hub 2S pre-deployment checklist
 
-|**Check**|**Item**|**Response**|**Learn more**|
+|**Item**|**Response**|**Learn more**|
-|:------ |:------ |:----- |:------ |
+|:------ |:------ |:----- |
-| ☐ |**Device account name**| | |
+|**Device account name**| | |
-| ☐ |**Device account UPN**| | |
+|**Device account UPN**| | |
-| ☐ |**ActiveSync Policy**| | |
+|**ActiveSync Policy**| | |
-| ☐ |**Calendar processing configuration completed**| - Yes <br> - No | |
+|**Calendar processing configuration completed**| ☐ Yes <br>  ☐ No | |
-| ☐ |**Device-friendly name**| | |
+|**Device-friendly name**| | |
-| ☐ |**Device host name**| | |
+|**Device host name**| | |
-| ☐ |**Affiliation**| - None <br> - Active Directory affiliation <br> - Azure Active Directory | |
+|**Affiliation**| ☐ None <br> ☐ Active Directory affiliation <br> ☐ Azure Active Directory | |
-| ☐ |**Microsoft Teams Mode**| - Mode 0 <br> - Mode 1 <br> - Mode 2 | |
+|**Microsoft Teams Mode**| ☐ Mode 0 <br> ☐ Mode 1 <br> ☐ Mode 2 | |
-| ☐ |**Device Management**| - Yes, Microsoft Intune <br> - Yes, other mobile device manager [MDM] <br> - None |  |
+|**Device Management**| ☐ Yes, Microsoft Intune <br> ☐ Yes, other mobile device manager [MDM] <br> ☐ None |  |
-| ☐ |**Proxy**| - Automatic configuration <br> - Proxy server <br> - Proxy auto-config (PAC) file | |
+|**Proxy**| ☐ Automatic configuration <br> ☐ Proxy server <br> ☐ Proxy auto-config (PAC) file | |
-| ☐ |**Proxy authentication**| - Device account credentials <br> - Prompt for credentials | |
+|**Proxy authentication**| ☐ Device account credentials <br> ☐ Prompt for credentials | |
-| ☐ |**Password rotation**| - On <br> - Off | |
+|**Password rotation**| ☐ On <br> ☐ Off | |
-| ☐ |**Skype for Business additional domain names (on-premises only)**| | |
+|**Skype for Business additional domain names (on-premises only)**| | |
-| ☐ |**Session timeout time**| | |
+|**Session timeout time**| | |
-| ☐ |**Session timeout action**| - End session <br> - Allow resume | |
+|**Session timeout action**| ☐ End session <br> ☐ Allow resume | |
-| ☐ |**My meetings and files**| - Enabled <br> - Disabled | |
+|**My meetings and files**| ☐ Enabled <br> ☐ Disabled | |
-| ☐ |**Lock screen timeout**| | |
+|**Lock screen timeout**| | |
-| ☐ |**Sleep idle timeout**| | |
+|**Sleep idle timeout**| | |
-| ☐ |**Bluetooth**| - On <br> - Off | |
+|**Bluetooth**| ☐ On <br> ☐ Off | |
-| ☐ |**Use only BitLocker USB drives**| - On <br> - Off | |
+|**Use only BitLocker USB drives**| ☐ On <br> ☐ Off | |
-| ☐ |**Install additional certificates (on-premises only)**| | [Using certificates for AADJ on-premises single-sign on](https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert) |
+|**Install additional certificates (on-premises only)**| | [Using certificates for AADJ on-premises single-sign on](https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert) |
-|☐ |**Windows update**| - Windows Update for Business <br> - Windows Server Update Services [WSUS] | [Deploy updates using Windows Update for Business](https://docs.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb) <br> [Get Started with Windows Server Update Services (WSUS)](https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) |
+|**Windows update**| ☐ Windows Update for Business <br> ☐ Windows Server Update Services [WSUS] | [Deploy updates using Windows Update for Business](https://docs.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb) <br> [Get Started with Windows Server Update Services (WSUS)](https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) |
-|☐ |**Surface app speaker setting**| - Rolling stand <br> - Wall-mounted | |
+|**Surface app speaker setting**| ☐ Rolling stand <br> ☐ Wall-mounted | |
-|☐ |**IP Address**| - Wired — DHCP <br> - Wired — DHCP reservation <br> - Wireless — DHCP <br> - Wireless — DHCP reservation | |
+|**IP Address**| ☐ Wired — DHCP <br> ☐ Wired — DHCP reservation <br> ☐ Wireless — DHCP <br> ☐ Wireless — DHCP reservation | |
 
 ## Surface Hub 2S post-deployment checklist
 
 |**Check**|**Item**|**Response**|**Learn more**|
 |:------|:-------|:---------|:----------|
-| ☐ |**Device account syncing**| - Yes <br> - No | |
+|**Device account syncing**| ☐ Yes <br> ☐ No | |
-| ☐ |**Bitlocker key**| - Saved to file (no affiliation) <br> - Saved in Active Directory (AD affiliation) <br>- Saved in Azure AD (Azure AD affiliation) | |
+|**Bitlocker key**| ☐ Saved to file (no affiliation) <br> ☐ Saved in Active Directory (AD affiliation) <br>☐ Saved in Azure AD (Azure AD affiliation) | |
-| ☐ |**Device OS updates**| - Completed | |
+|**Device OS updates**| ☐ Completed | |
-| ☐ |**Windows Store updates**| - Automatic <br> - Manual | |
+|**Windows Store updates**| ☐ Automatic <br> ☐ Manual | |
-| ☐ |**Microsoft Teams scheduled meeting**| - Confirmation email received <br> - Meeting appears on start screen <br> - One-touch join functions <br> - Able to join audio <br> - Able to join video <br> - Able to share screen ||
+|**Microsoft Teams scheduled meeting**| ☐ Confirmation email received <br> ☐ Meeting appears on start screen <br>  ☐ One-touch join functions <br> ☐ Able to join audio <br> ☐ Able to join video <br> ☐ Able to share screen ||
-| ☐ |**Skype for Business scheduled meeting**| - Confirmation email received <br> - Meeting appears on start screen <br> - One-touch join functions correctly <br> - Able to join audio <br> - Able to join video <br> - Able to share screen <br> - Able to send/receive IM | |
+|**Skype for Business scheduled meeting**| ☐ Confirmation email received <br> ☐ Meeting appears on start screen <br> ☐ One-touch join functions correctly <br> ☐ Able to join audio <br> ☐ Able to join video <br> ☐ Able to share screen <br> ☐ Able to send/receive IM | |
-| ☐ |**Scheduled meeting when already invited**| - Meeting declined | |
+|**Scheduled meeting when already invited**| ☐ Meeting declined | |
-| ☐ |**Microsoft Teams ad-hoc meeting**| - Invite other users work <br> - Able to join audio <br> - Able to join video <br> - Able to share screen | |
+|**Microsoft Teams ad-hoc meeting**| ☐ Invite other users work <br> ☐ Able to join audio <br> ☐ Able to join video <br> ☐ Able to share screen | |
-| ☐ |**Skype for Business scheduled meeting**| - Invite other users work <br> - Able to join audio <br> - Able to join video <br> - Able to share screen <br> - Able to send/receive IM | |
+|**Skype for Business scheduled meeting**| ☐ Invite other users work <br> ☐ Able to join audio <br> ☐ Able to join video <br> ☐ Able to share screen <br> ☐ Able to send/receive IM | |
-| ☐ |**Microsoft Whiteboard**| - Launch from Welcome / Start screen <br> - Launch from Microsoft Teams | [Microsoft Whiteboard](https://whiteboard.microsoft.com/) |
+|**Microsoft Whiteboard**| ☐ Launch from Welcome / Start screen <br> ☐ Launch from Microsoft Teams | [Microsoft Whiteboard](https://whiteboard.microsoft.com/) |
-| ☐ |**Incoming Skype/Teams call**| - Able to join audio<br>- Able to join video <br> - Able to share screen <br> - Able to send/receive IM (Skype for Business only) | |
+|**Incoming Skype/Teams call**| ☐ Able to join audio<br>☐ Able to join video <br> ☐ Able to share screen <br> ☐ Able to send/receive IM (Skype for Business only) | |
-| ☐ |**Incoming live video streams**| - Maximum 2 (Skype for Business) <br> - Maximum 4 (Microsoft Teams) | |
+|**Incoming live video streams**| ☐ Maximum 2 (Skype for Business) <br> ☐ Maximum 4 (Microsoft Teams) | |
-| ☐ |**Microsoft Teams Mode 0 behavior**| - Skype for Business tile on Welcome/Start screen <br> - Can join scheduled Skype for Business meetings (Skype UI) <br> - Can join scheduled Teams meetings (Teams UI) | |
+|**Microsoft Teams Mode 0 behavior**| ☐ Skype for Business tile on Welcome/Start screen <br> ☐ Can join scheduled Skype for Business meetings (Skype UI) <br> ☐ Can join scheduled Teams meetings (Teams UI) | |
-| ☐ |**Microsoft Teams Mode 1 behavior**| - Teams tile on Welcome/Start screen <br> - Can join scheduled Skype for Business meetings (Skype UI) <br> - Can join scheduled Teams meetings (Teams UI) | |
+|**Microsoft Teams Mode 1 behavior**| ☐ Teams tile on Welcome/Start screen <br> ☐ Can join scheduled Skype for Business meetings (Skype UI) <br> ☐ Can join scheduled Teams meetings (Teams UI) | |
-| ☐ |**Microsoft Teams Mode 2 behavior**| - Teams tile on Welcome / Start screen <br> - Can join scheduled Teams meetings <br> - Fail to join Skype for Business meetings | |
+|**Microsoft Teams Mode 2 behavior**| ☐ Teams tile on Welcome / Start screen <br> ☐ Can join scheduled Teams meetings <br> ☐ Fail to join Skype for Business meetings | |

devices/surface-hub/surface-hub-2s-secure-with-uefi-semm.md

@@ -42,16 +42,24 @@ Unlike other Surface devices, you cannot use an MSI file or a Win PE image to ap
 
 ## To configure UEFI on Surface Hub 2S
 
-1. Start the UEFI Configurator and on the first screen, choose **Configuration Package**.
+1. Start the UEFI Configurator and on the first screen, choose **Configuration Package**.<br><br>
-2. To add the certificate to your package, you must have a valid certificate with the private key in a .pfx file format to sign and protect the package. Select **+ Certificate Protection.**
+![* Start the UEFI Configurator and choose Configuration Package*](images/sh2-uefi1.png) <br> <br>
-3. Enter the certificate’s private key’s password.
+2. To add the certificate to your package, you must have a valid certificate with the private key in a .pfx file format to sign and protect the package. Select **+ Certificate Protection.** <br>
-4. After importing the private key, continue creating the package.
+![* Select + Certificate Protection *](images/sh2-uefi2.png) <br><br>
-5. Choose **Hub** and **Surface Hub 2S** as the target for the UEFI configuration package.
+3. Enter the certificate’s private key’s password.<br>
-6. Choose the components and settings you want to activate or deactivate on Surface Hub 2S.
+![* Enter the certificate’s private key’s password *](images/sh2-uefi3.png) <br><br>
-7. Use the USB option to export the file.
+4. After importing the private key, continue creating the package.<br>
-8. Insert and choose the USB drive you’d like to use for this package. The USB drive will be formatted and you lose any information you have on it.
+![* Continue creating the package *](images/sh2-uefi4.png) <br><br>
-
+5. Choose **Hub** and **Surface Hub 2S** as the target for the UEFI configuration package.<br>
-Upon successful creation of the package, the Configurator will display the last two characters of your certificate’s thumbprint. You need these characters when you import to the configuration to Surface Hub 2S.
+![* Choose Hub and Surface Hub 2S as the target for the UEFI configuration package *](images/sh2-uefi5.png) <br><br>
+6. Choose the components and settings you want to activate or deactivate on Surface Hub 2S.<br>
+![* Choose the components and settings you want to activate or deactivate *](images/sh2-uefi6.png) <br><br>
+7. Use the USB option to export the file.<br>
+![* Use the USB option to export the file *](images/sh2-uefi8.png) <br><br>
+8. Insert and choose the USB drive you’d like to use for this package. The USB drive will be formatted and you lose any information you have on it.<br>
+![* Insert and choose the USB drive for your package  *](images/sh2-uefi9.png) <br><br>
+9. Upon successful creation of the package, the Configurator will display the last two characters of your certificate’s thumbprint. You need these characters when you import to the configuration to Surface Hub 2S.<br>
+![* Successful configuration of package *](images/sh2-uefi10.png) <br>
 
 ## To boot into UEFI