mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-16 19:03:46 +00:00
Merge branch 'main' into v-smandalika-5694287-B12
This commit is contained in:
Siddarth Mandalika
@ -48,31 +48,31 @@ The steps to turn on Config Lock using Microsoft Endpoint Manager (Microsoft Int
|
||||
- **Profile type**: Templates
|
||||
- **Template name**: Custom
|
||||
|
||||
:::image type="content" source="images/configlock-mem-createprofile.png" alt-text="create profile":::
|
||||
:::image type="content" source="images/configlock-mem-createprofile.png" alt-text="In Configuration profiles, the Create a profile page is showing, with the Platform set to Windows 10 and later, and a Profile Type of Templates":::
|
||||
|
||||
1. Name your profile.
|
||||
1. When you reach the Configuration Settings step, select “Add” and add the following information:
|
||||
- **OMA-URI**: ./Vendor/MSFT/DMClient/Provider/MS%20DM%20Server/ConfigLock/Lock
|
||||
- **Data type**: Integer
|
||||
- **Value**: 1 </br>
|
||||
To turn off Config Lock. Change value to 0.
|
||||
To turn off Config Lock, change the value to 0.
|
||||
|
||||
:::image type="content" source="images/configlock-mem-editrow.png" alt-text="edit row":::
|
||||
:::image type="content" source="images/configlock-mem-editrow.png" alt-text="In the Configuration settings step, the Edit Row page is shown with a Name of Config Lock, a Description of Turn on Config Lock and the OMA-URI set as above, along with a Data type of Integer set to a Value of 1":::
|
||||
|
||||
1. Select the devices to turn on Config Lock. If you're using a test tenant, you can select “+ Add all devices”.
|
||||
1. You'll not need to set any applicability rules for test purposes.
|
||||
1. Review the Configuration and select “Create” if everything is correct.
|
||||
1. After the device syncs with the Microsoft Intune server, you can confirm if the Config Lock was successfully enabled.
|
||||
|
||||
:::image type="content" source="images/configlock-mem-dev.png" alt-text="status":::
|
||||
:::image type="content" source="images/configlock-mem-dev.png" alt-text="The Profile assignment status dashboard when viewing the Config Lock device configuration profile, showing one device has succeeded in having this profile applied":::
|
||||
|
||||
:::image type="content" source="images/configlock-mem-devstatus.png" alt-text="device status":::
|
||||
:::image type="content" source="images/configlock-mem-devstatus.png" alt-text="The Device Status for the Config Lock Device Configuration Profile, showing one device with a Deployment Status as Succeeded and two with Pending":::
|
||||
|
||||
## Disabling
|
||||
## Configuring Secured-Core PC features
|
||||
|
||||
Config Lock is designed to ensure that a Secured-Core PC isn't unintentionally misconfigured. IT Admins retain the ability to change (enabled/disable) SCPC features via Group Policies and/or mobile device management (MDM) tools, such as Microsoft Intune.
|
||||
Config Lock is designed to ensure that a Secured-Core PC isn't unintentionally misconfigured. IT Admins retain the ability to change (enable/disable) SCPC features (for example Firmware protection) via Group Policies and/or mobile device management (MDM) tools, such as Microsoft Intune.
|
||||
|
||||
:::image type="content" source="images/configlock-mem-firmwareprotect.png" alt-text="firmware protect":::
|
||||
:::image type="content" source="images/configlock-mem-firmwareprotect.png" alt-text="The Defender Firmware protection setting, with a description of Windows Defender System Guard protects your device from compromised firmware. The setting is set to Off":::
|
||||
|
||||
## FAQ
|
||||
|
||||
|
||||
@ -121,30 +121,30 @@ Follow these steps to create a provisioning package with multivariant capabiliti
|
||||
The following example shows the contents of a sample customizations.xml file.
|
||||
|
||||
```XML
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<WindowsCustomizatons>
|
||||
<PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
|
||||
<ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID>
|
||||
<Name>My Provisioning Package</Name>
|
||||
<Version>1.0</Version>
|
||||
<OwnerType>OEM</OwnerType>
|
||||
<Rank>50</Rank>
|
||||
</PackageConfig>
|
||||
<Settings xmlns="urn:schemas-microsoft-com:windows-provisioning">
|
||||
<Customizations>
|
||||
<Common>
|
||||
<Policies>
|
||||
<AllowBrowser>0</AllowBrowser>
|
||||
<AllowCamera>0</AllowCamera>
|
||||
<AllowBluetooth>0</AllowBluetooth>
|
||||
</Policies>
|
||||
<HotSpot>
|
||||
<Enabled>0</Enabled>
|
||||
</HotSpot>
|
||||
</Common>
|
||||
</Customizations>
|
||||
</Settings>
|
||||
</WindowsCustomizatons>
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<WindowsCustomizations>
|
||||
<PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
|
||||
<ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID>
|
||||
<Name>My Provisioning Package</Name>
|
||||
<Version>1.0</Version>
|
||||
<OwnerType>OEM</OwnerType>
|
||||
<Rank>50</Rank>
|
||||
</PackageConfig>
|
||||
<Settings xmlns="urn:schemas-microsoft-com:windows-provisioning">
|
||||
<Customizations>
|
||||
<Common>
|
||||
<Policies>
|
||||
<AllowBrowser>0</AllowBrowser>
|
||||
<AllowCamera>0</AllowCamera>
|
||||
<AllowBluetooth>0</AllowBluetooth>
|
||||
</Policies>
|
||||
<HotSpot>
|
||||
<Enabled>0</Enabled>
|
||||
</HotSpot>
|
||||
</Common>
|
||||
</Customizations>
|
||||
</Settings>
|
||||
</WindowsCustomizations>
|
||||
```
|
||||
|
||||
5. Edit the customizations.xml file to create a **Targets** section to describe the conditions that will handle your multivariant settings.
|
||||
@ -152,48 +152,48 @@ Follow these steps to create a provisioning package with multivariant capabiliti
|
||||
The following example shows the customizations.xml, which has been modified to include several conditions including **ProcessorName**, **ProcessorType**, **MCC**, and **MNC**.
|
||||
|
||||
```XML
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<WindowsCustomizatons>
|
||||
<PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
|
||||
<ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID>
|
||||
<Name>My Provisioning Package</Name>
|
||||
<Version>1.0</Version>
|
||||
<OwnerType>OEM</OwnerType>
|
||||
<Rank>50</Rank>
|
||||
</PackageConfig>
|
||||
<Settings xmlns="urn:schemas-microsoft-com:windows-provisioning">
|
||||
<Customizations>
|
||||
<Common>
|
||||
<Policies>
|
||||
<AllowBrowser>0</AllowBrowser>
|
||||
<AllowCamera>0</AllowCamera>
|
||||
<AllowBluetooth>0</AllowBluetooth>
|
||||
</Policies>
|
||||
<HotSpot>
|
||||
<Enabled>0</Enabled>
|
||||
</HotSpot>
|
||||
</Common>
|
||||
<Targets>
|
||||
<Target Id="Unique target identifier for desktop">
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" />
|
||||
<Condition Name="ProcessorType" Value="Pattern:.*(I|i)ntel.*" />
|
||||
</TargetState>
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Barton" />
|
||||
<Condition Name="ProcessorType" Value="Athlon MP" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
<Target Id="Mobile target">
|
||||
<TargetState>
|
||||
<Condition Name="MCC" Value="Range:310, 320" />
|
||||
<Condition Name="MNC" Value="!Range:400, 550" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
</Targets>
|
||||
</Customizations>
|
||||
</Settings>
|
||||
</WindowsCustomizatons>
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<WindowsCustomizations>
|
||||
<PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
|
||||
<ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID>
|
||||
<Name>My Provisioning Package</Name>
|
||||
<Version>1.0</Version>
|
||||
<OwnerType>OEM</OwnerType>
|
||||
<Rank>50</Rank>
|
||||
</PackageConfig>
|
||||
<Settings xmlns="urn:schemas-microsoft-com:windows-provisioning">
|
||||
<Customizations>
|
||||
<Common>
|
||||
<Policies>
|
||||
<AllowBrowser>0</AllowBrowser>
|
||||
<AllowCamera>0</AllowCamera>
|
||||
<AllowBluetooth>0</AllowBluetooth>
|
||||
</Policies>
|
||||
<HotSpot>
|
||||
<Enabled>0</Enabled>
|
||||
</HotSpot>
|
||||
</Common>
|
||||
<Targets>
|
||||
<Target Id="Unique target identifier for desktop">
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" />
|
||||
<Condition Name="ProcessorType" Value="Pattern:.*(I|i)ntel.*" />
|
||||
</TargetState>
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Barton" />
|
||||
<Condition Name="ProcessorType" Value="Athlon MP" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
<Target Id="Mobile target">
|
||||
<TargetState>
|
||||
<Condition Name="MCC" Value="Range:310, 320" />
|
||||
<Condition Name="MNC" Value="!Range:400, 550" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
</Targets>
|
||||
</Customizations>
|
||||
</Settings>
|
||||
</WindowsCustomizations>
|
||||
```
|
||||
|
||||
6. In the customizations.xml file, create a **Variant** section for the settings you need to customize. To do this:
|
||||
@ -212,56 +212,56 @@ Follow these steps to create a provisioning package with multivariant capabiliti
|
||||
The following example shows the customizations.xml updated to include a **Variant** section and the moved settings that will be applied if the conditions for the variant are met.
|
||||
|
||||
```XML
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<WindowsCustomizatons>
|
||||
<PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
|
||||
<ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID>
|
||||
<Name>My Provisioning Package</Name>
|
||||
<Version>1.0</Version>
|
||||
<OwnerType>OEM</OwnerType>
|
||||
<Rank>50</Rank>
|
||||
</PackageConfig>
|
||||
<Settings xmlns="urn:schemas-microsoft-com:windows-provisioning">
|
||||
<Customizations>
|
||||
<Common>
|
||||
</Common>
|
||||
<Targets>
|
||||
<Target Id="Unique target identifier for desktop">
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" />
|
||||
<Condition Name="ProcessorType" Value="Pattern:.*(I|i)ntel.*" />
|
||||
</TargetState>
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Barton" />
|
||||
<Condition Name="ProcessorType" Value="Athlon MP" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
<Target Id="Mobile target">
|
||||
<TargetState>
|
||||
<Condition Name="MCC" Value="Range:310, 320" />
|
||||
<Condition Name="MNC" Value="!Range:400, 550" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
</Targets>
|
||||
<Variant>
|
||||
<TargetRefs>
|
||||
<TargetRef Id="Unique target identifier for desktop" />
|
||||
<TargetRef Id="Mobile target" />
|
||||
</TargetRefs>
|
||||
<Settings>
|
||||
<Policies>
|
||||
<AllowBrowser>1</AllowBrowser>
|
||||
<AllowCamera>1</AllowCamera>
|
||||
<AllowBluetooth>1</AllowBluetooth>
|
||||
</Policies>
|
||||
<HotSpot>
|
||||
<Enabled>1</Enabled>
|
||||
</HotSpot>
|
||||
</Settings>
|
||||
</Variant>
|
||||
</Customizations>
|
||||
</Settings>
|
||||
</WindowsCustomizatons>
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<WindowsCustomizations>
|
||||
<PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
|
||||
<ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID>
|
||||
<Name>My Provisioning Package</Name>
|
||||
<Version>1.0</Version>
|
||||
<OwnerType>OEM</OwnerType>
|
||||
<Rank>50</Rank>
|
||||
</PackageConfig>
|
||||
<Settings xmlns="urn:schemas-microsoft-com:windows-provisioning">
|
||||
<Customizations>
|
||||
<Common>
|
||||
</Common>
|
||||
<Targets>
|
||||
<Target Id="Unique target identifier for desktop">
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" />
|
||||
<Condition Name="ProcessorType" Value="Pattern:.*(I|i)ntel.*" />
|
||||
</TargetState>
|
||||
<TargetState>
|
||||
<Condition Name="ProcessorName" Value="Barton" />
|
||||
<Condition Name="ProcessorType" Value="Athlon MP" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
<Target Id="Mobile target">
|
||||
<TargetState>
|
||||
<Condition Name="MCC" Value="Range:310, 320" />
|
||||
<Condition Name="MNC" Value="!Range:400, 550" />
|
||||
</TargetState>
|
||||
</Target>
|
||||
</Targets>
|
||||
<Variant>
|
||||
<TargetRefs>
|
||||
<TargetRef Id="Unique target identifier for desktop" />
|
||||
<TargetRef Id="Mobile target" />
|
||||
</TargetRefs>
|
||||
<Settings>
|
||||
<Policies>
|
||||
<AllowBrowser>1</AllowBrowser>
|
||||
<AllowCamera>1</AllowCamera>
|
||||
<AllowBluetooth>1</AllowBluetooth>
|
||||
</Policies>
|
||||
<HotSpot>
|
||||
<Enabled>1</Enabled>
|
||||
</HotSpot>
|
||||
</Settings>
|
||||
</Variant>
|
||||
</Customizations>
|
||||
</Settings>
|
||||
</WindowsCustomizations>
|
||||
```
|
||||
|
||||
7. Save the updated customizations.xml file and note the path to this updated file. You will need the path as one of the values for the next step.
|
||||
|
||||
@ -82,6 +82,10 @@ If all else fails, try resetting the Windows Update Agent by running these comma
|
||||
Ren %Systemroot%\SoftwareDistribution\Download Download.bak
|
||||
Ren %Systemroot%\System32\catroot2 catroot2.bak
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The **reset** step below using sc.exe will **overwrite** your existing security ACLs on the BITS and Windows Update service and set them to default. Skip this step unless the other steps to reset Windows Update components have not resolved the issue.
|
||||
|
||||
2. Reset the **BITS service** and the **Windows Update service** to the default security descriptor. To do this, type the following commands at a command prompt. Press ENTER after you type each command.
|
||||
``` console
|
||||
sc.exe sdset bits D:(A;CI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
|
||||
|
||||
@ -45,11 +45,15 @@ sections:
|
||||
|
||||
- question: Can I deploy Windows Hello for Business by using Microsoft Endpoint Configuration Manager?
|
||||
answer: |
|
||||
Windows Hello for Business deployments using Configuration Manager should follow the hybrid deployment model that uses Active Directory Federation Services. In Configuration Manager version 1910 and later, certificate-based authentication with Windows Hello for Business settings isn't supported. Key-based authentication is still valid with Configuration Manager. For more information, see [Windows Hello for Business settings in Configuration Manager](/configmgr/protect/deploy-use/windows-hello-for-business-settings).
|
||||
Windows Hello for Business deployments using Configuration Manager should follow the hybrid deployment model that uses Active Directory Federation Services. Starting in Configuration Manager version 1910, certificate-based authentication with Windows Hello for Business settings isn't supported. Key-based authentication is still valid with Configuration Manager. For more information, see [Windows Hello for Business settings in Configuration Manager](/configmgr/protect/deploy-use/windows-hello-for-business-settings).
|
||||
|
||||
- question: Can I deploy Windows Hello for Business by using Microsoft Endpoint Manager Intune?
|
||||
answer: |
|
||||
Windows Hello for Business deployments using Intune allow for a great deal of flexibility in deployment. For more information, see [Integrate Windows Hello for Business with Microsoft Intune](/mem/intune/protect/windows-hello).
|
||||
|
||||
- question: How many users can enroll for Windows Hello for Business on a single Windows 10 computer?
|
||||
answer: |
|
||||
The maximum number of supported enrollments on a single Windows 10 computer is 10. This limit lets 10 users each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we'll strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available.
|
||||
The maximum number of supported enrollments on a single Windows 10 computer is 10. This lets 10 users each enroll their face and up to 10 fingerprints. For devices with more than 10 users, we strongly encourage the use of FIDO2 security keys.
|
||||
|
||||
- question: How can a PIN be more secure than a password?
|
||||
answer: |
|
||||
@ -101,7 +105,7 @@ sections:
|
||||
|
||||
[Windows Hello for Business forgotten PIN user experience](hello-videos.md#windows-hello-for-business-forgotten-pin-user-experience)
|
||||
|
||||
For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network.
|
||||
For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can onboard their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs. Non-destructive PIN reset works without access to the corporate network. Destructive PIN reset requires access to the corporate network. For more details about destructive and non-destructive PIN reset, see [PIN reset](/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset).
|
||||
|
||||
- question: What URLs do I need to allow for a hybrid deployment?
|
||||
answer: |
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Why a PIN is better than a password (Windows)
|
||||
description: Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password .
|
||||
title: Why a PIN is better than an online password (Windows)
|
||||
description: Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) an online password .
|
||||
ms.assetid: A6FC0520-01E6-4E90-B53D-6C4C4E780212
|
||||
keywords: pin, security, password, hello
|
||||
ms.prod: m365-security
|
||||
@ -19,42 +19,44 @@ ms.localizationpriority: medium
|
||||
ms.date: 10/23/2017
|
||||
---
|
||||
|
||||
# Why a PIN is better than a password
|
||||
# Why a PIN is better than an online password
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password?
|
||||
On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Hello PIN. It isn't the structure of a PIN (length, complexity) that makes it better than a password, it's how it works.
|
||||
Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a local password?
|
||||
On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Hello PIN. It isn't the structure of a PIN (length, complexity) that makes it better than an online password, it's how it works. First we need to distinguish between two types of passwords: `local` passwords are validated against the machine's password store, whereas `online` passwords are validated against a server. This article mostly covers the benefits a PIN has over an online password, and also why it can be considered even better than a local password.
|
||||
|
||||
Watch Dana Huang explain why a Windows Hello for Business PIN is more secure than a password.
|
||||
Watch Dana Huang explain why a Windows Hello for Business PIN is more secure than an online password.
|
||||
|
||||
> [!VIDEO https://www.youtube.com/embed/cC24rPBvdhA]
|
||||
|
||||
## PIN is tied to the device
|
||||
|
||||
One important difference between a password and a Hello PIN is that the PIN is tied to the specific device on which it was set up. That PIN is useless to anyone without that specific hardware. Someone who steals your password can sign in to your account from anywhere, but if they steal your PIN, they'd have to steal your physical device too!
|
||||
One important difference between an online password and a Hello PIN is that the PIN is tied to the specific device on which it was set up. That PIN is useless to anyone without that specific hardware. Someone who steals your online password can sign in to your account from anywhere, but if they steal your PIN, they'd have to steal your physical device too!
|
||||
|
||||
Even you can't use that PIN anywhere except on that specific device. If you want to sign in on multiple devices, you have to set up Hello on each device.
|
||||
|
||||
## PIN is local to the device
|
||||
|
||||
A password is transmitted to the server -- it can be intercepted in transmission or stolen from a server. A PIN is local to the device -- it isn't transmitted anywhere and it isn't stored on the server.
|
||||
An online password is transmitted to the server -- it can be intercepted in transmission or stolen from a server. A PIN is local to the device -- it isn't transmitted anywhere and it isn't stored on the server.
|
||||
When the PIN is created, it establishes a trusted relationship with the identity provider and creates an asymmetric key pair that is used for authentication. When you enter your PIN, it unlocks the authentication key and uses the key to sign the request that is sent to the authenticating server.
|
||||
However, note that even though local passwords are also local to the device, they are still less secure than a PIN, as described in the next section.
|
||||
|
||||
>[!NOTE]
|
||||
>For details on how Hello uses asymetric key pairs for authentication, see [Windows Hello for Business](hello-overview.md#benefits-of-windows-hello).
|
||||
|
||||
## PIN is backed by hardware
|
||||
|
||||
The Hello PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Many modern devices have TPM.
|
||||
The Hello PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Many modern devices have TPM. Windows 10, on the other hand, has a defect of not linking local passwords to TPM. This is the reason why PINs are considered more secure than local passwords.
|
||||
|
||||
User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Because Hello uses asymmetric key pairs, users credentials can't be stolen in cases where the identity provider or websites the user accesses have been compromised.
|
||||
|
||||
The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. After too many incorrect guesses, the device is locked.
|
||||
|
||||
|
||||
## PIN can be complex
|
||||
|
||||
The Windows Hello for Business PIN is subject to the same set of IT management policies as a password, such as complexity, length, expiration, and history. Although we generally think of a PIN as a simple four-digit code, administrators can set [policies](hello-manage-in-organization.md) for managed devices to require a PIN complexity similar to a password. You can require or block: special characters, uppercase characters, lowercase characters, and digits.
|
||||
|
||||
@ -45,9 +45,7 @@ Test Provider | Lab Test Type | Minimum Level / Score
|
||||
AV-Comparatives | Real-World Protection Test </br> https://www.av-comparatives.org/testmethod/real-world-protection-tests/ |“Approved” rating from AV Comparatives
|
||||
AV-Test | Must pass tests for Windows. Certifications for Mac and Linux aren't accepted </br> https://www.av-test.org/en/about-the-institute/certification/ | Achieve "AV-TEST Certified" (for home users) or "AV-TEST Approved” (for corporate users)
|
||||
ICSA Labs | Endpoint Anti-Malware Detection </br> https://www.icsalabs.com/technology-program/anti-virus/criteria |PASS/Certified
|
||||
NSS Labs | Advanced Endpoint Protection AEP 3.0, which covers automatic threat prevention and threat event reporting capabilities </br> https://www.nsslabs.com/tested-technologies/advanced-endpoint-protection/ |“Neutral” rating from NSS
|
||||
SKD Labs | Certification Requirements Product: Anti-virus or Antimalware </br> http://www.skdlabs.com/html/english/ </br> http://www.skdlabs.com/cert/ |SKD Labs Star Check Certification Requirements Pass >= 98.5% with On Demand, On Access and Total Detection tests
|
||||
SE Labs | Protection A rating or Small Business EP A rating or Enterprise EP Protection A rating </br> https://selabs.uk/en/reports/consumers |Home or Enterprise “A” rating
|
||||
VB 100 | VB100 Certification Test V1.1 </br> https://www.virusbulletin.com/testing/vb100/vb100-methodology/vb100-methodology-ver1-1/ | VB100 Certification
|
||||
West Coast Labs | Checkmark Certified </br> http://www.checkmarkcertified.com/sme/ | “A” Rating on Product Security Performance
|
||||
|
||||
|
||||
@ -62,11 +62,11 @@ Additional settings that can be included in a custom Passfilt.dll are the use of
|
||||
> [!TIP]
|
||||
> For the latest best practices, see [Password Guidance](https://www.microsoft.com/research/publication/password-guidance).
|
||||
|
||||
Set **Passwords must meet complexity requirements** to Enabled. This policy setting, combined with a minimum password length of 8, ensures that there are at least 218,340,105,584,896 different possibilities for a single password. This setting makes a brute force attack difficult, but still not impossible.
|
||||
Set **Passwords must meet complexity requirements** to Enabled. This policy setting, combined with a minimum password length of 8, ensures that there are at least 159,238,157,238,528 different possibilities for a single password. This setting makes a brute force attack difficult, but still not impossible.
|
||||
|
||||
The use of ALT key character combinations may greatly enhance the complexity of a password. However, requiring all users in an organization to adhere to such stringent password requirements might result in unhappy users and an over-worked Help Desk. Consider implementing a requirement in your organization to use ALT characters in the range from 0128 through 0159 as part of all administrator passwords. (ALT characters outside of that range can represent standard alphanumeric characters that do not add more complexity to the password.)
|
||||
|
||||
Passwords that contain only alphanumeric characters are easy to compromise by using publicly available tools. To prevent this, passwords should contain additional characters and meet complexity requirements.
|
||||
Short passwords that contain only alphanumeric characters are easy to compromise by using publicly available tools. To prevent this, passwords should contain additional characters and/or meet complexity requirements.
|
||||
|
||||
### Location
|
||||
|
||||
|
||||
@ -10,7 +10,7 @@ ms.reviewer: jogeurte
|
||||
ms.author: jogeurte
|
||||
ms.manager: jsuther
|
||||
manager: dansimp
|
||||
ms.date: 11/06/2021
|
||||
ms.date: 03/08/2022
|
||||
ms.technology: windows-sec
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
@ -88,8 +88,8 @@ In addition to the steps outlined above, the binary policy file must also be cop
|
||||
$MountPoint = 'C:\EFI'
|
||||
$EFIDestinationFolder = "$MountPoint\Microsoft\Boot\CiPolicies\Active"
|
||||
$EFIPartition = (Get-Partition | Where-Object IsSystem).AccessPaths[0]
|
||||
mkdir $EFIDestinationFolder
|
||||
mountvol $MountPoint $EFIPartition
|
||||
mkdir $EFIDestinationFolder
|
||||
```
|
||||
|
||||
2. Copy the signed policy to the created folder:
|
||||
|
||||
@ -46,7 +46,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
|
||||
<VersionEx>10.0.22530.0</VersionEx>
|
||||
<VersionEx>10.0.25070.0</VersionEx>
|
||||
<PolicyTypeID>{D2BDA982-CCF6-4344-AC5B-0B44427B6816}</PolicyTypeID>
|
||||
<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
|
||||
<Rules>
|
||||
@ -64,6 +64,8 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<EKUs />
|
||||
<!--File Rules-->
|
||||
<FileRules>
|
||||
<Allow ID="ID_ALLOW_ALL_1" FriendlyName="" FileName="*" />
|
||||
<Allow ID="ID_ALLOW_ALL_2" FriendlyName="" FileName="*" />
|
||||
<Deny ID="ID_DENY_ASIO_32_SHA1" FriendlyName="ASIO32.sys Hash Sha1" Hash="D569D4BAB86E70EFBCDFDAC9D822139D6F477B7C" />
|
||||
<Deny ID="ID_DENY_ASIO_32_SHA256" FriendlyName="ASIO32.sys Hash Sha256" Hash="80599708CE61EC5D6DCFC5977208A2A0BE2252820A88D9BA260D8CDF5DC7FBE4" />
|
||||
<Deny ID="ID_DENY_ASIO_32_SHA1_PAGE" FriendlyName="ASIO32.sys Hash Page Sha1" Hash="80FA962BDFB76DFCB9E5D13EFC38BB3D392F2E77" />
|
||||
@ -108,6 +110,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<Deny ID="ID_DENY_BANDAI_SHA256" FriendlyName="bandai.sys Hash Sha256" Hash="7FD788358585E0B863328475898BB4400ED8D478466D1B7F5CC0252671456CC8" />
|
||||
<Deny ID="ID_DENY_BANDAI_SHA1_PAGE" FriendlyName="bandai.sys Hash Page Sha1" Hash="EA360A9F23BB7CF67F08B88E6A185A699F0C5410" />
|
||||
<Deny ID="ID_DENY_BANDAI_SHA256_PAGE" FriendlyName="bandai.sys Hash Page Sha256" Hash="BB83738210650E09307CE869ACA9BFA251024D3C47B1006B94FCE2846313F56E" />
|
||||
<Deny ID="ID_DENY_BS_RCIO64_SHA1" FriendlyName="BS_RCIO64 73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e Hash Sha1" Hash="4BFE9E5A5A25B7CDE6C81EBE31ED4ABEB5147FAF" />
|
||||
<Deny ID="ID_DENY_BS_RCIO64_SHA256" FriendlyName="BS_RCIO64 73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e Hash Sha256" Hash="0381632CD236CD94FA9E64CCC958516AC50F9437F99092E231A607B1E6BE6CF8" />
|
||||
<Deny ID="ID_DENY_BS_RCIO64_SHA1_PAGE" FriendlyName="BS_RCIO64 5651466512138240\73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e Hash Page Sha1" Hash="C28B640BECA5E2834D2A373F139869CC309F6631" />
|
||||
<Deny ID="ID_DENY_BS_RCIO64_SHA256_PAGE" FriendlyName="BS_RCIO64 5651466512138240\73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e Hash Page Sha256" Hash="9378F7DFF94D9409D38FA1A125C52734D6BAEA90913FC3CEE2659FD36AB0DA29" />
|
||||
<Deny ID="ID_DENY_CAPCOM_SHA1" FriendlyName="capcom.sys Hash Sha1" Hash="1D1CAFC73C97C6BCD2331F8777D90FDCA57125A3" />
|
||||
<Deny ID="ID_DENY_CAPCOM_SHA256" FriendlyName="capcom.sys Hash Sha256" Hash="FAA08CB609A5B7BE6BFDB61F1E4A5E8ADF2F5A1D2492F262483DF7326934F5D4" />
|
||||
<Deny ID="ID_DENY_CAPCOM_SHA1_PAGE" FriendlyName="capcom.sys Hash Page Sha1" Hash="69006FBBD1B150FB9404867A5BCDC04FE0FC1BAD" />
|
||||
@ -396,6 +402,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<FileAttrib ID="ID_FILEATTRIB_BSMI" FriendlyName="" FileName="BSMI.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.0.0.3" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_BS_HWMIO64" FriendlyName="" FileName="BS_HWMIO64_W10.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="10.0.1806.2200" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_BS_I2CIO" FriendlyName="" FileName="BS_I2cIo.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.1.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_BS_RCIO" FriendlyName="BS_RCIO.sys FileAttribute" FileName="BS_RCIO64.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="10.0.0.1" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_NTIOLIB" FriendlyName="" FileName="NTIOLib.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.0.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_CPUZ_DRIVER" FriendlyName="" FileName="cpuz.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.0.4.3" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_ELBY_DRIVER" FriendlyName="" FileName="ElbyCDIO.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="6.0.3.2" />
|
||||
@ -406,6 +413,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<FileAttrib ID="ID_FILEATTRIB_LIBNICM_DRIVER" FriendlyName="" FileName="libnicm.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="3.1.12.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_MTCBSV64" FriendlyName="mtcBSv64.sys FileAttribute" FileName="mtcBSv64.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="21.2.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_NCHGBIOS2X64" FriendlyName="" FileName="NCHGBIOS2x64.SYS" MinimumFileVersion="0.0.0.0" MaximumFileVersion="4.2.4.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_NCPL_DRIVER" FriendlyName="" FileName="NCPL.SYS" MinimumFileVersion="0.0.0.0" MaximumFileVersion="3.1.12.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_NICM_DRIVER" FriendlyName="" FileName="NICM.SYS" MinimumFileVersion="0.0.0.0" MaximumFileVersion="3.1.12.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_NSCM_DRIVER" FriendlyName="" FileName="nscm.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="3.1.12.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_PHYSMEM" FriendlyName="Physmem.sys FileAttribute" FileName="physmem.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="65535.65535.65535.65535" />
|
||||
@ -418,6 +426,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<FileAttrib ID="ID_FILEATTRIB_SANDRA_DRIVER" FriendlyName="" FileName="sandra.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="10.12.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_SEGWINDRVX64" FriendlyName="segwindrvx64.sys FileAttribute" FileName="segwindrvx64.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="100.0.7.2" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_TREND_MICRO" FriendlyName="TmComm.sys" FileName="TmComm.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="8.0.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_VBOX" FriendlyName="VBoxDrv.sys FileAttribute" FileName="VBoxDrv.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="3.0.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_VIRAGT" FriendlyName="viragt.sys 32-bit" FileName="viragt.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.80.0.0" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_VIRAGT64" FriendlyName="viragt64.sys" FileName="viragt64.sys" MinimumFileVersion="0.0.0.0" MaximumFileVersion="1.0.0.11" />
|
||||
<FileAttrib ID="ID_FILEATTRIB_VMDRV" FriendlyName="vmdrv.sys FileAttribute" FileName="vmdrv.sys" MinimumFileVersion="10.0.10011.16384" />
|
||||
@ -473,6 +482,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_ATSZIO" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_IQVW64" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_LIBNICM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NCPL_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NICM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NSCM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_TREND_MICRO" />
|
||||
@ -513,6 +523,16 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<Signer ID="ID_SIGNER_VBOX" Name="GlobalSign Primary Object Publishing CA">
|
||||
<CertRoot Type="TBS" Value="041750993D7C9E063F02DFE74699598640911AAB" />
|
||||
<CertPublisher Value="innotek GmbH" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_VBOX_ORCALE" Name="VeriSign Class 3 Code Signing 2010 CA">
|
||||
<CertRoot Type="TBS" Value="4843A82ED3B1F2BFBEE9671960E1940C942F688D" />
|
||||
<CertPublisher Value="Oracle Corporation" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_VBOX" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_VBOX_SUN" Name="VeriSign Class 3 Code Signing 2004 CA">
|
||||
<CertRoot Type="TBS" Value="C7FC1727F5B75A6421A1F95C73BBDB23580C48E5" />
|
||||
<CertPublisher Value="Sun Microsystems, Inc." />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_VBOX" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_REALTEK" Name="DigiCert EV Code Signing CA">
|
||||
<CertRoot Type="TBS" Value="2D54C16A8F8B69CCDEA48D0603C132F547A5CF75" />
|
||||
@ -544,9 +564,11 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<Signer ID="ID_SIGNER_WINDOWS_3RD_PARTY_2014" Name="Microsoft Windows Third Party Component CA 2014">
|
||||
<CertRoot Type="TBS" Value="D8BE9E4D9074088EF818BC6F6FB64955E90378B2754155126FEEBBBD969CF0AE" />
|
||||
<CertPublisher Value="Microsoft Windows Hardware Compatibility Publisher" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_BS_RCIO" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_CPUZ_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_LHA" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_LIBNICM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NCPL_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NICM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NSCM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_RTKIO_DRIVER" />
|
||||
@ -600,6 +622,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<CertRoot Type="TBS" Value="4843A82ED3B1F2BFBEE9671960E1940C942F688D" />
|
||||
<CertPublisher Value="Novell, Inc." />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_LIBNICM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NCPL_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NICM_DRIVER" />
|
||||
<FileAttribRef RuleID="ID_FILEATTRIB_NSCM_DRIVER" />
|
||||
</Signer>
|
||||
@ -698,6 +721,12 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_SAASAME" Name="SaaSaMe Ltd.">
|
||||
<CertRoot Type="TBS" Value="A86DE66D8198E4272859881476A6F9936034A482" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_NVIDIA_2011" Name="Leaked 2011 NVIDIA Corporation Verisign Class 3 Code Signing 2010 CA">
|
||||
<CertRoot Type="TBS" Value="15C37DBEBE6FCC77108E3D7AD982676D3D5E77F7" />
|
||||
</Signer>
|
||||
<Signer ID="ID_SIGNER_NVIDIA_2015" Name="Leaked 2015 NVIDIA Corporation Verisign Class 3 Code Signing 2010 CA">
|
||||
<CertRoot Type="TBS" Value="F049A238763D4A90B148AB10A500F96EBF1DC436" />
|
||||
</Signer>
|
||||
</Signers>
|
||||
<!--Driver Signing Scenarios-->
|
||||
@ -728,16 +757,20 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<DeniedSigner SignerId="ID_SIGNER_MIMIKATZ_KERNEL_SHA2" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_MIMIKATZ_USER" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_NANJING" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_NVIDIA_2011" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_NVIDIA_2015" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_PHYSMEM" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_REALTEK" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_RWEVERY" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_SAASAME" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_SAASAME" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_SANDRA" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_SANDRA_THAWTE" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_SPEEDFAN" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_SYMANTEC_CLASS_3" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_TRUST_ASIA" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VBOX" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VBOX_ORCALE" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VBOX_SUN" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VERISIGN_2004" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VERISIGN_2004_BIOSTAR" />
|
||||
<DeniedSigner SignerId="ID_SIGNER_VERISIGN_2009" />
|
||||
@ -802,6 +835,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
<FileRuleRef RuleID="ID_DENY_BANDAI_SHA256" />
|
||||
<FileRuleRef RuleID="ID_DENY_BANDAI_SHA1_PAGE" />
|
||||
<FileRuleRef RuleID="ID_DENY_BANDAI_SHA256_PAGE" />
|
||||
<FileRuleRef RuleID="ID_DENY_BS_RCIO64_SHA1" />
|
||||
<FileRuleRef RuleID="ID_DENY_BS_RCIO64_SHA256" />
|
||||
<FileRuleRef RuleID="ID_DENY_BS_RCIO64_SHA1_PAGE" />
|
||||
<FileRuleRef RuleID="ID_DENY_BS_RCIO64_SHA256_PAGE" />
|
||||
<FileRuleRef RuleID="ID_DENY_CAPCOM_SHA1" />
|
||||
<FileRuleRef RuleID="ID_DENY_CAPCOM_SHA256" />
|
||||
<FileRuleRef RuleID="ID_DENY_CAPCOM_SHA1_PAGE" />
|
||||
@ -1106,7 +1143,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
|
||||
</Setting>
|
||||
<Setting Provider="PolicyInfo" Key="Information" ValueName="Id">
|
||||
<Value>
|
||||
<String>10.0.22530.0</String>
|
||||
<String>10.0.25070.0</String>
|
||||
</Value>
|
||||
</Setting>
|
||||
</Settings>
|
||||
|
||||
Reference in New Issue
Block a user