deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 21:37:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

final migrated build

Browse Source
This commit is contained in:
Brian Lich 2016-04-01 14:09:23 -07:00
parent 6fba143fad
commit ae6fcffb07
22 changed files with 3832 additions and 2234 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md
View File

@ -17,7 +17,7 @@ author: brianlic-msft
- Windows 10 Insider Preview
- Windows 10 Mobile Preview
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows SDK Insider Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
Add multiple apps to your enterprise data protection (EDP) **Protected Apps** list at the same time, by using the Microsoft Intune Custom URI functionality and the AppLocker Group Policy. For more info about how to create a custom URI using Intune, see [Windows 10 custom policy settings in Microsoft Intune](http://go.microsoft.com/fwlink/?LinkID=691330).

2
windows/keep-secure/audit-pnp-activity.md
View File

@ -15,7 +15,7 @@ author: brianlic-msft
- Windows 10
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows SDK Insider Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
This topic for the IT professional describes the advanced security audit policy setting, **Audit PNP Activity**, which determines when plug and play detects an external device.

2
windows/keep-secure/basic-audit-directory-service-access.md
View File

@ -15,7 +15,7 @@ author: brianlic-msft
- Windows 10
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows SDK Insider Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
Determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified.

2
windows/keep-secure/basic-audit-logon-events.md
View File

@ -15,7 +15,7 @@ author: brianlic-msft
- Windows 10
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows SDK Insider Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
Determines whether to audit each instance of a user logging on to or logging off from a device.

2
windows/keep-secure/create-edp-policy-using-intune.md
View File

@ -16,7 +16,7 @@ author: brianlic-msft
- Windows 10 Insider Preview
- Windows 10 Mobile Preview
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows SDK Insider Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
Microsoft Intune helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network.

2
windows/keep-secure/create-edp-policy-using-sccm.md
View File

@ -17,7 +17,7 @@ author: brianlic-msft
- Windows 10 Mobile Preview
- System Center Configuration Manager (version 1511 or later)
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows SDK Insider Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
Configuration Manager (version 1511 or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network.

2
windows/keep-secure/create-vpn-and-edp-policy-using-intune.md
View File

@ -17,7 +17,7 @@ author: brianlic-msft
- Windows 10 Insider Preview
- Windows 10 Mobile Preview
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows SDK Insider Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
After you've created and deployed your enterprise data protection (EDP) policy, you can use Microsoft Intune to create and deploy your Virtual Private Network (VPN) policy, linking it to your EDP policy.

2
windows/keep-secure/deploy-edp-policy-using-intune.md
View File

@ -17,7 +17,7 @@ author: brianlic-msft
- Windows 10 Insider Preview
- Windows 10 Mobile Preview
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows SDK Insider Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
After you’ve created your enterprise data protection (EDP) policy, you'll need to deploy it to your organization's enrolled devices. Enrollment can be done for business or personal devices, allowing the devices to use your managed apps and to sync with your managed content and information.

2
windows/keep-secure/enlightened-microsoft-apps-and-edp.md
View File

@ -17,7 +17,7 @@ author: brianlic-msft
- Windows 10 Insider Preview
- Windows 10 Mobile Preview
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows SDK Insider Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your **Protected Apps** list.

2
windows/keep-secure/guidance-and-best-practices-edp.md
View File

@ -17,7 +17,7 @@ author: brianlic-msft
- Windows 10 Insider Preview
- Windows 10 Mobile Preview
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows SDK Insider Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
This section includes info about the enlightened Microsoft apps, including how to add them to your **Protected Apps** list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with enterprise data protection (EDP).

459
windows/keep-secure/implement-microsoft-passport-in-your-organization.md
View File

@ -29,216 +29,267 @@ The Group Policy setting **Turn on PIN sign-in** does not apply to Windows 10.
The following table lists the Group Policy settings that you can configure for Passport use in your workplace. These policy settings are available in **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Microsoft Passport for Work**.
Policy
Options
Use Microsoft Passport for Work
**Not configured**: Users can provision Passport for Work, which encrypts their domain password.
**Enabled**: Device provisions Passport for Work using keys or certificates for all users.
**Disabled**: Device does not provision Passport for Work for any user.
Use a hardware security device
**Not configured**: Passport for Work will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.
**Enabled**: Passport for Work will only be provisioned using TPM.
**Disabled**: Passport for Work will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.
Use biometrics
**Not configured**: Biometrics can be used as a gesture in place of a PIN.
**Enabled**: Biometrics can be used as a gesture in place of a PIN.
**Disabled**: Only a PIN can be used as a gesture.
PIN Complexity
Require digits
**Not configured**: Users must include a digit in their PIN.
**Enabled**: Users must include a digit in their PIN.
**Disabled**: Users cannot use digits in their PIN.
Require lowercase letters
**Not configured**: Users cannot use lowercase letters in their PIN.
**Enabled**: Users must include at least one lowercase letter in their PIN.
**Disabled**: Users cannot use lowercase letters in their PIN.
Maximum PIN length
**Not configured**: PIN length must be less than or equal to 127.
**Enabled**: PIN length must be less than or equal to the number you specify.
**Disabled**: PIN length must be less than or equal to 127.
Minimum PIN length
**Not configured**: PIN length must be greater than or equal to 4.
**Enabled**: PIN length must be greater than or equal to the number you specify.
**Disabled**: PIN length must be greater than or equal to 4.
Expiration
**Not configured**: PIN does not expire.
**Enabled**: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.
**Disabled**: PIN does not expire.
History
**Not configured**: Previous PINs are not stored.
**Enabled**: Specify the number of previous PINs that can be associated to a user account that can't be reused.
**Disabled**: Previous PINs are not stored.
**Note**  Current PIN is included in PIN history.
 
Require special characters
**Not configured**: Users cannot include a special character in their PIN.
**Enabled**: Users must include at least one special character in their PIN.
**Disabled**: Users cannot include a special character in their PIN.
Require uppercase letters
**Not configured**: Users cannot include an uppercase letter in their PIN.
**Enabled**: Users must include at least one uppercase letter in their PIN.
**Disabled**: Users cannot include an uppercase letter in their PIN.
[Remote Passport](prepare-people-to-use-microsoft-passport.md#bmk-remote)
Use Remote Passport
**Note**  Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.
 
**Not configured**: Remote Passport is disabled.
**Enabled**: Users can use a portable, registered device as a companion device for desktop authentication.
**Disabled**: Remote Passport is disabled.
 
<table>
<tr>
<th colspan="2">Policy</th>
<th>Options</th>
</tr>
<tr>
<td>Use Microsoft Passport for Work</td>
<td></td>
<td>
<p><b>Not configured</b>: Users can provision Passport for Work, which encrypts their domain password.</p>
<p><b>Enabled</b>: Device provisions Passport for Work using keys or certificates for all users.</p>
<p><b>Disabled</b>: Device does not provision Passport for Work for any user.</p>
</td>
</tr>
<tr>
<td>Use a hardware security device</td>
<td></td>
<td>
<p><b>Not configured</b>: Passport for Work will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.</p>
<p><b>Enabled</b>: Passport for Work will only be provisioned using TPM.</p>
<p><b>Disabled</b>: Passport for Work will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.</p>
</td>
</tr>
<tr>
<td>Use biometrics</td>
<td></td>
<td>
<p><b>Not configured</b>: Biometrics can be used as a gesture in place of a PIN.</p>
<p><b>Enabled</b>: Biometrics can be used as a gesture in place of a PIN.</p>
<p><b>Disabled</b>: Only a PIN can be used as a gesture.</p>
</td>
</tr>
<tr>
<td rowspan="8">PIN Complexity</td>
<td>Require digits</td>
<td>
<p><b>Not configured</b>: Users must include a digit in their PIN.</p>
<p><b>Enabled</b>: Users must include a digit in their PIN.</p>
<p><b>Disabled</b>: Users cannot use digits in their PIN.</p>
</td>
</tr>
<tr>
<td>Require lowercase letters</td>
<td>
<p><b>Not configured</b>: Users cannot use lowercase letters in their PIN.</p>
<p><b>Enabled</b>: Users must include at least one lowercase letter in their PIN.</p>
<p><b>Disabled</b>: Users cannot use lowercase letters in their PIN.</p>
</td>
</tr>
<tr>
<td>Maximum PIN length</td>
<td>
<p><b>Not configured</b>: PIN length must be less than or equal to 127.</p>
<p><b>Enabled</b>: PIN length must be less than or equal to the number you specify.</p>
<p><b>Disabled</b>: PIN length must be less than or equal to 127.</p>
</td>
</tr>
<tr>
<td>Minimum PIN length</td>
<td>
<p><b>Not configured</b>: PIN length must be greater than or equal to 4.</p>
<p><b>Enabled</b>: PIN length must be greater than or equal to the number you specify.</p>
<p><b>Disabled</b>: PIN length must be greater than or equal to 4.</p>
</td>
</tr>
<tr>
<td>Expiration</td>
<td>
<p><b>Not configured</b>: PIN does not expire.</p>
<p><b>Enabled</b>: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.</p>
<p><b>Disabled</b>: PIN does not expire.</p>
</td>
</tr>
<tr>
<td>History</td>
<td>
<p><b>Not configured</b>: Previous PINs are not stored.</p>
<p><b>Enabled</b>: Specify the number of previous PINs that can be associated to a user account that can't be reused.</p>
<p><b>Disabled</b>: Previous PINs are not stored.</p>
<div class="alert"><b>Note</b>  Current PIN is included in PIN history.</div>
<div> </div>
</td>
</tr>
<tr>
<td>Require special characters</td>
<td>
<p><b>Not configured</b>: Users cannot include a special character in their PIN.</p>
<p><b>Enabled</b>: Users must include at least one special character in their PIN.</p>
<p><b>Disabled</b>: Users cannot include a special character in their PIN.</p>
</td>
</tr>
<tr>
<td>Require uppercase letters</td>
<td>
<p><b>Not configured</b>: Users cannot include an uppercase letter in their PIN.</p>
<p><b>Enabled</b>: Users must include at least one uppercase letter in their PIN.</p>
<p><b>Disabled</b>: Users cannot include an uppercase letter in their PIN.</p>
</td>
</tr>
<tr>
<td><a href="prepare_people_to_use_microsoft_passport.htm#BMK_remote">Remote Passport</a></td>
<td>
<p>Use Remote Passport</p>
<div class="alert"><b>Note</b>  Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.</div>
<div> </div>
</td>
<td>
<p><b>Not configured</b>: Remote Passport is disabled.</p>
<p><b>Enabled</b>: Users can use a portable, registered device as a companion device for desktop authentication.</p>
<p><b>Disabled</b>: Remote Passport is disabled.</p>
</td>
</tr>
</table>
## MDM policy settings for Passport
The following table lists the MDM policy settings that you can configure for Passport use in your workplace. These MDM policy settings use the [PassportForWork configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkId=692070).
Policy
Scope
Default
Options
UsePassportForWork
Device
True
True: Passport will be provisioned for all users on the device.
False: Users will not be able to provision Passport.
**Note**  If Passport is enabled, and then the policy is changed to False, users who previously set up Passport can continue to use it, but will not be able to set up Passport on other devices.
 
RequireSecurityDevice
Device
False
True: Passport will only be provisioned using TPM.
False: Passport will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.
Biometrics
UseBiometrics
Device
False
True: Biometrics can be used as a gesture in place of a PIN for domain logon.
False: Only a PIN can be used as a gesture for domain logon.
FacialFeaturesUser
EnhancedAntiSpoofing
Device
Not configured
Not configured: users can choose whether to turn on enhanced anti-spoofing.
True: Enhanced anti-spoofing is required on devices which support it.
False: Users cannot turn on enhanced anti-spoofing.
PINComplexity
Digits
Device or user
2
1: Numbers are not allowed.
2: At least one number is required.
Lowercase letters
Device or user
1
1: Lowercase letters are not allowed.
2: At least one lowercase letter is required.
Maximum PIN length
Device or user
127
Maximum length that can be set is 127. Maximum length cannot be less than minimum setting.
Minimum PIN length
Device or user
4
Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting.
Expiration
Device or user
0
Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user’s PIN will never expire.
History
Device or user
0
Integer value that specifies the number of past PINs that can be associated to a user account that can’t be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required.
Special characters
Device or user
1
1: Special characters are not allowed.
2: At least one special character is required.
Uppercase letters
Device or user
1
1: Uppercase letters are not allowed
2: At least one uppercase letter is required
Remote
UseRemotePassport
**Note**  Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.
 
Device or user
False
True: [Remote Passport](prepare-people-to-use-microsoft-passport.md#bmk-remote) is enabled.
False: [Remote Passport](prepare-people-to-use-microsoft-passport.md#bmk-remote) is disabled.
 
<table>
<tr>
<th colspan="2">Policy</th>
<th>Scope</th>
<th>Default</th>
<th>Options</th>
</tr>
<tr>
<td>UsePassportForWork</td>
<td></td>
<td>Device</td>
<td>True</td>
<td>
<p>True: Passport will be provisioned for all users on the device.</p>
<p>False: Users will not be able to provision Passport. </p>
<div class="alert"><b>Note</b>  If Passport is enabled, and then the policy is changed to False, users who previously set up Passport can continue to use it, but will not be able to set up Passport on other devices.</div>
<div> </div>
</td>
</tr>
<tr>
<td>RequireSecurityDevice</td>
<td></td>
<td>Device</td>
<td>False</td>
<td>
<p>True: Passport will only be provisioned using TPM.</p>
<p>False: Passport will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.</p>
</td>
</tr>
<tr>
<td rowspan="2">Biometrics</td>
<td>
<p>UseBiometrics</p>
</td>
<td>Device </td>
<td>False</td>
<td>
<p>True: Biometrics can be used as a gesture in place of a PIN for domain logon.</p>
<p>False: Only a PIN can be used as a gesture for domain logon.</p>
</td>
</tr>
<tr>
<td>
<p>FacialFeaturesUser</p>
<p>EnhancedAntiSpoofing</p>
</td>
<td>Device</td>
<td>Not configured</td>
<td>
<p>Not configured: users can choose whether to turn on enhanced anti-spoofing.</p>
<p>True: Enhanced anti-spoofing is required on devices which support it.</p>
<p>False: Users cannot turn on enhanced anti-spoofing.</p>
</td>
</tr>
<tr>
<td rowspan="9">PINComplexity</td>
</tr>
<tr>
<td>Digits </td>
<td>Device or user</td>
<td>2 </td>
<td>
<p>1: Numbers are not allowed. </p>
<p>2: At least one number is required.</p>
</td>
</tr>
<tr>
<td>Lowercase letters </td>
<td>Device or user</td>
<td>1 </td>
<td>
<p>1: Lowercase letters are not allowed. </p>
<p>2: At least one lowercase letter is required.</p>
</td>
</tr>
<tr>
<td>Maximum PIN length </td>
<td>Device or user</td>
<td>127 </td>
<td>
<p>Maximum length that can be set is 127. Maximum length cannot be less than minimum setting.</p>
</td>
</tr>
<tr>
<td>Minimum PIN length</td>
<td>Device or user</td>
<td>4</td>
<td>
<p>Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting.</p>
</td>
</tr>
<tr>
<td>Expiration </td>
<td>Device or user</td>
<td>0</td>
<td>
<p>Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user’s PIN will never expire.
</p>
</td>
</tr>
<tr>
<td>History</td>
<td>Device or user</td>
<td>0</td>
<td>
<p>Integer value that specifies the number of past PINs that can be associated to a user account that can’t be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required.
</p>
</td>
</tr>
<tr>
<td>Special characters</td>
<td>Device or user</td>
<td>1</td>
<td>
<p>1: Special characters are not allowed. </p>
<p>2: At least one special character is required.</p>
</td>
</tr>
<tr>
<td>Uppercase letters</td>
<td>Device or user</td>
<td>1</td>
<td>
<p>1: Uppercase letters are not allowed </p>
<p>2: At least one uppercase letter is required</p>
</td>
</tr>
<tr>
<td>Remote</td>
<td>
<p>UseRemotePassport</p>
<div class="alert"><b>Note</b>  Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.</div>
<div> </div>
</td>
<td>Device or user</td>
<td>False</td>
<td>
<p>True: <a href="prepare_people_to_use_microsoft_passport.htm#BMK_remote">Remote Passport</a> is enabled.</p>
<p>False: <a href="prepare_people_to_use_microsoft_passport.htm#BMK_remote">Remote Passport</a> is disabled.</p>
</td>
</tr>
</table>
**Note**  
If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN.

2
windows/keep-secure/overview-create-edp-policy.md
View File

@ -16,7 +16,7 @@ author: brianlic-msft
- Windows 10 Insider Preview
- Windows 10 Mobile Preview
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows SDK Insider Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
Microsoft Intune and System Center Configuration Manager (version 1511 or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network.

2
windows/keep-secure/protect-enterprise-data-using-edp.md
View File

@ -17,7 +17,7 @@ author: brianlic-msft
- Windows 10 Insider Preview
- Windows 10 Mobile Preview
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows SDK Insider Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures to their personal email account, copies and pastes product info to a public Yammer group or tweet, or saves an in-progress sales report to their public cloud storage.

2
windows/keep-secure/testing-scenarios-for-edp.md
View File

@ -13,7 +13,7 @@ author: brianlic-msft
- Windows 10 Insider Preview
- Windows 10 Mobile Preview
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows SDK Insider Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
We've come up with a list of suggested testing scenarios that you can use to test enterprise data protection (EDP) in your company.

5024
windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md
View File

File diff suppressed because it is too large Load Diff

32
windows/manage/change-history-for-manage-and-update-windows-10.md
View File

@ -13,6 +13,30 @@ author: jdeckerMS
This topic lists new and updated topics in the [Manage and update Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md).
## April 2016
<table>
<colgroup>
<col width="50%" />
<col width="50%" />
</colgroup>
<thead>
<tr class="header">
<th align="left">New or changed topic</th>
<th align="left">Description</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td align="left">[Configure telemetry and other settings in your organization](disconnect-your-organization-from-microsoft.md)</td>
<td align="left"><p>Added the font streaming section.</p></td>
</tr>
</tbody>
</table>
 
## March 2016
@ -40,14 +64,6 @@ This topic lists new and updated topics in the [Manage and update Windows 10](in
<td align="left">[Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md))</td>
<td align="left"><p>Updated to include the new Preview feature, Cortana and Microsoft Dynamics CRM integration.</p></td>
</tr>
<tr class="even">
<td align="left">[Configure telemetry in your organization](../manage/configure-telemetry-in-your-organization.md)</td>
<td align="left"><p>Updated to include Windows Server 2016 Technical Preview.</p></td>
</tr>
<tr class="odd">
<td align="left">[Disconnect from Microsoft and configure privacy settings in your organization](disconnect-your-organization-from-microsoft.md)</td>
<td align="left"><p>Removed the telemetry content into its own topic.</p></td>
</tr>
</tbody>
</table>

255
windows/manage/disconnect-your-organization-from-microsoft.md
View File

@ -45,91 +45,93 @@ Here's what's covered in this article:
- [3. Device metadata retrieval](#bkmk-devinst)
- [4. Insider Preview builds](#bkmk-previewbuilds)
- [4. Font streaming](#font-streaming)
- [5. Internet Explorer](#bkmk-ie)
- [5. Insider Preview builds](#bkmk-previewbuilds)
- [5.1 Internet Explorer Group Policies](#bkmk-ie-gp)
- [6. Internet Explorer](#bkmk-ie)
- [5.2 ActiveX control blocking](#bkmk-ie-activex)
- [6.1 Internet Explorer Group Policies](#bkmk-ie-gp)
- [6. Mail synchronization](#bkmk-mailsync)
- [6.2 ActiveX control blocking](#bkmk-ie-activex)
- [7. Microsoft Edge](#bkmk-edge)
- [7. Mail synchronization](#bkmk-mailsync)
- [7.1 Microsoft Edge Group Policies](#bkmk-edgegp)
- [8. Microsoft Edge](#bkmk-edge)
- [7.2 Microsoft Edge MDM policies](#bkmk-edge-mdm)
- [8.1 Microsoft Edge Group Policies](#bkmk-edgegp)
- [7.3 Microsoft Edge Windows Provisioning](#bkmk-edge-prov)
- [8.2 Microsoft Edge MDM policies](#bkmk-edge-mdm)
- [8. Network Connection Status Indicator](#bkmk-ncsi)
- [8.3 Microsoft Edge Windows Provisioning](#bkmk-edge-prov)
- [9. Offline maps](#bkmk-offlinemaps)
- [9. Network Connection Status Indicator](#bkmk-ncsi)
- [10. OneDrive](#bkmk-onedrive)
- [10. Offline maps](#bkmk-offlinemaps)
- [11. Preinstalled apps](#bkmk-preinstalledapps)
- [11. OneDrive](#bkmk-onedrive)
- [12. Settings &gt; Privacy](#bkmk-settingssection)
- [12. Preinstalled apps](#bkmk-preinstalledapps)
- [12.1 General](#bkmk-general)
- [13. Settings &gt; Privacy](#bkmk-settingssection)
- [12.2 Location](#bkmk-priv-location)
- [13.1 General](#bkmk-general)
- [12.3 Camera](#bkmk-priv-camera)
- [13.2 Location](#bkmk-priv-location)
- [12.4 Microphone](#bkmk-priv-microphone)
- [13.3 Camera](#bkmk-priv-camera)
- [12.5 Speech, inking, & typing](#bkmk-priv-speech)
- [13.4 Microphone](#bkmk-priv-microphone)
- [12.6 Account info](#bkmk-priv-accounts)
- [13.5 Speech, inking, & typing](#bkmk-priv-speech)
- [12.7 Contacts](#bkmk-priv-contacts)
- [13.6 Account info](#bkmk-priv-accounts)
- [12.8 Calendar](#bkmk-priv-calendar)
- [13.7 Contacts](#bkmk-priv-contacts)
- [12.9 Call history](#bkmk-priv-callhistory)
- [13.8 Calendar](#bkmk-priv-calendar)
- [12.10 Email](#bkmk-priv-email)
- [13.9 Call history](#bkmk-priv-callhistory)
- [12.11 Messaging](#bkmk-priv-messaging)
- [13.10 Email](#bkmk-priv-email)
- [12.12 Radios](#bkmk-priv-radios)
- [13.11 Messaging](#bkmk-priv-messaging)
- [12.13 Other devices](#bkmk-priv-other-devices)
- [13.12 Radios](#bkmk-priv-radios)
- [12.14 Feedback & diagnostics](#bkmk-priv-feedback)
- [13.13 Other devices](#bkmk-priv-other-devices)
- [12.15 Background apps](#bkmk-priv-background)
- [13.14 Feedback & diagnostics](#bkmk-priv-feedback)
- [13. Software Protection Platform](#bkmk-spp)
- [13.15 Background apps](#bkmk-priv-background)
- [14. Sync your settings](#bkmk-syncsettings)
- [14. Software Protection Platform](#bkmk-spp)
- [15. Teredo](#bkmk-teredo)
- [15. Sync your settings](#bkmk-syncsettings)
- [16. Wi-Fi Sense](#bkmk-wifisense)
- [16. Teredo](#bkmk-teredo)
- [17. Windows Defender](#bkmk-defender)
- [17. Wi-Fi Sense](#bkmk-wifisense)
- [18. Windows Media Player](#bkmk-wmp)
- [18. Windows Defender](#bkmk-defender)
- [19. Windows spotlight](#bkmk-spotlight)
- [19. Windows Media Player](#bkmk-wmp)
- [20. Windows Store](#bkmk-windowsstore)
- [20. Windows spotlight](#bkmk-spotlight)
- [21. Windows Update Delivery Optimization](#bkmk-updates)
- [21. Windows Store](#bkmk-windowsstore)
- [21.1 Settings &gt; Update & security](#bkmk-wudo-ui)
- [22. Windows Update Delivery Optimization](#bkmk-updates)
- [21.2 Delivery Optimization Group Policies](#bkmk-wudo-gp)
- [22.1 Settings &gt; Update & security](#bkmk-wudo-ui)
- [21.3 Delivery Optimization MDM policies](#bkmk-wudo-mdm)
- [22.2 Delivery Optimization Group Policies](#bkmk-wudo-gp)
- [21.4 Delivery Optimization Windows Provisioning](#bkmk-wudo-prov)
- [22.3 Delivery Optimization MDM policies](#bkmk-wudo-mdm)
- [22. Windows Update](#bkmk-wu)
- [22.4 Delivery Optimization Windows Provisioning](#bkmk-wudo-prov)
- [23. Windows Update](#bkmk-wu)
- [Manage your telemetry settings](#bkmk-utc)
@ -201,43 +203,45 @@ The settings in this section assume you are using Windows 10, version 1511 (cur
- [3. Device metadata retrieval](#bkmk-devinst)
- [4. Insider Preview builds](#bkmk-previewbuilds)
- [4. Font streaming](#font-streaming)
- [5. Internet Explorer](#bkmk-ie)
- [5. Insider Preview builds](#bkmk-previewbuilds)
- [6. Mail synchronization](#bkmk-mailsync)
- [6. Internet Explorer](#bkmk-ie)
- [7. Microsoft Edge](#bkmk-edge)
- [7. Mail synchronization](#bkmk-mailsync)
- [8. Network Connection Status Indicator](#bkmk-ncsi)
- [8. Microsoft Edge](#bkmk-edge)
- [9. Offline maps](#bkmk-offlinemaps)
- [9. Network Connection Status Indicator](#bkmk-ncsi)
- [10. OneDrive](#bkmk-onedrive)
- [10. Offline maps](#bkmk-offlinemaps)
- [11. Preinstalled apps](#bkmk-preinstalledapps)
- [11. OneDrive](#bkmk-onedrive)
- [12. Settings &gt; Privacy](#bkmk-settingssection)
- [12. Preinstalled apps](#bkmk-preinstalledapps)
- [13. Software Protection Platform](#bkmk-spp)
- [13. Settings &gt; Privacy](#bkmk-settingssection)
- [14. Sync your settings](#bkmk-syncsettings)
- [14. Software Protection Platform](#bkmk-spp)
- [15. Teredo](#bkmk-teredo)
- [15. Sync your settings](#bkmk-syncsettings)
- [16. Wi-Fi Sense](#bkmk-wifisense)
- [16. Teredo](#bkmk-teredo)
- [17. Windows Defender](#bkmk-defender)
- [17. Wi-Fi Sense](#bkmk-wifisense)
- [18. Windows Media Player](#bkmk-wmp)
- [18. Windows Defender](#bkmk-defender)
- [19. Windows spotlight](#bkmk-spotlight)
- [19. Windows Media Player](#bkmk-wmp)
- [20. Windows Store](#bkmk-windowsstore)
- [20. Windows spotlight](#bkmk-spotlight)
- [21. Windows Update](#bkmk-wu)
- [21. Windows Store](#bkmk-windowsstore)
- [22. Windows Update Delivery Optimization](#bkmk-updates)
- [22. Windows Update](#bkmk-wu)
- [23. Windows Update Delivery Optimization](#bkmk-updates)
See the following table for a summary of the management settings. For more info, see its corresponding section.
@ -372,7 +376,18 @@ You can prevent Windows from setting the time automatically.
To prevent Windows from retrieving device metadata from the Internet, apply the Group Policy: **Computer Configuration** &gt; **Administrative Templates** &gt; **System** &gt; **Device Installation** &gt; **Prevent device metadata retrieval from the Internet**.
### <a href="" id="bkmk-previewbuilds"></a>4. Insider Preview builds
### <a href="" id="font-streaming"></a>4. Font streaming
Starting with Windows 10, fonts that are included in Windows but that are not stored on the local device can be downloaded on demand.
To turn off font streaming, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1.
**Note**  
This may change in future versions of Windows.
 
### <a href="" id="bkmk-previewbuilds"></a>5. Insider Preview builds
To turn off Insider Preview builds if you're running a released version of Windows 10. If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds.
@ -402,11 +417,11 @@ To turn off Insider Preview builds if you're running a released version of Windo
- **2**. (default) Not configured. Users can make their devices available for download and installing preview software.
### <a href="" id="bkmk-ie"></a>5. Internet Explorer
### <a href="" id="bkmk-ie"></a>6. Internet Explorer
Use Group Policy to manage settings for Internet Explorer.
### <a href="" id="bkmk-ie-gp"></a>5.1 Internet Explorer Group Policies
### <a href="" id="bkmk-ie-gp"></a>6.1 Internet Explorer Group Policies
Find the Internet Explorer Group Policy objects under **Computer Configuration** &gt; **Administrative Templates** &gt; **Windows Components** &gt; **Internet Explorer**.
@ -454,13 +469,13 @@ Find the Internet Explorer Group Policy objects under **Computer Configuration**
 
### <a href="" id="bkmk-ie-activex"></a>5.2 ActiveX control blocking
### <a href="" id="bkmk-ie-activex"></a>6.2 ActiveX control blocking
ActiveX control blocking periodically downloads a new list of out-of-date ActiveX controls that should be blocked. You can turn this off by changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero).
For more info, see [Out-of-date ActiveX control blocking](http://technet.microsoft.com/library/dn761713.aspx).
### <a href="" id="bkmk-mailsync"></a>6. Mail synchronization
### <a href="" id="bkmk-mailsync"></a>7. Mail synchronization
To turn off mail synchronization for Microsoft Accounts that are configured on a device:
@ -478,11 +493,11 @@ To turn off the Windows Mail app:
- Apply the Group Policy: **Computer Configuration** &gt; **Administrative Templates** &gt; **Windows Components** &gt; **Windows Mail** &gt; **Turn off Windows Mail application**
### <a href="" id="bkmk-edge"></a>7. Microsoft Edge
### <a href="" id="bkmk-edge"></a>8. Microsoft Edge
Use either Group Policy or MDM policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730682).
### <a href="" id="bkmk-edgegp"></a>7.1 Microsoft Edge Group Policies
### <a href="" id="bkmk-edgegp"></a>8.1 Microsoft Edge Group Policies
Find the Microsoft Edge Group Policy objects under **Computer Configuration** &gt; **Administrative Templates** &gt; **Windows Components** &gt; **Microsoft Edge**.
@ -543,7 +558,7 @@ The Microsoft Edge Group Policy names were changed in Windows 10, version 1511.
 
### <a href="" id="bkmk-edge-mdm"></a>7.2 Microsoft Edge MDM policies
### <a href="" id="bkmk-edge-mdm"></a>8.2 Microsoft Edge MDM policies
The following Microsoft Edge MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
@ -589,13 +604,13 @@ The following Microsoft Edge MDM policies are available in the [Policy CSP](http
 
### <a href="" id="bkmk-edge-prov"></a>7.3 Microsoft Edge Windows Provisioning
### <a href="" id="bkmk-edge-prov"></a>8.3 Microsoft Edge Windows Provisioning
Use Windows ICD to create a provisioning package with the settings for these policies, go to **Runtime settings** &gt; **Policies**.
For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](http://technet.microsoft.com/library/mt270204.aspx).
### <a href="" id="bkmk-ncsi"></a>8. Network Connection Status Indicator
### <a href="" id="bkmk-ncsi"></a>9. Network Connection Status Indicator
Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftncsi.com to determine if the device can communicate with the Internet. For more info about NCIS, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx).
@ -603,7 +618,7 @@ You can turn off NCSI through Group Policy:
- Enable the Group Policy: **Computer Configuration** &gt; **Administrative Templates** &gt; **System** &gt; **Internet Communication Management** &gt; **Internet Communication Settings** &gt; **Turn off Windows Network Connectivity Status Indicator active tests**
### <a href="" id="bkmk-offlinemaps"></a>9. Offline maps
### <a href="" id="bkmk-offlinemaps"></a>10. Offline maps
You can turn off the ability to download and update offline maps.
@ -613,13 +628,13 @@ You can turn off the ability to download and update offline maps.
- Apply the Group Policy: **Computer Configuration** &gt; **Administrative Templates** &gt; **Windows Components** &gt; **Maps** &gt; **Turn off Automatic Download and Update of Map Data**
### <a href="" id="bkmk-onedrive"></a>10. OneDrive
### <a href="" id="bkmk-onedrive"></a>11. OneDrive
To turn off OneDrive in your organization:
- Apply the Group Policy: **Computer Configuration** &gt; **Administrative Templates** &gt; **Windows Components** &gt; **OneDrive** &gt; **Prevent the usage of OneDrive for file storage**
### <a href="" id="bkmk-preinstalledapps"></a>11. Preinstalled apps
### <a href="" id="bkmk-preinstalledapps"></a>12. Preinstalled apps
Some preinstalled apps get content before they are opened to ensure a great experience. You can remove these using the steps in this section.
@ -731,41 +746,41 @@ To remove the Get Skype app:
Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.SkypeApp | Remove-AppxPackage**
### <a href="" id="bkmk-settingssection"></a>12. Settings &gt; Privacy
### <a href="" id="bkmk-settingssection"></a>13. Settings &gt; Privacy
Use Settings &gt; Privacy to configure some settings that may be important to your organization. Except for the Feedback & Diagnostics page, these settings must be configured for every user account that signs into the PC.
- [12.1 General](#bkmk-general)
- [13.1 General](#bkmk-general)
- [12.2 Location](#bkmk-priv-location)
- [13.2 Location](#bkmk-priv-location)
- [12.3 Camera](#bkmk-priv-camera)
- [13.3 Camera](#bkmk-priv-camera)
- [12.4 Microphone](#bkmk-priv-microphone)
- [13.4 Microphone](#bkmk-priv-microphone)
- [12.5 Speech, inking, & typing](#bkmk-priv-speech)
- [13.5 Speech, inking, & typing](#bkmk-priv-speech)
- [12.6 Account info](#bkmk-priv-accounts)
- [13.6 Account info](#bkmk-priv-accounts)
- [12.7 Contacts](#bkmk-priv-contacts)
- [13.7 Contacts](#bkmk-priv-contacts)
- [12.8 Calendar](#bkmk-priv-calendar)
- [13.8 Calendar](#bkmk-priv-calendar)
- [12.9 Call history](#bkmk-priv-callhistory)
- [13.9 Call history](#bkmk-priv-callhistory)
- [12.10 Email](#bkmk-priv-email)
- [13.10 Email](#bkmk-priv-email)
- [12.11 Messaging](#bkmk-priv-messaging)
- [13.11 Messaging](#bkmk-priv-messaging)
- [12.12 Radios](#bkmk-priv-radios)
- [13.12 Radios](#bkmk-priv-radios)
- [12.13 Other devices](#bkmk-priv-other-devices)
- [13.13 Other devices](#bkmk-priv-other-devices)
- [12.14 Feedback & diagnostics](#bkmk-priv-feedback)
- [13.14 Feedback & diagnostics](#bkmk-priv-feedback)
- [12.15 Background apps](#bkmk-priv-background)
- [13.15 Background apps](#bkmk-priv-background)
### <a href="" id="bkmk-priv-general"></a>12.1 General
### <a href="" id="bkmk-priv-general"></a>13.1 General
**General** includes options that don't fall into other areas.
@ -837,7 +852,7 @@ To turn off **Let websites provide locally relevant content by accessing my lang
- Create a new REG\_DWORD registry setting called **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile**, with a value of 1.
### <a href="" id="bkmk-priv-location"></a>12.2 Location
### <a href="" id="bkmk-priv-location"></a>13.2 Location
In the **Location** area, you choose whether devices have access to location-specific sensors and which apps have access to the device's location.
@ -890,7 +905,7 @@ To turn off **Choose apps that can use your location**:
- Turn off each app using the UI.
### <a href="" id="bkmk-priv-camera"></a>12.3 Camera
### <a href="" id="bkmk-priv-camera"></a>13.3 Camera
In the **Camera** area, you can choose which apps can access a device's camera.
@ -929,7 +944,7 @@ To turn off **Choose apps that can use your camera**:
- Turn off the feature in the UI for each app.
### <a href="" id="bkmk-priv-microphone"></a>12.4 Microphone
### <a href="" id="bkmk-priv-microphone"></a>13.4 Microphone
In the **Microphone** area, you can choose which apps can access a device's microphone.
@ -947,7 +962,7 @@ To turn off **Choose apps that can use your microphone**:
- Turn off the feature in the UI for each app.
### <a href="" id="bkmk-priv-speech"></a>12.5 Speech, inking, & typing
### <a href="" id="bkmk-priv-speech"></a>13.5 Speech, inking, & typing
In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees.
@ -972,7 +987,7 @@ To turn off the functionality:
Create a REG\_DWORD registry setting called **HarvestContacts** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore**, with a value of 0 (zero).
### <a href="" id="bkmk-priv-accounts"></a>12.6 Account info
### <a href="" id="bkmk-priv-accounts"></a>13.6 Account info
In the **Account Info** area, you can choose which apps can access your name, picture, and other account info.
@ -990,7 +1005,7 @@ To turn off **Choose the apps that can access your account info**:
- Turn off the feature in the UI for each app.
### <a href="" id="bkmk-priv-contacts"></a>12.7 Contacts
### <a href="" id="bkmk-priv-contacts"></a>13.7 Contacts
In the **Contacts** area, you can choose which apps can access an employee's contacts list.
@ -1004,7 +1019,7 @@ To turn off **Choose apps that can access contacts**:
- Set the **Select a setting** box to **Force Deny**.
### <a href="" id="bkmk-priv-calendar"></a>12.8 Calendar
### <a href="" id="bkmk-priv-calendar"></a>13.8 Calendar
In the **Calendar** area, you can choose which apps have access to an employee's calendar.
@ -1022,7 +1037,7 @@ To turn off **Choose apps that can access calendar**:
- Turn off the feature in the UI for each app.
### <a href="" id="bkmk-priv-callhistory"></a>12.9 Call history
### <a href="" id="bkmk-priv-callhistory"></a>13.9 Call history
In the **Call history** area, you can choose which apps have access to an employee's call history.
@ -1036,7 +1051,7 @@ To turn off **Let apps access my call history**:
- Set the **Select a setting** box to **Force Deny**.
### <a href="" id="bkmk-priv-email"></a>12.10 Email
### <a href="" id="bkmk-priv-email"></a>13.10 Email
In the **Email** area, you can choose which apps have can access and send email.
@ -1050,7 +1065,7 @@ To turn off **Let apps access and send email**:
- Set the **Select a setting** box to **Force Deny**.
### <a href="" id="bkmk-priv-messaging"></a>12.11 Messaging
### <a href="" id="bkmk-priv-messaging"></a>13.11 Messaging
In the **Messaging** area, you can choose which apps can read or send messages.
@ -1068,7 +1083,7 @@ To turn off **Choose apps that can read or send messages**:
- Turn off the feature in the UI for each app.
### <a href="" id="bkmk-priv-radios"></a>12.12 Radios
### <a href="" id="bkmk-priv-radios"></a>13.12 Radios
In the **Radios** area, you can choose which apps can turn a device's radio on or off.
@ -1086,7 +1101,7 @@ To turn off **Choose apps that can control radios**:
- Turn off the feature in the UI for each app.
### <a href="" id="bkmk-priv-other-devices"></a>12.13 Other devices
### <a href="" id="bkmk-priv-other-devices"></a>13.13 Other devices
In the **Other Devices** area, you can choose whether devices that aren't paired to PCs, such as an Xbox One, can share and sync info.
@ -1104,7 +1119,7 @@ To turn off **Let your apps use your trusted devices (hardware you've already co
- Set the **Select a setting** box to **Force Deny**.
### <a href="" id="bkmk-priv-feedback"></a>12.14 Feedback & diagnostics
### <a href="" id="bkmk-priv-feedback"></a>13.14 Feedback & diagnostics
In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft.
@ -1178,7 +1193,7 @@ To change the level of diagnostic and usage data sent when you **Send your devic
- **3**. Maps to the [Full](#bkmk-utc-full) level.
### <a href="" id="bkmk-priv-background"></a>12.15 Background apps
### <a href="" id="bkmk-priv-background"></a>13.15 Background apps
In the **Background Apps** area, you can choose which apps can run in the background.
@ -1186,7 +1201,7 @@ To turn off **Let apps run in the background**:
- Turn off the feature in the UI for each app.
### <a href="" id="bkmk-spp"></a>13. Software Protection Platform
### <a href="" id="bkmk-spp"></a>14. Software Protection Platform
Enterprise customers can manage their Windows activation status with volume licensing using an on-premise Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by applying the following Group Policy:
@ -1194,7 +1209,7 @@ Enterprise customers can manage their Windows activation status with volume lice
The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS.
### <a href="" id="bkmk-syncsettings"></a>14. Sync your settings
### <a href="" id="bkmk-syncsettings"></a>15. Sync your settings
You can control if your settings are synchronized:
@ -1220,13 +1235,13 @@ To turn off Messaging cloud sync:
- Create a REG\_DWORD registry setting called **CloudServiceSyncEnabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Messaging**, with a value of 0 (zero).
### <a href="" id="bkmk-teredo"></a>15. Teredo
### <a href="" id="bkmk-teredo"></a>16. Teredo
You can disable Teredo by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](http://technet.microsoft.com/library/cc722030.aspx).
- From an elevated command prompt, run **netsh interface teredo set state disabled**
### <a href="" id="bkmk-wifisense"></a>16. Wi-Fi Sense
### <a href="" id="bkmk-wifisense"></a>17. Wi-Fi Sense
Wi-Fi Sense automatically connects devices to known hotspots and to the wireless networks the person’s contacts have shared with them.
@ -1252,7 +1267,7 @@ To turn off **Connect to suggested open hotspots** and **Connect to networks sha
When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but they’re non-functional and they can’t be controlled by the employee.
### <a href="" id="bkmk-defender"></a>17. Windows Defender
### <a href="" id="bkmk-defender"></a>18. Windows Defender
You can opt of the Microsoft Antimalware Protection Service.
@ -1296,7 +1311,7 @@ You can stop downloading definition updates:
You can also use the registry to turn off Malicious Software Reporting Tool telemetry by setting the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to 1.
### <a href="" id="bkmk-wmp"></a>18. Windows Media Player
### <a href="" id="bkmk-wmp"></a>19. Windows Media Player
To remove Windows Media Player:
@ -1306,7 +1321,7 @@ To remove Windows Media Player:
- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer**
### <a href="" id="bkmk-spotlight"></a>19. Windows spotlight
### <a href="" id="bkmk-spotlight"></a>20. Windows spotlight
Windows spotlight provides different background images and text on the lock screen. You can control it by using the user interface or through Group Policy.
@ -1337,13 +1352,13 @@ Windows spotlight provides different background images and text on the lock scre
For more info, see [Windows spotlight on the lock screen](../whats-new/windows-spotlight.md).
### <a href="" id="bkmk-windowsstore"></a>20. Windows Store
### <a href="" id="bkmk-windowsstore"></a>21. Windows Store
You can turn off the ability to launch apps from the Windows Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Windows Store will be disabled.
- Apply the Group Policy: **Computer Configuration** &gt; **Administrative Templates** &gt; **Windows Components** &gt; **Store** &gt; **Disable all apps from Windows Store**.
### <a href="" id="bkmk-updates"></a>21. Windows Update Delivery Optimization
### <a href="" id="bkmk-updates"></a>22. Windows Update Delivery Optimization
Windows Update Delivery Optimization lets you get Windows updates and Windows Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization’s PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet.
@ -1351,13 +1366,13 @@ By default, PCs running Windows 10 Enterprise and Windows 10 Education will on
Use the UI, Group Policy, MDM policies, or Windows Provisioning to set up Delivery Optimization.
### <a href="" id="bkmk-wudo-ui"></a>21.1 Settings &gt; Update & security
### <a href="" id="bkmk-wudo-ui"></a>22.1 Settings &gt; Update & security
You can set up Delivery Optimization from the **Settings** UI.
- Go to **Settings** &gt; **Update & security** &gt; **Windows Update** &gt; **Advanced options** &gt; **Choose how updates are delivered**.
### <a href="" id="bkmk-wudo-gp"></a>21.2 Delivery Optimization Group Policies
### <a href="" id="bkmk-wudo-gp"></a>22.2 Delivery Optimization Group Policies
You can find the Delivery Optimization Group Policy objects under **Computer Configuration** &gt; **Administrative Templates** &gt; **Windows Components** &gt; **Delivery Optimization**.
@ -1414,7 +1429,7 @@ You can find the Delivery Optimization Group Policy objects under **Computer Con
 
### <a href="" id="bkmk-wudo-mdm"></a>21.3 Delivery Optimization MDM policies
### <a href="" id="bkmk-wudo-mdm"></a>22.3 Delivery Optimization MDM policies
The following Delivery Optimization MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
@ -1471,7 +1486,7 @@ The following Delivery Optimization MDM policies are available in the [Policy CS
 
### <a href="" id="bkmk-wudo-prov"></a>21.4 Delivery Optimization Windows Provisioning
### <a href="" id="bkmk-wudo-prov"></a>22.4 Delivery Optimization Windows Provisioning
If you don't have an MDM server in your enterprise, you can use Windows Provisioning to configure the Delivery Optimization policies
@ -1487,7 +1502,7 @@ Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windo
For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](http://go.microsoft.com/fwlink/p/?LinkId=730684).
### <a href="" id="bkmk-wu"></a>22. Windows Update
### <a href="" id="bkmk-wu"></a>23. Windows Update
You can turn off Windows Update by setting the following registry entries:

BIN
windows/manage/images/settings-table.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 17 KiB

After

Width:  |  Height:  |  Size: 16 KiB

130
windows/manage/introduction-to-windows-10-servicing.md
View File

@ -286,51 +286,91 @@ Windows 10 Enterprise LTSB does include Internet Explorer 11, and is compatible
Table 2. Servicing option summary
Comparison
Windows 10 servicing options
Current Branch (CB)
Current Branch for Business (CBB)
Long-Term Servicing Branch (LTSB)
**Availability of new feature upgrades for installation**
Immediate
Deferred by ~4 months
Not applicable
**Supported editions**
Windows 10 Home, Windows 10 Pro, Windows 10 Education, Windows 10 Enterprise, Windows 10 Mobile, IoT Core, IoT Core Pro
Windows 10 Pro, Windows 10 Education, Windows 10 Enterprise, Windows 10 Mobile Enterprise, IoT Core Pro
Windows 10 Enterprise LTSB
**Minimum length of servicing lifetime**
Approximately 4 Months
Approximately 8 months
10 years
**Ongoing installation of new feature upgrades required to receive servicing updates**
Yes
Yes
No
**Supports Windows Update for release deployment**
Yes
Yes
Yes
**Supports Windows Server Update Services for release deployment**
Yes (excludes Home)
Yes
Yes
**Supports Configuration Manager/configuration management systems for release deployment**
Yes (excludes Home)
Yes
Yes
**First party browsers included**
Microsoft Edge, Internet Explorer 11
Microsoft Edge, IE11
IE11
**Notable Windows system apps removed**
None
None
Microsoft Edge, Windows Store Client, Cortana (limited search available)
**Notable Windows universal apps removed**
None
None
Outlook Mail/Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, Clock
<table>
<tr>
<th rowspan="2">Comparison</th>
<th colspan="3">Windows 10 servicing options</th>
</tr>
<tr>
<th>Current Branch (CB)</th>
<th>Current Branch for Business (CBB)</th>
<th>Long-Term Servicing Branch (LTSB)</th>
</tr>
<tr>
<td><b>Availability of new feature upgrades for installation</b></td>
<td>Immediate</td>
<td>Deferred by ~4 months</td>
<td>Not applicable</td>
</tr>
<tr>
<td><b>Supported editions</b></td>
<td>Windows 10 Home, Windows 10 Pro, Windows 10 Education, Windows 10 Enterprise, Windows 10 Mobile,
IoT Core, IoT Core Pro</td>
<td>Windows 10 Pro,
Windows 10 Education,
Windows 10 Enterprise, Windows 10 Mobile Enterprise,
IoT Core Pro</td>
<td>Windows 10 Enterprise LTSB</td>
</tr>
<tr>
<td><b>Minimum length of servicing lifetime</b></td>
<td>Approximately 4 Months</td>
<td>Approximately 8 months</td>
<td>10 years</td>
</tr>
<tr>
<td><b>Ongoing installation of new feature upgrades required to receive servicing updates</b></td>
<td>Yes</td>
<td>Yes</td>
<td>No</td>
</tr>
<tr>
<td><b>Supports Windows Update for release deployment</b></td>
<td>Yes</td>
<td>Yes</td>
<td>Yes</td>
</tr>
<tr>
<td><b>Supports Windows Server Update Services for release deployment</b></td>
<td>Yes
(excludes Home)
</td>
<td>Yes</td>
<td>Yes</td>
</tr>
<tr>
<td><b>Supports Configuration Manager/configuration management systems for release deployment</b></td>
<td>Yes
(excludes Home)
</td>
<td>Yes</td>
<td>Yes</td>
</tr>
<tr>
<td><b>First party browsers included</b></td>
<td>Microsoft Edge,
Internet Explorer 11</td>
<td>Microsoft Edge,
IE11</td>
<td>IE11</td>
</tr>
<tr>
<td><b>Notable Windows
system apps removed
</b></td>
<td>None</td>
<td>None</td>
<td>Microsoft Edge, Windows Store Client, Cortana (limited search available)</td>
</tr>
<tr>
<td><b>Notable Windows
universal apps removed
</b></td>
<td>None</td>
<td>None</td>
<td>Outlook Mail/Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, Clock</td>
</tr>
</table>
 
## Related topics

75
windows/plan/setup-and-deployment.md
View File

@ -34,27 +34,62 @@ To use Windows Update for Business, Windows 10-based devices must first be conf
Windows Update for Business allows administrators to control when upgrades and updates are deployed to their Windows 10 clients by specifying deferral windows from when they are initially made available on the Windows Update service. As mentioned, there are restrictions as to how long you can delay upgrades and updates. The following table details these restrictions, per deployment category type:
**Group Policy keys**
<table>
<tr>
<td rowspan="2">
<p><b>Group Policy keys</b></p>
</td>
<td>
<p>HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\DeferUpgradePeriod</p>
<ul>
<li>
<p>Values: 0-8 where each unit for upgrade is a month
HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DeferUpgradePeriod
- Values: 0-8 where each unit for upgrade is a month
HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DeferUpdatePeriod
- Values: 0-4 where each unit for update is a week
**MDM**
*./Vendor/MSFT/Update/DeferUpgrade*
Software\\Microsoft\\PolicyManager\\current\\Update\\RequireDeferUpgrade
- Values: 0-8 where each unit for upgrade is a month
Software\\Microsoft\\PolicyManager\\current\\Update\\RequireDeferUpdate
- Values: 0-4 where each unit for update is a week
</p>
</li>
</ul>
</td>
</tr>
<tr>
<td>
<p>HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\DeferUpdatePeriod</p>
<ul>
<li>
<p>Values: 0-4 where each unit for update is a week
</p>
</li>
</ul>
</td>
</tr>
<tr>
<td rowspan="2">
<p><b>MDM</b></p>
<p><i>./Vendor/MSFT/Update/DeferUpgrade</i></p>
</td>
<td>
<p>Software\Microsoft\PolicyManager\current\Update\RequireDeferUpgrade
</p>
<ul>
<li>
<p>Values: 0-8 where each unit for upgrade is a month
</p>
</li>
</ul>
</td>
</tr>
<tr>
<td>
<p>Software\Microsoft\PolicyManager\current\Update\RequireDeferUpdate</p>
<ul>
<li>
<p>Values: 0-4 where each unit for update is a week
</p>
</li>
</ul>
</td>
</tr>
</table>
 

63
windows/plan/windows-update-for-business.md
View File

@ -65,31 +65,44 @@ In Windows 10, Windows Update for Business recognizes three deployment categori
Both upgrades and updates can be deferred from deployment to client machines by a Windows Update for Business administrator within a bounded rage of time from when those updates are first made available on the Windows Update service. This deferral capability allows administrators to validate deployments as they are pushed to all their Windows Update for Business enrolled clients. The following table defines maximum deferral periods allowed by deployment type:
Category
Maximum deferral
Deferral increments
Classification type
Classification GUID
OS upgrades
8 months
1 month
Upgrade
3689BDC8-B205-4AF4-8D4A-A63924C5E9D5
OS updates
4 weeks
1 week
Security updates
0FA1201D-4330-4FA8-8AE9-B877473B6441
Drivers
EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0
Updates
CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83
Other/non-deferrable
No deferral
No deferral
Definition updates
E0789628-CE08-4437-BE74-2495B842F43B
 
<table>
<tr>
<th>Category</th>
<th>Maximum deferral</th>
<th>Deferral increments</th>
<th>Classification type</th>
<th>Classification GUID</th>
</tr>
<tr>
<td>OS upgrades</td>
<td>8 months</td>
<td>1 month</td>
<td>Upgrade</td>
<td>3689BDC8-B205-4AF4-8D4A-A63924C5E9D5</td>
</tr>
<tr>
<td rowspan="3">OS updates</td>
<td rowspan="3">4 weeks</td>
<td rowspan="3">1 week</td>
<td>Security updates</td>
<td>0FA1201D-4330-4FA8-8AE9-B877473B6441</td>
</tr>
<tr>
<td>Drivers</td>
<td>EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0</td>
</tr>
<tr>
<td>Updates</td>
<td>CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83</td>
</tr>
<tr>
<td>Other/non-deferrable</td>
<td>No deferral</td>
<td>No deferral</td>
<td>Definition updates</td>
<td>E0789628-CE08-4437-BE74-2495B842F43B</td>
</tr>
</table>
## Related topics

2
windows/whats-new/edp-whats-new-overview.md
View File

@ -12,7 +12,7 @@ author: TrudyHa
# Enterprise data protection (EDP) overview
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows SDK Insider Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
\[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. An app that calls an API introduced in Windows 10 Anniversary SDK Preview Build 14295 cannot be ingested into the Windows Store during the Preview period.\]
With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data disclosure through apps and services that are outside of the enterprise’s control like email, social media, and the public cloud.