From d7838ad37a7d6c3abfc1f2df067a48ed13fb116b Mon Sep 17 00:00:00 2001 From: Johnson Shih Date: Thu, 19 Dec 2019 13:39:40 -0800 Subject: [PATCH 0001/1077] Add autologon account information Add autologon account information --- windows/client-management/mdm/assignedaccess-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index b8eb37197c..846086718a 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -1221,7 +1221,7 @@ ShellLauncherConfiguration Add ``` -ShellLauncherConfiguration Add AutoLogon +ShellLauncherConfiguration Add AutoLogon, this will create an autologon account (standard user, no password) on your behalf. The autologon account is managed by AssignedAccessCSP so the account name is not exposed. ``` From 4ce116228da67eb2cbe833129d0547eae050d0c9 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha <69782111+Lovina-Saldanha@users.noreply.github.com> Date: Tue, 25 Aug 2020 10:25:04 +0530 Subject: [PATCH 0002/1077] Github-update-app-v-windows10-PR Updated the tables under "Management server database requirements" and "Reporting server database requirements" with SQL Server 2019 info. --- .../app-v/appv-supported-configurations.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/application-management/app-v/appv-supported-configurations.md b/windows/application-management/app-v/appv-supported-configurations.md index 340244864b..bfd278de1c 100644 --- a/windows/application-management/app-v/appv-supported-configurations.md +++ b/windows/application-management/app-v/appv-supported-configurations.md @@ -51,7 +51,7 @@ The following table lists the SQL Server versions that the App-V Management data |SQL Server version|Service pack|System architecture| |---|---|---| -|Microsoft SQL Server 2019||32-bit or 64-bit| +|Microsoft SQL Server 2019|CU4|32-bit or 64-bit| |Microsoft SQL Server 2017||32-bit or 64-bit| |Microsoft SQL Server 2016|SP2|32-bit or 64-bit| |Microsoft SQL Server 2014||32-bit or 64-bit| @@ -90,6 +90,7 @@ The following table lists the SQL Server versions that are supported for the App |SQL Server version|Service pack|System architecture| |---|---|---| +|Microsoft SQL Server 2019|CU4|32-bit or 64-bit| |Microsoft SQL Server 2017||32-bit or 64-bit| |Microsoft SQL Server 2016|SP2|32-bit or 64-bit| |Microsoft SQL Server 2014||32-bit or 64-bit| From 8ce5c04f2b37b761fe6a1562bdbfc4f07776c342 Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Tue, 8 Sep 2020 17:42:07 +0530 Subject: [PATCH 0003/1077] Update-bl-mgep-4318240 made minor changes in language --- .../bitlocker-management-for-enterprises.md | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md index 78eb7b7715..8791e6cf7a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md +++ b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md @@ -17,11 +17,11 @@ ms.reviewer: ms.custom: bitlocker --- -# BitLocker Management for Enterprises +# BitLocker management for enterprises -The ideal for BitLocker management is to eliminate the need for IT admins to set management policies using tools or other mechanisms by having Windows perform tasks that are more practical to automate. This vision leverages modern hardware developments. The growth of TPM 2.0, Secure Boot, and other hardware improvements, for example, has helped to alleviate the support burden on the helpdesk, and we are seeing a consequent decrease in support call volumes, yielding improved user satisfaction. Windows continues to be the focus for new features and improvements for built-in encryption management, such as automatically enabling encryption on devices that support Modern Standby beginning with Windows 8.1. +The ideal solution for BitLocker management is to eliminate the need for IT administrators to set management policies using tools or other mechanisms by having Windows perform tasks that are more practical to automate. This vision leverages modern hardware developments. The growth of TPM 2.0, secure boot, and other hardware improvements, for example, have helped to alleviate the support burden on the helpdesk, and we are seeing a consequent decrease in support-call volumes, yielding improved user satisfaction. Windows continues to be the focus for new features and improvements for built-in encryption management, such as automatically enabling encryption on devices that support Modern Standby beginning with Windows 8.1. -Though much Windows BitLocker [documentation](bitlocker-overview.md) has been published, customers frequently ask for recommendations and pointers to specific, task-oriented documentation that is both easy to digest and focused on how to deploy and manage BitLocker. This article links to relevant documentation, products, and services to help answer this and other related frequently-asked questions, and also provides BitLocker recommendations for different types of computers. +Though much Windows BitLocker [documentation](bitlocker-overview.md) has been published, customers frequently ask for recommendations and pointers to specific, task-oriented documentation that is both easy to digest and focused on how to deploy and manage BitLocker. This article links to relevant documentation, products, and services to help answer this and other related frequently asked questions, and also provides BitLocker recommendations for different types of computers. > [!IMPORTANT] @@ -31,39 +31,39 @@ Though much Windows BitLocker [documentation](bitlocker-overview.md) has been pu Companies that image their own computers using Microsoft System Center 2012 Configuration Manager SP1 (SCCM) or later can use an existing task sequence to [pre-provision BitLocker](https://docs.microsoft.com/configmgr/osd/understand/task-sequence-steps#BKMK_PreProvisionBitLocker) encryption while in Windows Preinstallation Environment (WinPE) and can then [enable protection](https://docs.microsoft.com/configmgr/osd/understand/task-sequence-steps#BKMK_EnableBitLocker). This can help ensure that computers are encrypted from the start, even before users receive them. As part of the imaging process, a company could also decide to use SCCM to pre-set any desired [BitLocker Group Policy](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings/). -Enterprises can use [Microsoft BitLocker Administration and Monitoring (MBAM)](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/) to manage client computers with BitLocker that are domain-joined on-premises until [mainstream support ends in July 2019](https://support.microsoft.com/lifecycle/search?alpha=Microsoft%20BitLocker%20Administration%20and%20Monitoring%202.5%20Service%20Pack%201/) or they can receive extended support until April 2026. Thus, over the next few years, a good strategy for enterprises will be to plan and move to cloud-based management for BitLocker. Refer to the [PowerShell examples](#powershell-examples) to see how to store recovery keys in Azure Active Directory (Azure AD). +Enterprises can use [Microsoft BitLocker Administration and Monitoring (MBAM)](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/) to manage client computers with BitLocker which are domain-joined on-premises until [mainstream support ends in July 2019](https://support.microsoft.com/lifecycle/search?alpha=Microsoft%20BitLocker%20Administration%20and%20Monitoring%202.5%20Service%20Pack%201/) or they can receive extended support until April 2026. Thus, over the next few years, a good strategy for enterprises will be to plan and move to cloud-based management for BitLocker. Refer to the [PowerShell examples](#powershell-examples) to see how to store recovery keys in Azure Active Directory (Azure AD). ## Managing devices joined to Azure Active Directory Devices joined to Azure AD are managed using Mobile Device Management (MDM) policy from an MDM solution such as Microsoft Intune. Without Windows 10, version 1809, only local administrators can enable BitLocker via Intune policy. Starting with Windows 10, version 1809, Intune can enable BitLocker for standard users. [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) status can be queried from managed machines via the [Policy Configuration Settings Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider/), which reports on whether BitLocker Device Encryption is enabled on the device. Compliance with BitLocker Device Encryption policy can be a requirement for [Conditional Access](https://www.microsoft.com/cloud-platform/conditional-access/) to services like Exchange Online and SharePoint Online. -Starting with Windows 10 version 1703 (also known as the Windows Creators Update), the enablement of BitLocker can be triggered over MDM either by the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider/) or the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp/). The BitLocker CSP adds policy options that go beyond ensuring that encryption has occurred, and is available on computers that run Windows 10 and on Windows phones. +Starting with Windows 10, version 1703 (also known as the Windows Creators Update), the enablement of BitLocker can be triggered over MDM either by the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider/) or the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp/). The BitLocker CSP adds policy options that go beyond ensuring that encryption has occurred, and is available on computers that run Windows 10 and on Windows phones. -For hardware that is compliant with Modern Standby and HSTI, when using either of these features, [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) is automatically turned on whenever the user joins a device to Azure AD. Azure AD provides a portal where recovery keys are also backed up, so users can retrieve their own recovery key for self-service, if required. For older devices that are not yet encrypted, beginning with Windows 10 version 1703 (the Windows 10 Creators Update), admins can use the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp/) to trigger encryption and store the recovery key in Azure AD. +For hardware that is compliant with Modern Standby and HSTI, when using either of these features, [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) is automatically turned on whenever the user joins a device to Azure AD. The Azure AD provides a portal where recovery keys are also backed up; thus, users can retrieve their own recovery keys for self-service, if required. For older devices that are not yet encrypted, beginning with Windows 10, version 1703 (the Windows 10 Creators Update), administrators can use the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp/) to trigger encryption and store the recovery key in Azure AD. This is applicable to Azure Hybrid AD as well. ## Managing workplace-joined PCs and phones -For Windows PCs and Windows Phones that enroll using **Connect to work or school account**, BitLocker Device Encryption is managed over MDM, the same as devices joined to Azure AD. +For Windows PCs and Windows Phones that are enrolled using **Connect to work or school account**, BitLocker Device Encryption is managed over MDM, the same as devices joined to Azure AD. ## Managing servers -Servers are often installed, configured, and deployed using PowerShell, so the recommendation is to also use [PowerShell to enable BitLocker on a server](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md#bitlocker-cmdlets-for-windows-powershell), ideally as part of the initial setup. BitLocker is an Optional Component (OC) in Windows Server, so follow the directions in [BitLocker: How to deploy on Windows Server 2012 and later](bitlocker-how-to-deploy-on-windows-server.md) to add the BitLocker OC. +Servers are often installed, configured, and deployed using PowerShell; therefore, the recommendation is to also use [PowerShell to enable BitLocker on a server](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md#bitlocker-cmdlets-for-windows-powershell), ideally as part of the initial setup. BitLocker is an Optional Component (OC) in Windows Server; therefore, follow the directions in [BitLocker: How to deploy on Windows Server 2012 and later](bitlocker-how-to-deploy-on-windows-server.md) to add the BitLocker OC. -The Minimal Server Interface is a prerequisite for some of the BitLocker administration tools. On a [Server Core](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-core/) installation, you must add the necessary GUI components first. The steps to add shell components to Server Core are described in [Using Features on Demand with Updated Systems and Patched Images](https://blogs.technet.microsoft.com/server_core/2012/11/05/using-features-on-demand-with-updated-systems-and-patched-images/) and [How to update local source media to add roles and features](https://blogs.technet.microsoft.com/joscon/2012/11/14/how-to-update-local-source-media-to-add-roles-and-features/). +The minimal server interface is a prerequisite for some of the BitLocker administration tools. On a [Server Core](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-core/) installation, you must add the necessary GUI components first. The steps to add shell components to Server Core are described in [Using Features on Demand with Updated Systems and Patched Images](https://blogs.technet.microsoft.com/server_core/2012/11/05/using-features-on-demand-with-updated-systems-and-patched-images/) and [How to update local source media to add roles and features](https://blogs.technet.microsoft.com/joscon/2012/11/14/how-to-update-local-source-media-to-add-roles-and-features/). If you are installing a server manually, such as a stand-alone server, then choosing [Server with Desktop Experience](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-with-desktop-experience/) is the easiest path because you can avoid performing the steps to add a GUI to Server Core. - Additionally, lights out data centers can take advantage of the enhanced security of a second factor while avoiding the need for user intervention during reboots by optionally using a combination of BitLocker (TPM+PIN) and BitLocker Network Unlock. BitLocker Network Unlock brings together the best of hardware protection, location dependence, and automatic unlock, while in the trusted location. For the configuration steps, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). + Additionally, lights-out data centers can take advantage of the enhanced security of a second factor while avoiding the need for user intervention during reboots by optionally using a combination of BitLocker (TPM+PIN) and BitLocker Network Unlock. BitLocker Network Unlock brings together the best of hardware protection, location dependence, and automatic unlock, while in the trusted location. For the configuration steps, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). For more information, see the Bitlocker FAQs article and other useful links in [Related Articles](#related-articles).   ## PowerShell examples -For Azure AD-joined computers, including virtual machines, the recovery password should be stored in Azure Active Directory. +For Azure AD-joined computers, including virtual machines, the recovery password should be stored in Azure AD. *Example: Use PowerShell to add a recovery password and back it up to Azure AD before enabling BitLocker* ```powershell From 6b209962f6599188ba2f461f510079e9c4d2e283 Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Wed, 16 Dec 2020 08:24:58 -0800 Subject: [PATCH 0004/1077] added draft changes to Assigned Access Configuration section --- windows/client-management/mdm/assignedaccess-csp.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index 3a48ac399e..7eb3a57caf 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -75,6 +75,10 @@ The supported operations are Add, Delete, Get and Replace. When there's no confi **./Device/Vendor/MSFT/AssignedAccess/Configuration** Added in Windows 10, version 1709. Specifies the settings that you can configure in the kiosk or device. This node accepts an AssignedAccessConfiguration xml as input to configure the device experience. For details about the configuration settings in the XML, see [Create a Windows 10 kiosk that runs multiple apps](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps). Here is the schema for the [AssignedAccessConfiguration](#assignedaccessconfiguration-xsd). +Supports Microsoft Edge kiosk mode, which allows Microsoft Edge to be the specified kiosk application. For details about configuring Microsoft Edge kiosk mode, see [Create a Windows 10 kiosk that runs Microsoft Edge](https://docs.microsoft.com/windows/configuration/test). + +Allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. By default this is set to ctrl+alt+delete. For details on how to customize a breakout sequence, see [Create a custom breakout sequence for a kiosk](https://docs.microsoft.com/windows/configuration/test). + > [!Note] > In Windows 10, version 1803 the Configuration node introduces single app kiosk profile to replace KioskModeApp CSP node. KioskModeApp node will be deprecated soon, so you should use the single app kiosk profile in config xml for Configuration node to configure public-facing single app Kiosk. > From 86847b0904ed624e0abfbd05fa067a821c9ec329 Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Wed, 16 Dec 2020 08:54:50 -0800 Subject: [PATCH 0005/1077] added draft changes to Assigned Access Configuration XML --- .../mdm/assignedaccess-csp.md | 46 ++++++++++++++++++- 1 file changed, 45 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index 7eb3a57caf..b2005cb0ae 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -77,7 +77,7 @@ Added in Windows 10, version 1709. Specifies the settings that you can configure Supports Microsoft Edge kiosk mode, which allows Microsoft Edge to be the specified kiosk application. For details about configuring Microsoft Edge kiosk mode, see [Create a Windows 10 kiosk that runs Microsoft Edge](https://docs.microsoft.com/windows/configuration/test). -Allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. By default this is set to ctrl+alt+delete. For details on how to customize a breakout sequence, see [Create a custom breakout sequence for a kiosk](https://docs.microsoft.com/windows/configuration/test). +Allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. By default the breakout sequence is set to ctrl+alt+delete. For details on how to customize a breakout sequence, see [Create a custom breakout sequence for a kiosk](https://docs.microsoft.com/windows/configuration/test). > [!Note] > In Windows 10, version 1803 the Configuration node introduces single app kiosk profile to replace KioskModeApp CSP node. KioskModeApp node will be deprecated soon, so you should use the single app kiosk profile in config xml for Configuration node to configure public-facing single app Kiosk. @@ -516,6 +516,7 @@ To authorize a compatible configuration XML that includes 1809 or prerelease ele ## Example AssignedAccessConfiguration XML +Example XML configuration for a multi app kiosk. ```xml @@ -567,6 +568,49 @@ To authorize a compatible configuration XML that includes 1809 or prerelease ele ``` +Example XML configuration for a Microsoft Edge kiosk. This Edge kiosk s configure to launch www.bing.com on startup. +```xml + + + + + + + + + + EdgeKioskUser + + + + +``` + +Example XML configuration for setting a breakout sequence to be Shift+Windows on a Microsoft Edge kiosk. Note BreakoutSequence can be applied to any kiosk type not just an Edge kiosk. +```xml + + + + + + + + + + + EdgeKioskUser + + + + +``` + ## Configuration examples XML encoding (escaped) and CDATA of the XML in the Data node both ensure that DM client can properly interpret the SyncML and send the configuration xml as string (in original format, unescaped) to AssignedAccess CSP to handle. From e5a3daaefd6ad20add89cda0ac18aafe8a21c134 Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Wed, 16 Dec 2020 13:31:47 -0800 Subject: [PATCH 0006/1077] added draft changes examples added from code --- .../mdm/assignedaccess-csp.md | 4 +- .../mdm/assignedaccess-ddf.md | 175 +++++++++++++++++- 2 files changed, 175 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index b2005cb0ae..0cae125012 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -75,9 +75,7 @@ The supported operations are Add, Delete, Get and Replace. When there's no confi **./Device/Vendor/MSFT/AssignedAccess/Configuration** Added in Windows 10, version 1709. Specifies the settings that you can configure in the kiosk or device. This node accepts an AssignedAccessConfiguration xml as input to configure the device experience. For details about the configuration settings in the XML, see [Create a Windows 10 kiosk that runs multiple apps](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps). Here is the schema for the [AssignedAccessConfiguration](#assignedaccessconfiguration-xsd). -Supports Microsoft Edge kiosk mode, which allows Microsoft Edge to be the specified kiosk application. For details about configuring Microsoft Edge kiosk mode, see [Create a Windows 10 kiosk that runs Microsoft Edge](https://docs.microsoft.com/windows/configuration/test). - -Allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. By default the breakout sequence is set to ctrl+alt+delete. For details on how to customize a breakout sequence, see [Create a custom breakout sequence for a kiosk](https://docs.microsoft.com/windows/configuration/test). +Currently in Windows 10 Insider Preview Build is Microsoft Edge kiosk mode. This allows Microsoft Edge to be the specified kiosk application. For details about configuring Microsoft Edge kiosk mode, see [Create a Windows 10 kiosk that runs Microsoft Edge](https://docs.microsoft.com/windows/configuration/test). The Windows 10 Insider Preview Build also allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. By default the breakout sequence is set to ctrl+alt+delete. For details on how to customize a breakout sequence, see [Create a custom breakout sequence for a kiosk](https://docs.microsoft.com/windows/configuration/test). > [!Note] > In Windows 10, version 1803 the Configuration node introduces single app kiosk profile to replace KioskModeApp CSP node. KioskModeApp node will be deprecated soon, so you should use the single app kiosk profile in config xml for Configuration node to configure public-facing single app Kiosk. diff --git a/windows/client-management/mdm/assignedaccess-ddf.md b/windows/client-management/mdm/assignedaccess-ddf.md index 703958aa0e..f5562707ae 100644 --- a/windows/client-management/mdm/assignedaccess-ddf.md +++ b/windows/client-management/mdm/assignedaccess-ddf.md @@ -1,4 +1,4 @@ ---- + --- title: AssignedAccess DDF description: Learn how the OMA DM device description framework (DDF) for the AssignedAccess configuration service provider. ms.assetid: 224FADDB-0EFD-4E5A-AE20-1BD4ABE24306 @@ -195,6 +195,179 @@ This node supports Add, Delete, Replace and Get methods. When there's no configu ``` +The XML below is for Windows 10, version 1909. +```xml + + +]> + + 1.2 + + AssignedAccess + ./Vendor/MSFT + + + + + + + + + + + + + + + com.microsoft/4.0/MDM/AssignedAccess + + + + KioskModeApp + + + + + + + + This node can accept and return json string which comprises of account name, and AUMID for Kiosk mode app. + +Example: {"User":"domain\\user", "AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"}. + +When configuring kiosk mode app, account name will be used to find the target user. Account name includes domain name and user name. Domain name can be optional if user name is unique across the system. For a local account, domain name should be machine name. When "Get" is executed on this node, domain name is always returned in the output. + +This node supports Add, Delete, Replace and Get methods. When there's no configuration, "Get" and "Delete" methods fail. When there's already a configuration for kiosk mode app, "Add" method fails. The data pattern for "Add" and "Replace" is the same. + + + + + + + + + + + + + + text/plain + + + + + Configuration + + + + + + + + This node accepts an AssignedAccessConfiguration xml as input. Please check out samples and required xsd on MSDN. + + + + + + + + + + + + + + text/plain + + + + + Status + + + + + This read only node contains kiosk health event xml + + + + + + + + + + + + + + text/plain + + + + + ShellLauncher + + + + + + + + This node accepts a ShellLauncherConfiguration xml as input. Please check out samples and required xsd on MSDN. + + + + + + + + + + + + + + text/plain + + + + + StatusConfiguration + + + + + + + + This node accepts a StatusConfiguration xml as input. Please check out samples and required xsd on MSDN. + + + + + + + + + + + + + + text/plain + + + + + + +``` + ## Related topics From 9376302517f01894cff9c75fec27d1d7c4b99621 Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Wed, 16 Dec 2020 14:01:34 -0800 Subject: [PATCH 0007/1077] draft update guidelines for choosing an app for assigned access --- windows/configuration/guidelines-for-assigned-access-app.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/configuration/guidelines-for-assigned-access-app.md b/windows/configuration/guidelines-for-assigned-access-app.md index bbe21777b6..500a3ccc14 100644 --- a/windows/configuration/guidelines-for-assigned-access-app.md +++ b/windows/configuration/guidelines-for-assigned-access-app.md @@ -45,6 +45,8 @@ Avoid selecting Windows apps that are designed to launch other apps as part of t ## Guidelines for web browsers +In Windows 10, Version 1909, Assigned access adds support for the new Microsoft Edge kiosk mode support. [Learn how to deploy Microsoft Edge kiosk mode](https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-configure-kiosk-mode). + In Windows 10, version 1809, Microsoft Edge includes support for kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode.](https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy) In Windows 10, version 1803 and later, you can install the **Kiosk Browser** app from Microsoft to use as your kiosk app. For digital signage scenarios, you can configure **Kiosk Browser** to navigate to a URL and show only that content -- no navigation buttons, no address bar, etc. For kiosk scenarios, you can configure additional settings, such as allowed and blocked URLs, navigation buttons, and end session buttons. For example, you could configure your kiosk to show the online catalog for your store, where customers can navigate between departments and items, but aren’t allowed to go to a competitor's website. From 7c6758fbe221fdf840a8270dec92cdbf67b0851b Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Wed, 16 Dec 2020 14:08:12 -0800 Subject: [PATCH 0008/1077] draft update guidelines for choosing an app for assigned access --- windows/configuration/guidelines-for-assigned-access-app.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/guidelines-for-assigned-access-app.md b/windows/configuration/guidelines-for-assigned-access-app.md index 500a3ccc14..431ffa6832 100644 --- a/windows/configuration/guidelines-for-assigned-access-app.md +++ b/windows/configuration/guidelines-for-assigned-access-app.md @@ -47,7 +47,7 @@ Avoid selecting Windows apps that are designed to launch other apps as part of t In Windows 10, Version 1909, Assigned access adds support for the new Microsoft Edge kiosk mode support. [Learn how to deploy Microsoft Edge kiosk mode](https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-configure-kiosk-mode). -In Windows 10, version 1809, Microsoft Edge includes support for kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode.](https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy) +In Windows 10, version 1809, Microsoft Edge includes support for legacy kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode.](https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy) In Windows 10, version 1803 and later, you can install the **Kiosk Browser** app from Microsoft to use as your kiosk app. For digital signage scenarios, you can configure **Kiosk Browser** to navigate to a URL and show only that content -- no navigation buttons, no address bar, etc. For kiosk scenarios, you can configure additional settings, such as allowed and blocked URLs, navigation buttons, and end session buttons. For example, you could configure your kiosk to show the online catalog for your store, where customers can navigate between departments and items, but aren’t allowed to go to a competitor's website. From ed0180bdc5ea15106bf7137f86a133cf495f701c Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Thu, 17 Dec 2020 07:39:14 -0800 Subject: [PATCH 0009/1077] draft update 1 for set up a single-app kiosk --- .../guidelines-for-assigned-access-app.md | 6 +++ windows/configuration/kiosk-xml.md | 51 ++++++++++++++++--- 2 files changed, 51 insertions(+), 6 deletions(-) diff --git a/windows/configuration/guidelines-for-assigned-access-app.md b/windows/configuration/guidelines-for-assigned-access-app.md index 431ffa6832..1270ea3283 100644 --- a/windows/configuration/guidelines-for-assigned-access-app.md +++ b/windows/configuration/guidelines-for-assigned-access-app.md @@ -156,6 +156,12 @@ You can create your own web browser Windows app by using the WebView class. Lear Avoid selecting Windows apps that may expose the information you don’t want to show in your kiosk, since kiosk usually means anonymous access and locates in a public setting like a shopping mall. For example, an app that has a file picker allows the user to gain access to files and folders on the user's system, avoid selecting these types of apps if they provide unnecessary data access. +## Customize your breakout sequence + +Assigned access allows for the specification of a new breakout sequence. A breakout sequence is a keyboard shortcut that stops the kiosk experience and brings the user back to the lock screen. By default the breakout sequence is configured to be ctrl+alt+delete, a common windows keyboard shortcut. It is recommended that this is set to a non-standard windows shortcut to prevent disruptions in the kiosk experience. + +The Breakout Sequence can only be customized at the provision time of the kiosk. There is also no GUI for specifying this currently, so it would need to be specified in a provision method like MDM or WMI which allow the user to specify the configuration in an XML format. + ## App configuration Some apps may require additional configurations before they can be used appropriately in assigned access. For example, Microsoft OneNote requires you to set up a Microsoft account for the assigned access user account before OneNote will open in assigned access. diff --git a/windows/configuration/kiosk-xml.md b/windows/configuration/kiosk-xml.md index c0eb573c32..1cc2cd11d9 100644 --- a/windows/configuration/kiosk-xml.md +++ b/windows/configuration/kiosk-xml.md @@ -254,6 +254,29 @@ This sample demonstrates that both UWP and Win32 apps can be configured to autom ``` +## Microsoft Edge Kiosk XML Sample +```xml + + + + + + + + + + + EdgeKioskUser + + + + +``` + ## [Preview] Global Profile Sample XML Global Profile is currently supported in Windows 10 Insider Preview (20H1 builds). Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lockdown mode, or used as mitigation when a profile cannot be determined for a user. @@ -635,12 +658,7 @@ IT Admin now can specify user access to Downloads folder, Removable drives, or n ## XSD for AssignedAccess configuration XML ->[!NOTE] ->Updated for Windows 10, version 1903 and Windows 10 Insider Preview (19H2, 20H1 builds). -Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. - ```xml - + @@ -662,8 +682,14 @@ Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. + + + + + + @@ -672,7 +698,19 @@ Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. - + + + + + + + + + + + + + @@ -773,6 +811,7 @@ Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. + From b2f80a65518eccc03104a32229a61a309326320b Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Thu, 17 Dec 2020 07:39:31 -0800 Subject: [PATCH 0010/1077] draft update 2 for set up a single-app kiosk --- windows/configuration/guidelines-for-assigned-access-app.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/guidelines-for-assigned-access-app.md b/windows/configuration/guidelines-for-assigned-access-app.md index 1270ea3283..5c30c9b7b2 100644 --- a/windows/configuration/guidelines-for-assigned-access-app.md +++ b/windows/configuration/guidelines-for-assigned-access-app.md @@ -160,7 +160,7 @@ Avoid selecting Windows apps that may expose the information you don’t want to Assigned access allows for the specification of a new breakout sequence. A breakout sequence is a keyboard shortcut that stops the kiosk experience and brings the user back to the lock screen. By default the breakout sequence is configured to be ctrl+alt+delete, a common windows keyboard shortcut. It is recommended that this is set to a non-standard windows shortcut to prevent disruptions in the kiosk experience. -The Breakout Sequence can only be customized at the provision time of the kiosk. There is also no GUI for specifying this currently, so it would need to be specified in a provision method like MDM or WMI which allow the user to specify the configuration in an XML format. +There is currently no GUI for customizing the breakout sequence, so it would need to be specified in a provision method where an XML format is used like MDM. ## App configuration From 5a28a0d7d00252e98be1d88f614c13d219fd3a77 Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Thu, 17 Dec 2020 08:19:27 -0800 Subject: [PATCH 0011/1077] fixed links and formatting issues --- .../mdm/assignedaccess-ddf.md | 173 ------------------ 1 file changed, 173 deletions(-) diff --git a/windows/client-management/mdm/assignedaccess-ddf.md b/windows/client-management/mdm/assignedaccess-ddf.md index f5562707ae..790a9fa3ea 100644 --- a/windows/client-management/mdm/assignedaccess-ddf.md +++ b/windows/client-management/mdm/assignedaccess-ddf.md @@ -22,179 +22,6 @@ You can download the DDF files from the links below: - [Download all the DDF files for Windows 10, version 1703](https://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1607](https://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip) -The XML below is for Windows 10, version 1803. - -```xml - - -]> - - 1.2 - - AssignedAccess - ./Vendor/MSFT - - - - - - - - - - - - - - - com.microsoft/2.0/MDM/AssignedAccess - - - - KioskModeApp - - - - - - - - This node can accept and return json string which comprises of account name, and AUMID for Kiosk mode app. - -Example: {"User":"domain\\user", "AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"}. - -When configuring kiosk mode app, account name will be used to find the target user. Account name includes domain name and user name. Domain name can be optional if user name is unique across the system. For a local account, domain name should be machine name. When "Get" is executed on this node, domain name is always returned in the output. - -This node supports Add, Delete, Replace and Get methods. When there's no configuration, "Get" and "Delete" methods fail. When there's already a configuration for kiosk mode app, "Add" method fails. The data pattern for "Add" and "Replace" is the same. - - - - - - - - - - - - - - text/plain - - - - - Configuration - - - - - - - - This node accepts an AssignedAccessConfiguration xml as input. Please check out samples and required xsd on MSDN. - - - - - - - - - - - - - - text/plain - - - - - Status - - - - - This read only node contains kiosk health event xml - - - - - - - - - - - - - - text/plain - - - - - ShellLauncher - - - - - - - - This node accepts a ShellLauncherConfiguration xml as input. Please check out samples and required xsd on MSDN. - - - - - - - - - - - - - - text/plain - - - - - StatusConfiguration - - - - - - - - This node accepts a StatusConfiguration xml as input. Please check out samples and required xsd on MSDN. - - - - - - - - - - - - - - text/plain - - - - - -``` - The XML below is for Windows 10, version 1909. ```xml From 213e2d3f65479abe2df943dce341252660e29116 Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Thu, 17 Dec 2020 08:38:21 -0800 Subject: [PATCH 0012/1077] removed extra space --- .../mdm/assignedaccess-csp.md | 54 +++++++++++++++++-- 1 file changed, 50 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index 0cae125012..a471243300 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -75,7 +75,7 @@ The supported operations are Add, Delete, Get and Replace. When there's no confi **./Device/Vendor/MSFT/AssignedAccess/Configuration** Added in Windows 10, version 1709. Specifies the settings that you can configure in the kiosk or device. This node accepts an AssignedAccessConfiguration xml as input to configure the device experience. For details about the configuration settings in the XML, see [Create a Windows 10 kiosk that runs multiple apps](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps). Here is the schema for the [AssignedAccessConfiguration](#assignedaccessconfiguration-xsd). -Currently in Windows 10 Insider Preview Build is Microsoft Edge kiosk mode. This allows Microsoft Edge to be the specified kiosk application. For details about configuring Microsoft Edge kiosk mode, see [Create a Windows 10 kiosk that runs Microsoft Edge](https://docs.microsoft.com/windows/configuration/test). The Windows 10 Insider Preview Build also allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. By default the breakout sequence is set to ctrl+alt+delete. For details on how to customize a breakout sequence, see [Create a custom breakout sequence for a kiosk](https://docs.microsoft.com/windows/configuration/test). +Updated in Windows 10, version 1909. Added Microsoft Edge kiosk mode. This allows Microsoft Edge to be the specified kiosk application. For details about configuring Microsoft Edge kiosk mode, see [Configure a Windows 10 kiosk that runs Microsoft Edge](https://docs.microsoft.com/DeployEdge/microsoft-edge-configure-kiosk-mode). Windows 10, version 1909 also allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. > [!Note] > In Windows 10, version 1803 the Configuration node introduces single app kiosk profile to replace KioskModeApp CSP node. KioskModeApp node will be deprecated soon, so you should use the single app kiosk profile in config xml for Configuration node to configure public-facing single app Kiosk. @@ -247,7 +247,7 @@ KioskModeApp Replace ## AssignedAccessConfiguration XSD -Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. +Below schema is for AssignedAccess Configuration up to Windows 10 1909 release. ```xml @@ -258,11 +258,13 @@ Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. xmlns:default="http://schemas.microsoft.com/AssignedAccess/2017/config" xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config" xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config" + xmlns:v4="http://schemas.microsoft.com/AssignedAccess/2021/config" targetNamespace="http://schemas.microsoft.com/AssignedAccess/2017/config" > + @@ -272,8 +274,14 @@ Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. + + + + + + @@ -282,7 +290,19 @@ Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. - + + + + + + + + + + + + + @@ -383,6 +403,7 @@ Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. + @@ -421,7 +442,7 @@ Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. - +); ``` Here is the schema for new features introduced in Windows 10 1809 release @@ -499,6 +520,31 @@ Schema for Windows 10 prerelease ``` +Schema for features introduced in Windows 10, version 1909. +```xml + + + + + + + + + + + + + +``` + To authorize a compatible configuration XML that includes 1809 or prerelease elements and attributes, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. e.g. to configure auto-launch feature which is added in 1809 release, use below sample, notice an alias r1809 is given to the 201810 namespace for 1809 release, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. ```xml Date: Fri, 18 Dec 2020 07:22:49 -0800 Subject: [PATCH 0013/1077] fixes from PR --- windows/client-management/mdm/assignedaccess-csp.md | 12 ++++++++---- windows/client-management/mdm/assignedaccess-ddf.md | 1 - 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index a471243300..be244e5716 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -560,7 +560,7 @@ To authorize a compatible configuration XML that includes 1809 or prerelease ele ## Example AssignedAccessConfiguration XML -Example XML configuration for a multi app kiosk. +Example XML configuration for a multi-app kiosk: ```xml @@ -633,7 +633,9 @@ Example XML configuration for a Microsoft Edge kiosk. This Edge kiosk s configur ``` -Example XML configuration for setting a breakout sequence to be Shift+Windows on a Microsoft Edge kiosk. Note BreakoutSequence can be applied to any kiosk type not just an Edge kiosk. +Example XML configuration for setting a breakout sequence to be Ctrl+A on a Microsoft Edge kiosk. +[!Note] +**BreakoutSequence** can be applied to any kiosk type, not just an Edge kiosk. ```xml - - + + + diff --git a/windows/client-management/mdm/assignedaccess-ddf.md b/windows/client-management/mdm/assignedaccess-ddf.md index 790a9fa3ea..af05799855 100644 --- a/windows/client-management/mdm/assignedaccess-ddf.md +++ b/windows/client-management/mdm/assignedaccess-ddf.md @@ -192,7 +192,6 @@ This node supports Add, Delete, Replace and Get methods. When there's no configu - ``` ## Related topics From 8805684c54f1c2f621ccc4c29a8391e7e62b3472 Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Fri, 18 Dec 2020 07:24:10 -0800 Subject: [PATCH 0014/1077] removed space --- windows/client-management/mdm/assignedaccess-ddf.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/assignedaccess-ddf.md b/windows/client-management/mdm/assignedaccess-ddf.md index af05799855..ad54fb7f07 100644 --- a/windows/client-management/mdm/assignedaccess-ddf.md +++ b/windows/client-management/mdm/assignedaccess-ddf.md @@ -1,4 +1,4 @@ - --- +--- title: AssignedAccess DDF description: Learn how the OMA DM device description framework (DDF) for the AssignedAccess configuration service provider. ms.assetid: 224FADDB-0EFD-4E5A-AE20-1BD4ABE24306 From db13660dbe280756c65702768f1951b12fd98f30 Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Fri, 18 Dec 2020 11:30:06 -0800 Subject: [PATCH 0015/1077] xml format changes added --- windows/client-management/mdm/assignedaccess-csp.md | 3 +-- windows/configuration/kiosk-xml.md | 5 +++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index be244e5716..4712c79d55 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -634,7 +634,7 @@ Example XML configuration for a Microsoft Edge kiosk. This Edge kiosk s configur ``` Example XML configuration for setting a breakout sequence to be Ctrl+A on a Microsoft Edge kiosk. -[!Note] +>[!Note] **BreakoutSequence** can be applied to any kiosk type, not just an Edge kiosk. ```xml @@ -646,7 +646,6 @@ Example XML configuration for setting a breakout sequence to be Ctrl+A on a Micr - diff --git a/windows/configuration/kiosk-xml.md b/windows/configuration/kiosk-xml.md index 1cc2cd11d9..278c259d64 100644 --- a/windows/configuration/kiosk-xml.md +++ b/windows/configuration/kiosk-xml.md @@ -264,8 +264,9 @@ This sample demonstrates that both UWP and Win32 apps can be configured to autom - + + From 2b4ed8fc088a9e340861e9f6c8eb25051fa63e54 Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Fri, 18 Dec 2020 11:37:00 -0800 Subject: [PATCH 0016/1077] xml format changes added --- windows/client-management/mdm/assignedaccess-csp.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index 4712c79d55..a7ba5eae75 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -621,7 +621,8 @@ Example XML configuration for a Microsoft Edge kiosk. This Edge kiosk s configur > - + From 2539d7794a5c97449c75ef648bf443dd107db3ee Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Wed, 27 Jan 2021 01:15:26 -0800 Subject: [PATCH 0017/1077] added changes from PR --- windows/client-management/mdm/assignedaccess-csp.md | 12 ++++++------ .../guidelines-for-assigned-access-app.md | 6 +++--- windows/configuration/kiosk-xml.md | 4 ++-- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index a7ba5eae75..397cc810b3 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -75,7 +75,7 @@ The supported operations are Add, Delete, Get and Replace. When there's no confi **./Device/Vendor/MSFT/AssignedAccess/Configuration** Added in Windows 10, version 1709. Specifies the settings that you can configure in the kiosk or device. This node accepts an AssignedAccessConfiguration xml as input to configure the device experience. For details about the configuration settings in the XML, see [Create a Windows 10 kiosk that runs multiple apps](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps). Here is the schema for the [AssignedAccessConfiguration](#assignedaccessconfiguration-xsd). -Updated in Windows 10, version 1909. Added Microsoft Edge kiosk mode. This allows Microsoft Edge to be the specified kiosk application. For details about configuring Microsoft Edge kiosk mode, see [Configure a Windows 10 kiosk that runs Microsoft Edge](https://docs.microsoft.com/DeployEdge/microsoft-edge-configure-kiosk-mode). Windows 10, version 1909 also allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. +Updated in Windows 10, version 1909. Added Microsoft Edge kiosk mode support. This allows Microsoft Edge to be the specified kiosk application. For details about configuring Microsoft Edge kiosk mode, see [Configure a Windows 10 kiosk that runs Microsoft Edge](https://docs.microsoft.com/DeployEdge/microsoft-edge-configure-kiosk-mode). Windows 10, version 1909 also allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. The breakout sequence is defined with the format modifiers + keys. An example breakout sequence would look something like "shift+alt+a", where "shift" and "alt" are the modifiers and "a" is the key. > [!Note] > In Windows 10, version 1803 the Configuration node introduces single app kiosk profile to replace KioskModeApp CSP node. KioskModeApp node will be deprecated soon, so you should use the single app kiosk profile in config xml for Configuration node to configure public-facing single app Kiosk. @@ -247,7 +247,7 @@ KioskModeApp Replace ## AssignedAccessConfiguration XSD -Below schema is for AssignedAccess Configuration up to Windows 10 1909 release. +The schema below is for AssignedAccess Configuration up to Windows 10 20H2 release. ```xml @@ -520,7 +520,7 @@ Schema for Windows 10 prerelease ``` -Schema for features introduced in Windows 10, version 1909. +The schema below is for features introduced in Windows 10, version 1909 which has added support for Microsoft Edge kiosk mode and breakout key sequence customization. ```xml ``` -Example XML configuration for a Microsoft Edge kiosk. This Edge kiosk s configure to launch www.bing.com on startup. +Example XML configuration for a Microsoft Edge kiosk. This Microsoft Edge kiosk is configured to launch www.bing.com on startup in a public browsing mode. ```xml [!Note] -**BreakoutSequence** can be applied to any kiosk type, not just an Edge kiosk. +> [!NOTE] +> **BreakoutSequence** can be applied to any kiosk type, not just an Edge kiosk. ```xml ``` -## [Preview] Global Profile Sample XML -Global Profile is currently supported in Windows 10 Insider Preview (20H1 builds). Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lockdown mode, or used as mitigation when a profile cannot be determined for a user. +## Global Profile Sample XML +Global profile is currently supported in Windows 10, version 2004 and later. Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lockdown mode, or used as mitigation when a profile cannot be determined for a user. This sample demonstrates that only a global profile is used, no active user configured. Global profile will be applied when every non-admin account logs in ```xml From 9f44ce4bca1f30ac0bf9625cf048041564b7bb8f Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Fri, 5 Feb 2021 12:26:36 -0800 Subject: [PATCH 0018/1077] added in note on idle timeout and breakout sequence example --- windows/configuration/kiosk-single-app.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md index 92c0f753d1..042dbe70fd 100644 --- a/windows/configuration/kiosk-single-app.md +++ b/windows/configuration/kiosk-single-app.md @@ -267,7 +267,10 @@ If you press **Ctrl + Alt + Del** and do not sign in to another account, after a To change the default time for assigned access to resume, add *IdleTimeOut* (DWORD) and enter the value data as milliseconds in hexadecimal. - +> [!NOTE] +> **IdleTimeOut** does not apply to the new Microsoft Edge kiosk mode. + + The Breakout Sequence of **Ctrl + Alt + Del** is the default, but this can be configured to be a different sequence of keys. The breakout sequence uses the format **modifiers + keys**. An example breakout sequence would look something like **Shift + Alt + a**, where **Shift** and **Alt** are the modifiers and **A** is the key value. [See how this is configured using in xml](https://docs.microsoft.com/en-us/windows/configuration/kiosk-xml#microsoft-edge-kiosk-xml-sample). From 87ecaced68b764559a616ad9e44fcf7864560b94 Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Thu, 4 Mar 2021 13:06:46 +0530 Subject: [PATCH 0019/1077] Update bitlocker-basic-deployment.md --- .../bitlocker/bitlocker-basic-deployment.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md index 23047bf7f1..fcf11cf7d8 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md +++ b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md @@ -110,9 +110,8 @@ The following table shows the compatibility matrix for systems that have been Bi Table 1: Cross compatibility for Windows 10, Windows 8.1, Windows 8, and Windows 7 encrypted volumes -||||| -|--- |--- |--- |--- | |Encryption Type|Windows 10 and Windows 8.1|Windows 8|Windows 7| +|--- |--- |--- |--- | |Fully encrypted on Windows 8|Presents as fully encrypted|N/A|Presented as fully encrypted| |Used Disk Space Only encrypted on Windows 8|Presents as encrypt on write|N/A|Presented as fully encrypted| |Fully encrypted volume from Windows 7|Presents as fully encrypted|Presented as fully encrypted|N/A| From c23d0c30324211440291a4d035de7a045f4418bf Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Fri, 5 Mar 2021 12:38:56 -0800 Subject: [PATCH 0020/1077] add in changes from PR comments --- windows/configuration/guidelines-for-assigned-access-app.md | 6 +++--- windows/configuration/kiosk-single-app.md | 2 +- windows/configuration/kiosk-xml.md | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/configuration/guidelines-for-assigned-access-app.md b/windows/configuration/guidelines-for-assigned-access-app.md index 907f1635b2..cfbe09c2b5 100644 --- a/windows/configuration/guidelines-for-assigned-access-app.md +++ b/windows/configuration/guidelines-for-assigned-access-app.md @@ -45,7 +45,7 @@ Avoid selecting Windows apps that are designed to launch other apps as part of t ## Guidelines for web browsers -In Windows 10, version 1909, assigned access adds support for the new Microsoft Edge kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode](https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-configure-kiosk-mode). +In Windows 10, version 1909, assigned access adds support for the new Microsoft Edge kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode](https://docs.microsoft.com/DeployEdge/microsoft-edge-configure-kiosk-mode). In Windows 10, version 1809, Microsoft Edge Legacy includes support for kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode.](https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy) @@ -158,9 +158,9 @@ Avoid selecting Windows apps that may expose the information you don’t want to ## Customize your breakout sequence -Assigned access allows for the specification of a new breakout sequence. A breakout sequence is a keyboard shortcut that stops the kiosk experience and brings the user back to the lock screen. By default the breakout sequence is configured to be ctrl+alt+delete, a common windows keyboard shortcut. It is recommended that this is set to a non-standard windows shortcut to prevent disruptions in the kiosk experience. +Assigned access allows for the specification of a new breakout sequence. A breakout sequence is a keyboard shortcut that stops the kiosk experience and brings the user back to the lock screen. By default the breakout sequence is configured to be ctrl+alt+delete, a common Windows keyboard shortcut. It is recommended that this is set to a non-standard Windows shortcut to prevent disruptions in the kiosk experience. -There is currently no UI for customizing the breakout sequence in Windows Settings, so it would need to be specified in a provision method where an XML format is used like MDM. +There is currently no user interface for customizing the breakout sequence in Windows settings, so it would need to be specified in a provisioning method where an XML format such as MDM is used. ## App configuration diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md index 042dbe70fd..8ea21a80c4 100644 --- a/windows/configuration/kiosk-single-app.md +++ b/windows/configuration/kiosk-single-app.md @@ -270,7 +270,7 @@ To change the default time for assigned access to resume, add *IdleTimeOut* (DWO > [!NOTE] > **IdleTimeOut** does not apply to the new Microsoft Edge kiosk mode. - The Breakout Sequence of **Ctrl + Alt + Del** is the default, but this can be configured to be a different sequence of keys. The breakout sequence uses the format **modifiers + keys**. An example breakout sequence would look something like **Shift + Alt + a**, where **Shift** and **Alt** are the modifiers and **A** is the key value. [See how this is configured using in xml](https://docs.microsoft.com/en-us/windows/configuration/kiosk-xml#microsoft-edge-kiosk-xml-sample). + The Breakout Sequence of **Ctrl + Alt + Del** is the default, but this can be configured to be a different sequence of keys. The breakout sequence uses the format **modifiers + keys**. An example breakout sequence would look something like **Shift + Alt + a**, where **Shift** and **Alt** are the modifiers and **a** is the key value. [See how this is configured in XML](https://docs.microsoft.com/windows/configuration/kiosk-xml#microsoft-edge-kiosk-xml-sample). diff --git a/windows/configuration/kiosk-xml.md b/windows/configuration/kiosk-xml.md index 65ecf4cc93..e9bc0774a3 100644 --- a/windows/configuration/kiosk-xml.md +++ b/windows/configuration/kiosk-xml.md @@ -279,9 +279,9 @@ This sample demonstrates that both UWP and Win32 apps can be configured to autom ``` ## Global Profile Sample XML -Global profile is currently supported in Windows 10, version 2004 and later. Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lockdown mode, or used as mitigation when a profile cannot be determined for a user. +Global Profile is currently supported in Windows 10, version 2004 and later. Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lockdown mode, or it is used as mitigation when a profile cannot be determined for a user. -This sample demonstrates that only a global profile is used, no active user configured. Global profile will be applied when every non-admin account logs in +This sample demonstrates that only a global profile is used, with no active user configured. Global Profile will be applied when every non-admin account logs in. ```xml Date: Fri, 16 Apr 2021 13:06:27 -0700 Subject: [PATCH 0021/1077] Update windows/client-management/mdm/assignedaccess-ddf.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- windows/client-management/mdm/assignedaccess-ddf.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/client-management/mdm/assignedaccess-ddf.md b/windows/client-management/mdm/assignedaccess-ddf.md index ad54fb7f07..7555504ca8 100644 --- a/windows/client-management/mdm/assignedaccess-ddf.md +++ b/windows/client-management/mdm/assignedaccess-ddf.md @@ -63,7 +63,7 @@ The XML below is for Windows 10, version 1909. This node can accept and return json string which comprises of account name, and AUMID for Kiosk mode app. -Example: {"User":"domain\\user", "AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"}. +Example: {"User":"domain\\user", "AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"}. When configuring kiosk mode app, account name will be used to find the target user. Account name includes domain name and user name. Domain name can be optional if user name is unique across the system. For a local account, domain name should be machine name. When "Get" is executed on this node, domain name is always returned in the output. @@ -207,4 +207,3 @@ This node supports Add, Delete, Replace and Get methods. When there's no configu - From 012f2605a8f5f3368cb23c579180f1033f37dbc6 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Fri, 20 Aug 2021 14:11:38 -0700 Subject: [PATCH 0022/1077] Update to Certificate definition --- windows/privacy/manage-windows-1709-endpoints.md | 2 ++ windows/privacy/manage-windows-1803-endpoints.md | 2 ++ windows/privacy/manage-windows-1809-endpoints.md | 2 ++ windows/privacy/manage-windows-1903-endpoints.md | 2 +- windows/privacy/manage-windows-1909-endpoints.md | 2 +- windows/privacy/manage-windows-2004-endpoints.md | 2 +- windows/privacy/manage-windows-20H2-endpoints.md | 2 +- 7 files changed, 10 insertions(+), 4 deletions(-) diff --git a/windows/privacy/manage-windows-1709-endpoints.md b/windows/privacy/manage-windows-1709-endpoints.md index 8c9ec8ec64..249701a04b 100644 --- a/windows/privacy/manage-windows-1709-endpoints.md +++ b/windows/privacy/manage-windows-1709-endpoints.md @@ -150,6 +150,8 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Certificates +Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. + The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. diff --git a/windows/privacy/manage-windows-1803-endpoints.md b/windows/privacy/manage-windows-1803-endpoints.md index 88aab3a7f9..47d72871ce 100644 --- a/windows/privacy/manage-windows-1803-endpoints.md +++ b/windows/privacy/manage-windows-1803-endpoints.md @@ -151,6 +151,8 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Certificates +Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. + The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. diff --git a/windows/privacy/manage-windows-1809-endpoints.md b/windows/privacy/manage-windows-1809-endpoints.md index 3da8139a20..15defa1a52 100644 --- a/windows/privacy/manage-windows-1809-endpoints.md +++ b/windows/privacy/manage-windows-1809-endpoints.md @@ -162,6 +162,8 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Certificates +Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. + The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. diff --git a/windows/privacy/manage-windows-1903-endpoints.md b/windows/privacy/manage-windows-1903-endpoints.md index 6045eb3da4..84fe836e14 100644 --- a/windows/privacy/manage-windows-1903-endpoints.md +++ b/windows/privacy/manage-windows-1903-endpoints.md @@ -67,7 +67,7 @@ The following methodology was used to derive these network endpoints: |Azure |The following endpoints are related to Azure. |HTTPS|wd-prod-*fe*.cloudapp.azure.com| |||HTTPS|ris-prod-atm.trafficmanager.net| |||HTTPS|validation-v2.sls.trafficmanager.net| -|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible turn off traffic to this endpoint, but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||HTTP|ctldl.windowsupdate.com| |Cortana and Search|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| ||The following endpoint is used to get images that are used for Microsoft Store suggestions. If you turn off traffic for this endpoint, you will block images that are used for Microsoft Store suggestions.|HTTPS|store-images.*microsoft.com| diff --git a/windows/privacy/manage-windows-1909-endpoints.md b/windows/privacy/manage-windows-1909-endpoints.md index 5ef89fdb59..52426e2f66 100644 --- a/windows/privacy/manage-windows-1909-endpoints.md +++ b/windows/privacy/manage-windows-1909-endpoints.md @@ -54,7 +54,7 @@ The following methodology was used to derive these network endpoints: |||HTTP|tile-service.weather.microsoft.com/en-us/livetile/preinstall| ||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|cdn.onenote.net/*| ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLS v1.2|evoke-windowsservices-tas.msedge.net -|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to turn off traffic to this endpoint, but it is not recommended because as root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||HTTP|ctldl.windowsupdate.com| |Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| ||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|HTTPS|www.bing.com*| diff --git a/windows/privacy/manage-windows-2004-endpoints.md b/windows/privacy/manage-windows-2004-endpoints.md index 6e2d31cd9a..4c80cf5104 100644 --- a/windows/privacy/manage-windows-2004-endpoints.md +++ b/windows/privacy/manage-windows-2004-endpoints.md @@ -54,7 +54,7 @@ The following methodology was used to derive these network endpoints: |||HTTP|tile-service.weather.microsoft.com| ||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|cdn.onenote.net/* ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2|evoke-windowsservices-tas.msedge.net| -|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to turn off traffic to this endpoint, but it is not recommended because as root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||HTTP|ctldl.windowsupdate.com| |Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| ||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|TLSv1.2|www.bing.com*| diff --git a/windows/privacy/manage-windows-20H2-endpoints.md b/windows/privacy/manage-windows-20H2-endpoints.md index 4378cb0b1d..526e5a2797 100644 --- a/windows/privacy/manage-windows-20H2-endpoints.md +++ b/windows/privacy/manage-windows-20H2-endpoints.md @@ -54,7 +54,7 @@ The following methodology was used to derive these network endpoints: ||The following endpoint is used for the Weather app. To turn off traffic for this endpoint, either uninstall the Weather app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTP|tile-service.weather.microsoft.com| ||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS/HTTP|cdn.onenote.net| ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS|evoke-windowsservices-tas.msedge.net -|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to turn off traffic to this endpoint, but it is not recommended because as root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com| |Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| ||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|TLSv1.2/HTTPS/HTTP|www.bing.com*| From d61467798dba76b7319b0dc4db874726e0d57258 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Fri, 20 Aug 2021 15:04:58 -0700 Subject: [PATCH 0023/1077] Update manage-connections-from-windows-operating-system-components-to-microsoft-services.md Added the Windows Feeds GP. https://microsoft.visualstudio.com/DefaultCollection/OS/_workitems/edit/35115207 --- ...-operating-system-components-to-microsoft-services.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 189ace9071..e57ef99b93 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -855,6 +855,8 @@ Use Settings > Privacy to configure some settings that may be important to yo - [18.23 Voice Activation](#bkmk-voice-act) +- [18.24 News and interests](#bkmk-priv-news) + ### 18.1 General **General** includes options that don't fall into other areas. @@ -1523,6 +1525,13 @@ To turn this Off in the UI: - Create a REG_DWORD registry setting named **LetAppsActivateWithVoiceAboveLock** in **HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppPrivacy** with a **value of 2 (two)** +### 18.24 News and interests + +In the **Windows Feeds** area, you can choose which apps have access to your diagnostic information. + +To turn this off: + +- Create a REG_DWORD registry setting named **EnableFeeds** in **HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Feeds** with a **value of 0 (zero)**. ### 19. Software Protection Platform From f2d9c07dcf4b5183673523db5af65ee30d8a3212 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Fri, 20 Aug 2021 15:38:48 -0700 Subject: [PATCH 0024/1077] Update manage-connections-from-windows-operating-system-components-to-microsoft-services.md Added troubleshooting links. https://microsoft.visualstudio.com/DefaultCollection/OS/_workitems/edit/34812129 --- ...dows-operating-system-components-to-microsoft-services.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index e57ef99b93..cb2491d5a9 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -54,6 +54,11 @@ The following sections list the components that make network connections to Micr The following table lists management options for each setting, beginning with Windows 10 Enterprise version 1607. + >[!IMPORTANT] +>**If you need assistance with troubleshooting issues, please refer to:**
+> - [Keep your device running smoothly](https://support.microsoft.com/en-us/topic/keep-your-device-running-smoothly-with-recommended-troubleshooting-ec76fe10-4ac8-ce9d-49c6-757770fe68f1)
+> - [CSP - Troubleshooting](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-troubleshooting) + | Setting | UI | Group Policy | Registry | | - | :-: | :-: | :-: | From 82fd7309c3097133c02b94fd4f6cae5d14191f3e Mon Sep 17 00:00:00 2001 From: Joseph Knierman Date: Tue, 14 Sep 2021 15:37:16 -0700 Subject: [PATCH 0025/1077] added relative links --- windows/client-management/mdm/assignedaccess-csp.md | 2 +- windows/configuration/guidelines-for-assigned-access-app.md | 4 ++-- windows/configuration/kiosk-single-app.md | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index a0f5885385..4b7f2a6f84 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -82,7 +82,7 @@ The supported operations are Add, Delete, Get and Replace. When there's no confi **./Device/Vendor/MSFT/AssignedAccess/Configuration** Added in Windows 10, version 1709. Specifies the settings that you can configure in the kiosk or device. This node accepts an AssignedAccessConfiguration xml as input to configure the device experience. For details about the configuration settings in the XML, see [Create a Windows 10 kiosk that runs multiple apps](/windows/configuration/lock-down-windows-10-to-specific-apps). Here is the schema for the [AssignedAccessConfiguration](#assignedaccessconfiguration-xsd). -Updated in Windows 10, version 1909. Added Microsoft Edge kiosk mode support. This allows Microsoft Edge to be the specified kiosk application. For details about configuring Microsoft Edge kiosk mode, see [Configure a Windows 10 kiosk that runs Microsoft Edge](https://docs.microsoft.com/DeployEdge/microsoft-edge-configure-kiosk-mode). Windows 10, version 1909 also allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. The breakout sequence is defined with the format modifiers + keys. An example breakout sequence would look something like "shift+alt+a", where "shift" and "alt" are the modifiers and "a" is the key. +Updated in Windows 10, version 1909. Added Microsoft Edge kiosk mode support. This allows Microsoft Edge to be the specified kiosk application. For details about configuring Microsoft Edge kiosk mode, see [Configure a Windows 10 kiosk that runs Microsoft Edge](/DeployEdge/microsoft-edge-configure-kiosk-mode). Windows 10, version 1909 also allows for configuration of the breakout sequence. The breakout sequence specifies the keyboard shortcut that returns a kiosk session to the lock screen. The breakout sequence is defined with the format modifiers + keys. An example breakout sequence would look something like "shift+alt+a", where "shift" and "alt" are the modifiers and "a" is the key. > [!Note] > In Windows 10, version 1803 the Configuration node introduces single app kiosk profile to replace KioskModeApp CSP node. KioskModeApp node will be deprecated soon, so you should use the single app kiosk profile in config xml for Configuration node to configure public-facing single app Kiosk. diff --git a/windows/configuration/guidelines-for-assigned-access-app.md b/windows/configuration/guidelines-for-assigned-access-app.md index 2810e1685a..e8b848c1a6 100644 --- a/windows/configuration/guidelines-for-assigned-access-app.md +++ b/windows/configuration/guidelines-for-assigned-access-app.md @@ -45,9 +45,9 @@ Avoid selecting Windows apps that are designed to launch other apps as part of t ## Guidelines for web browsers -In Windows 10, version 1909, assigned access adds support for the new Microsoft Edge kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode](https://docs.microsoft.com/DeployEdge/microsoft-edge-configure-kiosk-mode). +In Windows 10, version 1909, assigned access adds support for the new Microsoft Edge kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode](/DeployEdge/microsoft-edge-configure-kiosk-mode). -In Windows 10, version 1809, Microsoft Edge Legacy includes support for kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode.](https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy) +In Windows 10, version 1809, Microsoft Edge Legacy includes support for kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode.](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy) In Windows 10, version 1803 and later, you can install the **Kiosk Browser** app from Microsoft to use as your kiosk app. For digital signage scenarios, you can configure **Kiosk Browser** to navigate to a URL and show only that content -- no navigation buttons, no address bar, etc. For kiosk scenarios, you can configure additional settings, such as allowed and blocked URLs, navigation buttons, and end session buttons. For example, you could configure your kiosk to show the online catalog for your store, where customers can navigate between departments and items, but aren’t allowed to go to a competitor's website. diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md index 22eff9f6b2..f3438008cc 100644 --- a/windows/configuration/kiosk-single-app.md +++ b/windows/configuration/kiosk-single-app.md @@ -270,7 +270,7 @@ To change the default time for assigned access to resume, add *IdleTimeOut* (DWO > [!NOTE] > **IdleTimeOut** does not apply to the new Microsoft Edge kiosk mode. - The Breakout Sequence of **Ctrl + Alt + Del** is the default, but this can be configured to be a different sequence of keys. The breakout sequence uses the format **modifiers + keys**. An example breakout sequence would look something like **Shift + Alt + a**, where **Shift** and **Alt** are the modifiers and **a** is the key value. [See how this is configured in XML](https://docs.microsoft.com/windows/configuration/kiosk-xml#microsoft-edge-kiosk-xml-sample). + The Breakout Sequence of **Ctrl + Alt + Del** is the default, but this can be configured to be a different sequence of keys. The breakout sequence uses the format **modifiers + keys**. An example breakout sequence would look something like **Shift + Alt + a**, where **Shift** and **Alt** are the modifiers and **a** is the key value. [See how this is configured in XML](/windows/configuration/kiosk-xml#microsoft-edge-kiosk-xml-sample). From 3f06b869b4cf211cc1d7fcdbfd6723dacbead3a7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20Notin?= Date: Thu, 16 Sep 2021 15:46:05 +0200 Subject: [PATCH 0026/1077] Fix SIDs for IUSR and IIS_IUSRS well known security identifiers --- .../identity-protection/access-control/security-identifiers.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/identity-protection/access-control/security-identifiers.md b/windows/security/identity-protection/access-control/security-identifiers.md index be0a573f71..0138f2f32f 100644 --- a/windows/security/identity-protection/access-control/security-identifiers.md +++ b/windows/security/identity-protection/access-control/security-identifiers.md @@ -205,7 +205,7 @@ The SECURITY\_NT\_AUTHORITY (S-1-5) predefined identifier authority produces SID | S-1-5-13 | Terminal Server User| A group that includes all users who sign in to a server with Remote Desktop Services enabled.| | S-1-5-14 | Remote Interactive Logon| A group that includes all users who log on to the computer by using a remote desktop connection. This group is a subset of the Interactive group. Access tokens that contain the Remote Interactive Logon SID also contain the Interactive SID.| | S-1-5-15| This Organization| A group that includes all users from the same organization. Only included with Active Directory accounts and only added by a domain controller.| -| S-1-5-17 | IIS_USRS| An account that is used by the default Internet Information Services (IIS) user.| +| S-1-5-17 | IUSR| An account that is used by the default Internet Information Services (IIS) user.| | S-1-5-18 | System (or LocalSystem)| An identity that is used locally by the operating system and by services that are configured to sign in as LocalSystem.
System is a hidden member of Administrators. That is, any process running as System has the SID for the built-in Administrators group in its access token.
When a process that is running locally as System accesses network resources, it does so by using the computer's domain identity. Its access token on the remote computer includes the SID for the local computer's domain account plus SIDs for security groups that the computer is a member of, such as Domain Computers and Authenticated Users.| | S-1-5-19 | NT Authority (LocalService)| An identity that is used by services that are local to the computer, have no need for extensive local access, and do not need authenticated network access. Services that run as LocalService access local resources as ordinary users, and they access network resources as anonymous users. As a result, a service that runs as LocalService has significantly less authority than a service that runs as LocalSystem locally and on the network.| | S-1-5-20 | Network Service| An identity that is used by services that have no need for extensive local access but do need authenticated network access. Services running as NetworkService access local resources as ordinary users and access network resources by using the computer's identity. As a result, a service that runs as NetworkService has the same network access as a service that runs as LocalSystem, but it has significantly reduced local access.| @@ -240,6 +240,7 @@ The SECURITY\_NT\_AUTHORITY (S-1-5) predefined identifier authority produces SID |S-1-5-32-560|Builtin\Windows Authorization Access Group|An alias. Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects.| |S-1-5-32-561|Builtin\Terminal Server License Servers|An alias. A group for Terminal Server License Servers. When Windows Server 2003 Service Pack 1 is installed, a new local group is created.| |S-1-5-32-562|Builtin\Distributed COM Users|An alias. A group for COM to provide computer-wide access controls that govern access to all call, activation, or launch requests on the computer.| +|S-1-5-32-568|Builtin\IIS_IUSRS|An alias. A built-in group account for IIS users.| |S-1-5-32-569|Builtin\Cryptographic Operators|A built-in local group. Members are authorized to perform cryptographic operations.| |S-1-5-32-573|Builtin\Event Log Readers|A built-in local group. Members of this group can read event logs from local computer.| |S-1-5-32-574|Builtin\Certificate Service DCOM Access|A built-in local group. Members of this group are allowed to connect to Certification Authorities in the enterprise.| From e8df71d29947947b671bcb0867741b79bd48afa0 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Sat, 18 Sep 2021 12:54:50 -0700 Subject: [PATCH 0027/1077] Replaced the definition of Certificates to remove the word fraudulent Replaced the definition of Certificates to remove the word fraudulent --- .../privacy/manage-windows-1803-endpoints.md | 4 +- .../privacy/manage-windows-1809-endpoints.md | 4 +- .../privacy/manage-windows-1903-endpoints.md | 4 +- .../privacy/manage-windows-1909-endpoints.md | 4 +- .../privacy/manage-windows-2004-endpoints.md | 4 +- .../privacy/manage-windows-20H2-endpoints.md | 4 +- .../privacy/manage-windows-21H1-endpoints.md | 161 ++++++++++++++++++ 7 files changed, 179 insertions(+), 6 deletions(-) create mode 100644 windows/privacy/manage-windows-21H1-endpoints.md diff --git a/windows/privacy/manage-windows-1803-endpoints.md b/windows/privacy/manage-windows-1803-endpoints.md index 47d72871ce..60cfe989fd 100644 --- a/windows/privacy/manage-windows-1803-endpoints.md +++ b/windows/privacy/manage-windows-1803-endpoints.md @@ -151,7 +151,9 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Certificates -Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. +Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. + +If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. diff --git a/windows/privacy/manage-windows-1809-endpoints.md b/windows/privacy/manage-windows-1809-endpoints.md index 15defa1a52..c2c7e42c44 100644 --- a/windows/privacy/manage-windows-1809-endpoints.md +++ b/windows/privacy/manage-windows-1809-endpoints.md @@ -162,7 +162,9 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Certificates -Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. +Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. + +If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. diff --git a/windows/privacy/manage-windows-1903-endpoints.md b/windows/privacy/manage-windows-1903-endpoints.md index 84fe836e14..ac15578eba 100644 --- a/windows/privacy/manage-windows-1903-endpoints.md +++ b/windows/privacy/manage-windows-1903-endpoints.md @@ -67,7 +67,9 @@ The following methodology was used to derive these network endpoints: |Azure |The following endpoints are related to Azure. |HTTPS|wd-prod-*fe*.cloudapp.azure.com| |||HTTPS|ris-prod-atm.trafficmanager.net| |||HTTPS|validation-v2.sls.trafficmanager.net| -|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. + +If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||HTTP|ctldl.windowsupdate.com| |Cortana and Search|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| ||The following endpoint is used to get images that are used for Microsoft Store suggestions. If you turn off traffic for this endpoint, you will block images that are used for Microsoft Store suggestions.|HTTPS|store-images.*microsoft.com| diff --git a/windows/privacy/manage-windows-1909-endpoints.md b/windows/privacy/manage-windows-1909-endpoints.md index 52426e2f66..226771442a 100644 --- a/windows/privacy/manage-windows-1909-endpoints.md +++ b/windows/privacy/manage-windows-1909-endpoints.md @@ -54,7 +54,9 @@ The following methodology was used to derive these network endpoints: |||HTTP|tile-service.weather.microsoft.com/en-us/livetile/preinstall| ||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|cdn.onenote.net/*| ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLS v1.2|evoke-windowsservices-tas.msedge.net -|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. + +If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||HTTP|ctldl.windowsupdate.com| |Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| ||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|HTTPS|www.bing.com*| diff --git a/windows/privacy/manage-windows-2004-endpoints.md b/windows/privacy/manage-windows-2004-endpoints.md index 4c80cf5104..80a1d264d1 100644 --- a/windows/privacy/manage-windows-2004-endpoints.md +++ b/windows/privacy/manage-windows-2004-endpoints.md @@ -54,7 +54,9 @@ The following methodology was used to derive these network endpoints: |||HTTP|tile-service.weather.microsoft.com| ||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|cdn.onenote.net/* ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2|evoke-windowsservices-tas.msedge.net| -|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. + +If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||HTTP|ctldl.windowsupdate.com| |Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| ||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|TLSv1.2|www.bing.com*| diff --git a/windows/privacy/manage-windows-20H2-endpoints.md b/windows/privacy/manage-windows-20H2-endpoints.md index 526e5a2797..8d503ed260 100644 --- a/windows/privacy/manage-windows-20H2-endpoints.md +++ b/windows/privacy/manage-windows-20H2-endpoints.md @@ -54,7 +54,9 @@ The following methodology was used to derive these network endpoints: ||The following endpoint is used for the Weather app. To turn off traffic for this endpoint, either uninstall the Weather app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTP|tile-service.weather.microsoft.com| ||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS/HTTP|cdn.onenote.net| ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS|evoke-windowsservices-tas.msedge.net -|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. + +If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com| |Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| ||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|TLSv1.2/HTTPS/HTTP|www.bing.com*| diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md new file mode 100644 index 0000000000..a99b73f3a8 --- /dev/null +++ b/windows/privacy/manage-windows-21H1-endpoints.md @@ -0,0 +1,161 @@ +--- +title: Connection endpoints for Windows 10 Enterprise, version 21H1 +description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 20H2. +keywords: privacy, manage connections to Microsoft, Windows 10 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: high +audience: ITPro +author: gental-giant +ms.author: tomlayson +manager: mfletcher +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 9/17/2021 +--- + +# Manage connection endpoints for Windows 10 Enterprise, version 21H1 + +**Applies to** + +- Windows 10 Enterprise, version 21H1 + +Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include: + +- Connecting to Microsoft Office and Windows sites to download the latest app and security updates. +- Connecting to email servers to send and receive email. +- Connecting to the web for every day web browsing. +- Connecting to the cloud to store and access backups. +- Using your location to show a weather forecast. + +Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +Where applicable, each endpoint covered in this topic includes a link to the specific details on how to control that traffic. + +The following methodology was used to derive these network endpoints: + +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. +5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. +7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. +8. These tests were conducted for one week, but if you capture traffic for longer you may have different results. + +> [!NOTE] +> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. + +## Windows 10 21H1 Enterprise connection endpoints + +|Area|Description|Protocol|Destination| +|----------------|----------|----------|------------| +|Apps|||[Learn how to turn off traffic to the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +||The following endpoint is used for the Weather app. To turn off traffic for this endpoint, either uninstall the Weather app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTP|tile-service.weather.microsoft.com| +||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS/HTTP|cdn.onenote.net| +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS|evoke-windowsservices-tas.msedge.net +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. + +If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|||TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com| +|Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| +||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|TLSv1.2/HTTPS/HTTP|www.bing.com*| +|||TLSv1.2/HTTPS/HTTP|fp.msedge.net| +|||TLSv1.2|I-ring.msedge.net| +|||HTTPS|s-ring.msedge.net| +|Device authentication|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +||The following endpoint is used to authenticate a device. If you turn off traffic for this endpoint, the device will not be authenticated.|HTTPS|login.live.com*| +|Device metadata|The following endpoint is used to retrieve device metadata. If you turn off traffic for this endpoint, metadata will not be updated for the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#4-device-metadata-retrieval)| +|||HTTP|dmd.metaservices.microsoft.com| +|Diagnostic Data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||TLSv1.2/HTTPS/HTTP|v10.events.data.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|v20.events.data.microsoft.com| +|||HTTP|www.microsoft.com| +||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft.|TLSv1.2|telecommand.telemetry.microsoft.com| +|||TLS v1.2/HTTPS/HTTP|watson.*.microsoft.com| +|Font Streaming|The following endpoints are used to download fonts on demand. If you turn off traffic for these endpoints, you will not be able to download fonts on demand.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#6-font-streaming)| +|||HTTPS|fs.microsoft.com| +|Licensing|The following endpoint is used for online activation and some app licensing. To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#9-license-manager)| +|||TLSv1.2/HTTPS/HTTP|licensing.mp.microsoft.com| +|Maps|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-offlinemaps)| +||The following endpoints are used to check for updates to maps that have been downloaded for offline use. If you turn off traffic for this endpoint, offline maps will not be updated.|TLSv1.2/HTTPS/HTTP|maps.windows.com| +|Microsoft Account|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-microsoft-account)| +||The following endpoints are used for Microsoft accounts to sign in. If you turn off traffic for these endpoints, users cannot sign in with Microsoft accounts. |TLSv1.2/HTTPS|login.live.com| +|Microsoft Edge|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge)| +||This traffic is related to the Microsoft Edge browser.|HTTPS|iecvlist.microsoft.com| +||The following endpoint is used by Microsoft Edge Update service to check for new updates. If you disable this endpoint, Microsoft Edge won’t be able to check for and apply new edge updates.|TLSv1.2/HTTPS/HTTP|msedge.api.cdp.microsoft.com| +|Microsoft forward link redirection service (FWLink)|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer. If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded.|HTTP|go.microsoft.com| +|Microsoft Store|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +||The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). If you turn off traffic for these endpoints, the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|HTTPS|img-prod-cms-rt-microsoft-com.akamaized.net| +||The following endpoint is needed to load the content in the Microsoft Store app.|HTTPS|livetileedge.dsx.mp.microsoft.com| +||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way. If you turn off traffic for this endpoint, push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization.|TLSv1.2/HTTPS|*.wns.windows.com| +||The following endpoints are used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them|TLSv1.2/HTTPS/HTTP|storecatalogrevocation.storequality.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|HTTPS|manage.devcenter.microsoft.com| +||The following endpoints are used to communicate with Microsoft Store. If you turn off traffic for these endpoints, apps cannot be installed or updated from the Microsoft Store.|TLSv1.2/HTTPS/HTTP|displaycatalog.mp.microsoft.com| +|||HTTPS|pti.store.microsoft.com| +|||HTTP|share.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2/HTTPS/HTTP|manage.devcenter.microsoft.com| +|Network Connection Status Indicator (NCSI)|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi)| +||Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you turn off traffic for this endpoint, NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning.|HTTPS|www.msftconnecttest.com*| +|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser. For more info, see Office 365 URLs and IP address ranges. You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||HTTPS|www.office.com| +|||HTTPS|blobs.officehome.msocdn.com| +|||HTTPS|officehomeblobs.blob.core.windows.net| +|||HTTPS|self.events.data.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|outlookmobile-office365-tas.msedge.net| +|OneDrive|The following endpoints are related to OneDrive. If you turn off traffic for these endpoints, anything that relies on g.live.com to get updated URL information will no longer work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive)| +|||TLSv1.2/HTTPS/HTTP|g.live.com| +|||TLSv1.2/HTTPS/HTTP|oneclient.sfx.ms| +|||HTTPS| logincdn.msauth.net| +|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you turn off traffic for this endpoint, an app that uses this endpoint may stop working.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||TLSv1.2/HTTPS/HTTP|settings-win.data.microsoft.com| +|||HTTPS|settings.data.microsoft.com| +|Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +|||HTTPS/HTTP|*.pipe.aria.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|config.edge.skype.com| +|Teams|The following endpoint is used for Microsoft Teams application.||[Learn how to turn off traffic to all of the following endpoint(s).]( manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||TLSv1.2/HTTPS/HTTP|config.teams.microsoft.com| +|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. If you turn off traffic for this endpoint, the device will not use Cloud-based Protection.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender)| +|||HTTPS/TLSv1.2|wdcp.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications. If you turn off traffic for these endpoints, SmartScreen notifications will not appear.|HTTPS|*smartscreen-prod.microsoft.com| +|||HTTPS/HTTP|checkappexec.microsoft.com| +|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. If you turn off traffic for these endpoints, Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see Windows Spotlight.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight)| +|||TLSv1.2/HTTPS/HTTP|arc.msn.com| +|||HTTPS|ris.api.iris.microsoft.com| +|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)| +|||TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| +|||HTTP|emdl.ws.microsoft.com| +||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device will not be able to download updates for the operating system.|TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com| +|||HTTP|*.windowsupdate.com| +||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTPS|adl.windows.com| +||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| +|Xbox Live|The following endpoint is used for Xbox Live.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||HTTPS|dlassets-ssl.xboxlive.com| + + +## Other Windows 10 editions + +To view endpoints for other versions of Windows 10 Enterprise, see: + +- [Manage connection endpoints for Windows 10, version 2004](manage-windows-2004-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1909](manage-windows-1909-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md) + +To view endpoints for non-Enterprise Windows 10 editions, see: + +- [Windows 10, version 2004, connection endpoints for non-Enterprise editions](windows-endpoints-2004-non-enterprise-editions.md) +- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions.md) +- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md) +- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md) +- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions.md) +- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions.md) + +## Related links + +- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) +- [Network infrastructure requirements for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints) \ No newline at end of file From 9e94bf395e7ba82f6187b4cbd673648cb9ab932a Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Sat, 18 Sep 2021 13:03:30 -0700 Subject: [PATCH 0028/1077] Update manage-windows-1709-endpoints.md Updated Certificates definition --- windows/privacy/manage-windows-1709-endpoints.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-1709-endpoints.md b/windows/privacy/manage-windows-1709-endpoints.md index 249701a04b..721183b96d 100644 --- a/windows/privacy/manage-windows-1709-endpoints.md +++ b/windows/privacy/manage-windows-1709-endpoints.md @@ -150,7 +150,9 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Certificates -Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. +Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. + +If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. From af3d264f1939ba3815117093279df0b8c8d8fd5c Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Sat, 18 Sep 2021 13:14:40 -0700 Subject: [PATCH 0029/1077] Corrected formatting error --- windows/privacy/manage-windows-20H2-endpoints.md | 1 - windows/privacy/manage-windows-21H1-endpoints.md | 3 +-- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/privacy/manage-windows-20H2-endpoints.md b/windows/privacy/manage-windows-20H2-endpoints.md index 8d503ed260..15048c65f7 100644 --- a/windows/privacy/manage-windows-20H2-endpoints.md +++ b/windows/privacy/manage-windows-20H2-endpoints.md @@ -55,7 +55,6 @@ The following methodology was used to derive these network endpoints: ||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS/HTTP|cdn.onenote.net| ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS|evoke-windowsservices-tas.msedge.net |Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. - If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com| |Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md index a99b73f3a8..544f5742bd 100644 --- a/windows/privacy/manage-windows-21H1-endpoints.md +++ b/windows/privacy/manage-windows-21H1-endpoints.md @@ -1,6 +1,6 @@ --- title: Connection endpoints for Windows 10 Enterprise, version 21H1 -description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 20H2. +description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 21H1. keywords: privacy, manage connections to Microsoft, Windows 10 ms.prod: w10 ms.mktglfcycl: manage @@ -55,7 +55,6 @@ The following methodology was used to derive these network endpoints: ||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS/HTTP|cdn.onenote.net| ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS|evoke-windowsservices-tas.msedge.net |Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. - If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com| |Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| From 68d45ff38871a0ab115019bd7a533bef898bcf78 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Sat, 18 Sep 2021 15:50:33 -0700 Subject: [PATCH 0030/1077] Added additional links for previous versions --- windows/privacy/manage-windows-21H1-endpoints.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md index 544f5742bd..dcd6176934 100644 --- a/windows/privacy/manage-windows-21H1-endpoints.md +++ b/windows/privacy/manage-windows-21H1-endpoints.md @@ -138,6 +138,7 @@ If automatic updates are turned off, applications and websites may stop working To view endpoints for other versions of Windows 10 Enterprise, see: +- [Manage connection endpoints for Windows 10, version 20H2](manage-windows-20H2-endpoints.md) - [Manage connection endpoints for Windows 10, version 2004](manage-windows-2004-endpoints.md) - [Manage connection endpoints for Windows 10, version 1909](manage-windows-1909-endpoints.md) - [Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) @@ -147,6 +148,7 @@ To view endpoints for other versions of Windows 10 Enterprise, see: To view endpoints for non-Enterprise Windows 10 editions, see: +- [Windows 10, version 20H2, connection endpoints for non-Enterprise editions](windows-endpoints-20H2-non-enterprise-editions.md) - [Windows 10, version 2004, connection endpoints for non-Enterprise editions](windows-endpoints-2004-non-enterprise-editions.md) - [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions.md) - [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md) From 94740ce346c0b37244df77988eec3f83e22b4680 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Wed, 22 Sep 2021 21:52:17 -0700 Subject: [PATCH 0031/1077] Update windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...s-operating-system-components-to-microsoft-services.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index cb2491d5a9..d663011771 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -54,10 +54,10 @@ The following sections list the components that make network connections to Micr The following table lists management options for each setting, beginning with Windows 10 Enterprise version 1607. - >[!IMPORTANT] ->**If you need assistance with troubleshooting issues, please refer to:**
-> - [Keep your device running smoothly](https://support.microsoft.com/en-us/topic/keep-your-device-running-smoothly-with-recommended-troubleshooting-ec76fe10-4ac8-ce9d-49c6-757770fe68f1)
-> - [CSP - Troubleshooting](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-troubleshooting) + > [!IMPORTANT] +> **If you need assistance with troubleshooting issues, please refer to**:
+> - [Keep your device running smoothly](https://support.microsoft.com/topic/keep-your-device-running-smoothly-with-recommended-troubleshooting-ec76fe10-4ac8-ce9d-49c6-757770fe68f1)
+> - [CSP - Troubleshooting](/windows/client-management/mdm/policy-csp-troubleshooting) | Setting | UI | Group Policy | Registry | From f8abb9505eb8cd2285db96be7142065317eb620c Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Wed, 22 Sep 2021 21:52:48 -0700 Subject: [PATCH 0032/1077] Update windows/privacy/manage-windows-1709-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-1709-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-1709-endpoints.md b/windows/privacy/manage-windows-1709-endpoints.md index 721183b96d..e3021c019c 100644 --- a/windows/privacy/manage-windows-1709-endpoints.md +++ b/windows/privacy/manage-windows-1709-endpoints.md @@ -150,7 +150,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Certificates -Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. +Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA) are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. From 349dbdee8080561111136bb227879cae1c24e615 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Wed, 22 Sep 2021 21:53:09 -0700 Subject: [PATCH 0033/1077] Update windows/privacy/manage-windows-1809-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-1809-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-1809-endpoints.md b/windows/privacy/manage-windows-1809-endpoints.md index c2c7e42c44..e9ea3debad 100644 --- a/windows/privacy/manage-windows-1809-endpoints.md +++ b/windows/privacy/manage-windows-1809-endpoints.md @@ -162,7 +162,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Certificates -Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. +Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA) are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. From 0b2e6c5bbc6d9081171ecdd61c706f5dbdc1b4a1 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Wed, 22 Sep 2021 21:55:39 -0700 Subject: [PATCH 0034/1077] Update windows/privacy/manage-windows-2004-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-2004-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-2004-endpoints.md b/windows/privacy/manage-windows-2004-endpoints.md index 80a1d264d1..61e552e9a8 100644 --- a/windows/privacy/manage-windows-2004-endpoints.md +++ b/windows/privacy/manage-windows-2004-endpoints.md @@ -54,7 +54,7 @@ The following methodology was used to derive these network endpoints: |||HTTP|tile-service.weather.microsoft.com| ||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|cdn.onenote.net/* ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2|evoke-windowsservices-tas.msedge.net| -|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA) are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||HTTP|ctldl.windowsupdate.com| From 2845c3301f766a88255f69965731ccfb0f8d363f Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Wed, 22 Sep 2021 21:56:02 -0700 Subject: [PATCH 0035/1077] Update windows/privacy/manage-windows-20H2-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-20H2-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-20H2-endpoints.md b/windows/privacy/manage-windows-20H2-endpoints.md index 15048c65f7..3e6feb3e60 100644 --- a/windows/privacy/manage-windows-20H2-endpoints.md +++ b/windows/privacy/manage-windows-20H2-endpoints.md @@ -54,7 +54,7 @@ The following methodology was used to derive these network endpoints: ||The following endpoint is used for the Weather app. To turn off traffic for this endpoint, either uninstall the Weather app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTP|tile-service.weather.microsoft.com| ||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS/HTTP|cdn.onenote.net| ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS|evoke-windowsservices-tas.msedge.net -|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA) are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com| |Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| From ee8303b7f63f565e8f6260ae10c08c99930a3ffd Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Wed, 22 Sep 2021 21:56:36 -0700 Subject: [PATCH 0036/1077] Update windows/privacy/manage-windows-1909-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-1909-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-1909-endpoints.md b/windows/privacy/manage-windows-1909-endpoints.md index 226771442a..944768ac5a 100644 --- a/windows/privacy/manage-windows-1909-endpoints.md +++ b/windows/privacy/manage-windows-1909-endpoints.md @@ -54,7 +54,7 @@ The following methodology was used to derive these network endpoints: |||HTTP|tile-service.weather.microsoft.com/en-us/livetile/preinstall| ||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|cdn.onenote.net/*| ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLS v1.2|evoke-windowsservices-tas.msedge.net -|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA) are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||HTTP|ctldl.windowsupdate.com| From 3b77d9b7e37ef9c43829e7a0399e8391aa671149 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Wed, 22 Sep 2021 22:02:12 -0700 Subject: [PATCH 0037/1077] Update windows/privacy/manage-windows-1903-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-1903-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-1903-endpoints.md b/windows/privacy/manage-windows-1903-endpoints.md index ac15578eba..e4d8bdf70f 100644 --- a/windows/privacy/manage-windows-1903-endpoints.md +++ b/windows/privacy/manage-windows-1903-endpoints.md @@ -67,7 +67,7 @@ The following methodology was used to derive these network endpoints: |Azure |The following endpoints are related to Azure. |HTTPS|wd-prod-*fe*.cloudapp.azure.com| |||HTTPS|ris-prod-atm.trafficmanager.net| |||HTTPS|validation-v2.sls.trafficmanager.net| -|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA) are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||HTTP|ctldl.windowsupdate.com| From de7b4e9941a22b31ee5fb95085b2a0911308936f Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Wed, 22 Sep 2021 22:02:35 -0700 Subject: [PATCH 0038/1077] Update windows/privacy/manage-windows-21H1-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-21H1-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md index dcd6176934..46cfe2a3d2 100644 --- a/windows/privacy/manage-windows-21H1-endpoints.md +++ b/windows/privacy/manage-windows-21H1-endpoints.md @@ -51,7 +51,7 @@ The following methodology was used to derive these network endpoints: |Area|Description|Protocol|Destination| |----------------|----------|----------|------------| |Apps|||[Learn how to turn off traffic to the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| -||The following endpoint is used for the Weather app. To turn off traffic for this endpoint, either uninstall the Weather app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTP|tile-service.weather.microsoft.com| +||The following endpoint is used for the Weather app. To turn off traffic for this endpoint, either uninstall the Weather app or disable the Microsoft Store. If you disable the Microsoft Store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTP|tile-service.weather.microsoft.com| ||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS/HTTP|cdn.onenote.net| ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS|evoke-windowsservices-tas.msedge.net |Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. From 9b44def8c1cd30b660f4a22f1b1c2e3f9763192d Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Wed, 22 Sep 2021 22:03:04 -0700 Subject: [PATCH 0039/1077] Update windows/privacy/manage-windows-21H1-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-21H1-endpoints.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md index 46cfe2a3d2..d37b3382ee 100644 --- a/windows/privacy/manage-windows-21H1-endpoints.md +++ b/windows/privacy/manage-windows-21H1-endpoints.md @@ -52,8 +52,8 @@ The following methodology was used to derive these network endpoints: |----------------|----------|----------|------------| |Apps|||[Learn how to turn off traffic to the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| ||The following endpoint is used for the Weather app. To turn off traffic for this endpoint, either uninstall the Weather app or disable the Microsoft Store. If you disable the Microsoft Store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTP|tile-service.weather.microsoft.com| -||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS/HTTP|cdn.onenote.net| -||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS|evoke-windowsservices-tas.msedge.net +||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft Store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS/HTTP|cdn.onenote.net| +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft Store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS|evoke-windowsservices-tas.msedge.net |Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com| From bc50fa1863f6e8e6c5f8b079a74732e98b07593e Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Wed, 22 Sep 2021 22:03:20 -0700 Subject: [PATCH 0040/1077] Update windows/privacy/manage-windows-21H1-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-21H1-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md index d37b3382ee..a2925d1b13 100644 --- a/windows/privacy/manage-windows-21H1-endpoints.md +++ b/windows/privacy/manage-windows-21H1-endpoints.md @@ -54,7 +54,7 @@ The following methodology was used to derive these network endpoints: ||The following endpoint is used for the Weather app. To turn off traffic for this endpoint, either uninstall the Weather app or disable the Microsoft Store. If you disable the Microsoft Store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTP|tile-service.weather.microsoft.com| ||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft Store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS/HTTP|cdn.onenote.net| ||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft Store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS|evoke-windowsservices-tas.msedge.net -|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. +|Certificates|Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA) are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates where the server certificate issuer is unknown or is not trusted by the service. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism. If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| |||TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com| |Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| From ae2450ab5ed0bd0d78335364bacd995bd0cfbff2 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Wed, 22 Sep 2021 22:03:40 -0700 Subject: [PATCH 0041/1077] Update windows/privacy/manage-windows-21H1-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-21H1-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md index a2925d1b13..3d74636c9f 100644 --- a/windows/privacy/manage-windows-21H1-endpoints.md +++ b/windows/privacy/manage-windows-21H1-endpoints.md @@ -70,7 +70,7 @@ If automatic updates are turned off, applications and websites may stop working |||TLSv1.2/HTTPS/HTTP|v10.events.data.microsoft.com| |||TLSv1.2/HTTPS/HTTP|v20.events.data.microsoft.com| |||HTTP|www.microsoft.com| -||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft.|TLSv1.2|telecommand.telemetry.microsoft.com| +||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: **Administrative Templates** > **Windows Components** > **Windows Error Reporting** > **Disable Windows Error Reporting**. This means error reporting information will not be sent back to Microsoft.|TLSv1.2|telecommand.telemetry.microsoft.com| |||TLS v1.2/HTTPS/HTTP|watson.*.microsoft.com| |Font Streaming|The following endpoints are used to download fonts on demand. If you turn off traffic for these endpoints, you will not be able to download fonts on demand.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#6-font-streaming)| |||HTTPS|fs.microsoft.com| From 29c09f6e3021ee1f8214708253f9a7aa69f5c411 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Wed, 22 Sep 2021 22:05:38 -0700 Subject: [PATCH 0042/1077] Update windows/privacy/manage-windows-21H1-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-21H1-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md index 3d74636c9f..d85fba8989 100644 --- a/windows/privacy/manage-windows-21H1-endpoints.md +++ b/windows/privacy/manage-windows-21H1-endpoints.md @@ -83,7 +83,7 @@ If automatic updates are turned off, applications and websites may stop working |Microsoft Edge|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge)| ||This traffic is related to the Microsoft Edge browser.|HTTPS|iecvlist.microsoft.com| ||The following endpoint is used by Microsoft Edge Update service to check for new updates. If you disable this endpoint, Microsoft Edge won’t be able to check for and apply new edge updates.|TLSv1.2/HTTPS/HTTP|msedge.api.cdp.microsoft.com| -|Microsoft forward link redirection service (FWLink)|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer. If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded.|HTTP|go.microsoft.com| +|Microsoft forward link redirection service (FWLink)|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer. If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead, disable the traffic that's getting forwarded.|HTTP|go.microsoft.com| |Microsoft Store|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| ||The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). If you turn off traffic for these endpoints, the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|HTTPS|img-prod-cms-rt-microsoft-com.akamaized.net| ||The following endpoint is needed to load the content in the Microsoft Store app.|HTTPS|livetileedge.dsx.mp.microsoft.com| From 8e3a643e820172d1fdfc8dde8e8b90c47267502c Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Wed, 22 Sep 2021 22:13:09 -0700 Subject: [PATCH 0043/1077] Update windows/privacy/manage-windows-21H1-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-21H1-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md index d85fba8989..a091a7b1a0 100644 --- a/windows/privacy/manage-windows-21H1-endpoints.md +++ b/windows/privacy/manage-windows-21H1-endpoints.md @@ -112,7 +112,7 @@ If automatic updates are turned off, applications and websites may stop working |Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| |||HTTPS/HTTP|*.pipe.aria.microsoft.com| |||TLSv1.2/HTTPS/HTTP|config.edge.skype.com| -|Teams|The following endpoint is used for Microsoft Teams application.||[Learn how to turn off traffic to all of the following endpoint(s).]( manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|Teams|The following endpoint is used for Microsoft Teams application.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| |||TLSv1.2/HTTPS/HTTP|config.teams.microsoft.com| |Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. If you turn off traffic for this endpoint, the device will not use Cloud-based Protection.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender)| |||HTTPS/TLSv1.2|wdcp.microsoft.com| From d503010897026f2dabf5b7819c216ba47a0ed8b6 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Wed, 22 Sep 2021 22:13:35 -0700 Subject: [PATCH 0044/1077] Update windows/privacy/manage-windows-21H1-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-21H1-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md index a091a7b1a0..a1591d8213 100644 --- a/windows/privacy/manage-windows-21H1-endpoints.md +++ b/windows/privacy/manage-windows-21H1-endpoints.md @@ -121,7 +121,7 @@ If automatic updates are turned off, applications and websites may stop working |Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. If you turn off traffic for these endpoints, Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see Windows Spotlight.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight)| |||TLSv1.2/HTTPS/HTTP|arc.msn.com| |||HTTPS|ris.api.iris.microsoft.com| -|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)| +|Windows Update|The following endpoint is used for Windows Update downloads of apps and operating system updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)| |||TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| |||HTTP|emdl.ws.microsoft.com| ||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device will not be able to download updates for the operating system.|TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com| From ec4ee2d5fb915753a1b95eef6c6d257e94d36fe5 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Thu, 23 Sep 2021 10:05:28 -0700 Subject: [PATCH 0045/1077] Update windows/privacy/manage-windows-21H1-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-21H1-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md index a1591d8213..6a2ead3f78 100644 --- a/windows/privacy/manage-windows-21H1-endpoints.md +++ b/windows/privacy/manage-windows-21H1-endpoints.md @@ -109,7 +109,7 @@ If automatic updates are turned off, applications and websites may stop working |Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you turn off traffic for this endpoint, an app that uses this endpoint may stop working.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| |||TLSv1.2/HTTPS/HTTP|settings-win.data.microsoft.com| |||HTTPS|settings.data.microsoft.com| -|Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +|Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| |||HTTPS/HTTP|*.pipe.aria.microsoft.com| |||TLSv1.2/HTTPS/HTTP|config.edge.skype.com| |Teams|The following endpoint is used for Microsoft Teams application.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| From 7638d8acaf5e81e60b7a251ad60d357280837c0a Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Thu, 23 Sep 2021 10:05:42 -0700 Subject: [PATCH 0046/1077] Update windows/privacy/manage-windows-21H1-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-21H1-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md index 6a2ead3f78..11ba1b2ffc 100644 --- a/windows/privacy/manage-windows-21H1-endpoints.md +++ b/windows/privacy/manage-windows-21H1-endpoints.md @@ -126,7 +126,7 @@ If automatic updates are turned off, applications and websites may stop working |||HTTP|emdl.ws.microsoft.com| ||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device will not be able to download updates for the operating system.|TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com| |||HTTP|*.windowsupdate.com| -||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com| +||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Microsoft Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com| |||TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| ||The following endpoint is used for compatibility database updates for Windows.|HTTPS|adl.windows.com| ||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| From ebe2b97325480f8ef827aa34b48c7301ba085d40 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Thu, 23 Sep 2021 10:06:02 -0700 Subject: [PATCH 0047/1077] Update windows/privacy/manage-windows-21H1-endpoints.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/privacy/manage-windows-21H1-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md index 11ba1b2ffc..9c284f4cf2 100644 --- a/windows/privacy/manage-windows-21H1-endpoints.md +++ b/windows/privacy/manage-windows-21H1-endpoints.md @@ -158,5 +158,5 @@ To view endpoints for non-Enterprise Windows 10 editions, see: ## Related links -- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) +- [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) - [Network infrastructure requirements for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints) \ No newline at end of file From 5eb239ce482c044246dddab84636f62874ac8bcd Mon Sep 17 00:00:00 2001 From: bohops Date: Wed, 29 Sep 2021 08:16:37 -0400 Subject: [PATCH 0048/1077] Update Block Rule Credits - Add James Forshaw James has discovered numerous WDAC bypasses and is credited with the addinprocess* findings. --- .../microsoft-recommended-block-rules.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index d9e8974465..0a04135fbc 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -88,6 +88,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you | `Alex Ionescu` | `@aionescu`| | `Brock Mammen`| | | `Casey Smith` | `@subTee` | +| `James Forshaw` | `@tiraniddo` | | `Jimmy Bayne` | `@bohops` | | `Lasse Trolle Borup` | `Langkjaer Cyber Defence` | | `Lee Christensen` | `@tifkin_` | @@ -1555,4 +1556,4 @@ Select the correct version of each .dll for the Windows release you plan to supp ## More information -- [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md) \ No newline at end of file +- [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md) From f7e3dd91d76ac6b6d550936a6588fc9baada5617 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 29 Sep 2021 11:34:11 -0700 Subject: [PATCH 0049/1077] Update microsoft-recommended-block-rules.md --- .../microsoft-recommended-block-rules.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 0a04135fbc..d7e11faa0a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -15,7 +15,7 @@ author: jsuther1974 ms.reviewer: isbrahm ms.author: dansimp manager: dansimp -ms.date: 08/23/2021 +ms.date: 09/29/2021 --- # Microsoft recommended block rules From 78489ec40abdc1a2b8b84f6c6afd9c7f799e4265 Mon Sep 17 00:00:00 2001 From: Rick Munck <33725928+jmunck@users.noreply.github.com> Date: Tue, 5 Oct 2021 08:10:25 -0500 Subject: [PATCH 0050/1077] Update security-compliance-toolkit-10.md Updated Office version also --- .../security-compliance-toolkit-10.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md b/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md index dc7c58f214..1fb53dc08f 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md @@ -44,7 +44,7 @@ The Security Compliance Toolkit consists of: - Windows Server 2012 R2 - Microsoft Office security baseline - - Office 365 Pro Plus + - M365 Apps for enterprise - Office 2016 - Microsoft Edge security baseline From 4977a99ebc7d9a55d0593860567c64a00ec412ad Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 5 Oct 2021 08:55:35 -0700 Subject: [PATCH 0051/1077] Update security-compliance-toolkit-10.md changed M365 to Microsoft 365 --- .../security-compliance-toolkit-10.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md b/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md index 1fb53dc08f..73c2193d00 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md @@ -44,7 +44,7 @@ The Security Compliance Toolkit consists of: - Windows Server 2012 R2 - Microsoft Office security baseline - - M365 Apps for enterprise + - Microsoft 365 Apps for enterprise - Office 2016 - Microsoft Edge security baseline From f1b755ae2b9ad36fd052ad5c400892b3384bc4b3 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Wed, 6 Oct 2021 13:47:52 -0700 Subject: [PATCH 0052/1077] updating references for Win11 --- .../update/deploy-updates-configmgr.md | 4 +- .../olympia/olympia-enrollment-guidelines.md | 55 ++++++++++--------- 2 files changed, 32 insertions(+), 27 deletions(-) diff --git a/windows/deployment/update/deploy-updates-configmgr.md b/windows/deployment/update/deploy-updates-configmgr.md index 73f4b8e93f..dc99943d00 100644 --- a/windows/deployment/update/deploy-updates-configmgr.md +++ b/windows/deployment/update/deploy-updates-configmgr.md @@ -15,7 +15,7 @@ ms.topic: article **Applies to** -- Windows 10 -- Windows 11 +- Windows 10 +- Windows 11 See the Microsoft Endpoint Manager [documentation](/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) for details about using Configuration Manager to deploy and manage Windows 10 updates. \ No newline at end of file diff --git a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md index 1c557d6128..9e9ab9af5d 100644 --- a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md +++ b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md @@ -1,6 +1,6 @@ --- title: Olympia Corp enrollment guidelines -description: Learn about the Olympia Corp enrollment and setting up an Azure Active Directory-REGISTERED Windows 10 device or an Azure Active Directory-JOINED Windows 10 device. +description: Learn about the Olympia Corp enrollment and setting up an Azure Active Directory-REGISTERED Windows client device or an Azure Active Directory-JOINED Windows client device. ms.author: jaimeo ms.topic: article ms.prod: w10 @@ -16,17 +16,22 @@ ms.custom: seo-marvel-apr2020 # Olympia Corp +**Applies to** + +- Windows 10 +- Windows 11 + ## What is Windows Insider Lab for Enterprise and Olympia Corp? Windows Insider Lab for Enterprise is intended for Windows Insiders who want to try new experimental and pre-release enterprise privacy and security features. To get the complete experience of these enterprise features, Olympia Corp, a virtual corporation has been set up to reflect the IT infrastructure of real world business. Selected customers are invited to join Olympia Corp and try these features. As an Olympia user, you will have an opportunity to: -- Use various enterprise features like Windows Information Protection (WIP), Microsoft Defender for Office 365, Windows Defender Application Guard (WDAG), and Application Virtualization (APP-V). -- Learn how Microsoft is preparing for GDPR, as well as enabling enterprise customers to prepare for their own readiness. -- Validate and test pre-release software in your environment. -- Provide feedback. -- Interact with engineering team members through a variety of communication channels. +- Use various enterprise features like Windows Information Protection (WIP), Microsoft Defender for Office 365, Windows Defender Application Guard (WDAG), and Application Virtualization (APP-V). +- Learn how Microsoft is preparing for GDPR, as well as enabling enterprise customers to prepare for their own readiness. +- Validate and test pre-release software in your environment. +- Provide feedback. +- Interact with engineering team members through a variety of communication channels. >[!Note] >Enterprise features might have reduced or different security, privacy, accessibility, availability, and reliability standards relative to commercially provided services and software. We may change or discontinue any of the enterprise features at any time without notice. @@ -39,17 +44,17 @@ To request an Olympia Corp account, fill out the survey at [https://aka.ms/Regis Welcome to Olympia Corp. Here are the steps needed to enroll. -As part of Windows Insider Lab for Enterprise, you can upgrade to Windows 10 Enterprise from Windows 10 Pro. This upgrade is optional. Since certain features such as Windows Defender Application Guard are only available on Windows 10 Enterprise, we recommend you to upgrade. +As part of Windows Insider Lab for Enterprise, you can upgrade to Windows client Enterprise from Windows client Pro. This upgrade is optional. Since certain features such as Windows Defender Application Guard are only available on Windows client Enterprise, we recommend you to upgrade. Choose one of the following two enrollment options: - To set up an AAD-registered device, [follow these steps](#enrollment-keep-current-edition). In this case, you log onto the device by using an existing (non-Olympia) account. -- If you are running Windows 10 Pro, we recommend that you upgrade to Windows 10 Enterprise by following these steps to [set up an Azure Active Directory-joined device](#enrollment-upgrade-to-enterprise). In this case, you will be able to log on to the device with your Olympia account. +- If you are running Windows client Pro, we recommend that you upgrade to Windows client Enterprise by following these steps to [set up an Azure Active Directory-joined device](#enrollment-upgrade-to-enterprise). In this case, you will be able to log on to the device with your Olympia account. -### Set up an Azure Active Directory-REGISTERED Windows 10 device +### Set up an Azure Active Directory-REGISTERED Windows client device This is the Bring Your Own Device (BYOD) method--your device will receive Olympia policies and features, but a new account will not be created. See [Set up Azure Active Directory registered Windows 10 devices](/azure/active-directory/device-management-azuread-registered-devices-windows10-setup) for additional information. @@ -57,26 +62,26 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi ![Settings -> Accounts.](images/1-1.png) -2. If you are already connected to a domain, click the existing account and then click **Disconnect**. Click **Restart Later**. +2. If you are already connected to a domain, select the existing account and then select **Disconnect**. Select **Restart Later**. -3. Click **Connect** and enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**. +3. Select **Connect** and enter your **Olympia corporate account** (for example, username@olympia.windows.com). Select **Next**. ![Entering account information when setting up a work or school account.](images/1-3.png) -4. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password. +4. Enter the temporary password that was sent to you. Select **Sign in**. Follow the instructions to set a new password. > [!NOTE] > Passwords should contain 8-16 characters, including at least one special character or number. ![Update your password.](images/1-4.png) -5. Read the **Terms and Conditions**. Click **Accept** to participate in the program. +5. Read the **Terms and Conditions**. Select **Accept** to participate in the program. 6. If this is the first time you are logging in, fill in the additional information to help you retrieve your account details. 7. Create a PIN for signing into your Olympia corporate account. -8. Go to **Start > Settings > Update & Security > Windows Insider Program**. Click on the current Windows Insider account, and click **Change**. Sign in with your **Olympia corporate account**. +8. Go to **Start > Settings > Update & Security > Windows Insider Program**. Select on the current Windows Insider account, and select **Change**. Sign in with your **Olympia corporate account**. > [!NOTE] > To complete this step, you will need to register your account with the [Windows Insider Program for Business](https://insider.windows.com/ForBusiness). @@ -85,9 +90,9 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi -### Set up Azure Active Directory-JOINED Windows 10 device +### Set up Azure Active Directory-JOINED Windows client device -- This method will upgrade your Windows 10 Pro license to Enterprise and create a new account. See [Set up Azure Active Directory joined devices](/azure/active-directory/device-management-azuread-joined-devices-setup) for more information. +- This method will upgrade your Windows client Pro license to Enterprise and create a new account. See [Set up Azure Active Directory joined devices](/azure/active-directory/device-management-azuread-joined-devices-setup) for more information. > [!NOTE] > Make sure that you save your Pro license key before upgrading to the Enterprise edition. If the device gets disconnected from Olympia, you can use the Pro key to reactivate the license manually in the unlikely event that the license fails to downgrade back to Pro automatically. To reactivate manually, see [Upgrade by manually entering a product key](../../upgrade/windows-10-edition-upgrades.md#upgrade-by-manually-entering-a-product-key). @@ -96,36 +101,36 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi ![Settings -> Accounts.](images/1-1.png) -2. If you are already connected to a domain, click the existing account and then click **Disconnect**. Click **Restart Later**. +2. If you are already connected to a domain, select the existing account and then select **Disconnect**. Select **Restart Later**. -3. Click **Connect**, then click **Join this device to Azure Active Directory**. +3. Select **Connect**, then select **Join this device to Azure Active Directory**. ![Joining device to Azure AD.]](images/2-3.png) -4. Enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**. +4. Enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Select **Next**. ![Set up a work or school account.](images/2-4.png) -5. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password. +5. Enter the temporary password that was sent to you. Select **Sign in**. Follow the instructions to set a new password. > [!NOTE] > Passwords should contain 8-16 characters, including at least one special character or number. ![Entering temporary password.](images/2-5.png) -6. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**. +6. When asked to make sure this is your organization, verify that the information is correct. If so, select **Join**. 7. If this is the first time you are signing in, fill in the additional information to help you retrieve your account details. 8. Create a PIN for signing into your Olympia corporate account. -9. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**. +9. When asked to make sure this is your organization, verify that the information is correct. If so, select **Join**. 10. Restart your device. -11. In the sign-in screen, choose **Other User** and sign in with your **Olympia corporate account**. Your device will upgrade to Windows 10 Enterprise. +11. In the sign-in screen, choose **Other User** and sign in with your **Olympia corporate account**. Your device will upgrade to Windows client Enterprise. -12. Go to **Start > Settings > Update & Security > Windows Insider Program**. Click on the current Windows Insider account, and click **Change**. Sign in with your **Olympia corporate account**. +12. Go to **Start > Settings > Update & Security > Windows Insider Program**. Select on the current Windows Insider account, and select **Change**. Sign in with your **Olympia corporate account**. > [!NOTE] > To complete this step, you will need to register your account with the [Windows Insider Program for Business](https://insider.windows.com/ForBusiness). @@ -133,4 +138,4 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi 13. Open the **Feedback Hub**, and sign in with your **Olympia corporate account**. >[!NOTE] -> Your Windows 10 Enterprise license will not be renewed if your device is not connected to Olympia. \ No newline at end of file +> Your Windows client Enterprise license will not be renewed if your device is not connected to Olympia. \ No newline at end of file From 51d8f81882e36d581f15b10168fce94356a08f6d Mon Sep 17 00:00:00 2001 From: fmata-ms <91461126+fmata-ms@users.noreply.github.com> Date: Thu, 7 Oct 2021 15:20:39 +0100 Subject: [PATCH 0053/1077] Update on Network Security Allow Pk2U Mitigation Added the mitigation information and link to the proper CVE for easy identification so that the users can easily understand how to address it if no longer an issue. --- ...ation-requests-to-this-computer-to-use-online-identities.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md b/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md index 671eb87720..1a9ea3a61c 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md @@ -86,6 +86,9 @@ If you don't set or you disable this policy, the PKU2U protocol won't be used to If you enable this policy in a hybrid environment, you allow your users to authenticate by using certificates issued by Azure AD and their online identity between the corresponding devices. This configuration allows users to share resources between such devices. Without enabling this policy, remote connections to an Azure AD joined device will not work. +### Fix/Remediation + +This vulnerability was fixed on February 2021 Security Update. More Information on [CVE-2021-25195](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-25195) ## Related topics From b26cfc6926be2e4db2bdc721f9fb332227c920d7 Mon Sep 17 00:00:00 2001 From: fmata-ms <91461126+fmata-ms@users.noreply.github.com> Date: Tue, 12 Oct 2021 11:17:37 +0100 Subject: [PATCH 0054/1077] Update windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...cation-requests-to-this-computer-to-use-online-identities.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md b/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md index 1a9ea3a61c..8327d5e9bc 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md @@ -88,7 +88,7 @@ If you enable this policy in a hybrid environment, you allow your users to authe ### Fix/Remediation -This vulnerability was fixed on February 2021 Security Update. More Information on [CVE-2021-25195](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-25195) +This vulnerability was fixed on February 9, 2021, in the [CVE-2021-25195](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-25195) Security Update. ## Related topics From f66d0dd5f9790e79d50f28dca8dfa54ad2589896 Mon Sep 17 00:00:00 2001 From: Gitprakhar13 <45089022+Gitprakhar13@users.noreply.github.com> Date: Tue, 12 Oct 2021 08:56:50 -0700 Subject: [PATCH 0055/1077] added security considerations --- windows/client-management/mdm/healthattestation-csp.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index e570b9890d..bf1801062d 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -1169,7 +1169,9 @@ xmlns="http://schemas.microsoft.com/windows/security/healthcertificate/validatio ``` - +## Security Considerations +> DHA anchors its trust in the TPM and its measurements. If TPM measurements can be spoofed or tampered, DHA cannot provide any guarantee of device health of that device. +PC Client TPM Certification ## Related topics From 47f7926a946e5d6c4c2e44e8efa3a38c82aa06f8 Mon Sep 17 00:00:00 2001 From: RavennMSFT <37601656+RavennMSFT@users.noreply.github.com> Date: Tue, 12 Oct 2021 23:26:00 -0700 Subject: [PATCH 0056/1077] Update hello-hybrid-key-trust-dirsync.md Added config details for Alternate ID scenario --- .../hello-for-business/hello-hybrid-key-trust-dirsync.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md index 5acfb06f68..7583001fed 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md @@ -36,6 +36,13 @@ Next, you need to synchronize the on-premises Active Directory with Azure Active
+If the user principal name (UPN) in your on-premises Active Directory is different from the UPN in Azure AD, you also need to complete the following steps - +- Configure Azure AD Connect to sync the user's on-premises UPN to the onPremisesUserPrincipalName attribute in Azure AD. +- Add the domain name of the on-premises UPN as a [verified domain](/azure/active-directory/fundamentals/add-custom-domain) in Azure AD. + +> [!NOTE] +> Windows Hello for Business Hybrid key trust is not supported if your users' on-premises domain cannot be added as a verified domain in Azure AD. +
## Follow the Windows Hello for Business hybrid key trust deployment guide @@ -45,4 +52,4 @@ Next, you need to synchronize the on-premises Active Directory with Azure Active 4. Configure Directory Synchronization (*You are here*) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) 6. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) -7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) From 76a09e689df665ac5313e2dcc67730eae91a2540 Mon Sep 17 00:00:00 2001 From: RavennMSFT <37601656+RavennMSFT@users.noreply.github.com> Date: Tue, 12 Oct 2021 23:35:44 -0700 Subject: [PATCH 0057/1077] Update hello-hybrid-key-trust-devreg.md Added note for Alt ID support --- .../hello-hybrid-key-trust-devreg.md | 21 +++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md index 713fcd89a5..8ebe1ed414 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -33,17 +33,26 @@ You are ready to configure device registration for your hybrid environment. Hybr > * Azure AD joined devices > * Hybrid Azure AD joined devices > -> You can learn about this and more by reading [Introduction to Device Management in Azure Active Directory.](/azure/active-directory/device-management-introduction) +> You can learn about this and more by reading [What is a device identity](/azure/active-directory/devices/overview) -## Configure Azure for Device Registration +## Configure Hybrid Azure AD join Begin configuring device registration to support Hybrid Windows Hello for Business by configuring device registration capabilities in Azure AD. -To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](/azure/active-directory/devices/device-management-azure-portal). +Follow the guidance on the [How to configure hybrid Azure Active Directory joined devices](/azure/active-directory/devices/hybrid-azuread-join-plan) page. In the **Select your scenario based on your identity infrastructure** section, identify your configuration (either **Managed environment** or **federated environment**) and perform only the steps applicable to your environment. -Next, follow the guidance on the [How to configure hybrid Azure Active Directory joined devices](/azure/active-directory/devices/hybrid-azuread-join-manual) page. In the **Configuration steps** section, identify your configuration at the top of the table (either **Windows current and password hash sync** or **Windows current and federation**) and perform only the steps identified with a check mark. +
+ +If the user principal name (UPN) in your on-premises Active Directory is different from the UPN in Azure AD, you also need to complete the following steps - +- Configure Azure AD Connect to sync the user's on-premises UPN to the onPremisesUserPrincipalName attribute in Azure AD. +- Add the domain name of the on-premises UPN as a [verified domain](/azure/active-directory/fundamentals/add-custom-domain) in Azure AD. + +You can learn more about this scenario by reading [review on-premises UPN support for Hybrid Azure Ad join](azure/active-directory/devices/hybrid-azuread-join-plan#review-on-premises-ad-users-upn-support-for-hybrid-azure-ad-join) + +> [!NOTE] +> Windows Hello for Business Hybrid key trust is not supported if your users' on-premises domain cannot be added as a verified domain in Azure AD. -

+
@@ -54,4 +63,4 @@ Next, follow the guidance on the [How to configure hybrid Azure Active Directory 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. Configure Azure Device Registration (*You are here*) 6. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) -7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) From 6e24a84af731f14e3f372a05acd2b9d06f1fcdf1 Mon Sep 17 00:00:00 2001 From: RavennMSFT <37601656+RavennMSFT@users.noreply.github.com> Date: Wed, 13 Oct 2021 08:13:37 -0700 Subject: [PATCH 0058/1077] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-dirsync.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md index 7583001fed..2a4d5d3c4b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md @@ -36,7 +36,7 @@ Next, you need to synchronize the on-premises Active Directory with Azure Active
-If the user principal name (UPN) in your on-premises Active Directory is different from the UPN in Azure AD, you also need to complete the following steps - +If the user principal name (UPN) in your on-premises Active Directory is different from the UPN in Azure AD, you also need to complete the following steps: - Configure Azure AD Connect to sync the user's on-premises UPN to the onPremisesUserPrincipalName attribute in Azure AD. - Add the domain name of the on-premises UPN as a [verified domain](/azure/active-directory/fundamentals/add-custom-domain) in Azure AD. From a177543be865635b6a518ef10e5c587041280b1f Mon Sep 17 00:00:00 2001 From: RavennMSFT <37601656+RavennMSFT@users.noreply.github.com> Date: Wed, 13 Oct 2021 08:14:08 -0700 Subject: [PATCH 0059/1077] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-devreg.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md index 8ebe1ed414..004c7aae32 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -38,7 +38,7 @@ You are ready to configure device registration for your hybrid environment. Hybr ## Configure Hybrid Azure AD join Begin configuring device registration to support Hybrid Windows Hello for Business by configuring device registration capabilities in Azure AD. -Follow the guidance on the [How to configure hybrid Azure Active Directory joined devices](/azure/active-directory/devices/hybrid-azuread-join-plan) page. In the **Select your scenario based on your identity infrastructure** section, identify your configuration (either **Managed environment** or **federated environment**) and perform only the steps applicable to your environment. +Follow the guidance on the [How to configure hybrid Azure Active Directory joined devices](/azure/active-directory/devices/hybrid-azuread-join-plan) page. In the **Select your scenario based on your identity infrastructure** section, identify your configuration (either **Managed environment** or **Federated environment**) and perform only the steps applicable to your environment.
From c46110c04db56c4b1d48c13ab33571eab9c1a558 Mon Sep 17 00:00:00 2001 From: RavennMSFT <37601656+RavennMSFT@users.noreply.github.com> Date: Wed, 13 Oct 2021 08:14:15 -0700 Subject: [PATCH 0060/1077] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-devreg.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md index 004c7aae32..948b42c856 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -42,7 +42,7 @@ Follow the guidance on the [How to configure hybrid Azure Active Directory joine
-If the user principal name (UPN) in your on-premises Active Directory is different from the UPN in Azure AD, you also need to complete the following steps - +If the user principal name (UPN) in your on-premises Active Directory is different from the UPN in Azure AD, you also need to complete the following steps: - Configure Azure AD Connect to sync the user's on-premises UPN to the onPremisesUserPrincipalName attribute in Azure AD. - Add the domain name of the on-premises UPN as a [verified domain](/azure/active-directory/fundamentals/add-custom-domain) in Azure AD. From f41743f6b099451ce98607238753fab144d52f26 Mon Sep 17 00:00:00 2001 From: RavennMSFT <37601656+RavennMSFT@users.noreply.github.com> Date: Wed, 13 Oct 2021 08:14:20 -0700 Subject: [PATCH 0061/1077] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-devreg.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md index 948b42c856..bd42354687 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -46,7 +46,7 @@ If the user principal name (UPN) in your on-premises Active Directory is differe - Configure Azure AD Connect to sync the user's on-premises UPN to the onPremisesUserPrincipalName attribute in Azure AD. - Add the domain name of the on-premises UPN as a [verified domain](/azure/active-directory/fundamentals/add-custom-domain) in Azure AD. -You can learn more about this scenario by reading [review on-premises UPN support for Hybrid Azure Ad join](azure/active-directory/devices/hybrid-azuread-join-plan#review-on-premises-ad-users-upn-support-for-hybrid-azure-ad-join) +You can learn more about this scenario by reading [Review on-premises UPN support for Hybrid Azure Ad join](azure/active-directory/devices/hybrid-azuread-join-plan#review-on-premises-ad-users-upn-support-for-hybrid-azure-ad-join). > [!NOTE] > Windows Hello for Business Hybrid key trust is not supported if your users' on-premises domain cannot be added as a verified domain in Azure AD. From 7c8677283e96d6a80c7859849ac10ee5a9f2220c Mon Sep 17 00:00:00 2001 From: Baard Hermansen Date: Sun, 17 Oct 2021 21:33:28 +0200 Subject: [PATCH 0062/1077] Update set-up-mdt-for-bitlocker.md Removed a surplus Notes section, seems like an old version that was supposed to have been removed when a newer Notes section was previously added. --- .../deploy-windows-mdt/set-up-mdt-for-bitlocker.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md index 481df59b4a..e41a843bb8 100644 --- a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md +++ b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md @@ -42,9 +42,6 @@ If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), > [!NOTE] > Backing up TPM to Active Directory was supported only on Windows 10 version 1507 and 1511. ->[!NOTE] ->Even though it is not a BitLocker requirement, we recommend configuring BitLocker to store the recovery key and TPM owner information in Active Directory. For more information about these features, see [Backing Up BitLocker and TPM Recovery Information to AD DS](/previous-versions/windows/it-pro/windows-7/dd875529(v=ws.10)). If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), which is part of Microsoft Desktop Optimization Pack (MDOP), you have additional management features for BitLocker. - For the purposes of this topic, we will use DC01, a domain controller that is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, see [Deploy Windows 10 with the Microsoft Deployment Toolkit](./prepare-for-windows-deployment-with-mdt.md). ## Configure Active Directory for BitLocker @@ -174,4 +171,4 @@ In the following task sequence, we added five actions: [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md)
[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md)
[Use web services in MDT](use-web-services-in-mdt.md)
-[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) \ No newline at end of file +[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) From 6ad2b380099407d9b8c0a0cc981e7c6dbaf0f347 Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Mon, 18 Oct 2021 11:20:55 -0700 Subject: [PATCH 0063/1077] Added formatting to the file. --- .../.vscode/settings.json | 8 ++ .../understanding-wdac-policy-settings.md | 76 +++++++++++++++++++ 2 files changed, 84 insertions(+) create mode 100644 windows/security/threat-protection/windows-defender-application-control/.vscode/settings.json create mode 100644 windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md diff --git a/windows/security/threat-protection/windows-defender-application-control/.vscode/settings.json b/windows/security/threat-protection/windows-defender-application-control/.vscode/settings.json new file mode 100644 index 0000000000..ed9462b7e6 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/.vscode/settings.json @@ -0,0 +1,8 @@ +{ + "markdownlint.config": { + "MD028": false, + "MD025": { + "front_matter_title": "" + } + } +} \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md b/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md new file mode 100644 index 0000000000..e966d5669a --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md @@ -0,0 +1,76 @@ +--- +title: Understanding WDAC secure settings. +description: Learn about secure settings in Windows Defender Application Control. +keywords: security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance +author: creator of the word doc +ms.reviewer: jogeurte +ms.author: dansimp +manager: dansimp +ms.date: 10/11/2021 +ms.technology: mde +--- + +# Understanding WDAC Policy Settings +Windows Defender Application Control (WDAC) Policies expose a Settings section where policy authors can define arbitrary secure settings. Secure Settings provide local admin tamper-free settings for secure boot enabled systems, with policy signing enabled. Settings consist of a Provider, Key, and ValueName, as well as a setting value. Setting values can be of type boolean, ulong, binary, and string. Applications can query for policy settings using [WldpQuerySecurityPolicy].
+ +An example settings section of a WDAC Policy: +```xml + + + + true + + + +``` + +### Example Scenario +An application that may want to restrict its capabilities, when used on a system with an active WDAC policy. Application authors can define a WDAC policy, setting their application queries, in order to disable certain features. For example, if Contoso’s Foo Application wants to disable a risky feature, such as macro execution, they can define a WDAC policy setting, and query for it at runtime. Contoso can then instruct IT administrators to configure the setting in their WDAC policy, if they don’t want Foo Application to execute macros on a system with a WDAC policy.
+ + +### WldpQuerySecurityPolicy +API that queries the secure settings of a WDAC policy. + +#### Syntax +``` C++ +HRESULT WINAPI WldpQuerySecurityPolicy( + _In_ const UNICODE_STRING * Provider, + _In_ const UNICODE_STRING * Key, + _In_ const UNICODE_STRING * ValueName, + _Out_ PWLDP_SECURE_SETTING_VALUE_TYPE ValueType, + _Out_writes_bytes_opt_(*ValueSize) PVOID Value, + _Inout_ PULONG ValueSize) +``` + +#### Parameters +Provider [in] +Setting Provider name. + +Key [in] +Key name of the Key-Value pair under Setting Provider "Provider". + +ValueName [in] +The value name of the "Key-Value" pair. + +ValueType [in, out] +Pointer to receive the value type. + +Value [in, out] +Pointer to a buffer to receive the value. The buffer should be of size “ValueSize”. If this value is NULL, this function will return the required buffer size for Value. + +ValueSize [in, out] +On input, it indicates the buffer size of "Value". On successful return, it indicates the size of data written to Value buffer. + +#### Return Value +This method returns S_OK if successful or a failure code otherwise. + +#### Remarks +See [WDAC Policy Settings] for more information on WDAC policy settings. From 371c645f32e0abf8712d513e98504e14c724c195 Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Mon, 18 Oct 2021 11:30:01 -0700 Subject: [PATCH 0064/1077] added new file to index and toc --- .../windows-defender-application-control/TOC.yml | 2 ++ .../windows-defender-application-control/index.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.yml b/windows/security/threat-protection/windows-defender-application-control/TOC.yml index 6e2bbdd64b..47bc7d1ad7 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.yml +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.yml @@ -22,6 +22,8 @@ href: understand-windows-defender-application-control-policy-design-decisions.md - name: Understand WDAC policy rules and file rules href: select-types-of-rules-to-create.md + - name: Understand WDAC secure settings + href: understand-wdac-policy-settings.md items: - name: Allow apps installed by a managed installer href: configure-authorized-apps-deployed-with-a-managed-installer.md diff --git a/windows/security/threat-protection/windows-defender-application-control/index.yml b/windows/security/threat-protection/windows-defender-application-control/index.yml index ef5892459f..152d5cb75f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/index.yml +++ b/windows/security/threat-protection/windows-defender-application-control/index.yml @@ -69,6 +69,8 @@ landingContent: links: - text: Understanding policy and file rules url: select-types-of-rules-to-create.md + - text: Understanding WDAC secure settings + url: understanding-wdac-policy-settings.md - linkListType: how-to-guide links: - text: Allow managed installer and configure managed installer rules From 0ff09040b4199de166bd4486c7a9d05545432945 Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Mon, 18 Oct 2021 12:19:12 -0700 Subject: [PATCH 0065/1077] removed brackets in wldpquerysecuritypolicy --- .../understanding-wdac-policy-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md b/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md index e966d5669a..6f583d977a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md +++ b/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md @@ -19,7 +19,7 @@ ms.technology: mde --- # Understanding WDAC Policy Settings -Windows Defender Application Control (WDAC) Policies expose a Settings section where policy authors can define arbitrary secure settings. Secure Settings provide local admin tamper-free settings for secure boot enabled systems, with policy signing enabled. Settings consist of a Provider, Key, and ValueName, as well as a setting value. Setting values can be of type boolean, ulong, binary, and string. Applications can query for policy settings using [WldpQuerySecurityPolicy].
+Windows Defender Application Control (WDAC) Policies expose a Settings section where policy authors can define arbitrary secure settings. Secure Settings provide local admin tamper-free settings for secure boot enabled systems, with policy signing enabled. Settings consist of a Provider, Key, and ValueName, as well as a setting value. Setting values can be of type boolean, ulong, binary, and string. Applications can query for policy settings using WldpQuerySecurityPolicy.
An example settings section of a WDAC Policy: ```xml From 80c417c09fe88702e1623c22c5a1b7ad7468123b Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Mon, 18 Oct 2021 13:19:02 -0700 Subject: [PATCH 0066/1077] updated the author --- .../understanding-wdac-policy-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md b/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md index 6f583d977a..530c147315 100644 --- a/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md +++ b/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro ms.collection: M365-security-compliance -author: creator of the word doc +author: Robert Wait ms.reviewer: jogeurte ms.author: dansimp manager: dansimp From 000a26dc6eabada6db05cb2334017c03caa8c551 Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Mon, 18 Oct 2021 13:20:20 -0700 Subject: [PATCH 0067/1077] corrected the md file name --- .../windows-defender-application-control/TOC.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.yml b/windows/security/threat-protection/windows-defender-application-control/TOC.yml index 47bc7d1ad7..9cfa2e9982 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.yml +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.yml @@ -23,7 +23,7 @@ - name: Understand WDAC policy rules and file rules href: select-types-of-rules-to-create.md - name: Understand WDAC secure settings - href: understand-wdac-policy-settings.md + href: understanding-wdac-policy-settings.md items: - name: Allow apps installed by a managed installer href: configure-authorized-apps-deployed-with-a-managed-installer.md From e1834ca4c51520b046f39208eb864de39340bb5d Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Mon, 18 Oct 2021 13:24:33 -0700 Subject: [PATCH 0068/1077] Update understanding-wdac-policy-settings.md --- .../understanding-wdac-policy-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md b/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md index 530c147315..28eb21e297 100644 --- a/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md +++ b/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro ms.collection: M365-security-compliance -author: Robert Wait +author: Robert Waite ms.reviewer: jogeurte ms.author: dansimp manager: dansimp From 18e8e2efc2e71a333fa3aaa4f5ae21ff4fabfbc1 Mon Sep 17 00:00:00 2001 From: RavennMSFT <37601656+RavennMSFT@users.noreply.github.com> Date: Thu, 21 Oct 2021 09:58:51 -0700 Subject: [PATCH 0069/1077] Update hello-faq.yml Added note about Deploying Certificates to Key Trust Users to Enable RDP --- .../identity-protection/hello-for-business/hello-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 213b9c9999..80746566bc 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -39,7 +39,7 @@ sections: - question: Can I use Windows Hello for Business key trust and RDP? answer: | - Remote Desktop Protocol (RDP) does not currently support using key-based authentication and self-signed certificates as supplied credentials. RDP with supplied credentials is currently only supported with certificate-based deployments. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md). + Remote Desktop Protocol (RDP) does not currently support using key-based authentication and self-signed certificates as supplied credentials. However, you can deploy certificates in the key trust model to enable RDP. See [Deploying Certificates to Key Trust Users to Enable RDP](https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs). Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md). - question: Can I deploy Windows Hello for Business by using Microsoft Endpoint Configuration Manager? answer: | From f8131c6283157d83c8057d9a94c2f3ed0e94e322 Mon Sep 17 00:00:00 2001 From: RavennMSFT <37601656+RavennMSFT@users.noreply.github.com> Date: Thu, 21 Oct 2021 10:42:29 -0700 Subject: [PATCH 0070/1077] Update hello-faq.yml --- .../identity-protection/hello-for-business/hello-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 80746566bc..8ef336a1d1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -39,7 +39,7 @@ sections: - question: Can I use Windows Hello for Business key trust and RDP? answer: | - Remote Desktop Protocol (RDP) does not currently support using key-based authentication and self-signed certificates as supplied credentials. However, you can deploy certificates in the key trust model to enable RDP. See [Deploying Certificates to Key Trust Users to Enable RDP](https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs). Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md). + Remote Desktop Protocol (RDP) does not currently support using key-based authentication and self-signed certificates as supplied credentials. However, you can deploy certificates in the key trust model to enable RDP. See [Deploying Certificates to Key Trust Users to Enable RDP](https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs). In addition, Windows Hello for Business key trust can be also used with RDP with [Windows Defender Remote Credential Guard](../remote-credential-guard.md) without deploying certificates. - question: Can I deploy Windows Hello for Business by using Microsoft Endpoint Configuration Manager? answer: | From ceef1791cb0c928a1f90b779922d33437016b03f Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 21 Oct 2021 11:44:23 -0700 Subject: [PATCH 0071/1077] Update hello-faq.yml --- .../identity-protection/hello-for-business/hello-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 8ef336a1d1..195b01460a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -39,7 +39,7 @@ sections: - question: Can I use Windows Hello for Business key trust and RDP? answer: | - Remote Desktop Protocol (RDP) does not currently support using key-based authentication and self-signed certificates as supplied credentials. However, you can deploy certificates in the key trust model to enable RDP. See [Deploying Certificates to Key Trust Users to Enable RDP](https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs). In addition, Windows Hello for Business key trust can be also used with RDP with [Windows Defender Remote Credential Guard](../remote-credential-guard.md) without deploying certificates. + Remote Desktop Protocol (RDP) does not currently support using key-based authentication and self-signed certificates as supplied credentials. However, you can deploy certificates in the key trust model to enable RDP. See [Deploying Certificates to Key Trust Users to Enable RDP](hello-deployment-rdp-certs.md). In addition, Windows Hello for Business key trust can be also used with RDP with [Windows Defender Remote Credential Guard](../remote-credential-guard.md) without deploying certificates. - question: Can I deploy Windows Hello for Business by using Microsoft Endpoint Configuration Manager? answer: | From 26065a85bc736705508ec87f989ba429e9ddd922 Mon Sep 17 00:00:00 2001 From: Thomas Maurer Date: Mon, 25 Oct 2021 12:20:49 +0200 Subject: [PATCH 0072/1077] Security Compliance Toolkit added Windows Server 2022 Added Windows Server 2022 to the list of operating system security baselines in the Security Compliance Toolkit. since it is available here: https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-server-2022-security-baseline/ba-p/2724685 ------- cc: @Dansimp --- .../security-compliance-toolkit-10.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md b/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md index 9b329ccb64..bd6f160893 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md @@ -41,6 +41,7 @@ The Security Compliance Toolkit consists of: - Windows 10 Version 1507 - Windows Server security baselines + - Windows Server 2022 - Windows Server 2019 - Windows Server 2016 - Windows Server 2012 R2 From 6510b6f40162de8281c7ecd928b82e0e0bc1a6bb Mon Sep 17 00:00:00 2001 From: Baard Hermansen Date: Wed, 27 Oct 2021 23:49:42 +0200 Subject: [PATCH 0073/1077] Update demonstrate-deployment-on-vm.md Aligned some PS code with https://docs.microsoft.com/en-us/mem/autopilot/windows-autopilot. --- .../demonstrate-deployment-on-vm.md | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index b47dd4d0f2..01cbe2b0fe 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -161,7 +161,7 @@ After you download this file, the name will be extremely long (ex: 19042.508.200 The **Get-NetAdaper** cmdlet is used to automatically find the network adapter that's most likely to be the one you use to connect to the internet. You should test this command first by running the following at an elevated Windows PowerShell prompt: ```powershell -(Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name +(Get-NetAdapter | Where-Object {$_.Status -eq "Up" -and !$_.Virtual}).Name ``` The output of this command should be the name of the network interface you use to connect to the internet. Verify that this is the correct interface name. If it isn't the correct interface name, you'll need to edit the first command below to use your network interface name. @@ -180,7 +180,7 @@ All VM data will be created under the current path in your PowerShell prompt. Co >- If you're not sure if you already have an External VM switch, enter **get-vmswitch** at a Windows PowerShell prompt to display a currently list of the VM switches that are provisioned in Hyper-V. If one of them is of SwitchType **External**, then you already have a VM switch configured on the server that's used to connect to the internet. In this case, you need to skip the first command below and modify the others to use the name of your VM switch instead of the name "AutopilotExternal" (or change the name of your switch). ```powershell -New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name +New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter | Where-Object {$_.Status -eq "Up" -and !$_.Virtual}).Name New-VM -Name WindowsAutopilot -MemoryStartupBytes 2GB -BootDevice VHD -NewVHDPath .\VMs\WindowsAutopilot.vhdx -Path .\VMData -NewVHDSizeBytes 80GB -Generation 2 -Switch AutopilotExternal Add-VMDvdDrive -Path c:\iso\win10-eval.iso -VMName WindowsAutopilot Start-VM -VMName WindowsAutopilot @@ -237,7 +237,6 @@ PS C:\autopilot> Make sure that the VM booted from the installation ISO, select **Next**, select **Install now**, and then complete the Windows installation process. See the following examples: - ![Windows setup example 1](images/winsetup1.png) ![Windows setup example 2](images/winsetup2.png) @@ -250,7 +249,6 @@ Make sure that the VM booted from the installation ISO, select **Next**, select ![Windows setup example 6](images/winsetup6.png) - After the VM restarts, during OOBE, it's fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This offers the fastest way to the desktop. For example: ![Windows setup example 7.](images/winsetup7.png) @@ -278,12 +276,12 @@ Follow these steps to run the PowerShell script: 1. **On the client VM**: Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same whether you're using a VM or a physical device: ```powershell - md c:\HWID - Set-Location c:\HWID - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force + New-Item -Type Directory -Path "C:\HWID" + Set-Location C:\HWID + Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned Install-Script -Name Get-WindowsAutopilotInfo -Force $env:Path += ";C:\Program Files\WindowsPowerShell\Scripts" - Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv + Get-WindowsAutopilotInfo -OutputFile AutopilotHWID.csv ``` 1. When you're prompted to install the NuGet package, choose **Yes**. @@ -615,7 +613,7 @@ To use the device (or VM) for other purposes after completion of this lab, you n ### Delete (deregister) Autopilot device -You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure AD), log into the MEM admin center, then go to **Intune > Devices > All Devices**. Select the device you want to delete, then select the **Delete** button along the top menu. +You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure AD), log into the MEM admin center, then go to **Intune > Devices > All Devices**. Select the device you want to delete, then select the **Delete** button along the top menu. > [!div class="mx-imgBorder"] > ![Delete device step 1.](images/delete-device1.png) From f66a308a843f25803e92ccb07f21d6047c132d09 Mon Sep 17 00:00:00 2001 From: Baard Hermansen Date: Fri, 29 Oct 2021 22:47:52 +0200 Subject: [PATCH 0074/1077] Update windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../windows-autopilot/demonstrate-deployment-on-vm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index 01cbe2b0fe..fabd6a01f0 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -177,7 +177,7 @@ All VM data will be created under the current path in your PowerShell prompt. Co > >- If you previously enabled Hyper-V and your internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal." >- If you have never created an external VM switch before, then just run the commands below. ->- If you're not sure if you already have an External VM switch, enter **get-vmswitch** at a Windows PowerShell prompt to display a currently list of the VM switches that are provisioned in Hyper-V. If one of them is of SwitchType **External**, then you already have a VM switch configured on the server that's used to connect to the internet. In this case, you need to skip the first command below and modify the others to use the name of your VM switch instead of the name "AutopilotExternal" (or change the name of your switch). +>- If you're not sure if you already have an External VM switch, enter **get-vmswitch** at a Windows PowerShell prompt to display a current list of the VM switches that are provisioned in Hyper-V. If one of them is of SwitchType **External**, then you already have a VM switch configured on the server that's used to connect to the internet. In this case, you need to skip the first command below and modify the others to use the name of your VM switch instead of the name "AutopilotExternal" (or change the name of your switch). ```powershell New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter | Where-Object {$_.Status -eq "Up" -and !$_.Virtual}).Name From 59eed88aea573972a8ddd291da37330535aad2e0 Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Mon, 1 Nov 2021 11:58:16 -0700 Subject: [PATCH 0075/1077] added headers for each parameter section Also removed Robert Waite as author since GitHub doesn't have him listed as an approved author. --- .../understanding-wdac-policy-settings.md | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md b/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md index 28eb21e297..9a9fe9f38b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md +++ b/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md @@ -10,7 +10,6 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro ms.collection: M365-security-compliance -author: Robert Waite ms.reviewer: jogeurte ms.author: dansimp manager: dansimp @@ -39,7 +38,7 @@ An application that may want to restrict its capabilities, when used on a system ### WldpQuerySecurityPolicy API that queries the secure settings of a WDAC policy. -#### Syntax +### Syntax ``` C++ HRESULT WINAPI WldpQuerySecurityPolicy( _In_ const UNICODE_STRING * Provider, @@ -50,23 +49,23 @@ HRESULT WINAPI WldpQuerySecurityPolicy( _Inout_ PULONG ValueSize) ``` -#### Parameters +### Parameters Provider [in] Setting Provider name. -Key [in] +#### Key [in] Key name of the Key-Value pair under Setting Provider "Provider". -ValueName [in] +#### ValueName [in] The value name of the "Key-Value" pair. -ValueType [in, out] +#### ValueType [in, out] Pointer to receive the value type. -Value [in, out] +#### Value [in, out] Pointer to a buffer to receive the value. The buffer should be of size “ValueSize”. If this value is NULL, this function will return the required buffer size for Value. -ValueSize [in, out] +#### ValueSize [in, out] On input, it indicates the buffer size of "Value". On successful return, it indicates the size of data written to Value buffer. #### Return Value From d40a2d17978763a90dad4e3692e0e9c201fc9186 Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Mon, 8 Nov 2021 12:21:00 -0800 Subject: [PATCH 0076/1077] added settings.json to gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index 9841e0daea..3a642828d6 100644 --- a/.gitignore +++ b/.gitignore @@ -13,6 +13,7 @@ common/ .openpublishing.build.mdproj .openpublishing.buildcore.ps1 packages.config +settings.json # User-specific files .vs/ From 89d1befa026685fa1423ad6f39b1794dd044c12d Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Mon, 8 Nov 2021 12:23:08 -0800 Subject: [PATCH 0077/1077] Deleted settings.json from .vscode --- .../.vscode/settings.json | 8 -------- 1 file changed, 8 deletions(-) delete mode 100644 windows/security/threat-protection/windows-defender-application-control/.vscode/settings.json diff --git a/windows/security/threat-protection/windows-defender-application-control/.vscode/settings.json b/windows/security/threat-protection/windows-defender-application-control/.vscode/settings.json deleted file mode 100644 index ed9462b7e6..0000000000 --- a/windows/security/threat-protection/windows-defender-application-control/.vscode/settings.json +++ /dev/null @@ -1,8 +0,0 @@ -{ - "markdownlint.config": { - "MD028": false, - "MD025": { - "front_matter_title": "" - } - } -} \ No newline at end of file From 305a3a0479a7b601a621f64b5138eddfc2c1c13a Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Tue, 9 Nov 2021 12:49:43 -0800 Subject: [PATCH 0078/1077] Listed jogeurte as the author --- .../understanding-wdac-policy-settings.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md b/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md index 9a9fe9f38b..d54ed1b819 100644 --- a/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md +++ b/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md @@ -10,6 +10,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro ms.collection: M365-security-compliance +author: jogeurte ms.reviewer: jogeurte ms.author: dansimp manager: dansimp From cc9e3d5a617417f2fc5ddb8dabbb7499f73c5a7a Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Tue, 9 Nov 2021 12:57:38 -0800 Subject: [PATCH 0079/1077] corrected Jordan's ID in both the author and ms.reviewer fields. --- .../understanding-wdac-policy-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md b/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md index d54ed1b819..d68f3d6a3f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md +++ b/windows/security/threat-protection/windows-defender-application-control/understanding-wdac-policy-settings.md @@ -10,8 +10,8 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro ms.collection: M365-security-compliance -author: jogeurte -ms.reviewer: jogeurte +author: jgeurten +ms.reviewer: jgeurten ms.author: dansimp manager: dansimp ms.date: 10/11/2021 From a35efe2f1e13d9305fbefb7db885a49483190d30 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Tue, 16 Nov 2021 21:25:48 +0530 Subject: [PATCH 0080/1077] added windows 11 and its registry keys after reading this article, i found windows 11 is missing so i added windows 11 and its related registry keys. --- .../access-control/security-identifiers.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/windows/security/identity-protection/access-control/security-identifiers.md b/windows/security/identity-protection/access-control/security-identifiers.md index be0a573f71..5506bf2736 100644 --- a/windows/security/identity-protection/access-control/security-identifiers.md +++ b/windows/security/identity-protection/access-control/security-identifiers.md @@ -20,7 +20,9 @@ ms.reviewer: **Applies to** - Windows 10 +- Windows 11 - Windows Server 2016 +- Windows Server 2019 This topic for the IT professional describes security identifiers and how they work in regards to accounts and groups in the Windows operating system. @@ -319,6 +321,19 @@ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCache All Capability SIDs are prefixed by S-1-15-3 +## Examples of registry keys taken from Windows 11, version 21H2, 64-bit Enterprise edition + +You may see the following registry keys under AllCachedCapabilities: + +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_DevUnlock +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_DevUnlock_Internal +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Enterprise +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_General +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Restricted +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Windows + +All Capability SIDs are prefixed by S-1-15-3 + ## See also - [Access Control Overview](access-control.md) From 33e1161180590e27d9459a6082b012d5df3b82a6 Mon Sep 17 00:00:00 2001 From: Snrat Date: Wed, 17 Nov 2021 15:36:27 +0800 Subject: [PATCH 0081/1077] Update index.md Fixed. --- windows/whats-new/ltsc/index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/ltsc/index.md b/windows/whats-new/ltsc/index.md index 28bc3db429..0d7830f328 100644 --- a/windows/whats-new/ltsc/index.md +++ b/windows/whats-new/ltsc/index.md @@ -36,7 +36,7 @@ The following table summarizes equivalent feature update versions of Windows 10 | Windows 10 Enterprise LTSC 2015 | Windows 10, Version 1507 | 7/29/2015 | | Windows 10 Enterprise LTSC 2016 | Windows 10, Version 1607 | 8/2/2016 | | Windows 10 Enterprise LTSC 2019 | Windows 10, Version 1809 | 11/13/2018 | -| Windows 10 Enterprise LTSC 2019 | Windows 10, Version 21H2 | 11/16/2021 | +| Windows 10 Enterprise LTSC 2021 | Windows 10, Version 21H2 | 11/16/2021 | > [!NOTE] > The Long-Term Servicing Channel was previously called the Long-Term Servicing Branch (LTSB). All references to LTSB are changed in this article to LTSC for consistency, even though the name of previous versions might still be displayed as LTSB. @@ -51,4 +51,4 @@ For detailed information about Windows 10 servicing, see [Overview of Windows as ## See Also [What's New in Windows 10](../index.yml): See what’s new in other versions of Windows 10.
-[Windows 10 - Release information](/windows/release-health/release-information): Windows 10 current versions by servicing option. \ No newline at end of file +[Windows 10 - Release information](/windows/release-health/release-information): Windows 10 current versions by servicing option. From 9f2b333b6fc788ba3a4947892684dbbf13371fef Mon Sep 17 00:00:00 2001 From: Maurice Daly Date: Wed, 17 Nov 2021 08:35:26 +0000 Subject: [PATCH 0082/1077] Restriction Peer Selection Update In the documentation it currently states that peer selection can be configured to "local peer discovery". This setting can only be set via MDM based policies in Windows 11 builds, and therefore clarification is required, as although technically the docs state 20H2 and docs here - https://docs.microsoft.com/en-us/windows/deployment/update/waas-delivery-optimization-reference, state 1803, setting the value via MDM policies in these builds will result in a policy failure. --- windows/deployment/update/waas-delivery-optimization.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index 4bd4c62a37..f5441af767 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -39,6 +39,9 @@ For information about setting up Delivery Optimization, including tips for the b - New peer selection options: Currently the available options include: 0 = NAT, 1 = Subnet mask, and 2 = Local Peer Discovery. The subnet mask option applies to both Download Modes LAN (1) and Group (2). If Group mode is set, Delivery Optimization will connect to locally discovered peers that are also part of the same Group (have the same Group ID)." - Local Peer Discovery: a new option for **Restrict Peer Selection By** (in Group Policy) or **DORestrictPeerSelectionBy** (in MDM). This option restricts the discovery of local peers using the DNS-SD protocol. When you set Option 2, Delivery Optimization will restrict peer selection to peers that are locally discovered (using DNS-SD). If you also enabled Group mode, Delivery Optimization will connect to locally discovered peers that are also part of the same group (that is, those which have the same Group ID). + +**Please Note:** that the "Local peer discovery (DNS-SD)" option can only be set via MDM delivered policies on Windows 11 builds. This feature can be enabled in supported Windows 10 builds by setting the "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DORestrictPeerSelectionBy" value to "2". More information can be found here - https://docs.microsoft.com/en-us/windows/deployment/update/waas-delivery-optimization-reference. + - Starting with Windows 10, version 2006 (and in Windows 11), the Bypass option of [Download Mode](waas-delivery-optimization-reference.md#download-mode) is no longer used. ## Requirements From ba2224e322f231f819743869df0e66fb4d1385c7 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 17 Nov 2021 15:48:36 +0530 Subject: [PATCH 0083/1077] Update policy-csp-admx-terminalserver.md --- .../client-management/mdm/policy-csp-admx-terminalserver.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index ed42ebde3f..1ae14c6f68 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -33,6 +33,9 @@ manager: dansimp
ADMX_TerminalServer/TS_GATEWAY_POLICY_AUTH_METHOD
+
+ ADMX_TerminalServer/TS_RADC_DefaultConnection +
From 4a96c0e084f8c364c390a53e53b67f13f2c9fd4c Mon Sep 17 00:00:00 2001 From: PingYanMinamoto <94566757+PingYanMinamoto@users.noreply.github.com> Date: Wed, 17 Nov 2021 14:03:04 -0600 Subject: [PATCH 0084/1077] Update "Trusted network detection" The original statement of "The VPN stack will look at the DNS suffix on the physical interface" is incorrect. The actual code design is comparing the network name of the physical interface connection profile. --- .../identity-protection/vpn/vpn-auto-trigger-profile.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md index 128afcfee9..1bbb01ee04 100644 --- a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md +++ b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md @@ -78,7 +78,7 @@ Should a management tool remove or add the same profile name back and set **Alwa ## Trusted network detection -This feature configures the VPN such that it would not get triggered if a user is on a trusted corporate network. The value of this setting is a list of DNS suffices. The VPN stack will look at the DNS suffix on the physical interface and if it matches any in the configured list and the network is private or provisioned by MDM, then VPN will not get triggered. +This feature configures the VPN such that it would not get triggered if a user is on a trusted corporate network. The value of this setting is a list of DNS suffices. The VPN stack will look at the network name of the physical interface connection profile and if it matches any in the configured list and the network is private or provisioned by MDM, then VPN will not get triggered. Trusted network detection can be configured using the VPNv2/*ProfileName*/TrustedNetworkDetection setting in the [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp). From 2cd22d65d75e7333f540416fbe0c84a32f23413a Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Thu, 18 Nov 2021 10:14:07 +0530 Subject: [PATCH 0085/1077] Update policy-csp-admx-terminalserver.md --- .../mdm/policy-csp-admx-terminalserver.md | 72 +++++++++++++++++++ 1 file changed, 72 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index 1ae14c6f68..2833f7d9f9 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -189,7 +189,79 @@ ADMX Info:
+ +**ADMX_TerminalServer/TS_RADC_DefaultConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + + +This policy setting specifies the default connection URL for RemoteApp and Desktop Connections. The default connection URL is a specific connection that can only be configured by using Group Policy. In addition to the capabilities that are common to all connections, the default connection URL allows document file types to be associated with RemoteApp programs. The default connection URL must be configured in the form of [http://contoso.com/rdweb/Feed/webfeed.aspx](http://contoso.com/rdweb/Feed/webfeed.aspx). + +- If you enable this policy setting, the specified URL is configured as the default connection URL for the user and replaces any existing connection URL. The user cannot change the default connection URL. The user's default logon credentials are used when setting up the default connection URL. + +- If you disable or do not configure this policy setting, the user has no default connection URL. + +RemoteApp programs that are installed through RemoteApp and Desktop Connections from an un-trusted server can compromise the security of a user's account. + + + + + + +ADMX Info: +- GP Friendly name: *Specify default connection URL* +- GP name: *TS_RADC_DefaultConnection* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
From 0edb5676d1c8049421660938ed10936ec6a63b4b Mon Sep 17 00:00:00 2001 From: Maurice Daly Date: Thu, 18 Nov 2021 15:57:21 +0000 Subject: [PATCH 0086/1077] Update windows/deployment/update/waas-delivery-optimization.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/deployment/update/waas-delivery-optimization.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index f5441af767..21cba9fae5 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -40,7 +40,8 @@ For information about setting up Delivery Optimization, including tips for the b - New peer selection options: Currently the available options include: 0 = NAT, 1 = Subnet mask, and 2 = Local Peer Discovery. The subnet mask option applies to both Download Modes LAN (1) and Group (2). If Group mode is set, Delivery Optimization will connect to locally discovered peers that are also part of the same Group (have the same Group ID)." - Local Peer Discovery: a new option for **Restrict Peer Selection By** (in Group Policy) or **DORestrictPeerSelectionBy** (in MDM). This option restricts the discovery of local peers using the DNS-SD protocol. When you set Option 2, Delivery Optimization will restrict peer selection to peers that are locally discovered (using DNS-SD). If you also enabled Group mode, Delivery Optimization will connect to locally discovered peers that are also part of the same group (that is, those which have the same Group ID). -**Please Note:** that the "Local peer discovery (DNS-SD)" option can only be set via MDM delivered policies on Windows 11 builds. This feature can be enabled in supported Windows 10 builds by setting the "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DORestrictPeerSelectionBy" value to "2". More information can be found here - https://docs.microsoft.com/en-us/windows/deployment/update/waas-delivery-optimization-reference. +> [!NOTE] +> The Local Peer Discovery (DNS-SD) option can only be set via MDM delivered policies on Windows 11 builds. This feature can be enabled in supported Windows 10 builds by setting the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DORestrictPeerSelectionBy` value to **2**. For more information, see [Delivery Optimization reference](/windows/deployment/update/waas-delivery-optimization-reference). - Starting with Windows 10, version 2006 (and in Windows 11), the Bypass option of [Download Mode](waas-delivery-optimization-reference.md#download-mode) is no longer used. From ded5d2e20dadd5c597fb2550238896b88e92230a Mon Sep 17 00:00:00 2001 From: PingYanMinamoto <94566757+PingYanMinamoto@users.noreply.github.com> Date: Thu, 18 Nov 2021 10:09:10 -0600 Subject: [PATCH 0087/1077] Update windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md good catch! thanks! Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../identity-protection/vpn/vpn-auto-trigger-profile.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md index 1bbb01ee04..c0bf853add 100644 --- a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md +++ b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md @@ -78,7 +78,7 @@ Should a management tool remove or add the same profile name back and set **Alwa ## Trusted network detection -This feature configures the VPN such that it would not get triggered if a user is on a trusted corporate network. The value of this setting is a list of DNS suffices. The VPN stack will look at the network name of the physical interface connection profile and if it matches any in the configured list and the network is private or provisioned by MDM, then VPN will not get triggered. +This feature configures the VPN such that it would not get triggered if a user is on a trusted corporate network. The value of this setting is a list of DNS suffixes. The VPN stack will look at the network name of the physical interface connection profile and if it matches any in the configured list and the network is private or provisioned by MDM, then VPN will not get triggered. Trusted network detection can be configured using the VPNv2/*ProfileName*/TrustedNetworkDetection setting in the [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp). From b80bba8a2be17cf1f6121473999157f966d6a945 Mon Sep 17 00:00:00 2001 From: midoliy <78302178+tatsuya-midorikawa@users.noreply.github.com> Date: Fri, 19 Nov 2021 08:33:54 +0900 Subject: [PATCH 0088/1077] fix index.md Correction of typographical errors. --- windows/whats-new/ltsc/index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/ltsc/index.md b/windows/whats-new/ltsc/index.md index 28bc3db429..0d7830f328 100644 --- a/windows/whats-new/ltsc/index.md +++ b/windows/whats-new/ltsc/index.md @@ -36,7 +36,7 @@ The following table summarizes equivalent feature update versions of Windows 10 | Windows 10 Enterprise LTSC 2015 | Windows 10, Version 1507 | 7/29/2015 | | Windows 10 Enterprise LTSC 2016 | Windows 10, Version 1607 | 8/2/2016 | | Windows 10 Enterprise LTSC 2019 | Windows 10, Version 1809 | 11/13/2018 | -| Windows 10 Enterprise LTSC 2019 | Windows 10, Version 21H2 | 11/16/2021 | +| Windows 10 Enterprise LTSC 2021 | Windows 10, Version 21H2 | 11/16/2021 | > [!NOTE] > The Long-Term Servicing Channel was previously called the Long-Term Servicing Branch (LTSB). All references to LTSB are changed in this article to LTSC for consistency, even though the name of previous versions might still be displayed as LTSB. @@ -51,4 +51,4 @@ For detailed information about Windows 10 servicing, see [Overview of Windows as ## See Also [What's New in Windows 10](../index.yml): See what’s new in other versions of Windows 10.
-[Windows 10 - Release information](/windows/release-health/release-information): Windows 10 current versions by servicing option. \ No newline at end of file +[Windows 10 - Release information](/windows/release-health/release-information): Windows 10 current versions by servicing option. From 769d57be92be5b607b8ccf2aff46d27f2f2f50c7 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Fri, 19 Nov 2021 10:58:04 +0530 Subject: [PATCH 0089/1077] ADMX terminal Server Missing polices - part1 Added 44 policies under ADMX Terminal Server and modifies existing content as it was incorrect. --- .../mdm/policies-in-policy-csp-admx-backed.md | 44 + .../policy-configuration-service-provider.md | 132 + .../mdm/policy-csp-admx-terminalserver.md | 3434 ++++++++++++++++- 3 files changed, 3594 insertions(+), 16 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 6256ffe15a..3b44f8e00e 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -1131,8 +1131,52 @@ ms.date: 10/08/2020 - [ADMX_tcpip/Teredo_Server_Name](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-server-name) - [ADMX_tcpip/Teredo_State](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-state) - [ADMX_tcpip/Windows_Scaling_Heuristics_State](./policy-csp-admx-tcpip.md#admx-tcpip-windows-scaling-heuristics-state) +- [ADMX_TerminalServer/TS_AUTO_RECONNECT](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_auto_reconnect) +- [ADMX_TerminalServer/TS_CAMERA_REDIRECTION](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_camera_redirection) +- [ADMX_TerminalServer/TS_CERTIFICATE_TEMPLATE_POLICY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_certificate_template_policy) +- [ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_allow_signed_files_1) +- [ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_allow_signed_files_2) +- [ADMX_TerminalServer/TS_CLIENT_ALLOW_UNSIGNED_FILES_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_allow_unsigned_files_1) +- [ADMX_TerminalServer/TS_CLIENT_ALLOW_UNSIGNED_FILES_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_allow_unsigned_files_2) +- [ADMX_TerminalServer/TS_CLIENT_AUDIO](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_audio) +- [ADMX_TerminalServer/TS_CLIENT_AUDIO_CAPTURE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_audio_capture) +- [ADMX_TerminalServer/TS_CLIENT_AUDIO_QUALITY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_audio_quality) +- [ADMX_TerminalServer/TS_CLIENT_CLIPBOARD](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_clipboard) +- [ADMX_TerminalServer/TS_CLIENT_COM](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_com) +- [ADMX_TerminalServer/TS_CLIENT_DEFAULT_M](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_default_m) +- [ADMX_TerminalServer/TS_CLIENT_DISABLE_HARDWARE_MODE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_disable_hardware_mode) +- [ADMX_TerminalServer/TS_CLIENT_DISABLE_PASSWORD_SAVING_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_disable_password_saving_1) +- [ADMX_TerminalServer/TS_CLIENT_LPT](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_lpt) +- [ADMX_TerminalServer/TS_CLIENT_PNP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_pnp) +- [ADMX_TerminalServer/TS_CLIENT_PRINTER](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_printer) +- [ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_trusted_certificate_thumbprints_1) +- [ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_trusted_certificate_thumbprints_2) +- [ADMX_TerminalServer/TS_CLIENT_TURN_OFF_UDP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_turn_off_udp) +- [ADMX_TerminalServer/TS_COLORDEPTH](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_colordepth) +- [ADMX_TerminalServer/TS_DELETE_ROAMING_USER_PROFILES](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_delete_roaming_user_profiles) +- [ADMX_TerminalServer/TS_DISABLE_REMOTE_DESKTOP_WALLPAPER](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_disable_remote_desktop_wallpaper) +- [ADMX_TerminalServer/TS_DX_USE_FULL_HWGPU](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_dx_use_full_hwgpu) +- [ADMX_TerminalServer/TS_EASY_PRINT](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_easy_print) +- [ADMX_TerminalServer/TS_EASY_PRINT_User](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_easy_print_user) +- [ADMX_TerminalServer/TS_EnableVirtualGraphics](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_enablevirtualgraphics) +- [ADMX_TerminalServer/TS_FALLBACKPRINTDRIVERTYPE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_fallbackprintdrivertype) +- [ADMX_TerminalServer/TS_FORCIBLE_LOGOFF](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_forcible_logoff) - [ADMX_TerminalServer/TS_GATEWAY_POLICY_ENABLE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_gateway_policy_enable) - [ADMX_TerminalServer/TS_GATEWAY_POLICY_AUTH_METHOD](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_gateway_policy_auth_method) +- [ADMX_TerminalServer/TS_GATEWAY_POLICY_SERVER](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_gateway_policy_server) +- [ADMX_TerminalServer/TS_JOIN_SESSION_DIRECTORY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_join_session_directory) +- [ADMX_TerminalServer/TS_KEEP_ALIVE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_keep_alive) +- [ADMX_TerminalServer/TS_LICENSE_SECGROUP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_license_secgroup) +- [ADMX_TerminalServer/TS_LICENSE_SERVERS](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_license_servers) +- [ADMX_TerminalServer/TS_LICENSE_TOOLTIP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_license_tooltip) +- [ADMX_TerminalServer/TS_LICENSING_MODE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_licensing_mode) +- [ADMX_TerminalServer/TS_MAX_CON_POLICY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_max_con_policy) +- [ADMX_TerminalServer/TS_MAXDISPLAYRES](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_maxdisplayres) +- [ADMX_TerminalServer/TS_MAXMONITOR](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_maxmonitor) +- [ADMX_TerminalServer/TS_NoDisconnectMenu](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_nodisconnectmenu) +- [ADMX_TerminalServer/TS_NoSecurityMenu](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_nosecuritymenu) +- [ADMX_TerminalServer/TS_PreventLicenseUpgrade](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_preventlicenseupgrade) +- [ADMX_TerminalServer/TS_PROMT_CREDS_CLIENT_COMP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_promt_creds_client_comp) - [ADMX_Thumbnails/DisableThumbnails](./policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbnails) - [ADMX_Thumbnails/DisableThumbnailsOnNetworkFolders](./policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbnailsonnetworkfolders) - [ADMX_Thumbnails/DisableThumbsDBOnNetworkFolders](./policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbsdbonnetworkfolders) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index bbd3101f94..fa5d7a6fb0 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -4067,12 +4067,144 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC ### ADMX_TerminalServer policies
+
+ ADMX_TerminalServer/TS_AUTO_RECONNECT +
+
+ ADMX_TerminalServer/TS_CAMERA_REDIRECTION +
+
+ ADMX_TerminalServer/TS_CERTIFICATE_TEMPLATE_POLICY +
+
+ ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_1 +
+
+ ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_2 +
+
+ ADMX_TerminalServer/TS_CLIENT_ALLOW_UNSIGNED_FILES_1 +
+
+ ADMX_TerminalServer/TS_CLIENT_ALLOW_UNSIGNED_FILES_2 +
+
+ ADMX_TerminalServer/TS_CLIENT_AUDIO +
+
+ ADMX_TerminalServer/TS_CLIENT_AUDIO_CAPTURE +
+
+ ADMX_TerminalServer/TS_CLIENT_AUDIO_QUALITY +
+
+ ADMX_TerminalServer/TS_CLIENT_CLIPBOARD +
+
+ ADMX_TerminalServer/TS_CLIENT_COM +
+
+ ADMX_TerminalServer/TS_CLIENT_DEFAULT_M +
+
+ ADMX_TerminalServer/TS_CLIENT_DISABLE_HARDWARE_MODE +
+
+ ADMX_TerminalServer/TS_CLIENT_DISABLE_PASSWORD_SAVING_1 +
+
+ ADMX_TerminalServer/TS_CLIENT_LPT +
+
+ ADMX_TerminalServer/TS_CLIENT_PNP +
+
+ ADMX_TerminalServer/TS_CLIENT_PRINTER +
+
+ ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1 +
+
+ ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_2 +
+
+ ADMX_TerminalServer/TS_CLIENT_TURN_OFF_UDP +
+
+ ADMX_TerminalServer/TS_COLORDEPTH +
+
+ ADMX_TerminalServer/TS_DELETE_ROAMING_USER_PROFILES +
+
+ ADMX_TerminalServer/TS_DISABLE_REMOTE_DESKTOP_WALLPAPER +
+
+ ADMX_TerminalServer/TS_DX_USE_FULL_HWGPU +
+
+ ADMX_TerminalServer/TS_EASY_PRINT +
+
+ ADMX_TerminalServer/TS_EASY_PRINT_User +
+
+ ADMX_TerminalServer/TS_EnableVirtualGraphics +
+
+ ADMX_TerminalServer/TS_FALLBACKPRINTDRIVERTYPE +
+
+ ADMX_TerminalServer/TS_FORCIBLE_LOGOFF +
ADMX_TerminalServer/TS_GATEWAY_POLICY_ENABLE
ADMX_TerminalServer/TS_GATEWAY_POLICY_AUTH_METHOD +
+
+ ADMX_TerminalServer/TS_GATEWAY_POLICY_SERVER
+
+ ADMX_TerminalServer/TS_JOIN_SESSION_DIRECTORY +
+
+ ADMX_TerminalServer/TS_KEEP_ALIVE +
+
+ ADMX_TerminalServer/TS_LICENSE_SECGROUP +
+
+ ADMX_TerminalServer/TS_LICENSE_SERVERS +
+
+ ADMX_TerminalServer/TS_LICENSE_TOOLTIP +
+
+ ADMX_TerminalServer/TS_LICENSING_MODE +
+
+ ADMX_TerminalServer/TS_MAX_CON_POLICY +
+
+ ADMX_TerminalServer/TS_MAXDISPLAYRES +
+
+ ADMX_TerminalServer/TS_MAXMONITOR +
+
+ ADMX_TerminalServer/TS_NoDisconnectMenu +
+
+ ADMX_TerminalServer/TS_NoSecurityMenu +
+
+ ADMX_TerminalServer/TS_PreventLicenseUpgrade +
+
+ ADMX_TerminalServer/TS_PROMT_CREDS_CLIENT_COMP +
### ADMX_Thumbnails policies diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index ed42ebde3f..8e10cb601a 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -27,19 +27,150 @@ manager: dansimp ## ADMX_TerminalServer policies
+
+ ADMX_TerminalServer/TS_AUTO_RECONNECT +
+
+ ADMX_TerminalServer/TS_CAMERA_REDIRECTION +
+
+ ADMX_TerminalServer/TS_CERTIFICATE_TEMPLATE_POLICY +
+
+ ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_1 +
+
+ ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_2 +
+
+ ADMX_TerminalServer/TS_CLIENT_ALLOW_UNSIGNED_FILES_1 +
+
+ ADMX_TerminalServer/TS_CLIENT_ALLOW_UNSIGNED_FILES_2 +
+
+ ADMX_TerminalServer/TS_CLIENT_AUDIO +
+
+ ADMX_TerminalServer/TS_CLIENT_AUDIO_CAPTURE +
+
+ ADMX_TerminalServer/TS_CLIENT_AUDIO_QUALITY +
+
+ ADMX_TerminalServer/TS_CLIENT_CLIPBOARD +
+
+ ADMX_TerminalServer/TS_CLIENT_COM +
+
+ ADMX_TerminalServer/TS_CLIENT_DEFAULT_M +
+
+ ADMX_TerminalServer/TS_CLIENT_DISABLE_HARDWARE_MODE +
+
+ ADMX_TerminalServer/TS_CLIENT_DISABLE_PASSWORD_SAVING_1 +
+
+ ADMX_TerminalServer/TS_CLIENT_LPT +
+
+ ADMX_TerminalServer/TS_CLIENT_PNP +
+
+ ADMX_TerminalServer/TS_CLIENT_PRINTER +
+
+ ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1 +
+
+ ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_2 +
+
+ ADMX_TerminalServer/TS_CLIENT_TURN_OFF_UDP +
+
+ ADMX_TerminalServer/TS_COLORDEPTH +
+
+ ADMX_TerminalServer/TS_DELETE_ROAMING_USER_PROFILES +
+
+ ADMX_TerminalServer/TS_DISABLE_REMOTE_DESKTOP_WALLPAPER +
+
+ ADMX_TerminalServer/TS_DX_USE_FULL_HWGPU +
+
+ ADMX_TerminalServer/TS_EASY_PRINT +
+
+ ADMX_TerminalServer/TS_EASY_PRINT_User +
+
+ ADMX_TerminalServer/TS_EnableVirtualGraphics +
+
+ ADMX_TerminalServer/TS_FALLBACKPRINTDRIVERTYPE +
+
+ ADMX_TerminalServer/TS_FORCIBLE_LOGOFF +
ADMX_TerminalServer/TS_GATEWAY_POLICY_ENABLE
ADMX_TerminalServer/TS_GATEWAY_POLICY_AUTH_METHOD
+
+ ADMX_TerminalServer/TS_GATEWAY_POLICY_SERVER +
+
+ ADMX_TerminalServer/TS_JOIN_SESSION_DIRECTORY +
+
+ ADMX_TerminalServer/TS_KEEP_ALIVE +
+
+ ADMX_TerminalServer/TS_LICENSE_SECGROUP +
+
+ ADMX_TerminalServer/TS_LICENSE_SERVERS +
+
+ ADMX_TerminalServer/TS_LICENSE_TOOLTIP +
+
+ ADMX_TerminalServer/TS_LICENSING_MODE +
+
+ ADMX_TerminalServer/TS_MAX_CON_POLICY +
+
+ ADMX_TerminalServer/TS_MAXDISPLAYRES +
+
+ ADMX_TerminalServer/TS_MAXMONITOR +
+
+ ADMX_TerminalServer/TS_NoDisconnectMenu +
+
+ ADMX_TerminalServer/TS_NoSecurityMenu +
+
+ ADMX_TerminalServer/TS_PreventLicenseUpgrade +
+
+ ADMX_TerminalServer/TS_PROMT_CREDS_CLIENT_COMP +
-
-**ADMX_TerminalServer/TS_GATEWAY_POLICY_ENABLE** +**ADMX_TerminalServer/TS_AUTO_RECONNECT** @@ -88,22 +219,2249 @@ manager: dansimp -This policy setting allows you to specify whether the client computer redirects its time zone settings to the Remote Desktop Services session. +This policy specifies whether to allow Remote Desktop Connection clients to automatically reconnect to sessions on an RD Session Host server if their network link is temporarily lost. -If you enable this policy setting, clients that are capable of time zone redirection send their time zone information to the server. The server base time is then used to calculate the current session time (current session time = server base time + client time zone). +By default, a maximum of twenty reconnection attempts are made at five second intervals. If the status is set to Enabled, automatic reconnection is attempted for all clients running Remote Desktop Connection whenever their network connection is lost. -If you disable or do not configure this policy setting, the client computer does not redirect its time zone information and the session time zone is the same as the server time zone. +If the status is set to Disabled, automatic reconnection of clients is prohibited. If the status is set to Not Configured, automatic reconnection is not specified at the Group Policy level. However, users can configure automatic reconnection using the "Reconnect if connection is dropped" checkbox on the Experience tab in Remote Desktop Connection. -Time zone redirection is possible only when connecting to at least a Microsoft Windows Server 2003 terminal server with a client using RDP 5.1 or later. + + + +ADMX Info: +- GP Friendly name: *Automatic reconnection* +- GP name: *TS_AUTO_RECONNECT* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CAMERA_REDIRECTION** + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting lets you control the redirection of video capture devices to the remote computer in a Remote Desktop Services session. By default, Remote Desktop Services allows redirection of video capture devices. + +If you enable this policy setting, users cannot redirect their video capture devices to the remote computer. + +If you disable or do not configure this policy setting, users can redirect their video capture devices to the remote computer. Users can use the More option on the Local Resources tab of Remote Desktop Connection to choose the video capture devices to redirect to the remote computer. + + + + +ADMX Info: +- GP Friendly name: *Do not allow video capture redirection* +- GP name: *TS_CAMERA_REDIRECTION* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CERTIFICATE_TEMPLATE_POLICY** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify the name of the certificate template that determines which certificate is automatically selected to authenticate an RD Session Host server. + +A certificate is needed to authenticate an RD Session Host server when TLS 1.0, 1.1 or 1.2 is used to secure communication between a client and an RD Session Host server during RDP connections. + +If you enable this policy setting, you need to specify a certificate template name. Only certificates created by using the specified certificate template will be considered when a certificate to authenticate the RD Session Host server is automatically selected. Automatic certificate selection only occurs when a specific certificate has not been selected. + +If no certificate can be found that was created with the specified certificate template, the RD Session Host server will issue a certificate enrollment request and will use the current certificate until the request is completed. If more than one certificate is found that was created with the specified certificate template, the certificate that will expire latest and that matches the current name of the RD Session Host server will be selected. If you disable or do not configure this policy, the certificate template name is not specified at the Group Policy level. By default, a self-signed certificate is used to authenticate the RD Session Host server. + +>[!NOTE] +>If you select a specific certificate to be used to authenticate the RD Session Host server, that certificate will take precedence over this policy setting. + + + + +ADMX Info: +- GP Friendly name: *Server authentication certificate template* +- GP name: *TS_CERTIFICATE_TEMPLATE_POLICY* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy setting allows you to specify whether users can run Remote Desktop Protocol (.rdp) files from a publisher that signed the file with a valid certificate. A valid certificate is one issued by an authority recognized by the client, such as the issuers in the client's Third-Party Root Certification Authorities certificate store. + +This policy setting also controls whether the user can start an RDP session by using default .rdp settings (for example, when a user directly opens the Remote Desktop Connection [RDC] client without specifying an .rdp file). + +If you enable or do not configure this policy setting, users can run .rdp files that are signed with a valid certificate. Users can also start an RDP session with default .rdp settings by directly opening the RDC client. When a user starts an RDP session, the user is asked to confirm whether they want to connect. + +If you disable this policy setting, users cannot run .rdp files that are signed with a valid certificate. Additionally, users cannot start an RDP session by directly opening the RDC client and specifying the remote computer name. When a user tries to start an RDP session, the user receives a message that the publisher has been blocked. + +>[!Note] +>You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, all users on the computer are affected. + + + + +ADMX Info: +- GP Friendly name: *Allow .rdp files from valid publishers and user's default .rdp settings* +- GP name: *TTS_CLIENT_ALLOW_SIGNED_FILES_1* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Connection Client* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ +**ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify whether users can run Remote Desktop Protocol (.rdp) files from a publisher that signed the file with a valid certificate. A valid certificate is one that is issued by an authority recognized by the client, such as the issuers in the client's Third-Party Root Certification Authorities certificate store. + +This policy setting also controls whether the user can start an RDP session by using default .rdp settings (for example, when a user directly opens the Remote Desktop Connection [RDC] client without specifying an .rdp file). + +If you enable or do not configure this policy setting, users can run .rdp files that are signed with a valid certificate. Users can also start an RDP session with default .rdp settings by directly opening the RDC client. When a user starts an RDP session, the user is asked to confirm whether they want to connect. + +If you disable this policy setting, users cannot run .rdp files that are signed with a valid certificate. Additionally, users cannot start an RDP session by directly opening the RDC client and specifying the remote computer name. When a user tries to start an RDP session, the user receives a message that the publisher has been blocked. + +>[!NOTE] +>You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, all users on the computer are affected. + + + + +ADMX Info: +- GP Friendly name: *Allow .rdp files from valid publishers and user's default .rdp settings* +- GP name: *TS_CLIENT_ALLOW_SIGNED_FILES_2* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Connection Client* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_ALLOW_UNSIGNED_FILES_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy setting allows you to specify whether users can run unsigned Remote Desktop Protocol (.rdp) files and .rdp files from unknown publishers on the client computer. + +If you enable or do not configure this policy setting, users can run unsigned .rdp files and .rdp files from unknown publishers on the client computer. Before a user starts an RDP session, the user receives a warning message and is asked to confirm whether they want to connect. + +If you disable this policy setting, users cannot run unsigned .rdp files and .rdp files from unknown publishers on the client computer. If the user tries to start an RDP session, the user receives a message that the publisher has been blocked. + + + + +ADMX Info: +- GP Friendly name: *Allow .rdp files from unknown publishers* +- GP name: *TS_CLIENT_ALLOW_UNSIGNED_FILES_1* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Connection Client* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_ALLOW_UNSIGNED_FILES_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify whether users can run unsigned Remote Desktop Protocol (.rdp) files and .rdp files from unknown publishers on the client computer. + +If you enable or do not configure this policy setting, users can run unsigned .rdp files and .rdp files from unknown publishers on the client computer. Before a user starts an RDP session, the user receives a warning message and is asked to confirm whether they want to connect. + +If you disable this policy setting, users cannot run unsigned .rdp files and .rdp files from unknown publishers on the client computer. If the user tries to start an RDP session, the user receives a message that the publisher has been blocked. + + + + +ADMX Info: +- GP Friendly name: *Allow .rdp files from unknown publishers* +- GP name: *TS_CLIENT_ALLOW_UNSIGNED_FILES_2* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Connection Client* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_AUDIO** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify whether users can redirect the remote computer's audio and video output in a Remote Desktop Services session. + +Users can specify where to play the remote computer's audio output by configuring the remote audio settings on the Local Resources tab in Remote Desktop Connection (RDC). Users can choose to play the remote audio on the remote computer or on the local computer. Users can also choose to not play the audio. Video playback can be configured by using the video playback setting in a Remote Desktop Protocol (.rdp) file. By default, video playback is enabled. + +By default, audio and video playback redirection is not allowed when connecting to a computer running Windows Server 2008 R2, Windows Server 2008, or Windows Server 2003. Audio and video playback redirection is allowed by default when connecting to a computer running Windows 8, Windows Server 2012, Windows 7, Windows Vista, or Windows XP Professional. + +If you enable this policy setting, audio and video playback redirection is allowed. + +If you disable this policy setting, audio and video playback redirection is not allowed, even if audio playback redirection is specified in RDC, or video playback is specified in the .rdp file. If you do not configure this policy setting audio and video playback redirection is not specified at the Group Policy level. + + + + +ADMX Info: +- GP Friendly name: *Allow audio and video playback redirection* +- GP name: *TS_CLIENT_AUDIO* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_AUDIO_CAPTURE** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify whether users can record audio to the remote computer in a Remote Desktop Services session. Users can specify whether to record audio to the remote computer by configuring the remote audio settings on the Local Resources tab in Remote Desktop Connection (RDC). + +Users can record audio by using an audio input device on the local computer, such as a built-in microphone. By default, audio recording redirection is not allowed when connecting to a computer running Windows Server 2008 R2. Audio recording redirection is allowed by default when connecting to a computer running at least Windows 7, or Windows Server 2008 R2. + +If you enable this policy setting, audio recording redirection is allowed. + +If you disable this policy setting, audio recording redirection is not allowed, even if audio recording redirection is specified in RDC. If you do not configure this policy setting, Audio recording redirection is not specified at the Group Policy level. + + + + +ADMX Info: +- GP Friendly name: *Allow audio recording redirection* +- GP name: *TS_CLIENT_AUDIO_CAPTURE* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_AUDIO_QUALITY** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to limit the audio playback quality for a Remote Desktop Services session. Limiting the quality of audio playback can improve connection performance, particularly over slow links. If you enable this policy setting, you must select one of the following: High, Medium, or Dynamic. If you select High, the audio will be sent without any compression and with minimum latency. This requires a large amount of bandwidth. If you select Medium, the audio will be sent with some compression and with minimum latency as determined by the codec that is being used. + +If you select Dynamic, the audio will be sent with a level of compression that is determined by the bandwidth of the remote connection. The audio playback quality that you specify on the remote computer by using this policy setting is the maximum quality that can be used for a Remote Desktop Services session, regardless of the audio playback quality configured on the client computer. + +For example, if the audio playback quality configured on the client computer is higher than the audio playback quality configured on the remote computer, the lower level of audio playback quality will be used. + +Audio playback quality can be configured on the client computer by using the audioqualitymode setting in a Remote Desktop Protocol (.rdp) file. By default, audio playback quality is set to Dynamic. + +If you disable or do not configure this policy setting, audio playback quality will be set to Dynamic. + + + + +ADMX Info: +- GP Friendly name: *Limit audio playback quality* +- GP name: *TS_CLIENT_AUDIO_QUALITY* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_CLIPBOARD** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting specifies whether to prevent the sharing of Clipboard contents (Clipboard redirection) between a remote computer and a client computer during a Remote Desktop Services session. + +You can use this setting to prevent users from redirecting Clipboard data to and from the remote computer and the local computer. By default, Remote Desktop Services allows Clipboard redirection. + +If you enable this policy setting, users cannot redirect Clipboard data. + +If you disable this policy setting, Remote Desktop Services always allows Clipboard redirection. + +If you do not configure this policy setting, Clipboard redirection is not specified at the Group Policy level. + + + + +ADMX Info: +- GP Friendly name: *Do not allow Clipboard redirection* +- GP name: *TS_CLIENT_CLIPBOARD* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_COM** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting specifies whether to prevent the redirection of data to client COM ports from the remote computer in a Remote Desktop Services session. + +You can use this setting to prevent users from redirecting data to COM port peripherals or mapping local COM ports while they are logged on to a Remote Desktop Services session. By default, Remote Desktop Services allows this COM port redirection. + +If you enable this policy setting, users cannot redirect server data to the local COM port. + +If you disable this policy setting, Remote Desktop Services always allows COM port redirection. + +If you do not configure this policy setting, COM port redirection is not specified at the Group Policy level. + + + + +ADMX Info: +- GP Friendly name: *Do not allow COM port redirection* +- GP name: *TS_CLIENT_COM* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_DEFAULT_M** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify whether the client default printer is automatically set as the default printer in a session on an RD Session Host server. + +By default, Remote Desktop Services automatically designates the client default printer as the default printer in a session on an RD Session Host server. You can use this policy setting to override this behavior. + +If you enable this policy setting, the default printer is the printer specified on the remote computer. + +If you disable this policy setting, the RD Session Host server automatically maps the client default printer and sets it as the default printer upon connection. + +If you do not configure this policy setting, the default printer is not specified at the Group Policy level. + + + + +ADMX Info: +- GP Friendly name: *Do not set default client printer to be default printer in a session* +- GP name: *TS_CLIENT_DEFAULT_M* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_DISABLE_HARDWARE_MODE** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting specifies whether the Remote Desktop Connection can use hardware acceleration if supported hardware is available. + +If you use this setting, the Remote Desktop Client will use only software decoding. For example, if you have a problem that you suspect may be related to hardware acceleration, use this setting to disable the acceleration; then, if the problem still occurs, you will know that there are additional issues to investigate. + +If you disable this setting or leave it not configured, the Remote Desktop client will use hardware accelerated decoding if supported hardware is available. + + + + +ADMX Info: +- GP Friendly name: *Do not allow hardware accelerated decoding* +- GP name: *TS_CLIENT_DISABLE_HARDWARE_MODE* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Connection Client* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_DISABLE_PASSWORD_SAVING_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy specifies whether to allow Remote Desktop Connection Controls whether a user can save passwords using Remote Desktop Connection. + +If you enable this setting the credential saving checkbox in Remote Desktop Connection will be disabled and users will no longer be able to save passwords. When a user opens an RDP file using Remote Desktop Connection and saves his settings, any password that previously existed in the RDP file will be deleted. + +If you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection + + + + +ADMX Info: +- GP Friendly name: *Do not allow passwords to be saved* +- GP name: *TS_CLIENT_DISABLE_PASSWORD_SAVING_1* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Connection Client* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_LPT** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting specifies whether to prevent the redirection of data to client LPT ports during a Remote Desktop Services session. You can use this setting to prevent users from mapping local LPT ports and redirecting data from the remote computer to local LPT port peripherals. By default, Remote Desktop Services allows LPT port redirection. + +If you enable this policy setting, users in a Remote Desktop Services session cannot redirect server data to the local LPT port. + +If you disable this policy setting, LPT port redirection is always allowed. If you do not configure this policy setting, LPT port redirection is not specified at the Group Policy level. + + + + +ADMX Info: +- GP Friendly name: *Do not allow LPT port redirection* +- GP name: *TS_CLIENT_LPT* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_PNP** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting lets you control the redirection of supported Plug and Play and RemoteFX USB devices, such as Windows Portable Devices, to the remote computer in a Remote Desktop Services session. By default, Remote Desktop Services does not allow redirection of supported Plug and Play and RemoteFX USB devices. + +If you disable this policy setting, users can redirect their supported Plug and Play devices to the remote computer. Users can use the More option on the Local Resources tab of Remote Desktop Connection to choose the supported Plug and Play devices to redirect to the remote computer. + +If you enable this policy setting, users cannot redirect their supported Plug and Play devices to the remote computer.If you do not configure this policy setting, users can redirect their supported Plug and Play devices to the remote computer only if it is running Windows Server 2012 R2 and earlier versions. + +>[!NOTE] +>You can disable redirection of specific types of supported Plug and Play devices by using Computer Configuration\Administrative Templates\System\Device Installation\Device Installation Restrictions policy settings. + + + + +ADMX Info: +- GP Friendly name: *Do not allow supported Plug and Play device redirection* +- GP name: *TS_CLIENT_PNP* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_PRINTER** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify whether to prevent the mapping of client printers in Remote Desktop Services sessions. You can use this policy setting to prevent users from redirecting print jobs from the remote computer to a printer attached to their local (client) computer. By default, Remote Desktop Services allows this client printer mapping. + +If you enable this policy setting, users cannot redirect print jobs from the remote computer to a local client printer in Remote Desktop Services sessions. + +If you disable this policy setting, users can redirect print jobs with client printer mapping. + +If you do not configure this policy setting, client printer mapping is not specified at the Group Policy level. + + + + +ADMX Info: +- GP Friendly name: *Do not allow client printer redirection* +- GP name: *TS_CLIENT_PRINTER* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA1) certificate thumbprints that represent trusted Remote Desktop Protocol (.rdp) file publishers. + +If you enable this policy setting, any certificate with an SHA1 thumbprint that matches a thumbprint on the list is trusted. If a user tries to start an .rdp file that is signed by a trusted certificate, the user does not receive any warning messages when they start the file. To obtain the thumbprint, view the certificate details, and then click the Thumbprint field. + +If you disable or do not configure this policy setting, no publisher is treated as a trusted .rdp publisher. + +>[!NOTE] +>You can define this policy setting in the Computer Configuration node or in the User Configuration node. + +If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user. + +This policy setting overrides the behavior of the "Allow .rdp files from valid publishers and user's default .rdp settings" policy setting. If the list contains a string that is not a certificate thumbprint, it is ignored. + + + + +ADMX Info: +- GP Friendly name: *Specify SHA1 thumbprints of certificates representing trusted .rdp publishers* +- GP name: *TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Connection Client* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA1) certificate thumbprints that represent trusted Remote Desktop Protocol (.rdp) file publishers. + +If you enable this policy setting, any certificate with an SHA1 thumbprint that matches a thumbprint on the list is trusted. If a user tries to start an .rdp file that is signed by a trusted certificate, the user does not receive any warning messages when they start the file. To obtain the thumbprint, view the certificate details, and then click the Thumbprint field. + +If you disable or do not configure this policy setting, no publisher is treated as a trusted .rdp publisher. + +>[!NOTE] +>You can define this policy setting in the Computer Configuration node or in the User Configuration node. + +If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user. + +This policy setting overrides the behavior of the "Allow .rdp files from valid publishers and user's default .rdp settings" policy setting. If the list contains a string that is not a certificate thumbprint, it is ignored. + + + + +ADMX Info: +- GP Friendly name: *Specify SHA1 thumbprints of certificates representing trusted .rdp publishers* +- GP name: *TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_2* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Connection Client* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_CLIENT_TURN_OFF_UDP** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting specifies whether the UDP protocol will be used to access servers via Remote Desktop Protocol. + +If you enable this policy setting, Remote Desktop Protocol traffic will only use the TCP protocol. + +If you disable or do not configure this policy setting, Remote Desktop Protocol traffic will attempt to use both TCP and UDP protocols. + + + + +ADMX Info: +- GP Friendly name: *Turn Off UDP On Client* +- GP name: *TS_CLIENT_TURN_OFF_UDP* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Connection Client* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_COLORDEPTH** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify the maximum color resolution (color depth) for Remote Desktop Services connections. You can use this policy setting to set a limit on the color depth of any connection that uses RDP. Limiting the color depth can improve connection performance, particularly over slow links, and reduce server load. + +If you enable this policy setting, the color depth that you specify is the maximum color depth allowed for a user's RDP connection. The actual color depth for the connection is determined by the color support available on the client computer. If you select Client Compatible, the highest color depth supported by the client will be used. + +If you disable or do not configure this policy setting, the color depth for connections is not specified at the Group Policy level. + +>[!NOTE] +> 1. Setting the color depth to 24 bits is only supported on Windows Server 2003 and Windows XP Professional. +>2. The value specified in this policy setting is not applied to connections from client computers that are using at least Remote Desktop Protocol 8.0 (computers running at least Windows 8 or Windows Server 2012). The 32-bit color depth format is always used for these connections. +>3. For connections from client computers that are using Remote Desktop Protocol 7.1 or earlier versions that are connecting to computers running at least Windows 8 or Windows Server 2012, the minimum of the following values is used as the color depth format: +> - a. Value specified by this policy setting +> - b. Maximum color depth supported by the client +> - c. Value requested by the client If the client does not support at least 16 bits, the connection is terminated. + + + + +ADMX Info: +- GP Friendly name: *Limit maximum color depth* +- GP name: *TS_COLORDEPTH* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_DELETE_ROAMING_USER_PROFILES** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to limit the size of the entire roaming user profile cache on the local drive. This policy setting only applies to a computer on which the Remote Desktop Session Host role service is installed. + +>[!NOTE] +>If you want to limit the size of an individual user profile, use the "Limit profile size" policy setting located in User Configuration\Policies\Administrative Templates\System\User Profiles. + +If you enable this policy setting, you must specify a monitoring interval (in minutes) and a maximum size (in gigabytes) for the entire roaming user profile cache. The monitoring interval determines how often the size of the entire roaming user profile cache is checked. + +When the size of the entire roaming user profile cache exceeds the maximum size that you have specified, the oldest (least recently used) roaming user profiles will be deleted until the size of the entire roaming user profile cache is less than the maximum size specified. + +If you disable or do not configure this policy setting, no restriction is placed on the size of the entire roaming user profile cache on the local drive. Note: This policy setting is ignored if the "Prevent Roaming Profile changes from propagating to the server" policy setting located in Computer Configuration\Policies\Administrative Templates\System\User Profiles is enabled. + + + + +ADMX Info: +- GP Friendly name: *Limit the size of the entire roaming user profile cache* +- GP name: *TS_DELETE_ROAMING_USER_PROFILES* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Profiles* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_DISABLE_REMOTE_DESKTOP_WALLPAPER** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy specifies whether desktop wallpaper is displayed to remote clients connecting via Remote Desktop Services. + +You can use this setting to enforce the removal of wallpaper during a Remote Desktop Services session. By default, Windows XP Professional displays wallpaper to remote clients connecting through Remote Desktop, depending on the client configuration (see the Experience tab in the Remote Desktop Connection options for more information). Servers running Windows Server 2003 do not display wallpaper by default to Remote Desktop Services sessions. + +If the status is set to Enabled, wallpaper never appears in a Remote Desktop Services session. + +If the status is set to Disabled, wallpaper might appear in a Remote Desktop Services session, depending on the client configuration. If the status is set to Not Configured, the default behavior applies. + + + + +ADMX Info: +- GP Friendly name: *Enforce Removal of Remote Desktop Wallpaper* +- GP name: *TS_DISABLE_REMOTE_DESKTOP_WALLPAPER* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + +**ADMX_TerminalServer/TS_DX_USE_FULL_HWGPU** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting enables system administrators to change the graphics rendering for all Remote Desktop Services sessions. If you enable this policy setting, all Remote Desktop Services sessions use the hardware graphics renderer instead of the Microsoft Basic Render Driver as the default adapter. + +If you disable this policy setting, all Remote Desktop Services sessions use the Microsoft Basic Render Driver as the default adapter. + +If you do not configure this policy setting, Remote Desktop Services sessions on the RD Session Host server use the Microsoft Basic Render Driver as the default adapter. In all other cases, Remote Desktop Services sessions use the hardware graphics renderer by default. + +>[!NOTE] +>The policy setting enables load-balancing of graphics processing units (GPU) on a computer with more than one GPU installed. The GPU configuration of the local session is not affected by this policy setting. + + + + +ADMX Info: +- GP Friendly name: *Use hardware graphics adapters for all Remote Desktop Services sessions* +- GP name: *TS_DX_USE_FULL_HWGPU* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_EASY_PRINT** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify whether the Remote Desktop Easy Print printer driver is used first to install all client printers. + +If you enable or do not configure this policy setting, the RD Session Host server first tries to use the Remote Desktop Easy Print printer driver to install all client printers. If for any reason the Remote Desktop Easy Print printer driver cannot be used, a printer driver on the RD Session Host server that matches the client printer is used. If the RD Session Host server does not have a printer driver that matches the client printer, the client printer is not available for the Remote Desktop session. + +If you disable this policy setting, the RD Session Host server tries to find a suitable printer driver to install the client printer. If the RD Session Host server does not have a printer driver that matches the client printer, the server tries to use the Remote Desktop Easy Print driver to install the client printer. If for any reason the Remote Desktop Easy Print printer driver cannot be used, the client printer is not available for the Remote Desktop Services session. + +>[!NOTE] +>If the "Do not allow client printer redirection" policy setting is enabled, the "Use Remote Desktop Easy Print printer driver first" policy setting is ignored. + + + + +ADMX Info: +- GP Friendly name: *Use Remote Desktop Easy Print printer driver first* +- GP name: *TS_EASY_PRINT* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_EASY_PRINT_User** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy setting allows you to specify whether the Remote Desktop Easy Print printer driver is used first to install all client printers. + +If you enable or do not configure this policy setting, the RD Session Host server first tries to use the Remote Desktop Easy Print printer driver to install all client printers. If for any reason the Remote Desktop Easy Print printer driver cannot be used, a printer driver on the RD Session Host server that matches the client printer is used. If the RD Session Host server does not have a printer driver that matches the client printer, the client printer is not available for the Remote Desktop session. + +If you disable this policy setting, the RD Session Host server tries to find a suitable printer driver to install the client printer. If the RD Session Host server does not have a printer driver that matches the client printer, the server tries to use the Remote Desktop Easy Print driver to install the client printer. If for any reason the Remote Desktop Easy Print printer driver cannot be used, the client printer is not available for the Remote Desktop Services session. + +>[!NOTE] +>If the "Do not allow client printer redirection" policy setting is enabled, the "Use Remote Desktop Easy Print printer driver first" policy setting is ignored. + + + + +ADMX Info: +- GP Friendly name: *Use Remote Desktop Easy Print printer driver first* +- GP name: *TS_EASY_PRINT_User* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_EnableVirtualGraphics** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to control the availability of RemoteFX on both a Remote Desktop Virtualization Host (RD Virtualization Host) server and a Remote Desktop Session Host (RD Session Host) server. When deployed on an RD Virtualization Host server, RemoteFX delivers a rich user experience by rendering content on the server by using graphics processing units (GPUs). + +By default, RemoteFX for RD Virtualization Host uses server-side GPUs to deliver a rich user experience over LAN connections and RDP 7.1. When deployed on an RD Session Host server, RemoteFX delivers a rich user experience by using a hardware-accelerated compression scheme. + +If you enable this policy setting, RemoteFX will be used to deliver a rich user experience over LAN connections and RDP 7.1. + +If you disable this policy setting, RemoteFX will be disabled. + +If you do not configure this policy setting, the default behavior will be used. By default, RemoteFX for RD Virtualization Host is enabled and RemoteFX for RD Session Host is disabled. + + + + +ADMX Info: +- GP Friendly name: *Configure RemoteFX* +- GP name: *TS_EnableVirtualGraphics* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\RemoteFX for Windows Server 2008 R2* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_FALLBACKPRINTDRIVERTYPE** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify the RD Session Host server fallback printer driver behavior. By default, the RD Session Host server fallback printer driver is disabled. If the RD Session Host server does not have a printer driver that matches the client's printer, no printer will be available for the Remote Desktop Services session. + +If you enable this policy setting, the fallback printer driver is enabled, and the default behavior is for the RD Session Host server to find a suitable printer driver. If one is not found, the client's printer is not available. You can choose to change this default behavior. The available options are: + +- **Do nothing if one is not found** - If there is a printer driver mismatch, the server will attempt to find a suitable driver. If one is not found, the client's printer is not available. This is the default behavior. +- **Default to PCL if one is not found** - If no suitable printer driver can be found, default to the Printer Control Language (PCL) fallback printer driver. +- **Default to PS if one is not found**- If no suitable printer driver can be found, default to the PostScript (PS) fallback printer driver. +- **Show both PCL and PS if one is not found**- If no suitable driver can be found, show both PS and PCL-based fallback printer drivers. + +If you disable this policy setting, the RD Session Host server fallback driver is disabled and the RD Session Host server will not attempt to use the fallback printer driver. If you do not configure this policy setting, the fallback printer driver behavior is off by default. + +>[!NOTE] +>If the **Do not allow client printer redirection** setting is enabled, this policy setting is ignored and the fallback printer driver is disabled. + + + + +ADMX Info: +- GP Friendly name: *Specify RD Session Host server fallback printer driver behavior* +- GP name: *TS_FALLBACKPRINTDRIVERTYPE* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_FORCIBLE_LOGOFF** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting determines whether an administrator attempting to connect remotely to the console of a server can log off an administrator currently logged on to the console. This policy is useful when the currently connected administrator does not want to be logged off by another administrator. If the connected administrator is logged off, any data not previously saved is lost. + +If you enable this policy setting, logging off the connected administrator is not allowed. + +If you disable or do not configure this policy setting, logging off the connected administrator is allowed. + +>[!NOTE] +>The console session is also known as Session 0. Console access can be obtained by using the /console switch from Remote Desktop Connection in the computer field name or from the command line. + + + + +ADMX Info: +- GP Friendly name: *Deny logoff of an administrator logged in to the console session* +- GP name: *TS_FORCIBLE_LOGOFF* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_GATEWAY_POLICY_ENABLE** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +If you enable this policy setting, when Remote Desktop Connection cannot connect directly to a remote computer (an RD Session Host server or a computer with Remote Desktop enabled), the clients will attempt to connect to the remote computer through an RD Gateway server. + +In this case, the clients will attempt to connect to the RD Gateway server that is specified in the "Set RD Gateway server address" policy setting. You can enforce this policy setting or you can allow users to overwrite this setting. + +By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these RD Gateway server settings" option on the client. Note: To enforce this policy setting, you must also specify the address of the RD Gateway server by using the "Set RD Gateway server address" policy setting, or client connection attempts to any remote computer will fail, if the client cannot connect directly to the remote computer. + +To enhance security, it is also highly recommended that you specify the authentication method by using the "Set RD Gateway authentication method" policy setting. If you do not specify an authentication method by using this policy setting, either the NTLM protocol that is enabled on the client or a smart card can be used. To allow users to overwrite this policy setting, select the "Allow users to change this setting" check box. + +When you do this, users on the client can choose not to connect through the RD Gateway server by selecting the "Do not use an RD Gateway server" option. Users can specify a connection method by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify a connection method, the connection method that you specify in this policy setting is used by default. + +If you disable or do not configure this policy setting, clients will not use the RD Gateway server address that is specified in the "Set RD Gateway server address" policy setting. If an RD Gateway server is specified by the user, a client connection attempt will be made through that RD Gateway server. ADMX Info: -- GP Friendly name: *Allow time zone redirection* +- GP Friendly name: *Enable connection through RD Gateway* - GP name: *TS_GATEWAY_POLICY_ENABLE* -- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP path: *Windows Components\Remote Desktop Services\RD Gateway* - GP ADMX file name: *TerminalServer.admx* @@ -161,15 +2519,13 @@ ADMX Info: -This policy setting specifies whether to prevent the sharing of Clipboard contents (Clipboard redirection) between a remote computer and a client computer during a Remote Desktop Services session. +This policy specifies the authentication method that clients must use when attempting to connect to an RD Session Host server through an RD Gateway server. You can enforce this policy setting or you can allow users to overwrite this policy setting. -You can use this setting to prevent users from redirecting Clipboard data to and from the remote computer and the local computer. By default, Remote Desktop Services allows Clipboard redirection. +By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these RD Gateway server settings" option on the client. -If you enable this policy setting, users cannot redirect Clipboard data. +To allow users to overwrite this policy setting, select the "Allow users to change this setting" check box. When you do this, users can specify an alternate authentication method by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify an alternate authentication method, the authentication method that you specify in this policy setting is used by default. -If you disable this policy setting, Remote Desktop Services always allows Clipboard redirection. - -If you do not configure this policy setting, Clipboard redirection is not specified at the Group Policy level. +If you disable or do not configure this policy setting, the authentication method that is specified by the user is used, if one is specified. If an authentication method is not specified, the Negotiate protocol that is enabled on the client or a smart card can be used for authentication. @@ -177,16 +2533,1062 @@ If you do not configure this policy setting, Clipboard redirection is not specif ADMX Info: -- GP Friendly name: *Do not allow Clipboard redirection* +- GP Friendly name: *Set RD Gateway authentication method* - GP name: *TS_GATEWAY_POLICY_AUTH_METHOD* -- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP path: *Windows Components\Remote Desktop Services\RD Gateway* - GP ADMX file name: *TerminalServer.admx*
+ +**ADMX_TerminalServer/TS_GATEWAY_POLICY_SERVER** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy specifies the address of the RD Gateway server that clients must use when attempting to connect to an RD Session Host server. You can enforce this policy setting or you can allow users to overwrite this policy setting. + +By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these RD Gateway server settings" option on the client. + +>[!NOTE] +>It is highly recommended that you also specify the authentication method by using the **Set RD Gateway authentication method** policy setting. If you do not specify an authentication method by using this setting, either the NTLM protocol that is enabled on the client or a smart card can be used. + +To allow users to overwrite the **Set RD Gateway server address** policy setting and connect to another RD Gateway server, you must select the **Allow users to change this setting** check box and users will be allowed to specify an alternate RD Gateway server. + +Users can specify an alternative RD Gateway server by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify an alternate RD Gateway server, the server that you specify in this policy setting is used by default. + +>[!NOTE] +>If you disable or do not configure this policy setting, but enable the **Enable connections through RD Gateway** policy setting, client connection attempts to any remote computer will fail, if the client cannot connect directly to the remote computer. If an RD Gateway server is specified by the user, a client connection attempt will be made through that RD Gateway server. + + + + +ADMX Info: +- GP Friendly name: *Set RD Gateway server address* +- GP name: *TS_GATEWAY_POLICY_SERVER* +- GP path: *Windows Components\Remote Desktop Services\RD Gateway* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + +**ADMX_TerminalServer/TS_JOIN_SESSION_DIRECTORY** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify whether the RD Session Host server should join a farm in RD Connection Broker. RD Connection Broker tracks user sessions and allows a user to reconnect to their existing session in a load-balanced RD Session Host server farm. To participate in RD Connection Broker, the Remote Desktop Session Host role service must be installed on the server. + +If the policy setting is enabled, the RD Session Host server joins the farm that is specified in the RD Connection Broker farm name policy setting. The farm exists on the RD Connection Broker server that is specified in the Configure RD Connection Broker server name policy setting. + +If you disable this policy setting, the server does not join a farm in RD Connection Broker, and user session tracking is not performed. If the policy setting is disabled, you cannot use either the Remote Desktop Session Host Configuration tool or the Remote Desktop Services WMI Provider to join the server to RD Connection Broker. + +If the policy setting is not configured, the policy setting is not specified at the Group Policy level. + +>[!NOTE] +>1. If you enable this policy setting, you must also enable the Configure RD Connection Broker farm name and Configure RD Connection Broker server name policy settings. +>2. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. + + + + +ADMX Info: +- GP Friendly name: *Join RD Connection Broker* +- GP name: *TS_JOIN_SESSION_DIRECTORY* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_KEEP_ALIVE** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to enter a keep-alive interval to ensure that the session state on the RD Session Host server is consistent with the client state. + +After an RD Session Host server client loses the connection to an RD Session Host server, the session on the RD Session Host server might remain active instead of changing to a disconnected state, even if the client is physically disconnected from the RD Session Host server. If the client logs on to the same RD Session Host server again, a new session might be established (if the RD Session Host server is configured to allow multiple sessions), and the original session might still be active. + +If you enable this policy setting, you must enter a keep-alive interval. The keep-alive interval determines how often, in minutes, the server checks the session state. The range of values you can enter is 1 to 999,999. + +If you disable or do not configure this policy setting, a keep-alive interval is not set and the server will not check the session state. + + + + +ADMX Info: +- GP Friendly name: *Configure keep-alive connection interval* +- GP name: *TS_KEEP_ALIVE* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_LICENSE_SECGROUP** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify the RD Session Host servers to which a Remote Desktop license server will offer Remote Desktop Services client access licenses (RDS CALs). + +You can use this policy setting to control which RD Session Host servers are issued RDS CALs by the Remote Desktop license server. By default, a license server issues an RDS CAL to any RD Session Host server that requests one. + +If you enable this policy setting and this policy setting is applied to a Remote Desktop license server, the license server will only respond to RDS CAL requests from RD Session Host servers whose computer accounts are a member of the RDS Endpoint Servers group on the license server. By default, the RDS Endpoint Servers group is empty. + +If you disable or do not configure this policy setting, the Remote Desktop license server issues an RDS CAL to any RD Session Host server that requests one. The RDS Endpoint Servers group is not deleted or changed in any way by disabling or not configuring this policy setting. + +>[!NOTE] +>You should only enable this policy setting when the license server is a member of a domain. You can only add computer accounts for RD Session Host servers to the RDS Endpoint Servers group when the license server is a member of a domain. + + + + +ADMX Info: +- GP Friendly name: *License server security group* +- GP name: *TS_LICENSE_SECGROUP* +- GP path: *Windows Components\Remote Desktop Services\RD Licensing* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_LICENSE_SERVERS** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify the order in which an RD Session Host server attempts to locate Remote Desktop license servers. + +If you enable this policy setting, an RD Session Host server first attempts to locate the specified license servers. If the specified license servers cannot be located, the RD Session Host server will attempt automatic license server discovery. + +In the automatic license server discovery process, an RD Session Host server in a Windows Server-based domain attempts to contact a license server in the following order: +1. Remote Desktop license servers that are published in Active Directory Domain Services. +2. Remote Desktop license servers that are installed on domain controllers in the same domain as the RD Session Host server. + +1If you disable or do not configure this policy setting, the RD Session Host server does not specify a license server at the Group Policy level. + + + + +ADMX Info: +- GP Friendly name: *Use the specified Remote Desktop license servers* +- GP name: *TS_LICENSE_SERVERS* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Licensing* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_LICENSE_TOOLTIP** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting determines whether notifications are displayed on an RD Session Host server when there are problems with RD Licensing that affect the RD Session Host server. + +By default, notifications are displayed on an RD Session Host server after you log on as a local administrator, if there are problems with RD Licensing that affect the RD Session Host server. If applicable, a notification will also be displayed that notes the number of days until the licensing grace period for the RD Session Host server will expire. + +If you enable this policy setting, these notifications will not be displayed on the RD Session Host server. + +If you disable or do not configure this policy setting, these notifications will be displayed on the RD Session Host server after you log on as a local administrator. + + + + +ADMX Info: +- GP Friendly name: *Hide notifications about RD Licensing problems that affect the RD Session Host server* +- GP name: *TS_LICENSE_TOOLTIP* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Licensing* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_LICENSING_MODE** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify the type of Remote Desktop Services client access license (RDS CAL) that is required to connect to this RD Session Host server. + +You can use this policy setting to select one of three licensing modes: Per User , Per Device and AAD Per User . +- Per User licensing mode requires that each user account connecting to this RD Session Host server have an RDS Per User CAL issued from an RD Licensing server. +- Per Device licensing mode requires that each device connecting to this RD Session Host server have an RDS Per Device CAL issued from an RD Licensing server. +- AAD Per User licensing mode requires that each user account connecting to this RD Session Host server have a service plan that supports RDS licenses assigned in AAD. + +If you enable this policy setting, the Remote Desktop licensing mode that you specify is honored by the Remote Desktop license server and RD Session Host. + +If you disable or do not configure this policy setting, the licensing mode is not specified at the Group Policy level. + + + + +ADMX Info: +- GP Friendly name: *Set the Remote Desktop licensing mode* +- GP name: *TS_LICENSING_MODE* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Licensing* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_MAX_CON_POLICY** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy specifies whether Remote Desktop Services limits the number of simultaneous connections to the server. You can use this setting to restrict the number of Remote Desktop Services sessions that can be active on a server. If this number is exceeded, additional users who try to connect receive an error message telling them that the server is busy and to try again later. Restricting the number of sessions improves performance because fewer sessions are demanding system resources. + +By default, RD Session Host servers allow an unlimited number of Remote Desktop Services sessions, and Remote Desktop for Administration allows two Remote Desktop Services sessions. + +To use this setting, enter the number of connections you want to specify as the maximum for the server. To specify an unlimited number of connections, type 999999. + +If the status is set to Enabled, the maximum number of connections is limited to the specified number consistent with the version of Windows and the mode of Remote Desktop Services running on the server. + +If the status is set to Disabled or Not Configured, limits to the number of connections are not enforced at the Group Policy level. + +>[!NOTE] +>This setting is designed to be used on RD Session Host servers (that is, on servers running Windows with Remote Desktop Session Host role service installed). + + + + +ADMX Info: +- GP Friendly name: *Limit number of connections* +- GP name: *TS_MAX_CON_POLICY* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_MAXDISPLAYRES** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify the maximum display resolution that can be used by each monitor used to display a Remote Desktop Services session. Limiting the resolution used to display a remote session can improve connection performance, particularly over slow links, and reduce server load. + +If you enable this policy setting, you must specify a resolution width and height. The resolution specified will be the maximum resolution that can be used by each monitor used to display a Remote Desktop Services session. + +If you disable or do not configure this policy setting, the maximum resolution that can be used by each monitor to display a Remote Desktop Services session will be determined by the values specified on the Display Settings tab in the Remote Desktop Session Host Configuration tool. + + + + +ADMX Info: +- GP Friendly name: *Limit maximum display resolution* +- GP name: *TS_MAXDISPLAYRES* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_MAXMONITOR** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to limit the number of monitors that a user can use to display a Remote Desktop Services session. Limiting the number of monitors to display a Remote Desktop Services session can improve connection performance, particularly over slow links, and reduce server load. + +If you enable this policy setting, you can specify the number of monitors that can be used to display a Remote Desktop Services session. You can specify a number from 1 to 16. + +If you disable or do not configure this policy setting, the number of monitors that can be used to display a Remote Desktop Services session is not specified at the Group Policy level. + + + + +ADMX Info: +- GP Friendly name: *Limit number of monitors* +- GP name: *TS_MAXMONITOR* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_NoDisconnectMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to remove the "Disconnect" option from the Shut Down Windows dialog box in Remote Desktop Services sessions. You can use this policy setting to prevent users from using this familiar method to disconnect their client from an RD Session Host server. + +If you enable this policy setting, "Disconnect" does not appear as an option in the drop-down list in the Shut Down Windows dialog box. + +If you disable or do not configure this policy setting, "Disconnect" is not removed from the list in the Shut Down Windows dialog box. + +>[!NOTE] +>This policy setting affects only the Shut Down Windows dialog box. It does not prevent users from using other methods to disconnect from a Remote Desktop Services session. + +This policy setting also does not prevent disconnected sessions at the server. You can control how long a disconnected session remains active on the server by configuring the **Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\RD Session Host\Session Time Limits\Set time limit for disconnected sessions** policy setting. + + + + +ADMX Info: +- GP Friendly name: *Remove "Disconnect" option from Shut Down dialog* +- GP name: *TS_NoDisconnectMenu* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_NoSecurityMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy specifies whether to remove the Windows Security item from the Settings menu on Remote Desktop clients. You can use this setting to prevent inexperienced users from logging off from Remote Desktop Services inadvertently. + +If the status is set to Enabled, Windows Security does not appear in Settings on the Start menu. As a result, users must type a security attention sequence, such as CTRL+ALT+END, to open the Windows Security dialog box on the client computer. + +If the status is set to Disabled or Not Configured, Windows Security remains in the Settings menu. + + + + +ADMX Info: +- GP Friendly name: *Remove Windows Security item from Start menu* +- GP name: *TS_NoSecurityMenu* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_PreventLicenseUpgrade** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify which version of Remote Desktop Services client access license (RDS CAL) a Remote Desktop Services license server will issue to clients connecting to RD Session Host servers running other Windows-based operating systems. + +A license server attempts to provide the most appropriate RDS or TS CAL for a connection. For example, a Windows Server 2008 license server will try to issue a Windows Server 2008 TS CAL for clients connecting to a terminal server running Windows Server 2008, and will try to issue a Windows Server 2003 TS CAL for clients connecting to a terminal server running Windows Server 2003. + +By default, if the most appropriate RDS CAL is not available for a connection, a Windows Server 2008 license server will issue a Windows Server 2008 TS CAL, if available, to the following: +- A client connecting to a Windows Server 2003 terminal server +- A client connecting to a Windows 2000 terminal server + +If you enable this policy setting, the license server will only issue a temporary RDS CAL to the client if an appropriate RDS CAL for the RD Session Host server is not available. If the client has already been issued a temporary RDS CAL and the temporary RDS CAL has expired, the client will not be able to connect to the RD Session Host server unless the RD Licensing grace period for the RD Session Host server has not expired. + +If you disable or do not configure this policy setting, the license server will exhibit the default behavior noted earlier. + + + + +ADMX Info: +- GP Friendly name: *Prevent license upgrade* +- GP name: *TS_PreventLicenseUpgrade* +- GP path: *Windows Components\Remote Desktop Services\RD Licensing* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
+ + +**ADMX_TerminalServer/TS_PROMT_CREDS_CLIENT_COMP** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting determines whether a user will be prompted on the client computer to provide credentials for a remote connection to an RD Session Host server. + +If you enable this policy setting, a user will be prompted on the client computer instead of on the RD Session Host server to provide credentials for a remote connection to an RD Session Host server. If saved credentials for the user are available on the client computer, the user will not be prompted to provide credentials. + +>[!NOTE] +>If you enable this policy setting in releases of Windows Server 2008 R2 with SP1 or Windows Server 2008 R2, and a user is prompted on both the client computer and on the RD Session Host server to provide credentials, clear the Always prompt for password check box on the Log on Settings tab in Remote Desktop Session Host Configuration. + +If you disable or do not configure this policy setting, the version of the operating system on the RD Session Host server will determine when a user is prompted to provide credentials for a remote connection to an RD Session Host server. + +For Windows Server 2003 and Windows 2000 Server a user will be prompted on the terminal server to provide credentials for a remote connection. For Windows Server 2008 and Windows Server 2008 R2, a user will be prompted on the client computer to provide credentials for a remote connection. + + + + +ADMX Info: +- GP Friendly name: *Prompt for credentials on the client computer* +- GP name: *TS_PROMT_CREDS_CLIENT_COMP* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Connection Client* +- GP ADMX file name: *TerminalServer.admx* + + + + + +
From 2728f29438458f6d694d286f0f178d603e2766c0 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Fri, 19 Nov 2021 15:46:26 +0530 Subject: [PATCH 0090/1077] Update policy-csp-admx-terminalserver.md --- .../mdm/policy-csp-admx-terminalserver.md | 1229 +++++++++++++++++ 1 file changed, 1229 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index 2833f7d9f9..f4dd2966a5 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -36,6 +36,54 @@ manager: dansimp
ADMX_TerminalServer/TS_RADC_DefaultConnection
+
+ ADMX_TerminalServer/TS_RDSAppX_WaitForRegistration +
+
+ ADMX_TerminalServer/TS_RemoteControl_1 +
+
+ ADMX_TerminalServer/TS_RemoteControl_2 +
+
+ ADMX_TerminalServer/TS_RemoteDesktopVirtualGraphics +
+
+ ADMX_TerminalServer/TS_SD_ClustName +
+
+ ADMX_TerminalServer/TS_SD_EXPOSE_ADDRESS +
+
+ ADMX_TerminalServer/TS_SD_Loc +
+
+ ADMX_TerminalServer/TS_SECURITY_LAYER_POLICY +
+
+ ADMX_TerminalServer/TS_SELECT_NETWORK_DETECT +
+
+ ADMX_TerminalServer/TS_SELECT_TRANSPORT +
+
+ ADMX_TerminalServer/TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP +
+
+ ADMX_TerminalServer/TS_SERVER_AUTH +
+
+ ADMX_TerminalServer/TS_SERVER_AVC_HW_ENCODE_PREFERRED +
+
+ ADMX_TerminalServer/TS_SERVER_AVC444_MODE_PREFERRED +
+
+ ADMX_TerminalServer/TS_SERVER_COMPRESSOR +
+
+ ADMX_TerminalServer/TS_SERVER_IMAGE_QUALITY +
@@ -263,5 +311,1186 @@ ADMX Info:
+ +**ADMX_TerminalServer/TS_RDSAppX_WaitForRegistration** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + + +This policy setting allows you to specify whether the app registration is completed before showing the Start screen to the user. By default, when a new user signs in to a computer, the Start screen is shown and apps are registered in the background. However, some apps may not work until app registration is complete. + +- If you enable this policy setting, user sign-in is blocked for up to 6 minutes to complete the app registration. You can use this policy setting when customizing the Start screen on Remote Desktop Session Host servers. + +- If you disable or do not configure this policy setting, the Start screen is shown and apps are registered in the background. + + + + + + +ADMX Info: +- GP Friendly name: *Suspend user sign-in to complete app registration* +- GP name: *TS_RDSAppX_WaitForRegistration* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_RemoteControl_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy determines whether the RPC protocol messagese used by VSS for SMB2 File Shares feature is enabled. VSS for SMB2 File Shares feature enables VSS aware backup applications to perform application consistent backup and restore of VSS aware applications storing data on SMB2 File Shares. By default, the RPC protocol message between File Server VSS provider and File Server VSS Agent is signed but not encrypted. + +To make changes to this setting effective, you must restart Volume Shadow Copy (VSS) Service. + + + + + + +ADMX Info: +- GP Friendly name: *Allow or Disallow use of encryption to protect the RPC protocol messages between File Share Shadow Copy Provider running on application server and File Share Shadow Copy Agent running on the file servers* +- GP name: *TS_RemoteControl_1* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_RemoteControl_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy determines whether the RPC protocol messagese used by VSS for SMB2 File Shares feature is enabled. VSS for SMB2 File Shares feature enables VSS aware backup applications to perform application consistent backup and restore of VSS aware applications storing data on SMB2 File Shares. By default, the RPC protocol message between File Server VSS provider and File Server VSS Agent is signed but not encrypted. + +To make changes to this setting effective, you must restart Volume Shadow Copy (VSS) Service. + + + + + + +ADMX Info: +- GP Friendly name: *Allow or Disallow use of encryption to protect the RPC protocol messages between File Share Shadow Copy Provider running on application server and File Share Shadow Copy Agent running on the file servers* +- GP name: *TS_RemoteControl_2* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_RemoteDesktopVirtualGraphics** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy setting allows you to specify the visual experience that remote users will have in Remote Desktop Connection (RDC) connections that use RemoteFX. + +You can use this policy to balance the network bandwidth usage with the type of graphics experience that is delivered. + +Depending on the requirements of your users, you can reduce network bandwidth usage by reducing the screen capture rate. You can also reduce network bandwidth usage by reducing the image quality (increasing the amount of image compression that is performed). If you have a higher than average bandwidth network, you can maximize the utilization of bandwidth by selecting the highest setting for screen capture rate and the highest setting for image quality. + +By default, Remote Desktop Connection sessions that use RemoteFX are optimized for a balanced experience over LAN conditions. If you disable or do not configure this policy setting, Remote Desktop Connection sessions that use RemoteFX will be the same as if the medium screen capture rate and the medium image compression settings were selected (the default behavior). + + + + + + +ADMX Info: +- GP Friendly name: *Optimize visual experience when using RemoteFX* +- GP name: *TS_RemoteDesktopVirtualGraphics* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_SD_ClustName** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy setting allows you to specify the name of a farm to join in RD Connection Broker. + +RD Connection Broker uses the farm name to determine which RD Session Host servers are in the same RD Session Host server farm. Therefore, you must use the same farm name for all RD Session Host servers in the same load-balanced farm. The farm name does not have to correspond to a name in Active Directory Domain Services. + +If you specify a new farm name, a new farm is created in RD Connection Broker. If you specify an existing farm name, the server joins that farm in RD Connection Broker. + +- If you enable this policy setting, you must specify the name of a farm in RD Connection Broker. +- If you disable or do not configure this policy setting, the farm name is not specified at the Group Policy level. + +- This policy setting is not effective unless both the Join RD Connection Broker and the Configure RD Connection Broker server name policy settings are enabled and configured by using Group Policy. +- For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. + + + + + +ADMX Info: +- GP Friendly name: *Configure RD Connection Broker farm name* +- GP name: *TS_SD_ClustName* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_SD_EXPOSE_ADDRESS** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy setting allows you to specify the redirection method to use when a client device reconnects to an existing Remote Desktop Services session in a load-balanced RD Session Host server farm. + +This setting applies to an RD Session Host server that is configured to use RD Connection Broker and not to the RD Connection Broker server. + +- If you enable this policy setting, a Remote Desktop Services client queries the RD Connection Broker server and is redirected to their existing session by using the IP address of the RD Session Host server where their session exists. To use this redirection method, client computers must be able to connect directly by IP address to RD Session Host servers in the farm. + +- If you disable this policy setting, the IP address of the RD Session Host server is not sent to the client. Instead, the IP address is embedded in a token. + +When a client reconnects to the load balancer, the routing token is used to redirect the client to their existing session on the correct RD Session Host server in the farm. Only disable this setting when your network load-balancing solution supports the use of RD Connection Broker routing tokens and you do not want clients to directly connect by IP address to RD Session Host servers in the load-balanced farm. + +If you do not configure this policy setting, the Use IP address redirection policy setting is not enforced at the group Group policy Policy level and the default will be used. This setting is enabled by default. + +For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. + + + + + + +ADMX Info: +- GP Friendly name: *Use IP Address Redirection* +- GP name: *TS_SD_EXPOSE_ADDRESS* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_SD_Loc** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy setting allows you to specify the RD Connection Broker server that the RD Session Host server uses to track and redirect user sessions for a load-balanced RD Session Host server farm. The specified server must be running the Remote Desktop Connection Broker service. + +All RD Session Host servers in a load-balanced farm should use the same RD Connection Broker server. + +- If you enable this policy setting, you must specify the RD Connection Broker server by using its fully qualified domain name (FQDN). In Windows Server 2012, for a high availability setup with multiple RD Connection Broker servers, you must provide a semi-colon separated list of the FQDNs of all the RD Connection Broker servers. + +- If you disable or do not configure this policy setting, the policy setting is not specified at the Group Policy level. + +For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. +This policy setting is not effective unless the Join RD Connection Broker policy setting is enabled. + +To be an active member of an RD Session Host server farm, the computer account for each RD Session Host server in the farm must be a member of one of the following local groups on the RD Connection Broker server: Session Directory Computers, Session Broker Computers, or RDS Endpoint Servers. + + + + + +ADMX Info: +- GP Friendly name: *Configure RD Connection Broker server name* +- GP name: *TS_SD_Loc* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_SECURITY_LAYER_POLICY** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy setting specifies whether to require the use of a specific security layer to secure communications between clients and RD Session Host servers during Remote Desktop Protocol (RDP) connections. + +- If you enable this policy setting, all communications between clients and RD Session Host servers during remote connections must use the security method specified in this setting. + +The following security methods are available: + +- * Negotiate: The Negotiate method enforces the most secure method that is supported by the client. If Transport Layer Security (TLS) version 1.0 is supported, it is used to authenticate the RD Session Host server. If TLS is not supported, native Remote Desktop Protocol (RDP) encryption is used to secure communications, but the RD Session Host server is not authenticated. Native RDP encryption (as opposed to SSL encryption) is not recommended. + +- * RDP: The RDP method uses native RDP encryption to secure communications between the client and RD Session Host server. If you select this setting, the RD Session Host server is not authenticated. Native RDP encryption (as opposed to SSL encryption) is not recommended. + +- * SSL (TLS 1.0): The SSL method requires the use of TLS 1.0 to authenticate the RD Session Host server. If TLS is not supported, the connection fails. This is the recommended setting for this policy. + +- If you disable or do not configure this policy setting, the security method to be used for remote connections to RD Session Host servers is not specified at the Group Policy level. + + + + + +ADMX Info: +- GP Friendly name: *Require use of specific security layer for remote (RDP) connections* +- GP name: *TS_SECURITY_LAYER_POLICY* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_SELECT_NETWORK_DETECT** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy setting allows you to specify how the Remote Desktop Protocol will try to detect the network quality (bandwidth and latency). +You can choose to disable Connect Time Detect, Continuous Network Detect, or both Connect Time Detect and Continuous Network Detect. +- If you disable Connect Time Detect, Remote Desktop Protocol will not determine the network quality at the connect time, and it will assume that all traffic to this server originates from a low-speed connection. +- If you disable Continuous Network Detect, Remote Desktop Protocol will not try to adapt the remote user experience to varying network quality. +- If you disable Connect Time Detect and Continuous Network Detect, Remote Desktop Protocol will not try to determine the network quality at the connect time; instead it will assume that all traffic to this server originates from a low-speed connection, and it will not try to adapt the user experience to varying network quality. +- If you disable or do not configure this policy setting, Remote Desktop Protocol will spend up to a few seconds trying to determine the network quality prior to the connection, and it will continuously try to adapt the user experience to varying network quality. + + + + + +ADMX Info: +- GP Friendly name: *Select network detection on the server* +- GP name: *TS_SELECT_NETWORK_DETECT* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_SELECT_TRANSPORT** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy setting allows you to specify which protocols can be used for Remote Desktop Protocol (RDP) access to this server. + +- If you enable this policy setting, you must specify if you would like RDP to use UDP. You can select one of the following options: +"Use both UDP and TCP", "Use only TCP" or "Use either UDP or TCP (default)" If you select "Use either UDP or TCP" and the UDP connection is successful, most of the RDP traffic will use UDP. If the UDP connection is not successful or if you select "Use only TCP," all of the RDP traffic will use TCP. + +- If you disable or do not configure this policy setting, RDP will choose the optimal protocols for delivering the best user experience. + + + + +ADMX Info: +- GP Friendly name: *Select RDP transport protocols* +- GP name: *TS_SELECT_TRANSPORT* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy setting allows you to enable RemoteApp programs to use advanced graphics, including support for transparency, live thumbnails, and seamless application moves. + +This policy setting applies only to RemoteApp programs and does not apply to remote desktop sessions. + +- If you enable or do not configure this policy setting, RemoteApp programs published from this RD Session Host server will use these advanced graphics. + +- If you disable this policy setting, RemoteApp programs published from this RD Session Host server will not use these advanced graphics. + +You may want to choose this option if you discover that applications published as RemoteApp programs do not support these advanced graphics. + + + + +ADMX Info: +- GP Friendly name: *Use advanced RemoteFX graphics for RemoteApp* +- GP name: *TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_SERVER_AUTH** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy setting allows you to specify whether the client will establish a connection to the RD Session Host server when the client cannot authenticate the RD Session Host server. + +- If you enable this policy setting, you must specify one of the following settings: + +Always connect, even if authentication fails: The client connects to the RD Session Host server even if the client cannot authenticate the RD Session Host server. + +Warn me if authentication fails: The client attempts to authenticate the RD Session Host server. If the RD Session Host server can be authenticated, the client establishes a connection to the RD Session Host server. If the RD Session Host server cannot be authenticated, the user is prompted to choose whether to connect to the RD Session Host server without authenticating the RD Session Host server. + +Do not connect if authentication fails: The client establishes a connection to the RD Session Host server only if the RD Session Host server can be authenticated. + +- If you disable or do not configure this policy setting, the authentication setting that is specified in Remote Desktop Connection or in the .rdp file determines whether the client establishes a connection to the RD Session Host server when the client cannot authenticate the RD Session Host server. + + + + +ADMX Info: +- GP Friendly name: *Configure server authentication for client* +- GP name: *TS_SERVER_AUTH* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_SERVER_AVC_HW_ENCODE_PREFERRED** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy setting lets you enable H.264/AVC hardware encoding support for Remote Desktop Connections. + +- When you enable hardware encoding, if an error occurs, we will attempt to use software encoding. + +- If you disable or do not configure this policy, we will always use software encoding. + + + + +ADMX Info: +- GP Friendly name: *Configure H.264/AVC hardware encoding for Remote Desktop Connections* +- GP name: *TS_SERVER_AVC_HW_ENCODE_PREFERRED* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_SERVER_AVC444_MODE_PREFERRED** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy setting prioritizes the H.264/AVC 444 graphics mode for non-RemoteFX vGPU scenarios. + +When you use this setting on the RDP server, the server will use H.264/AVC 444 as the codec in an RDP 10 connection where both the client and server can use H.264/AVC 444. + + + + +ADMX Info: +- GP Friendly name: *Prioritize H.264/AVC 444 graphics mode for Remote Desktop Connections* +- GP name: *TS_SERVER_AVC444_MODE_PREFERRED* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_SERVER_COMPRESSOR** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy setting allows you to specify which Remote Desktop Protocol (RDP) compression algorithm to use. By default, servers use an RDP compression algorithm that is based on the server's hardware configuration. + +If you enable this policy setting, you can specify which RDP compression algorithm to use. + +If you select the algorithm that is optimized to use less memory, this option is less memory-intensive, but uses more network bandwidth. + +If you select the algorithm that is optimized to use less network bandwidth, this option uses less network bandwidth, but is more memory-intensive. + +Additionally, a third option is available that balances memory usage and network bandwidth. In Windows 8 only the compression algorithm that balances memory usage and bandwidth is used. You can also choose not to use an RDP compression algorithm. Choosing not to use an RDP compression algorithm will use more network bandwidth and is only recommended if you are using a hardware device that is designed to optimize network traffic. Even if you choose not to use an RDP compression algorithm, some graphics data will still be compressed. If you disable or do not configure this policy setting, the default RDP compression algorithm will be used. + + + + +ADMX Info: +- GP Friendly name: *Configure compression for RemoteFX data* +- GP name: *TS_SERVER_COMPRESSOR* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_SERVER_IMAGE_QUALITY** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy setting allows you to specify the visual quality for remote users when connecting to this computer by using Remote Desktop Connection. You can use this policy setting to balance the network bandwidth usage with the visual quality that is delivered. + +- If you enable this policy setting and set quality to Low, RemoteFX Adaptive Graphics uses an encoding mechanism that results in low quality images. This mode consumes the lowest amount of network bandwidth of the quality modes. + +- If you enable this policy setting and set quality to Medium, RemoteFX Adaptive Graphics uses an encoding mechanism that results in medium quality images. This mode provides better graphics quality than low quality and uses less bandwidth than high quality. + +- If you enable this policy setting and set quality to High, RemoteFX Adaptive Graphics uses an encoding mechanism that results in high quality images and consumes moderate network bandwidth. + +- If you enable this policy setting and set quality to Lossless, RemoteFX Adaptive Graphics uses lossless encoding. In this mode, the color integrity of the graphics data is not impacted. However, this setting results in a significant increase in network bandwidth consumption. We recommend that you set this for very specific cases only. + +- If you disable or do not configure this policy setting, RemoteFX Adaptive Graphics uses an encoding mechanism that results in medium quality images. + + + + +ADMX Info: +- GP Friendly name: *Configure image quality for RemoteFX Adaptive Graphics* +- GP name: *TS_SERVER_IMAGE_QUALITY* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ From e5d84d5a6d6238a0267b51c21e80d05117036712 Mon Sep 17 00:00:00 2001 From: Makazeu Date: Fri, 19 Nov 2021 21:32:37 +0800 Subject: [PATCH 0091/1077] Update index.md Fixes a typo --- windows/whats-new/ltsc/index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/ltsc/index.md b/windows/whats-new/ltsc/index.md index 28bc3db429..0d7830f328 100644 --- a/windows/whats-new/ltsc/index.md +++ b/windows/whats-new/ltsc/index.md @@ -36,7 +36,7 @@ The following table summarizes equivalent feature update versions of Windows 10 | Windows 10 Enterprise LTSC 2015 | Windows 10, Version 1507 | 7/29/2015 | | Windows 10 Enterprise LTSC 2016 | Windows 10, Version 1607 | 8/2/2016 | | Windows 10 Enterprise LTSC 2019 | Windows 10, Version 1809 | 11/13/2018 | -| Windows 10 Enterprise LTSC 2019 | Windows 10, Version 21H2 | 11/16/2021 | +| Windows 10 Enterprise LTSC 2021 | Windows 10, Version 21H2 | 11/16/2021 | > [!NOTE] > The Long-Term Servicing Channel was previously called the Long-Term Servicing Branch (LTSB). All references to LTSB are changed in this article to LTSC for consistency, even though the name of previous versions might still be displayed as LTSB. @@ -51,4 +51,4 @@ For detailed information about Windows 10 servicing, see [Overview of Windows as ## See Also [What's New in Windows 10](../index.yml): See what’s new in other versions of Windows 10.
-[Windows 10 - Release information](/windows/release-health/release-information): Windows 10 current versions by servicing option. \ No newline at end of file +[Windows 10 - Release information](/windows/release-health/release-information): Windows 10 current versions by servicing option. From 1cfda485a318989004cfe1df843eb6d1537d77eb Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Fri, 19 Nov 2021 19:24:07 +0530 Subject: [PATCH 0092/1077] Update policy-csp-admx-terminalserver.md --- .../mdm/policy-csp-admx-terminalserver.md | 182 +++++++++++++++--- 1 file changed, 158 insertions(+), 24 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index 9febc8bf46..b42aac7547 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -173,6 +173,7 @@ manager: dansimp
ADMX_TerminalServer/TS_SERVER_IMAGE_QUALITY +
ADMX_TerminalServer/TS_GATEWAY_POLICY_SERVER
@@ -2661,7 +2662,7 @@ ADMX Info:
-**ADMX_TerminalServer/TS_GATEWAY_POLICY_ENABLE** +**ADMX_TerminalServer/TS_RemoteDesktopVirtualGraphics** @@ -2705,44 +2706,28 @@ ADMX Info: > [!div class = "checklist"] > * Device -> * User
-This policy setting allows you to specify the visual experience that remote users will have in Remote Desktop Connection (RDC) connections that use RemoteFX. +This policy setting allows you to specify the visual experience that remote users will have in Remote Desktop Connection (RDC) connections that use RemoteFX. You can use this policy to balance the network bandwidth usage with the type of graphics experience that is delivered. Depending on the requirements of your users, you can reduce network bandwidth usage by reducing the screen capture rate. -You can use this policy to balance the network bandwidth usage with the type of graphics experience that is delivered. +You can also reduce network bandwidth usage by reducing the image quality (increasing the amount of image compression that is performed). +If you have a higher than average bandwidth network, you can maximize the utilization of bandwidth by selecting the highest setting for screen capture rate and the highest setting for image quality. + +By default, Remote Desktop Connection sessions that use RemoteFX are optimized for a balanced experience over LAN conditions. -Depending on the requirements of your users, you can reduce network bandwidth usage by reducing the screen capture rate. You can also reduce network bandwidth usage by reducing the image quality (increasing the amount of image compression that is performed). If you have a higher than average bandwidth network, you can maximize the utilization of bandwidth by selecting the highest setting for screen capture rate and the highest setting for image quality. - -By default, Remote Desktop Connection sessions that use RemoteFX are optimized for a balanced experience over LAN conditions. If you disable or do not configure this policy setting, Remote Desktop Connection sessions that use RemoteFX will be the same as if the medium screen capture rate and the medium image compression settings were selected (the default behavior). - -If you enable this policy setting, when Remote Desktop Connection cannot connect directly to a remote computer (an RD Session Host server or a computer with Remote Desktop enabled), the clients will attempt to connect to the remote computer through an RD Gateway server. - -In this case, the clients will attempt to connect to the RD Gateway server that is specified in the "Set RD Gateway server address" policy setting. You can enforce this policy setting or you can allow users to overwrite this setting. - -By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these RD Gateway server settings" option on the client. Note: To enforce this policy setting, you must also specify the address of the RD Gateway server by using the "Set RD Gateway server address" policy setting, or client connection attempts to any remote computer will fail, if the client cannot connect directly to the remote computer. - -To enhance security, it is also highly recommended that you specify the authentication method by using the "Set RD Gateway authentication method" policy setting. If you do not specify an authentication method by using this policy setting, either the NTLM protocol that is enabled on the client or a smart card can be used. To allow users to overwrite this policy setting, select the "Allow users to change this setting" check box. - -When you do this, users on the client can choose not to connect through the RD Gateway server by selecting the "Do not use an RD Gateway server" option. Users can specify a connection method by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify a connection method, the connection method that you specify in this policy setting is used by default. - -If you disable or do not configure this policy setting, clients will not use the RD Gateway server address that is specified in the "Set RD Gateway server address" policy setting. If an RD Gateway server is specified by the user, a client connection attempt will be made through that RD Gateway server. +If you disable or do not configure this policy setting, Remote Desktop Connection sessions that use RemoteFX will be the same as if the medium screen capture rate and the medium image compression settings were selected (the default behavior). - ADMX Info: - GP Friendly name: *Optimize visual experience when using RemoteFX* - GP name: *TS_RemoteDesktopVirtualGraphics* -- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* -- GP Friendly name: *Enable connection through RD Gateway* -- GP name: *TS_GATEWAY_POLICY_ENABLE* -- GP path: *Windows Components\Remote Desktop Services\RD Gateway* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\RemoteFX for Windows Server 2008 R2* - GP ADMX file name: *TerminalServer.admx* @@ -2750,6 +2735,155 @@ ADMX Info:
+ +**ADMX_TerminalServer/TS_SD_ClustName** + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify the name of a farm to join in RD Connection Broker. RD Connection Broker uses the farm name to determine which RD Session Host servers are in the same RD Session Host server farm. + +Therefore, you must use the same farm name for all RD Session Host servers in the same load-balanced farm. The farm name does not have to correspond to a name in Active Directory Domain Services. If you specify a new farm name, a new farm is created in RD Connection Broker. If you specify an existing farm name, the server joins that farm in RD Connection Broker. + +- If you enable this policy setting, you must specify the name of a farm in RD Connection Broker. + +- If you disable or do not configure this policy setting, the farm name is not specified at the Group Policy level. + +>[!NOTES] +> 1. This policy setting is not effective unless both the Join RD Connection Broker and the Configure RD Connection Broker server name policy settings are enabled and configured by using Group Policy. +> 2. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. + + + + +ADMX Info: +- GP Friendly name: *Configure RD Connection Broker farm name* +- GP name: *TS_SD_ClustName* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_SD_EXPOSE_ADDRESS** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify the redirection method to use when a client device reconnects to an existing Remote Desktop Services session in a load-balanced RD Session Host server farm. This setting applies to an RD Session Host server that is configured to use RD Connection Broker and not to the RD Connection Broker server. + +- If you enable this policy setting, a Remote Desktop Services client queries the RD Connection Broker server and is redirected to their existing session by using the IP address of the RD Session Host server where their session exists. To use this redirection method, client computers must be able to connect directly by IP address to RD Session Host servers in the farm. + +- If you disable this policy setting, the IP address of the RD Session Host server is not sent to the client. Instead, the IP address is embedded in a token. When a client reconnects to the load balancer, the routing token is used to redirect the client to their existing session on the correct RD Session Host server in the farm. Only disable this setting when your network load-balancing solution supports the use of RD Connection Broker routing tokens and you do not want clients to directly connect by IP address to RD Session Host servers in the load-balanced farm. + +If you do not configure this policy setting, the Use IP address redirection policy setting is not enforced at the group Group policy Policy level and the default will be used. This setting is enabled by default. + +>[!NOTES] +> For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. + + + + +ADMX Info: +- GP Friendly name: *Use IP Address Redirection* +- GP name: *TS_SD_EXPOSE_ADDRESS* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ **ADMX_TerminalServer/TS_GATEWAY_POLICY_AUTH_METHOD** From 30c000b7290053554f8ef52da2685a88edc90b18 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Mon, 22 Nov 2021 06:18:39 +0530 Subject: [PATCH 0093/1077] Update policy-csp-admx-terminalserver.md --- .../mdm/policy-csp-admx-terminalserver.md | 2755 +++++++++++++++-- 1 file changed, 2490 insertions(+), 265 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index b42aac7547..bb3ba3a713 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -124,6 +124,48 @@ manager: dansimp ADMX_TerminalServer/TS_GATEWAY_POLICY_AUTH_METHOD
+ ADMX_TerminalServer/TS_GATEWAY_POLICY_SERVER +
+
+ ADMX_TerminalServer/TS_JOIN_SESSION_DIRECTORY +
+
+ ADMX_TerminalServer/TS_KEEP_ALIVE +
+
+ ADMX_TerminalServer/TS_LICENSE_SECGROUP +
+
+ ADMX_TerminalServer/TS_LICENSE_SERVERS +
+
+ ADMX_TerminalServer/TS_LICENSE_TOOLTIP +
+
+ ADMX_TerminalServer/TS_LICENSING_MODE +
+
+ ADMX_TerminalServer/TS_MAX_CON_POLICY +
+
+ ADMX_TerminalServer/TS_MAXDISPLAYRES +
+
+ ADMX_TerminalServer/TS_MAXMONITOR +
+
+ ADMX_TerminalServer/TS_NoDisconnectMenu +
+
+ ADMX_TerminalServer/TS_NoSecurityMenu +
+
+ ADMX_TerminalServer/TS_PreventLicenseUpgrade +
+
+ ADMX_TerminalServer/TS_PROMT_CREDS_CLIENT_COMP +
+
ADMX_TerminalServer/TS_RADC_DefaultConnection
@@ -174,47 +216,6 @@ manager: dansimp
ADMX_TerminalServer/TS_SERVER_IMAGE_QUALITY
- ADMX_TerminalServer/TS_GATEWAY_POLICY_SERVER - -
- ADMX_TerminalServer/TS_JOIN_SESSION_DIRECTORY -
-
- ADMX_TerminalServer/TS_KEEP_ALIVE -
-
- ADMX_TerminalServer/TS_LICENSE_SECGROUP -
-
- ADMX_TerminalServer/TS_LICENSE_SERVERS -
-
- ADMX_TerminalServer/TS_LICENSE_TOOLTIP -
-
- ADMX_TerminalServer/TS_LICENSING_MODE -
-
- ADMX_TerminalServer/TS_MAX_CON_POLICY -
-
- ADMX_TerminalServer/TS_MAXDISPLAYRES -
-
- ADMX_TerminalServer/TS_MAXMONITOR -
-
- ADMX_TerminalServer/TS_NoDisconnectMenu -
-
- ADMX_TerminalServer/TS_NoSecurityMenu -
-
- ADMX_TerminalServer/TS_PreventLicenseUpgrade -
-
- ADMX_TerminalServer/TS_PROMT_CREDS_CLIENT_COMP -
@@ -2658,230 +2659,6 @@ ADMX Info: - -
- - -**ADMX_TerminalServer/TS_RemoteDesktopVirtualGraphics** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - - -This policy setting allows you to specify the visual experience that remote users will have in Remote Desktop Connection (RDC) connections that use RemoteFX. You can use this policy to balance the network bandwidth usage with the type of graphics experience that is delivered. Depending on the requirements of your users, you can reduce network bandwidth usage by reducing the screen capture rate. - -You can also reduce network bandwidth usage by reducing the image quality (increasing the amount of image compression that is performed). -If you have a higher than average bandwidth network, you can maximize the utilization of bandwidth by selecting the highest setting for screen capture rate and the highest setting for image quality. - -By default, Remote Desktop Connection sessions that use RemoteFX are optimized for a balanced experience over LAN conditions. - -If you disable or do not configure this policy setting, Remote Desktop Connection sessions that use RemoteFX will be the same as if the medium screen capture rate and the medium image compression settings were selected (the default behavior). - - - - -ADMX Info: -- GP Friendly name: *Optimize visual experience when using RemoteFX* -- GP name: *TS_RemoteDesktopVirtualGraphics* -- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\RemoteFX for Windows Server 2008 R2* -- GP ADMX file name: *TerminalServer.admx* - - - - -
- - -**ADMX_TerminalServer/TS_SD_ClustName** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -This policy setting allows you to specify the name of a farm to join in RD Connection Broker. RD Connection Broker uses the farm name to determine which RD Session Host servers are in the same RD Session Host server farm. - -Therefore, you must use the same farm name for all RD Session Host servers in the same load-balanced farm. The farm name does not have to correspond to a name in Active Directory Domain Services. If you specify a new farm name, a new farm is created in RD Connection Broker. If you specify an existing farm name, the server joins that farm in RD Connection Broker. - -- If you enable this policy setting, you must specify the name of a farm in RD Connection Broker. - -- If you disable or do not configure this policy setting, the farm name is not specified at the Group Policy level. - ->[!NOTES] -> 1. This policy setting is not effective unless both the Join RD Connection Broker and the Configure RD Connection Broker server name policy settings are enabled and configured by using Group Policy. -> 2. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. - - - - -ADMX Info: -- GP Friendly name: *Configure RD Connection Broker farm name* -- GP name: *TS_SD_ClustName* -- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker* -- GP ADMX file name: *TerminalServer.admx* - - - -
- - -**ADMX_TerminalServer/TS_SD_EXPOSE_ADDRESS** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -This policy setting allows you to specify the redirection method to use when a client device reconnects to an existing Remote Desktop Services session in a load-balanced RD Session Host server farm. This setting applies to an RD Session Host server that is configured to use RD Connection Broker and not to the RD Connection Broker server. - -- If you enable this policy setting, a Remote Desktop Services client queries the RD Connection Broker server and is redirected to their existing session by using the IP address of the RD Session Host server where their session exists. To use this redirection method, client computers must be able to connect directly by IP address to RD Session Host servers in the farm. - -- If you disable this policy setting, the IP address of the RD Session Host server is not sent to the client. Instead, the IP address is embedded in a token. When a client reconnects to the load balancer, the routing token is used to redirect the client to their existing session on the correct RD Session Host server in the farm. Only disable this setting when your network load-balancing solution supports the use of RD Connection Broker routing tokens and you do not want clients to directly connect by IP address to RD Session Host servers in the load-balanced farm. - -If you do not configure this policy setting, the Use IP address redirection policy setting is not enforced at the group Group policy Policy level and the default will be used. This setting is enabled by default. - ->[!NOTES] -> For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. - - - - -ADMX Info: -- GP Friendly name: *Use IP Address Redirection* -- GP name: *TS_SD_EXPOSE_ADDRESS* -- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker* -- GP ADMX file name: *TerminalServer.admx* - - -
@@ -4003,6 +3780,2454 @@ ADMX Info: +
+ + +**ADMX_TerminalServer/TS_RemoteDesktopVirtualGraphics** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy setting allows you to specify the visual experience that remote users will have in Remote Desktop Connection (RDC) connections that use RemoteFX. You can use this policy to balance the network bandwidth usage with the type of graphics experience that is delivered. Depending on the requirements of your users, you can reduce network bandwidth usage by reducing the screen capture rate. + +You can also reduce network bandwidth usage by reducing the image quality (increasing the amount of image compression that is performed). +If you have a higher than average bandwidth network, you can maximize the utilization of bandwidth by selecting the highest setting for screen capture rate and the highest setting for image quality. + +By default, Remote Desktop Connection sessions that use RemoteFX are optimized for a balanced experience over LAN conditions. + +If you disable or do not configure this policy setting, Remote Desktop Connection sessions that use RemoteFX will be the same as if the medium screen capture rate and the medium image compression settings were selected (the default behavior). + + + + +ADMX Info: +- GP Friendly name: *Optimize visual experience when using RemoteFX* +- GP name: *TS_RemoteDesktopVirtualGraphics* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\RemoteFX for Windows Server 2008 R2* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + +**ADMX_TerminalServer/TS_SD_ClustName** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify the name of a farm to join in RD Connection Broker. RD Connection Broker uses the farm name to determine which RD Session Host servers are in the same RD Session Host server farm. + +Therefore, you must use the same farm name for all RD Session Host servers in the same load-balanced farm. The farm name does not have to correspond to a name in Active Directory Domain Services. If you specify a new farm name, a new farm is created in RD Connection Broker. If you specify an existing farm name, the server joins that farm in RD Connection Broker. + +- If you enable this policy setting, you must specify the name of a farm in RD Connection Broker. + +- If you disable or do not configure this policy setting, the farm name is not specified at the Group Policy level. + +>[!NOTES] +> 1. This policy setting is not effective unless both the Join RD Connection Broker and the Configure RD Connection Broker server name policy settings are enabled and configured by using Group Policy. +> 2. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. + + + + +ADMX Info: +- GP Friendly name: *Configure RD Connection Broker farm name* +- GP name: *TS_SD_ClustName* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_SD_EXPOSE_ADDRESS** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify the redirection method to use when a client device reconnects to an existing Remote Desktop Services session in a load-balanced RD Session Host server farm. This setting applies to an RD Session Host server that is configured to use RD Connection Broker and not to the RD Connection Broker server. + +- If you enable this policy setting, a Remote Desktop Services client queries the RD Connection Broker server and is redirected to their existing session by using the IP address of the RD Session Host server where their session exists. To use this redirection method, client computers must be able to connect directly by IP address to RD Session Host servers in the farm. + +- If you disable this policy setting, the IP address of the RD Session Host server is not sent to the client. Instead, the IP address is embedded in a token. When a client reconnects to the load balancer, the routing token is used to redirect the client to their existing session on the correct RD Session Host server in the farm. Only disable this setting when your network load-balancing solution supports the use of RD Connection Broker routing tokens and you do not want clients to directly connect by IP address to RD Session Host servers in the load-balanced farm. + +If you do not configure this policy setting, the Use IP address redirection policy setting is not enforced at the group Group policy Policy level and the default will be used. This setting is enabled by default. + +>[!NOTES] +> For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. + + + + +ADMX Info: +- GP Friendly name: *Use IP Address Redirection* +- GP name: *TS_SD_EXPOSE_ADDRESS* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_SD_Loc** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify the RD Connection Broker server that the RD Session Host server uses to track and redirect user sessions for a load-balanced RD Session Host server farm. +The specified server must be running the Remote Desktop Connection Broker service. All RD Session Host servers in a load-balanced farm should use the same RD Connection Broker server. + +- If you enable this policy setting, you must specify the RD Connection Broker server by using its fully qualified domain name (FQDN). In Windows Server 2012, for a high availability setup with multiple RD Connection Broker servers, you must provide a semi-colon separated list of the FQDNs of all the RD Connection Broker servers. + +- If you disable or do not configure this policy setting, the policy setting is not specified at the Group Policy level. + + +>[!NOTES] +> 1. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. +> 2. This policy setting is not effective unless the Join RD Connection Broker policy setting is enabled. +> 3. To be an active member of an RD Session Host server farm, the computer account for each RD Session Host server in the farm must be a member of one of the following local groups on the RD Connection Broker server: Session Directory Computers, Session Broker Computers, or RDS Endpoint Servers. + + + + +ADMX Info: +- GP Friendly name: *Configure RD Connection Broker server name* +- GP name: *TS_SD_Loc* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + +**ADMX_TerminalServer/TS_SECURITY_LAYER_POLICY** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting specifies whether to require the use of a specific security layer to secure communications between clients and RD Session Host servers during Remote Desktop Protocol (RDP) connections. + +- If you enable this policy setting, all communications between clients and RD Session Host servers during remote connections must use the security method specified in this setting. + +The following security methods are available: + +1. * Negotiate: The Negotiate method enforces the most secure method that is supported by the client. If Transport Layer Security (TLS) version 1.0 is supported, it is used to authenticate the RD Session Host server. If TLS is not supported, native Remote Desktop Protocol (RDP) encryption is used to secure communications, but the RD Session Host server is not authenticated. Native RDP encryption (as opposed to SSL encryption) is not recommended. +2. * RDP: The RDP method uses native RDP encryption to secure communications between the client and RD Session Host server. If you select this setting, the RD Session Host server is not authenticated. Native RDP encryption (as opposed to SSL encryption) is not recommended. +3. * SSL (TLS 1.0): The SSL method requires the use of TLS 1.0 to authenticate the RD Session Host server. If TLS is not supported, the connection fails. This is the recommended setting for this policy. + +- If you disable or do not configure this policy setting, the security method to be used for remote connections to RD Session Host servers is not specified at the Group Policy level. + + + + +ADMX Info: +- GP Friendly name: *Require use of specific security layer for remote (RDP) connections* +- GP name: *TS_SECURITY_LAYER_POLICY* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + +**ADMX_TerminalServer/TS_SELECT_NETWORK_DETECT** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify how the Remote Desktop Protocol will try to detect the network quality (bandwidth and latency). +You can choose to disable Connect Time Detect, Continuous Network Detect, or both Connect Time Detect and Continuous Network Detect. + +- If you disable Connect Time Detect, Remote Desktop Protocol will not determine the network quality at the connect time, and it will assume that all traffic to this server originates from a low-speed connection. + +- If you disable Continuous Network Detect, Remote Desktop Protocol will not try to adapt the remote user experience to varying network quality. + +- If you disable Connect Time Detect and Continuous Network Detect, Remote Desktop Protocol will not try to determine the network quality at the connect time; instead it will assume that all traffic to this server originates from a low-speed connection, and it will not try to adapt the user experience to varying network quality. + +- If you disable or do not configure this policy setting, Remote Desktop Protocol will spend up to a few seconds trying to determine the network quality prior to the connection, and it will continuously try to adapt the user experience to varying network quality. + + + + +ADMX Info: +- GP Friendly name: *Select network detection on the server* +- GP name: *TS_SELECT_NETWORK_DETECT* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_SELECT_TRANSPORT** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify which protocols can be used for Remote Desktop Protocol (RDP) access to this server. + +- If you enable this policy setting, you must specify if you would like RDP to use UDP. You can select one of the following options: "Use both UDP and TCP", "Use only TCP" or "Use either UDP or TCP (default)" + +If you select "Use either UDP or TCP" and the UDP connection is successful, most of the RDP traffic will use UDP. If the UDP connection is not successful or if you select "Use only TCP," all of the RDP traffic will use TCP. + +- If you disable or do not configure this policy setting, RDP will choose the optimal protocols for delivering the best user experience. + + + + +ADMX Info: +- GP Friendly name: *Select RDP transport protocols* +- GP name: *TS_SELECT_TRANSPORT* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to enable RemoteApp programs to use advanced graphics, including support for transparency, live thumbnails, and seamless application moves. +This policy setting applies only to RemoteApp programs and does not apply to remote desktop sessions. + +- If you enable or do not configure this policy setting, RemoteApp programs published from this RD Session Host server will use these advanced graphics. + +- If you disable this policy setting, RemoteApp programs published from this RD Session Host server will not use these advanced graphics. You may want to choose this option if you discover that applications published as RemoteApp programs do not support these advanced graphics. + + + + +ADMX Info: +- GP Friendly name: *Use advanced RemoteFX graphics for RemoteApp* +- GP name: *TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_SERVER_AUTH** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify whether the client will establish a connection to the RD Session Host server when the client cannot authenticate the RD Session Host server. + +- If you enable this policy setting, you must specify one of the following settings: + + 1. Always connect, even if authentication fails: The client connects to the RD Session Host server even if the client cannot authenticate the RD Session Host server. + + 2. Warn me if authentication fails: The client attempts to authenticate the RD Session Host server. If the RD Session Host server can be authenticated, the client establishes a connection to the RD Session Host server. If the RD Session Host server cannot be authenticated, the user is prompted to choose whether to connect to the RD Session Host server without authenticating the RD Session Host server. + + 3. Do not connect if authentication fails: The client establishes a connection to the RD Session Host server only if the RD Session Host server can be authenticated. + +- If you disable or do not configure this policy setting, the authentication setting that is specified in Remote Desktop Connection or in the .rdp file determines whether the client establishes a connection to the RD Session Host server when the client cannot authenticate the RD Session Host server. + + + + +ADMX Info: +- GP Friendly name: *Configure server authentication for client* +- GP name: *TS_SERVER_AUTH* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Connection Client* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_SERVER_AVC_HW_ENCODE_PREFERRED** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting lets you enable H.264/AVC hardware encoding support for Remote Desktop Connections. + +- When you enable hardware encoding, if an error occurs, we will attempt to use software encoding. + +- If you disable or do not configure this policy, we will always use software encoding. + + + + +ADMX Info: +- GP Friendly name: *Configure H.264/AVC hardware encoding for Remote Desktop Connections* +- GP name: *TS_SERVER_AVC_HW_ENCODE_PREFERRED* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_SERVER_AVC444_MODE_PREFERRED** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting prioritizes the H.264/AVC 444 graphics mode for non-RemoteFX vGPU scenarios. + +When you use this setting on the RDP server, the server will use H.264/AVC 444 as the codec in an RDP 10 connection where both the client and server can use H.264/AVC 444. + + + + +ADMX Info: +- GP Friendly name: *Prioritize H.264/AVC 444 graphics mode for Remote Desktop Connections* +- GP name: *TS_SERVER_AVC444_MODE_PREFERRED* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + +**ADMX_TerminalServer/TS_SERVER_COMPRESSOR** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify which Remote Desktop Protocol (RDP) compression algorithm to use. By default, servers use an RDP compression algorithm that is based on the server's hardware configuration. + +- If you enable this policy setting, you can specify which RDP compression algorithm to use. If you select the algorithm that is optimized to use less memory, this option is less memory-intensive, but uses more network bandwidth. + +If you select the algorithm that is optimized to use less network bandwidth, this option uses less network bandwidth, but is more memory-intensive. Additionally, a third option is available that balances memory usage and network bandwidth. + +In Windows 8 only the compression algorithm that balances memory usage and bandwidth is used. You can also choose not to use an RDP compression algorithm. Choosing not to use an RDP compression algorithm will use more network bandwidth and is only recommended if you are using a hardware device that is designed to optimize network traffic. + +Even if you choose not to use an RDP compression algorithm, some graphics data will still be compressed. + +- If you disable or do not configure this policy setting, the default RDP compression algorithm will be used. + + + + +ADMX Info: +- GP Friendly name: *Configure compression for RemoteFX data* +- GP name: *TS_SERVER_COMPRESSOR* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_SERVER_IMAGE_QUALITY** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + +This policy setting allows you to specify the visual quality for remote users when connecting to this computer by using Remote Desktop Connection. You can use this policy setting to balance the network bandwidth usage with the visual quality that is delivered. + +- If you enable this policy setting and set quality to Low, RemoteFX Adaptive Graphics uses an encoding mechanism that results in low quality images. This mode consumes the lowest amount of network bandwidth of the quality modes. + +- If you enable this policy setting and set quality to Medium, RemoteFX Adaptive Graphics uses an encoding mechanism that results in medium quality images. This mode provides better graphics quality than low quality and uses less bandwidth than high quality. + +- If you enable this policy setting and set quality to High, RemoteFX Adaptive Graphics uses an encoding mechanism that results in high quality images and consumes moderate network bandwidth. + +- If you enable this policy setting and set quality to Lossless, RemoteFX Adaptive Graphics uses lossless encoding. In this mode, the color integrity of the graphics data is not impacted. However, this setting results in a significant increase in network bandwidth consumption. We recommend that you set this for very specific cases only. + +- If you disable or do not configure this policy setting, RemoteFX Adaptive Graphics uses an encoding mechanism that results in medium quality images. + + + + +ADMX Info: +- GP Friendly name: *Configure image quality for RemoteFX Adaptive Graphics* +- GP name: *TS_SERVER_IMAGE_QUALITY* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + +**ADMX_TerminalServer/TS_SERVER_LEGACY_RFX** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + +This policy setting allows you to control the availability of RemoteFX on both a Remote Desktop Virtualization Host (RD Virtualization Host) server and a Remote Desktop Session Host (RD Session Host) server. + +When deployed on an RD Virtualization Host server, RemoteFX delivers a rich user experience by rendering content on the server by using graphics processing units (GPUs). By default, RemoteFX for RD Virtualization Host uses server-side GPUs to deliver a rich user experience over LAN connections and RDP 7.1. When deployed on an RD Session Host server, RemoteFX delivers a rich user experience by using a hardware-accelerated compression scheme. + +- If you enable this policy setting, RemoteFX will be used to deliver a rich user experience over LAN connections and RDP 7.1. + +- If you disable this policy setting, RemoteFX will be disabled. If you do not configure this policy setting, the default behavior will be used. By default, RemoteFX for RD Virtualization Host is enabled and RemoteFX for RD Session Host is disabled. + + + + +ADMX Info: +- GP Friendly name: *Configure RemoteFX* +- GP name: *TS_SERVER_LEGACY_RFX* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\RemoteFX for Windows Server 2008 R2* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_SERVER_PROFILE** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows the administrator to configure the RemoteFX experience for Remote Desktop Session Host or Remote Desktop Virtualization Host servers. By default, the system will choose the best experience based on available nework bandwidth. + +If you enable this policy setting, the RemoteFX experience could be set to one of the following options: +1. Let the system choose the experience for the network condition +2. Optimize for server scalability +3. Optimize for minimum bandwidth usage If you disable or do not configure this policy setting, the RemoteFX experience will change dynamically based on the network condition." + + + + +ADMX Info: +- GP Friendly name: *Configure RemoteFX Adaptive Graphics* +- GP name: *TS_SERVER_PROFILE* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_SERVER_WDDM_GRAPHICS_DRIVER** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting lets you enable WDDM graphics display driver for Remote Desktop Connections. + +- If you enable or do not configure this policy setting, Remote Desktop Connections will use WDDM graphics display driver. + +- If you disable this policy setting, Remote Desktop Connections will NOT use WDDM graphics display driver. In this case, the Remote Desktop Connections will use XDDM graphics display driver. For this change to take effect, you must restart Windows. + + + + +ADMX Info: +- GP Friendly name: *Use WDDM graphics display driver for Remote Desktop Connections* +- GP name: *TS_SERVER_WDDM_GRAPHICS_DRIVER* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_Session_End_On_Limit_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy setting specifies whether to end a Remote Desktop Services session that has timed out instead of disconnecting it. You can use this setting to direct Remote Desktop Services to end a session (that is, the user is logged off and the session is deleted from the server) after time limits for active or idle sessions are reached. By default, Remote Desktop Services disconnects sessions that reach their time limits. Time limits are set locally by the server administrator or by using Group Policy. + +See the policy settings Set time limit for active Remote Desktop Services sessions and Set time limit for active but idle Remote Desktop Services sessions policy settings. + +- If you enable this policy setting, Remote Desktop Services ends any session that reaches its time-out limit. + +- If you disable this policy setting, Remote Desktop Services always disconnects a timed-out session, even if specified otherwise by the server administrator. If you do not configure this policy setting, Remote Desktop Services disconnects a timed-out session, unless specified otherwise in local settings. + +This policy setting only applies to time-out limits that are explicitly set by the administrator. + +This policy setting does not apply to time-out events that occur due to connectivity or network conditions. This setting appears in both Computer Configuration and User Configuration. If both settings are configured, the Computer Configuration setting takes precedence. + + + + +ADMX Info: +- GP Friendly name: *End session when time limits are reached* +- GP name: *TS_Session_End_On_Limit_1* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_Session_End_On_Limit_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy setting specifies whether to end a Remote Desktop Services session that has timed out instead of disconnecting it. You can use this setting to direct Remote Desktop Services to end a session (that is, the user is logged off and the session is deleted from the server) after time limits for active or idle sessions are reached. By default, Remote Desktop Services disconnects sessions that reach their time limits. Time limits are set locally by the server administrator or by using Group Policy. + +See the policy settings Set time limit for active Remote Desktop Services sessions and Set time limit for active but idle Remote Desktop Services sessions policy settings. + +- If you enable this policy setting, Remote Desktop Services ends any session that reaches its time-out limit. + +- If you disable this policy setting, Remote Desktop Services always disconnects a timed-out session, even if specified otherwise by the server administrator. If you do not configure this policy setting, Remote Desktop Services disconnects a timed-out session, unless specified otherwise in local settings. + +This policy setting only applies to time-out limits that are explicitly set by the administrator. + +This policy setting does not apply to time-out events that occur due to connectivity or network conditions. This setting appears in both Computer Configuration and User Configuration. If both settings are configured, the Computer Configuration setting takes precedence. + + + + +ADMX Info: +- GP Friendly name: *End session when time limits are reached* +- GP name: *TS_Session_End_On_Limit_2* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy setting allows you to configure a time limit for disconnected Remote Desktop Services sessions. You can use this policy setting to specify the maximum amount of time that a disconnected session remains active on the server. By default, Remote Desktop Services allows users to disconnect from a Remote Desktop Services session without logging off and ending the session. +When a session is in a disconnected state, running programs are kept active even though the user is no longer actively connected. By default, these disconnected sessions are maintained for an unlimited time on the server. + +- If you enable this policy setting, disconnected sessions are deleted from the server after the specified amount of time. To enforce the default behavior that disconnected sessions are maintained for an unlimited time, select Never. If you have a console session, disconnected session time limits do not apply. + +- If you disable or do not configure this policy setting, this policy setting is not specified at the Group Policy level. Be default, Remote Desktop Services disconnected sessions are maintained for an unlimited amount of time. + +>[!NOTE] +> This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence. + + + + +ADMX Info: +- GP Friendly name: *Set time limit for disconnected sessions* +- GP name: *TS_SESSIONS_Disconnected_Timeout_1* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy setting allows you to configure a time limit for disconnected Remote Desktop Services sessions. You can use this policy setting to specify the maximum amount of time that a disconnected session remains active on the server. By default, Remote Desktop Services allows users to disconnect from a Remote Desktop Services session without logging off and ending the session. +When a session is in a disconnected state, running programs are kept active even though the user is no longer actively connected. By default, these disconnected sessions are maintained for an unlimited time on the server. + +- If you enable this policy setting, disconnected sessions are deleted from the server after the specified amount of time. To enforce the default behavior that disconnected sessions are maintained for an unlimited time, select Never. If you have a console session, disconnected session time limits do not apply. + +- If you disable or do not configure this policy setting, this policy setting is not specified at the Group Policy level. Be default, Remote Desktop Services disconnected sessions are maintained for an unlimited amount of time. + +>[!NOTE] +> This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence. + + + + +ADMX Info: +- GP Friendly name: *Set time limit for disconnected sessions* +- GP name: *TS_SESSIONS_Disconnected_Timeout_2* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy setting allows you to specify the maximum amount of time that an active Remote Desktop Services session can be idle (without user input) before it is automatically disconnected. + +- If you enable this policy setting, you must select the desired time limit in the Idle session limit list. Remote Desktop Services will automatically disconnect active but idle sessions after the specified amount of time. The user receives a warning two minutes before the session disconnects, which allows the user to press a key or move the mouse to keep the session active. If you have a console session, idle session time limits do not apply. + +- If you disable or do not configure this policy setting, the time limit is not specified at the Group Policy level. By default, Remote Desktop Services allows sessions to remain active but idle for an unlimited amount of time. + +If you want Remote Desktop Services to end instead of disconnect a session when the time limit is reached, you can configure the policy setting Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\End session when time limits are reached. + +>[!NOTE] +> This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence. + + + + +ADMX Info: +- GP Friendly name: *Set time limit for active but idle Remote Desktop Services sessions* +- GP name: *TS_SESSIONS_Idle_Limit_1* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy setting allows you to specify the maximum amount of time that an active Remote Desktop Services session can be idle (without user input) before it is automatically disconnected. + +- If you enable this policy setting, you must select the desired time limit in the Idle session limit list. Remote Desktop Services will automatically disconnect active but idle sessions after the specified amount of time. The user receives a warning two minutes before the session disconnects, which allows the user to press a key or move the mouse to keep the session active. If you have a console session, idle session time limits do not apply. + +- If you disable or do not configure this policy setting, the time limit is not specified at the Group Policy level. By default, Remote Desktop Services allows sessions to remain active but idle for an unlimited amount of time. + +If you want Remote Desktop Services to end instead of disconnect a session when the time limit is reached, you can configure the policy setting Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\End session when time limits are reached. + +>[!NOTE] +> This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence. + + + + +ADMX Info: +- GP Friendly name: *Set time limit for active but idle Remote Desktop Services sessions* +- GP name: *TS_SESSIONS_Idle_Limit_2* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_SESSIONS_Limits_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy setting allows you to specify the maximum amount of time that a Remote Desktop Services session can be active before it is automatically disconnected. + +- If you enable this policy setting, you must select the desired time limit in the Active session limit list. Remote Desktop Services will automatically disconnect active sessions after the specified amount of time. The user receives a warning two minutes before the Remote Desktop Services session disconnects, which allows the user to save open files and close programs. If you have a console session, active session time limits do not apply. + +- If you disable or do not configure this policy setting, this policy setting is not specified at the Group Policy level. By default, Remote Desktop Services allows sessions to remain active for an unlimited amount of time. + +If you want Remote Desktop Services to end instead of disconnect a session when the time limit is reached, you can configure the policy setting Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\End session when time limits are reached. + +>[!NOTE] +> This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence. + + + + + +ADMX Info: +- GP Friendly name: *Set time limit for active Remote Desktop Services sessions* +- GP name: *TS_SESSIONS_Limits_1* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_SINGLE_SESSION** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy setting allows you to restrict users to a single Remote Desktop Services session. If you enable this policy setting, users who log on remotely by using Remote Desktop Services will be restricted to a single session (either active or disconnected) on that server. + +If the user leaves the session in a disconnected state, the user automatically reconnects to that session at the next logon. + +If you disable this policy setting, users are allowed to make unlimited simultaneous remote connections by using Remote Desktop Services. If you do not configure this policy setting, this policy setting is not specified at the Group Policy level. + + + + + +ADMX Info: +- GP Friendly name: *Restrict Remote Desktop Services users to a single Remote Desktop Services session* +- GP name: *TS_SINGLE_SESSION* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_SMART_CARD** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to control the redirection of smart card devices in a Remote Desktop Services session. + +- If you enable this policy setting, Remote Desktop Services users cannot use a smart card to log on to a Remote Desktop Services session. + +- If you disable or do not configure this policy setting, smart card device redirection is allowed. By default, Remote Desktop Services automatically redirects smart card devices on connection. + +>[!NOTE] +> The client computer must be running at least Microsoft Windows 2000 Server or at least Microsoft Windows XP Professional and the target server must be joined to a domain. + + + + +ADMX Info: +- GP Friendly name: *Do not allow smart card device redirection* +- GP name: *TS_SMART_CARD* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_START_PROGRAM_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Configures Remote Desktop Services to run a specified program automatically upon connection. You can use this setting to specify a program to run automatically when a user logs on to a remote computer. By default, Remote Desktop Services sessions provide access to the full Windows desktop, unless otherwise specified with this setting, by the server administrator, or by the user in configuring the client connection. Enabling this setting overrides the "Start Program" settings set by the server administrator or user. + +The Start menu and Windows Desktop are not displayed, and when the user exits the program the session is automatically logged off. To use this setting, in Program path and file name, type the fully qualified path and file name of the executable file to be run when the user logs on. If necessary, in Working Directory, type the fully qualified path to the starting directory for the program. + +If you leave Working Directory blank, the program runs with its default working directory. If the specified program path, file name, or working directory is not the name of a valid directory, the RD Session Host server connection fails with an error message. If the status is set to Enabled, Remote Desktop Services sessions automatically run the specified program and use the specified Working Directory (or the program default directory, if Working Directory is not specified) as the working directory for the program. If the status is set to Disabled or Not Configured, Remote Desktop Services sessions start with the full desktop, unless the server administrator or user specify otherwise. (See "Computer Configuration\Administrative Templates\System\Logon\Run these programs at user logon" setting.) + +>[!NOTE] +> This setting appears in both Computer Configuration and User Configuration. If both settings are configured, the Computer Configuration setting overrides. + + + + +ADMX Info: +- GP Friendly name: *Start a program on connection* +- GP name: *TS_START_PROGRAM_1* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_START_PROGRAM_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Configures Remote Desktop Services to run a specified program automatically upon connection. You can use this setting to specify a program to run automatically when a user logs on to a remote computer. By default, Remote Desktop Services sessions provide access to the full Windows desktop, unless otherwise specified with this setting, by the server administrator, or by the user in configuring the client connection. Enabling this setting overrides the "Start Program" settings set by the server administrator or user. + +The Start menu and Windows Desktop are not displayed, and when the user exits the program the session is automatically logged off. To use this setting, in Program path and file name, type the fully qualified path and file name of the executable file to be run when the user logs on. If necessary, in Working Directory, type the fully qualified path to the starting directory for the program. + +If you leave Working Directory blank, the program runs with its default working directory. If the specified program path, file name, or working directory is not the name of a valid directory, the RD Session Host server connection fails with an error message. If the status is set to Enabled, Remote Desktop Services sessions automatically run the specified program and use the specified Working Directory (or the program default directory, if Working Directory is not specified) as the working directory for the program. If the status is set to Disabled or Not Configured, Remote Desktop Services sessions start with the full desktop, unless the server administrator or user specify otherwise. (See "Computer Configuration\Administrative Templates\System\Logon\Run these programs at user logon" setting.) + +>[!NOTE] +> This setting appears in both Computer Configuration and User Configuration. If both settings are configured, the Computer Configuration setting overrides. + + + + +ADMX Info: +- GP Friendly name: *Start a program on connection* +- GP name: *TS_START_PROGRAM_2* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_TEMP_DELETE** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting specifies whether Remote Desktop Services retains a user's per-session temporary folders at logoff. You can use this setting to maintain a user's session-specific temporary folders on a remote computer, even if the user logs off from a session. By default, Remote Desktop Services deletes a user's temporary folders when the user logs off. + +If you enable this policy setting, a user's per-session temporary folders are retained when the user logs off from a session. + +If you disable this policy setting, temporary folders are deleted when a user logs off, even if the server administrator specifies otherwise. If you do not configure this policy setting, Remote Desktop Services deletes the temporary folders from the remote computer at logoff, unless specified otherwise by the server administrator. + +>[!NOTE] +> This setting only takes effect if per-session temporary folders are in use on the server. If you enable the Do not use temporary folders per session policy setting, this policy setting has no effect. + + + + +ADMX Info: +- GP Friendly name: *Do not delete temp folders upon exit* +- GP name: *TS_TEMP_DELETE* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Temporary folders* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_TEMP_PER_SESSION** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to prevent Remote Desktop Services from creating session-specific temporary folders. + +You can use this policy setting to disable the creation of separate temporary folders on a remote computer for each session. By default, Remote Desktop Services creates a separate temporary folder for each active session that a user maintains on a remote computer. These temporary folders are created on the remote computer in a Temp folder under the user's profile folder and are named with the sessionid. + +- If you enable this policy setting, per-session temporary folders are not created. Instead, a user's temporary files for all sessions on the remote computer are stored in a common Temp folder under the user's profile folder on the remote computer. + +- If you disable this policy setting, per-session temporary folders are always created, even if the server administrator specifies otherwise. If you do not configure this policy setting, per-session temporary folders are created unless the server administrator specifies otherwise. + + + + +ADMX Info: +- GP Friendly name: *Do not use temporary folders per session* +- GP name: *TS_TEMP_PER_SESSION* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Temporary folders* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_TIME_ZONE** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify whether the client computer redirects its time zone settings to the Remote Desktop Services session. + +- If you enable this policy setting, clients that are capable of time zone redirection send their time zone information to the server. The server base time is then used to calculate the current session time (current session time = server base time + client time zone). + +- If you disable or do not configure this policy setting, the client computer does not redirect its time zone information and the session time zone is the same as the server time zone. + +>[!NOTE] +> Time zone redirection is possible only when connecting to at least a Microsoft Windows Server 2003 terminal server with a client using RDP 5.1 or later. + + + + +ADMX Info: +- GP Friendly name: *Allow time zone redirection* +- GP name: *TS_TIME_ZONE* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_TSCC_PERMISSIONS_POLICY** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting specifies whether to disable the administrator rights to customize security permissions for the Remote Desktop Session Host server. You can use this setting to prevent administrators from making changes to the user groups allowed to connect remotely to the RD Session Host server. By default, administrators are able to make such changes. + +- If you enable this policy setting the default security descriptors for existing groups on the RD Session Host server cannot be changed. All the security descriptors are read-only. + +- If you disable or do not configure this policy setting, server administrators have full read/write permissions to the user security descriptors by using the Remote Desktop Session WMI Provider. + +>[!NOTE] +> The preferred method of managing user access is by adding a user to the Remote Desktop Users group. + + + + +ADMX Info: +- GP Friendly name: *Do not allow local administrators to customize permissions* +- GP name: *TS_TSCC_PERMISSIONS_POLICY* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_TURNOFF_SINGLEAPP** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting determines whether the desktop is always displayed after a client connects to a remote computer or an initial program can run. It can be used to require that the desktop be displayed after a client connects to a remote computer, even if an initial program is already specified in the default user profile, Remote Desktop Connection, Remote Desktop Services client, or through Group Policy. + +- If you enable this policy setting, the desktop is always displayed when a client connects to a remote computer. This policy setting overrides any initial program policy settings. + +- If you disable or do not configure this policy setting, an initial program can be specified that runs on the remote computer after the client connects to the remote computer. If an initial program is not specified, the desktop is always displayed on the remote computer after the client connects to the remote computer. + +>[!NOTE] +> If this policy setting is enabled, then the "Start a program on connection" policy setting is ignored. + + + + +ADMX Info: +- GP Friendly name: *Always show desktop on connection* +- GP name: *TS_TURNOFF_SINGLEAPP* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_UIA** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to restrict users to a single Remote Desktop Services session. + +If you enable this policy setting, users who log on remotely by using Remote Desktop Services will be restricted to a single session (either active or disconnected) on that server. If the user leaves the session in a disconnected state, the user automatically reconnects to that session at the next logon. + +- If you disable this policy setting, users are allowed to make unlimited simultaneous remote connections by using Remote Desktop Services. + +- If you do not configure this policy setting, this policy setting is not specified at the Group Policy level. + + + + +ADMX Info: +- GP Friendly name: *Restrict Remote Desktop Services users to a single Remote Desktop Services session* +- GP name: *TS_UIA* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections* +- GP ADMX file name: *TerminalServer.admx* + + + +
From 6c5b285a5c7557bd9fbf7f58d11a2459ce3cf5a0 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Mon, 22 Nov 2021 06:27:45 +0530 Subject: [PATCH 0094/1077] Update policy-csp-admx-terminalserver.md --- .../mdm/policy-csp-admx-terminalserver.md | 67 +++++++++++++++++++ 1 file changed, 67 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index bb3ba3a713..e1907d8a54 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -6229,6 +6229,73 @@ ADMX Info:
+ +**ADMX_TerminalServer/TS_UIA** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to permit RDP redirection of other supported RemoteFX USB devices from this computer. Redirected RemoteFX USB devices will not be available for local usage on this computer. +If you enable this policy setting, you can choose to give the ability to redirect other supported RemoteFX USB devices over RDP to all users or only to users who are in the Administrators group on the computer. If you disable or do not configure this policy setting, other supported RemoteFX USB devices are not available for RDP redirection by using any user account. For this change to take effect, you must restart Windows. + + + + + +ADMX Info: +- GP Friendly name: *Allow RDP redirection of other supported RemoteFX USB devices from this computer* +- GP name: *TS_UIA* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Connection Client\RemoteFX USB Device Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + + +
From 85669a44a796971060886f1e3c71f89a49cee46c Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Mon, 22 Nov 2021 06:31:23 +0530 Subject: [PATCH 0095/1077] Update policy-csp-admx-terminalserver.md --- windows/client-management/mdm/policy-csp-admx-terminalserver.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index e1907d8a54..44fb95957d 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -6283,7 +6283,6 @@ ADMX Info: This policy setting allows you to permit RDP redirection of other supported RemoteFX USB devices from this computer. Redirected RemoteFX USB devices will not be available for local usage on this computer. If you enable this policy setting, you can choose to give the ability to redirect other supported RemoteFX USB devices over RDP to all users or only to users who are in the Administrators group on the computer. If you disable or do not configure this policy setting, other supported RemoteFX USB devices are not available for RDP redirection by using any user account. For this change to take effect, you must restart Windows. - From 9f518007f6ccd7fdc27abbbf9a6dbc2eb0727e2f Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Mon, 22 Nov 2021 06:48:54 +0530 Subject: [PATCH 0096/1077] Update policy-csp-admx-terminalserver.md --- .../mdm/policy-csp-admx-terminalserver.md | 60 ++++++++++++++++++- 1 file changed, 59 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index 44fb95957d..afc0d59440 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -165,7 +165,7 @@ manager: dansimp
ADMX_TerminalServer/TS_PROMT_CREDS_CLIENT_COMP
-
+
ADMX_TerminalServer/TS_RADC_DefaultConnection
@@ -216,6 +216,63 @@ manager: dansimp
ADMX_TerminalServer/TS_SERVER_IMAGE_QUALITY
+
+ ADMX_TerminalServer/TS_SERVER_LEGACY_RFX +
+
+ ADMX_TerminalServer/TS_SERVER_PROFILE +
+
+ ADMX_TerminalServer/TS_SERVER_VISEXP +
+
+ ADMX_TerminalServer/TS_SERVER_WDDM_GRAPHICS_DRIVER +
+
+ ADMX_TerminalServer/TS_Session_End_On_Limit_1 +
+
+ ADMX_TerminalServer/TS_Session_End_On_Limit_2 +
+
+ ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_1 +
+
+ ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_2 +
+
+ ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_1 +
+
+ ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_2 +
+
+ ADMX_TerminalServer/TS_SESSIONS_Limits_1 +
+
+ ADMX_TerminalServer/TS_SESSIONS_Limits_2 +
+
+ ADMX_TerminalServer/TS_SINGLE_SESSION +
+
+ ADMX_TerminalServer/TS_SMART_CARD +
+
+ ADMX_TerminalServer/TS_START_PROGRAM_1 +
+
+ ADMX_TerminalServer/TS_START_PROGRAM_2 +
+
+ ADMX_TerminalServer/TS_TEMP_DELETE +
+
+ ADMX_TerminalServer/TS_TEMP_PER_SESSION +
+
+ ADMX_TerminalServer/TS_TIME_ZONE +
@@ -6296,5 +6353,6 @@ ADMX Info:
+ From d02ee03e5f10fab0dc87b32ca8caf97955d0f39c Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Mon, 22 Nov 2021 07:08:58 +0530 Subject: [PATCH 0097/1077] Update policy-csp-admx-terminalserver.md --- .../mdm/policy-csp-admx-terminalserver.md | 305 +++++++++++++++++- 1 file changed, 302 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index afc0d59440..f67869e5fa 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -6288,7 +6288,7 @@ ADMX Info:
-**ADMX_TerminalServer/TS_UIA** +**ADMX_TerminalServer/TS_USB_REDIRECTION_DISABLE** @@ -6338,14 +6338,15 @@ ADMX Info: This policy setting allows you to permit RDP redirection of other supported RemoteFX USB devices from this computer. Redirected RemoteFX USB devices will not be available for local usage on this computer. -If you enable this policy setting, you can choose to give the ability to redirect other supported RemoteFX USB devices over RDP to all users or only to users who are in the Administrators group on the computer. If you disable or do not configure this policy setting, other supported RemoteFX USB devices are not available for RDP redirection by using any user account. For this change to take effect, you must restart Windows. +If you enable this policy setting, you can choose to give the ability to redirect other supported RemoteFX USB devices over RDP to all users or only to users who are in the Administrators group on the computer. +If you disable or do not configure this policy setting, other supported RemoteFX USB devices are not available for RDP redirection by using any user account. For this change to take effect, you must restart Windows. ADMX Info: - GP Friendly name: *Allow RDP redirection of other supported RemoteFX USB devices from this computer* -- GP name: *TS_UIA* +- GP name: *TS_USB_REDIRECTION_DISABLE* - GP path: *Windows Components\Remote Desktop Services\Remote Desktop Connection Client\RemoteFX USB Device Redirection* - GP ADMX file name: *TerminalServer.admx* @@ -6354,5 +6355,303 @@ ADMX Info:
+ + +**ADMX_TerminalServer/TS_USER_AUTHENTICATION_POLICY** + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting enhances security by requiring that user authentication occur earlier in the remote connection process. + +- If you enable this policy setting, only client computers that support Network Level Authentication can connect to the RD Session Host server. To determine whether a client computer supports Network Level Authentication, start Remote Desktop Connection on the client computer, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. In the About Remote Desktop Connection dialog box, look for the phrase Network Level Authentication supported. + +- If you disable this policy setting, Network Level Authentication is not required for user authentication before allowing remote connections to the RD Session Host server. If you do not configure this policy setting, the local setting on the target computer will be enforced. On Windows Server 2012 and Windows 8, Network Level Authentication is enforced by default. + +Disabling this policy setting provides less security because user authentication will occur later in the remote connection process. + + + + +ADMX Info: +- GP Friendly name: *Require user authentication for remote connections by using Network Level Authentication* +- GP name: *TS_USER_AUTHENTICATION_POLICY* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_USER_HOME** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify the name of the certificate template that determines which certificate is automatically selected to authenticate an RD Session Host server. A certificate is needed to authenticate an RD Session Host server when TLS 1.0, 1.1 or 1.2 is used to secure communication between a client and an RD Session Host server during RDP connections. + +- If you enable this policy setting, you need to specify a certificate template name. Only certificates created by using the specified certificate template will be considered when a certificate to authenticate the RD Session Host server is automatically selected. Automatic certificate selection only occurs when a specific certificate has not been selected. + +If no certificate can be found that was created with the specified certificate template, the RD Session Host server will issue a certificate enrollment request and will use the current certificate until the request is completed. If more than one certificate is found that was created with the specified certificate template, the certificate that will expire latest and that matches the current name of the RD Session Host server will be selected. + +- If you disable or do not configure this policy, the certificate template name is not specified at the Group Policy level. By default, a self-signed certificate is used to authenticate the RD Session Host server. + +If you select a specific certificate to be used to authenticate the RD Session Host server, that certificate will take precedence over this policy setting. + + + + +ADMX Info: +- GP Friendly name: *Server authentication certificate template* +- GP name: *TS_USER_HOME* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_USER_MANDATORY_PROFILES** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify whether Remote Desktop Services uses a mandatory profile for all users connecting remotely to the RD Session Host server. + +- If you enable this policy setting, Remote Desktop Services uses the path specified in the "Set path for Remote Desktop Services Roaming User Profile" policy setting as the root folder for the mandatory user profile. All users connecting remotely to the RD Session Host server use the same user profile. + +- If you disable or do not configure this policy setting, mandatory user profiles are not used by users connecting remotely to the RD Session Host server. + +For this policy setting to take effect, you must also enable and configure the "Set path for Remote Desktop Services Roaming User Profile" policy setting. + + + + + +ADMX Info: +- GP Friendly name: *Use mandatory profiles on the RD Session Host server* +- GP name: *TS_USER_MANDATORY_PROFILES* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Profiles* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + +**ADMX_TerminalServer/TS_USER_PROFILES** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify the network path that Remote Desktop Services uses for roaming user profiles. By default, Remote Desktop Services stores all user profiles locally on the RD Session Host server. You can use this policy setting to specify a network share where user profiles can be centrally stored, allowing a user to access the same profile for sessions on all RD Session Host servers that are configured to use the network share for user profiles. If you enable this policy setting, Remote Desktop Services uses the specified path as the root directory for all user profiles. The profiles are contained in subfolders named for the account name of each user. + +To configure this policy setting, type the path to the network share in the form of \\Computername\Sharename. Do not specify a placeholder for the user account name, because Remote Desktop Services automatically adds this when the user logs on and the profile is created. + +If the specified network share does not exist, Remote Desktop Services displays an error message on the RD Session Host server and will store the user profiles locally on the RD Session Host server. + +If you disable or do not configure this policy setting, user profiles are stored locally on the RD Session Host server. You can configure a user's profile path on the Remote Desktop Services Profile tab on the user's account Properties dialog box. + +1. The roaming user profiles enabled by the policy setting apply only to Remote Desktop Services connections. A user might also have a Windows roaming user profile configured. The Remote Desktop Services roaming user profile always takes precedence in a Remote Desktop Services session. +2. To configure a mandatory Remote Desktop Services roaming user profile for all users connecting remotely to the RD Session Host server, use this policy setting together with the "Use mandatory profiles on the RD Session Host server" policy setting located in Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\RD Session Host\Profiles. The path set in the "Set path for Remote Desktop Services Roaming User Profile" policy setting should contain the mandatory profile. + + + + +ADMX Info: +- GP Friendly name: *Set path for Remote Desktop Services Roaming User Profile* +- GP name: *TS_USER_PROFILES* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Profiles* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ From 8782e39f0b704dc08d825205fdcf1e5a12db122a Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Mon, 22 Nov 2021 07:25:28 +0530 Subject: [PATCH 0098/1077] Update policy-csp-admx-terminalserver.md --- .../mdm/policy-csp-admx-terminalserver.md | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index f67869e5fa..727599a933 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -273,6 +273,30 @@ manager: dansimp
ADMX_TerminalServer/TS_TIME_ZONE
+
+ ADMX_TerminalServer/TS_TSCC_PERMISSIONS_POLICY +
+
+ ADMX_TerminalServer/TS_TURNOFF_SINGLEAPP +
+
+ ADMX_TerminalServer/TS_UIA +
+
+ ADMX_TerminalServer/TS_USB_REDIRECTION_DISABLE +
+
+ ADMX_TerminalServer/TS_USER_AUTHENTICATION_POLICY +
+
+ ADMX_TerminalServer/TS_USER_HOME +
+
+ ADMX_TerminalServer/TS_USER_MANDATORY_PROFILES +
+
+ ADMX_TerminalServer/TS_USER_PROFILES +
From e0d3e5998873a314ba76872bcdbcfdf548574991 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Mon, 22 Nov 2021 07:55:20 +0530 Subject: [PATCH 0099/1077] Update policies-in-policy-csp-admx-backed.md --- .../mdm/policies-in-policy-csp-admx-backed.md | 44 +++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 3b44f8e00e..e32a8a34bd 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -1177,6 +1177,50 @@ ms.date: 10/08/2020 - [ADMX_TerminalServer/TS_NoSecurityMenu](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_nosecuritymenu) - [ADMX_TerminalServer/TS_PreventLicenseUpgrade](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_preventlicenseupgrade) - [ADMX_TerminalServer/TS_PROMT_CREDS_CLIENT_COMP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_promt_creds_client_comp) +- [ADMX_TerminalServer/TS_RADC_DefaultConnection](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_radc_defaultconnection) +- [ADMX_TerminalServer/TS_RDSAppX_WaitForRegistration](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_rdsappx_waitforregistration) +- [ADMX_TerminalServer/TS_RemoteControl_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_remotecontrol_1) +- [ADMX_TerminalServer/TS_RemoteControl_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_remotecontrol_2) +- [ADMX_TerminalServer/TS_RemoteDesktopVirtualGraphics](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_remotedesktopvirtualgraphics) +- [ADMX_TerminalServer/TS_SD_ClustName](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sd_clustname) +- [ADMX_TerminalServer/TS_SD_EXPOSE_ADDRESS](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sd_expose_address) +- [ADMX_TerminalServer/TS_SD_Loc](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sd_loc) +- [ADMX_TerminalServer/TS_SECURITY_LAYER_POLICY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_security_layer_policy) +- [ADMX_TerminalServer/TS_SELECT_NETWORK_DETECT](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_select_network_detect) +- [ADMX_TerminalServer/TS_SELECT_TRANSPORT](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_select_transport) +- [ADMX_TerminalServer/TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_advanced_remotefx_remoteapp) +- [ADMX_TerminalServer/TS_SERVER_AUTH](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_auth) +- [ADMX_TerminalServer/TS_SERVER_AVC_HW_ENCODE_PREFERRED](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_avc_hw_encode_preferred) +- [ADMX_TerminalServer/TS_SERVER_AVC444_MODE_PREFERRED](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_avc444_mode_preferred) +- [ADMX_TerminalServer/TS_SERVER_COMPRESSOR](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_compressor) +- [ADMX_TerminalServer/TS_SERVER_IMAGE_QUALITY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_image_quality) +- [ADMX_TerminalServer/TS_SERVER_LEGACY_RFX](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_legacy_rfx) +- [ADMX_TerminalServer/TS_SERVER_PROFILE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_profile) +- [ADMX_TerminalServer/TS_SERVER_VISEXP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_visexp) +- [ADMX_TerminalServer/TS_SERVER_WDDM_GRAPHICS_DRIVER](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_wddm_graphics_driver) +- [ADMX_TerminalServer/TS_Session_End_On_Limit_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_session_end_on_limit_1) +- [ADMX_TerminalServer/TS_Session_End_On_Limit_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_session_end_on_limit_2) +- [ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_disconnected_timeout_1) +- [ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_disconnected_timeout_2) +- [ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_idle_limit_1) +- [ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_idle_limit_2) +- [ADMX_TerminalServer/TS_SESSIONS_Limit_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions__limit_1) +- [ADMX_TerminalServer/TS_SESSIONS_Limit_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions__limit_2) +- [ADMX_TerminalServer/TS_SINGLE_SESSION](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_single_session) +- [ADMX_TerminalServer/TS_SMART_CARD](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_smart_card) +- [ADMX_TerminalServer/TS_START_PROGRAM_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_start_program_1) +- [ADMX_TerminalServer/TS_START_PROGRAM_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_start_program_2) +- [ADMX_TerminalServer/TS_TEMP_DELETE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_temp_delete) +- [ADMX_TerminalServer/TS_TEMP_PER_SESSION](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_temp_per_session) +- [ADMX_TerminalServer/TS_TIME_ZONE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_time_zone) +- [ADMX_TerminalServer/TS_TSCC_PERMISSIONS_POLICY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_tscc_permissions_policy) +- [ADMX_TerminalServer/TS_TURNOFF_SINGLEAPP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_turnoff_singleapp) +- [ADMX_TerminalServer/TS_UIA](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_uia) +- [ADMX_TerminalServer/TS_USB_REDIRECTION_DISABLE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_usb_redirection_disable) +- [ADMX_TerminalServer/TS_USER_AUTHENTICATION_POLICY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_user_authentication_policy) +- [ADMX_TerminalServer/TS_USER_HOME](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_user_home) +- [ADMX_TerminalServer/TS_USER_MANDATORY_PROFILES](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_user_mandatory_profiles) +- [ADMX_TerminalServer/TS_USER_PROFILES](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_user_profiles) - [ADMX_Thumbnails/DisableThumbnails](./policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbnails) - [ADMX_Thumbnails/DisableThumbnailsOnNetworkFolders](./policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbnailsonnetworkfolders) - [ADMX_Thumbnails/DisableThumbsDBOnNetworkFolders](./policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbsdbonnetworkfolders) From 013a58e0f8226113f7db945dac4d3fb4e0d23f65 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Mon, 22 Nov 2021 12:36:06 +0530 Subject: [PATCH 0100/1077] Updated --- .../policy-configuration-service-provider.md | 78 ++ .../mdm/policy-csp-admx-terminalserver.md | 690 +++++++++++++----- 2 files changed, 593 insertions(+), 175 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index fa5d7a6fb0..13d7cd2ea9 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -4205,6 +4205,84 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC
ADMX_TerminalServer/TS_PROMT_CREDS_CLIENT_COMP
+
+ ADMX_TerminalServer/TS_RADC_DefaultConnection +
+
+ ADMX_TerminalServer/TS_RDSAppX_WaitForRegistration +
+
+ ADMX_TerminalServer/TS_RemoteControl_1 +
+
+ ADMX_TerminalServer/TS_RemoteControl_2 +
+
+ ADMX_TerminalServer/TS_RemoteDesktopVirtualGraphics +
+
+ ADMX_TerminalServer/TS_SD_ClustName +
+
+ ADMX_TerminalServer/TS_SD_EXPOSE_ADDRESS +
+
+ ADMX_TerminalServer/TS_SD_Loc +
+
+ ADMX_TerminalServer/TS_SECURITY_LAYER_POLICY +
+
+ ADMX_TerminalServer/TS_SELECT_NETWORK_DETECT +
+
+ ADMX_TerminalServer/TS_SELECT_TRANSPORT +
+
+ ADMX_TerminalServer/TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP +
+
+ ADMX_TerminalServer/TS_SERVER_AUTH +
+
+ ADMX_TerminalServer/TS_SERVER_AVC_HW_ENCODE_PREFERRED +
+
+ ADMX_TerminalServer/TS_SERVER_AVC_HW_ENCODE_PREFERRED +
+
+ ADMX_TerminalServer/TS_SERVER_AVC444_MODE_PREFERRED +
+
+ ADMX_TerminalServer/TS_SERVER_COMPRESSOR +
+
+ ADMX_TerminalServer/TS_SERVER_IMAGE_QUALITY +
+
+ ADMX_TerminalServer/TS_SERVER_LEGACY_RFX +
+
+ ADMX_TerminalServer/TS_SERVER_PROFILE +
+
+ ADMX_TerminalServer/TS_SERVER_VISEXP +
+
+ ADMX_TerminalServer/TS_SERVER_WDDM_GRAPHICS_DRIVER +
+
+ ADMX_TerminalServer/TS_Session_End_On_Limit_1 +
+
+ ADMX_TerminalServer/TS_Session_End_On_Limit_2 +
+
+ ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_1 +
+
+ ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_2 +
### ADMX_Thumbnails policies diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index 727599a933..c96ea7e054 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -567,154 +567,9 @@ ADMX Info:
- -**ADMX_TerminalServer/TS_RADC_DefaultConnection** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * User - -
- - - - -This policy setting specifies the default connection URL for RemoteApp and Desktop Connections. The default connection URL is a specific connection that can only be configured by using Group Policy. In addition to the capabilities that are common to all connections, the default connection URL allows document file types to be associated with RemoteApp programs. The default connection URL must be configured in the form of [http://contoso.com/rdweb/Feed/webfeed.aspx](http://contoso.com/rdweb/Feed/webfeed.aspx). - -- If you enable this policy setting, the specified URL is configured as the default connection URL for the user and replaces any existing connection URL. The user cannot change the default connection URL. The user's default logon credentials are used when setting up the default connection URL. - -- If you disable or do not configure this policy setting, the user has no default connection URL. - -RemoteApp programs that are installed through RemoteApp and Desktop Connections from an un-trusted server can compromise the security of a user's account. - - - - - - -ADMX Info: -- GP Friendly name: *Specify default connection URL* -- GP name: *TS_RADC_DefaultConnection* -- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* -- GP ADMX file name: *TerminalServer.admx* - - - -
-**ADMX_TerminalServer/TS_RDSAppX_WaitForRegistration** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * User - -
- - - - -This policy setting allows you to specify whether the app registration is completed before showing the Start screen to the user. By default, when a new user signs in to a computer, the Start screen is shown and apps are registered in the background. However, some apps may not work until app registration is complete. - -- If you enable this policy setting, user sign-in is blocked for up to 6 minutes to complete the app registration. You can use this policy setting when customizing the Start screen on Remote Desktop Session Host servers. - -- If you disable or do not configure this policy setting, the Start screen is shown and apps are registered in the background. - - - - - - -ADMX Info: -- GP Friendly name: *Suspend user sign-in to complete app registration* -- GP name: *TS_RDSAppX_WaitForRegistration* -- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* -- GP ADMX file name: *TerminalServer.admx* - - - -
- - -**ADMX_TerminalServer/TS_RemoteControl_1** +**ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_1** @@ -763,32 +618,7 @@ ADMX Info: - -This policy determines whether the RPC protocol messagese used by VSS for SMB2 File Shares feature is enabled. VSS for SMB2 File Shares feature enables VSS aware backup applications to perform application consistent backup and restore of VSS aware applications storing data on SMB2 File Shares. By default, the RPC protocol message between File Server VSS provider and File Server VSS Agent is signed but not encrypted. - -To make changes to this setting effective, you must restart Volume Shadow Copy (VSS) Service. - - - - - - -ADMX Info: -- GP Friendly name: *Allow or Disallow use of encryption to protect the RPC protocol messages between File Share Shadow Copy Provider running on application server and File Share Shadow Copy Agent running on the file servers* -- GP name: *TS_RemoteControl_1* -- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* -- GP ADMX file name: *TerminalServer.admx* - - - -
- - -**ADMX_TerminalServer/TS_RemoteControl_2** - - - -This policy setting allows you to specify whether users can run Remote Desktop Protocol (.rdp) files from a publisher that signed the file with a valid certificate. A valid certificate is one issued by an authority recognized by the client, such as the issuers in the client's Third-Party Root Certification Authorities certificate store. +This policy setting allows you to specify whether users can run Remote Desktop Protocol (.rdp) files from a publisher that signed the file with a valid certificate. A valid certificate is one that is issued by an authority recognized by the client, such as the issuers in the client's Third-Party Root Certification Authorities certificate store. This policy setting also controls whether the user can start an RDP session by using default .rdp settings (for example, when a user directly opens the Remote Desktop Connection [RDC] client without specifying an .rdp file). @@ -796,7 +626,7 @@ If you enable or do not configure this policy setting, users can run .rdp files If you disable this policy setting, users cannot run .rdp files that are signed with a valid certificate. Additionally, users cannot start an RDP session by directly opening the RDC client and specifying the remote computer name. When a user tries to start an RDP session, the user receives a message that the publisher has been blocked. ->[!Note] +>[!NOTE] >You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, all users on the computer are affected. @@ -804,7 +634,7 @@ If you disable this policy setting, users cannot run .rdp files that are signed ADMX Info: - GP Friendly name: *Allow .rdp files from valid publishers and user's default .rdp settings* -- GP name: *TTS_CLIENT_ALLOW_SIGNED_FILES_1* +- GP name: *TS_CLIENT_ALLOW_SIGNED_FILES_1* - GP path: *Windows Components\Remote Desktop Services\Remote Desktop Connection Client* - GP ADMX file name: *TerminalServer.admx* @@ -2742,6 +2572,82 @@ ADMX Info:
+ +**ADMX_TerminalServer/TS_GATEWAY_POLICY_ENABLE** + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +If you enable this policy setting, when Remote Desktop Connection cannot connect directly to a remote computer (an RD Session Host server or a computer with Remote Desktop enabled), the clients will attempt to connect to the remote computer through an RD Gateway server. + +In this case, the clients will attempt to connect to the RD Gateway server that is specified in the "Set RD Gateway server address" policy setting. You can enforce this policy setting or you can allow users to overwrite this setting. + +By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these RD Gateway server settings" option on the client. To enforce this policy setting, you must also specify the address of the RD Gateway server by using the "Set RD Gateway server address" policy setting, or client connection attempts to any remote computer will fail, if the client cannot connect directly to the remote computer. + +To enhance security, it is also highly recommended that you specify the authentication method by using the "Set RD Gateway authentication method" policy setting. If you do not specify an authentication method by using this policy setting, either the NTLM protocol that is enabled on the client or a smart card can be used. To allow users to overwrite this policy setting, select the "Allow users to change this setting" check box. + +When you do this, users on the client can choose not to connect through the RD Gateway server by selecting the "Do not use an RD Gateway server" option. Users can specify a connection method by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify a connection method, the connection method that you specify in this policy setting is used by default. + +If you disable or do not configure this policy setting, clients will not use the RD Gateway server address that is specified in the "Set RD Gateway server address" policy setting. If an RD Gateway server is specified by the user, a client connection attempt will be made through that RD Gateway server. + + + + +ADMX Info: +- GP Friendly name: *Enable connection through RD Gateway* +- GP name: *TS_GATEWAY_POLICY_ENABLE* +- GP path: *Windows Components\Remote Desktop Services\RD Gateway* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ **ADMX_TerminalServer/TS_GATEWAY_POLICY_AUTH_METHOD** @@ -3863,6 +3769,292 @@ ADMX Info:
+ +**ADMX_TerminalServer/TS_RADC_DefaultConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + + +This policy setting specifies the default connection URL for RemoteApp and Desktop Connections. The default connection URL is a specific connection that can only be configured by using Group Policy. In addition to the capabilities that are common to all connections, the default connection URL allows document file types to be associated with RemoteApp programs. The default connection URL must be configured in the form of [http://contoso.com/rdweb/Feed/webfeed.aspx](http://contoso.com/rdweb/Feed/webfeed.aspx). + +- If you enable this policy setting, the specified URL is configured as the default connection URL for the user and replaces any existing connection URL. The user cannot change the default connection URL. The user's default logon credentials are used when setting up the default connection URL. + +- If you disable or do not configure this policy setting, the user has no default connection URL. + +RemoteApp programs that are installed through RemoteApp and Desktop Connections from an un-trusted server can compromise the security of a user's account. + + + + + + +ADMX Info: +- GP Friendly name: *Specify default connection URL* +- GP name: *TS_RADC_DefaultConnection* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_RDSAppX_WaitForRegistration** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + + +This policy setting allows you to specify whether the app registration is completed before showing the Start screen to the user. By default, when a new user signs in to a computer, the Start screen is shown and apps are registered in the background. However, some apps may not work until app registration is complete. + +- If you enable this policy setting, user sign-in is blocked for up to 6 minutes to complete the app registration. You can use this policy setting when customizing the Start screen on Remote Desktop Session Host servers. + +- If you disable or do not configure this policy setting, the Start screen is shown and apps are registered in the background. + + + + + + +ADMX Info: +- GP Friendly name: *Suspend user sign-in to complete app registration* +- GP name: *TS_RDSAppX_WaitForRegistration* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_RemoteControl_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy determines whether the RPC protocol messagese used by VSS for SMB2 File Shares feature is enabled. VSS for SMB2 File Shares feature enables VSS aware backup applications to perform application consistent backup and restore of VSS aware applications storing data on SMB2 File Shares. By default, the RPC protocol message between File Server VSS provider and File Server VSS Agent is signed but not encrypted. + +To make changes to this setting effective, you must restart Volume Shadow Copy (VSS) Service. + + + + + + +ADMX Info: +- GP Friendly name: *Allow or Disallow use of encryption to protect the RPC protocol messages between File Share Shadow Copy Provider running on application server and File Share Shadow Copy Agent running on the file servers* +- GP name: *TS_RemoteControl_1* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ + +**ADMX_TerminalServer/TS_RemoteControl_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +This policy determines whether the RPC protocol messagese used by VSS for SMB2 File Shares feature is enabled. VSS for SMB2 File Shares feature enables VSS aware backup applications to perform application consistent backup and restore of VSS aware applications storing data on SMB2 File Shares. By default, the RPC protocol message between File Server VSS provider and File Server VSS Agent is signed but not encrypted. + +To make changes to this setting effective, you must restart Volume Shadow Copy (VSS) Service. + + + + + + +ADMX Info: +- GP Friendly name: *Allow or Disallow use of encryption to protect the RPC protocol messages between File Share Shadow Copy Provider running on application server and File Share Shadow Copy Agent running on the file servers* +- GP name: *TS_RemoteControl_2* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection* +- GP ADMX file name: *TerminalServer.admx* + + + +
+ **ADMX_TerminalServer/TS_RemoteDesktopVirtualGraphics** @@ -4973,6 +5165,77 @@ ADMX Info: +**ADMX_TerminalServer/TS_SERVER_VISEXP** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify the visual experience that remote users receive in Remote Desktop Services sessions. Remote sessions on the remote computer are then optimized to support this visual experience. By default, Remote Desktop Services sessions are optimized for rich multimedia, such as applications that use Silverlight or Windows Presentation Foundation. + +- If you enable this policy setting, you must select the visual experience for which you want to optimize Remote Desktop Services sessions. You can select either Rich multimedia or Text. + +- If you disable or do not configure this policy setting, Remote Desktop Services sessions are optimized for rich multimedia. + + + + +ADMX Info: +- GP Friendly name: *Optimize visual experience for Remote Desktop Service Sessions* +- GP name: *TS_SERVER_VISEXP* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\RemoteFX for Windows Server 2008 R2* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + **ADMX_TerminalServer/TS_SERVER_WDDM_GRAPHICS_DRIVER** @@ -5577,6 +5840,83 @@ ADMX Info: +**ADMX_TerminalServer/TS_SESSIONS_Limits_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy setting allows you to specify the maximum amount of time that a Remote Desktop Services session can be active before it is automatically disconnected. + +- If you enable this policy setting, you must select the desired time limit in the Active session limit list. Remote Desktop Services will automatically disconnect active sessions after the specified amount of time. The user receives a warning two minutes before the Remote Desktop Services session disconnects, which allows the user to save open files and close programs. If you have a console session, active session time limits do not apply. + +- If you disable or do not configure this policy setting, this policy setting is not specified at the Group Policy level. By default, Remote Desktop Services allows sessions to remain active for an unlimited amount of time. + +If you want Remote Desktop Services to end instead of disconnect a session when the time limit is reached, you can configure the policy setting Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\End session when time limits are reached. + +>[!NOTE] +> This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence. + + + + + +ADMX Info: +- GP Friendly name: *Set time limit for active Remote Desktop Services sessions* +- GP name: *TS_SESSIONS_Limits_2* +- GP path: *Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits* +- GP ADMX file name: *TerminalServer.admx* + + + + +
+ + + **ADMX_TerminalServer/TS_SINGLE_SESSION** @@ -6312,7 +6652,7 @@ ADMX Info:
-**ADMX_TerminalServer/TS_USB_REDIRECTION_DISABLE** +**ADMX_TerminalServer/TS_USB_REDIRECTION_DISABLE** From 050ba1d6767b40a4a9ec0aba139c10d459d5a625 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Mon, 22 Nov 2021 12:48:35 +0530 Subject: [PATCH 0101/1077] Updated --- .../mdm/policies-in-policy-csp-admx-backed.md | 4 ++-- .../mdm/policy-configuration-service-provider.md | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index e32a8a34bd..57ac9f7317 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -1204,8 +1204,8 @@ ms.date: 10/08/2020 - [ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_disconnected_timeout_2) - [ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_idle_limit_1) - [ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_idle_limit_2) -- [ADMX_TerminalServer/TS_SESSIONS_Limit_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions__limit_1) -- [ADMX_TerminalServer/TS_SESSIONS_Limit_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions__limit_2) +- [ADMX_TerminalServer/TS_SESSIONS_Limit_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_limit_1) +- [ADMX_TerminalServer/TS_SESSIONS_Limit_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_limit_2) - [ADMX_TerminalServer/TS_SINGLE_SESSION](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_single_session) - [ADMX_TerminalServer/TS_SMART_CARD](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_smart_card) - [ADMX_TerminalServer/TS_START_PROGRAM_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_start_program_1) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 13d7cd2ea9..11916ac48a 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -4206,7 +4206,7 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC ADMX_TerminalServer/TS_PROMT_CREDS_CLIENT_COMP
- ADMX_TerminalServer/TS_RADC_DefaultConnection + ADMX_TerminalServer/TS_RADC_DefaultConnection
ADMX_TerminalServer/TS_RDSAppX_WaitForRegistration @@ -4239,13 +4239,13 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC ADMX_TerminalServer/TS_SELECT_TRANSPORT
- ADMX_TerminalServer/TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP + ADMX_TerminalServer/TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP
ADMX_TerminalServer/TS_SERVER_AUTH
- ADMX_TerminalServer/TS_SERVER_AVC_HW_ENCODE_PREFERRED + ADMX_TerminalServer/TS_SERVER_AVC_HW_ENCODE_PREFERRED
ADMX_TerminalServer/TS_SERVER_AVC_HW_ENCODE_PREFERRED From 34e27c8cd44ef6cc068a63f8bb95cce2eb3d3285 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Mon, 22 Nov 2021 13:17:16 +0530 Subject: [PATCH 0102/1077] Update policy-configuration-service-provider.md --- .../mdm/policy-configuration-service-provider.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 11916ac48a..b62b8f7d66 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -4247,9 +4247,6 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC
ADMX_TerminalServer/TS_SERVER_AVC_HW_ENCODE_PREFERRED
-
- ADMX_TerminalServer/TS_SERVER_AVC_HW_ENCODE_PREFERRED -
ADMX_TerminalServer/TS_SERVER_AVC444_MODE_PREFERRED
From 880432985b64090b80309fd112d1531a6b200bd6 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Mon, 22 Nov 2021 13:29:38 +0530 Subject: [PATCH 0103/1077] Updated --- .../mdm/policies-in-policy-csp-admx-backed.md | 4 ++-- .../mdm/policy-configuration-service-provider.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 57ac9f7317..0153913344 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -1204,8 +1204,8 @@ ms.date: 10/08/2020 - [ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_disconnected_timeout_2) - [ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_idle_limit_1) - [ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_idle_limit_2) -- [ADMX_TerminalServer/TS_SESSIONS_Limit_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_limit_1) -- [ADMX_TerminalServer/TS_SESSIONS_Limit_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_limit_2) +- [ADMX_TerminalServer/TS_SESSIONS_Limits_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_limits_1) +- [ADMX_TerminalServer/TS_SESSIONS_Limits_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_limits_2) - [ADMX_TerminalServer/TS_SINGLE_SESSION](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_single_session) - [ADMX_TerminalServer/TS_SMART_CARD](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_smart_card) - [ADMX_TerminalServer/TS_START_PROGRAM_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_start_program_1) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index b62b8f7d66..a636e041e5 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -4242,7 +4242,7 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC ADMX_TerminalServer/TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP
- ADMX_TerminalServer/TS_SERVER_AUTH + ADMX_TerminalServer/TS_SERVER_AUTH
ADMX_TerminalServer/TS_SERVER_AVC_HW_ENCODE_PREFERRED From f5ede191b79be42c1e6d6db6bfa26f14df02605e Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Mon, 22 Nov 2021 13:43:58 +0530 Subject: [PATCH 0104/1077] Update policy-configuration-service-provider.md --- .../mdm/policy-configuration-service-provider.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index a636e041e5..1fa8949def 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -4280,6 +4280,12 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC
ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_2
+
+ ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_1 +
+
+ ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_2 +
### ADMX_Thumbnails policies From 8e8a45bbd972cd73e93852e6f167855aef3cd54c Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Mon, 22 Nov 2021 14:03:49 +0530 Subject: [PATCH 0105/1077] Adding new policies in CSP .md --- .../policy-configuration-service-provider.md | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index b62b8f7d66..95217e5116 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -4280,6 +4280,51 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC
ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_2
+
+ ADMX_TerminalServer/TS_SINGLE_SESSION +
+
+ ADMX_TerminalServer/TS_SMART_CARD +
+
+ ADMX_TerminalServer/TS_START_PROGRAM_1 +
+
+ ADMX_TerminalServer/TS_START_PROGRAM_2 +
+
+ ADMX_TerminalServer/TS_TEMP_DELETE +
+
+ ADMX_TerminalServer/TS_TEMP_PER_SESSION +
+
+ ADMX_TerminalServer/TS_TIME_ZONE +
+
+ ADMX_TerminalServer/TS_TSCC_PERMISSIONS_POLICY +
+
+ ADMX_TerminalServer/TS_TURNOFF_SINGLEAPP +
+
+ ADMX_TerminalServer/TS_UIA +
+
+ ADMX_TerminalServer/TS_USB_REDIRECTION_DISABLE +
+
+ ADMX_TerminalServer/TS_USER_AUTHENTICATION_POLICY +
+
+ ADMX_TerminalServer/TS_USER_HOME +
+
+ ADMX_TerminalServer/TS_USER_MANDATORY_PROFILES +
+
+ ADMX_TerminalServer/TS_USER_PROFILES +
### ADMX_Thumbnails policies From 84b0ba0c436ebd9397cb675d32e9a68722d73bdd Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Mon, 22 Nov 2021 14:14:56 +0530 Subject: [PATCH 0106/1077] Updated --- .../mdm/policy-configuration-service-provider.md | 3 ++- .../client-management/mdm/policy-csp-admx-terminalserver.md | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 1fa8949def..21a5e6f57f 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -4283,9 +4283,10 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC
ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_1
-
+
ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_2
+
### ADMX_Thumbnails policies diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index c96ea7e054..67bd9ecc23 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -6,8 +6,8 @@ ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman -ms.date: 09/23/2020 +author: nimishasatapathy +ms.date: 11/22/2021 ms.reviewer: manager: dansimp --- From 458ff0e6b8a7bd627833f26e83a24923e768a6fa Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 24 Nov 2021 15:01:10 +0530 Subject: [PATCH 0107/1077] Update policy-csp-start.md --- .../client-management/mdm/policy-csp-start.md | 143 ++++++++++++++++++ 1 file changed, 143 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index 588586543f..a7bfb4c8ba 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -51,6 +51,9 @@ manager: dansimp
Start/AllowPinnedFolderVideos
+
+ Start/ConfigureStartPins +
Start/DisableContextMenus
@@ -108,6 +111,9 @@ manager: dansimp
Start/NoPinningToTaskbar
+
+ Start/ShowOrHideMostUsedApps +
Start/StartLayout
@@ -766,6 +772,73 @@ The following list shows the supported values:
+ +**Start/ConfigureStartPins** + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
+ + + +This policy will allow admins to push a new list of pinned apps to override the default/current list of pinned apps in the SV start menu experience. + +>[!NOTE] +> TFS information describes feature area owners and policy handling work, but the work to implement the policy itself is being completed by OS\WDX\DASH\Cloud-powered Windows Devices\Project Hailey --> Deliverable 32179178. + + + + +This string policy will take a JSON file (expected name LayoutModification.json), which enumerates the items to pin and their relative order. + + + + +
+ + **Start/DisableContextMenus** @@ -2197,6 +2270,76 @@ To validate on Desktop, do the following:
+ + +**Start/ShowOrHideMostUsedApps** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
+ + + +This supports a key Enterprise manageability request targeted for Iron. + + + +The following list shows the supported values: + +- 1 - Force showing of Most Used Apps in Start Menu, user cannot change in Settings +- 0 - Force hiding of Most Used Apps in Start Menu, user cannot change in Settings +- Not set - User can use Settings to hide or show Most Used Apps in Start Menu + +On clean install, the user setting defaults to "hide". + + + + + +
+ **Start/StartLayout** From 81090affab904c05f7e8547e71644cb6aca17819 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Wed, 24 Nov 2021 16:53:32 +0530 Subject: [PATCH 0108/1077] Updated policy-csp-storage with missing policy entries Added: - -- Storage/WPDDevicesDenyReadAccessPerDevice Storage/WPDDevicesDenyReadAccessPerUser Storage/WPDDevicesDenyWriteAccessPerDevice Storage/WPDDevicesDenyWriteAccessPerUser --- .../policy-configuration-service-provider.md | 12 + .../mdm/policy-csp-storage.md | 379 +++++++++++++++++- 2 files changed, 379 insertions(+), 12 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index bbd3101f94..f43673ae62 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -8293,6 +8293,18 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC
Storage/RemovableDiskDenyWriteAccess
+
+ Storage/WPDDevicesDenyReadAccessPerDevice +
+
+ Storage/WPDDevicesDenyReadAccessPerUser +
+
+ Storage/WPDDevicesDenyWriteAccessPerDevice +
+
+ Storage/WPDDevicesDenyWriteAccessPerUser +
### System policies diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index d470d7977b..7c441baca0 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -48,6 +48,18 @@ manager: dansimp
Storage/RemovableDiskDenyWriteAccess
+
+ Storage/WPDDevicesDenyReadAccessPerDevice +
+
+ Storage/WPDDevicesDenyReadAccessPerUser +
+
+ Storage/WPDDevicesDenyWriteAccessPerDevice +
+
+ Storage/WPDDevicesDenyWriteAccessPerUser +
@@ -139,8 +151,8 @@ The following list shows the supported values: Home - - + No + No Pro @@ -218,8 +230,8 @@ ADMX Info: Home - - + No + No Pro @@ -300,8 +312,8 @@ ADMX Info: Home - - + No + No Pro @@ -382,8 +394,8 @@ ADMX Info: Home - - + No + No Pro @@ -464,8 +476,8 @@ ADMX Info: Home - - + No + No Pro @@ -552,8 +564,8 @@ ADMX Info: Home - - + No + No Pro @@ -782,5 +794,348 @@ See [Use custom settings for Windows 10 devices in Intune](/intune/custom-settin
+ +**Storage/WPDDevicesDenyReadAccessPerDevice** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy will do the enforcement over the following protocols which are used by most portable devices, e.g. mobile/IOS/Android: + +- Picture Transfer Protocol (PTP) over USB, IP, and Bluetooth +- Media Transfer Protocol (MTP) over USB, IP, and Bluetooth +- Mass Storage Class (MSC) over USB + +If enabled, this policy will block end-user from Read access on any Windows Portal devices, e.g. mobile/iOS/Android. + +Audit/Warn – P1: in the future, will consider Audit/Warn modes with customer justifications[TC(1] [TW2]. + +>[!NOTE] +> WPD policy is not a reliable policy for removable storage - admin can not use WPD policy to block removable storage, e.g. if an end-user is using an USB thumb drive under a WPD policy, the policy may block PTP/MTP/etc, but end-user can still browser the USB via explorer. + +Supported values for this policy are: +- Not configured +- 1-Enabled +- 0-Disabled + + + +ADMX Info: +- GP Friendly name: *WPD Devices: Deny read access* +- GP name: *WPDDevices_DenyRead_Access_2* +- GP path: *System/Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + + + + + + + +
+ + +**Storage/WPDDevicesDenyReadAccessPerUser** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy will do the enforcement over the following protocols which are used by most portable devices, e.g. mobile/IOS/Android: + +- Picture Transfer Protocol (PTP) over USB, IP, and Bluetooth +- Media Transfer Protocol (MTP) over USB, IP, and Bluetooth +- Mass Storage Class (MSC) over USB + +If enabled, this policy will block end-user from Read access on any Windows Portal devices, e.g. mobile/iOS/Android. + +Audit/Warn – P1: in the future, will consider Audit/Warn modes with customer justifications[TC(1] [TW2]. + +>[!NOTE] +> WPD policy is not a reliable policy for removable storage - admin can not use WPD policy to block removable storage, e.g. if an end-user is using an USB thumb drive under a WPD policy, the policy may block PTP/MTP/etc, but end-user can still browser the USB via explorer. + +Supported values for this policy are: +- Not configured +- 1-Enabled +- 0-Disabled + + + +ADMX Info: +- GP Friendly name: *WPD Devices: Deny read access* +- GP name: *WPDDevices_DenyRead_Access_1* +- GP path: *System/Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + + + + + + + +
+ + +**Storage/WPDDevicesDenyWriteAccessPerDevice** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy will do the enforcement over the following protocols which are used by most portable devices, e.g. mobile/IOS/Android: + +- Picture Transfer Protocol (PTP) over USB, IP, and Bluetooth +- Media Transfer Protocol (MTP) over USB, IP, and Bluetooth +- Mass Storage Class (MSC) over USB + +If enabled, this will block end-user from Write access on any Windows Portal devices, e.g. mobile/iOS/Android. + +Audit/Warn – P1: in the future, will consider Audit/Warn modes with customer justifications. + +>[!NOTE] +> WPD policy is not a reliable policy for removable storage - admin can not use WPD policy to block removable storage, e.g. if an end-user is using an USB thumb drive under a WPD policy, the policy may block PTP/MTP/etc, but end-user can still browser the USB via explorer. + +Supported values for this policy are: +- Not configured +- 1-Enabled +- 0-Disabled + + + +ADMX Info: +- GP Friendly name: *WPD Devices: Deny write access* +- GP name: *WPDDevices_DenyWrite_Access_2* +- GP path: *System/Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + + + + + + + +
+ + +**Storage/WPDDevicesDenyWriteAccessPerUser** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy will do the enforcement over the following protocols which are used by most portable devices, e.g. mobile/IOS/Android: + +- Picture Transfer Protocol (PTP) over USB, IP, and Bluetooth +- Media Transfer Protocol (MTP) over USB, IP, and Bluetooth +- Mass Storage Class (MSC) over USB + +If enabled, this will block end-user from Write access on any Windows Portal devices, e.g. mobile/iOS/Android. + +Audit/Warn – P1: in the future, will consider Audit/Warn modes with customer justifications. + +>[!NOTE] +> WPD policy is not a reliable policy for removable storage - admin can not use WPD policy to block removable storage, e.g. if an end-user is using an USB thumb drive under a WPD policy, the policy may block PTP/MTP/etc, but end-user can still browser the USB via explorer. + +Supported values for this policy are: +- Not configured +- 1-Enabled +- 0-Disabled + + + +ADMX Info: +- GP Friendly name: *WPD Devices: Deny write access* +- GP name: *WPDDevices_DenyWrite_Access_2* +- GP path: *System/Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + + + + + + + +
From aa235ef9ef42e6fa7216a75c16dec08bde0cd0b2 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Wed, 24 Nov 2021 17:05:05 +0530 Subject: [PATCH 0109/1077] fix --- .../mdm/policy-csp-storage.md | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 7c441baca0..cdf3d508a1 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -857,10 +857,10 @@ Audit/Warn – P1: in the future, will consider Audit/Warn modes with customer j >[!NOTE] > WPD policy is not a reliable policy for removable storage - admin can not use WPD policy to block removable storage, e.g. if an end-user is using an USB thumb drive under a WPD policy, the policy may block PTP/MTP/etc, but end-user can still browser the USB via explorer. -Supported values for this policy are: -- Not configured -- 1-Enabled -- 0-Disabled +Supported values for this policy are: +- Not configured +- Enabled +- Disabled @@ -945,8 +945,8 @@ Audit/Warn – P1: in the future, will consider Audit/Warn modes with customer j Supported values for this policy are: - Not configured -- 1-Enabled -- 0-Disabled +- Enabled +- Disabled @@ -1031,8 +1031,8 @@ Audit/Warn – P1: in the future, will consider Audit/Warn modes with customer j Supported values for this policy are: - Not configured -- 1-Enabled -- 0-Disabled +- Enabled +- Disabled @@ -1117,8 +1117,8 @@ Audit/Warn – P1: in the future, will consider Audit/Warn modes with customer j Supported values for this policy are: - Not configured -- 1-Enabled -- 0-Disabled +- Enabled +- Disabled From a434405f888184557819da4da5d76ee1530e8d5b Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 24 Nov 2021 17:38:34 +0530 Subject: [PATCH 0110/1077] Update policy-csp-search.md --- .../mdm/policy-csp-search.md | 73 +++++++++++++++++++ 1 file changed, 73 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 8eb0dbe3ea..667994f6ca 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -24,6 +24,9 @@ manager: dansimp
Search/AllowCloudSearch
+
+ Search/AllowCortanaInAAD +
Search/AllowFindMyFiles
@@ -138,6 +141,76 @@ The following list shows the supported values:
+ +**Search/AllowCortanaInAAD** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + + + +ADMX Info: +- GP English name: *Allow Cloud Search* +- GP name: *AllowCortanaInAAD* +- GP element: *AllowCloudSearch_Dropdown* +- GP path: *Windows Components/Search* +- GP ADMX file name: *Search.admx* + + + + +This is a simple boolean value, default false, that can be set by MDM policy to allow the Cortana Page in OOBE when logged in with an AAD account. + + + + +
+ From fcc0a6224db041d4a29d540b95ca60fe0c82ef1b Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Wed, 24 Nov 2021 18:09:12 +0530 Subject: [PATCH 0111/1077] correction! --- windows/client-management/mdm/policy-csp-storage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index cdf3d508a1..318ae0e1ce 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -1124,7 +1124,7 @@ Supported values for this policy are: ADMX Info: - GP Friendly name: *WPD Devices: Deny write access* -- GP name: *WPDDevices_DenyWrite_Access_2* +- GP name: *WPDDevices_DenyWrite_Access_1* - GP path: *System/Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* From 58631b2a54ea4644dceec28f1c31e577e3c0aedf Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 24 Nov 2021 19:00:02 +0530 Subject: [PATCH 0112/1077] Update policy-csp-printers.md --- .../mdm/policy-csp-printers.md | 302 ++++++++++++++++++ 1 file changed, 302 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index 3902457217..d6f2240333 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -22,6 +22,18 @@ manager: dansimp ## Printers policies
+
+ Printers/ApprovedUsbPrintDevices +
+
+ Printers/ApprovedUsbPrintDevicesUser +
+
+ Printers/EnableDeviceControl +
+
+ Printers/EnableDeviceControlUser +
Printers/PointAndPrintRestrictions
@@ -42,6 +54,296 @@ manager: dansimp
+ +**Printers/ApprovedUsbPrintDevices** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy implements the print portion of the Device Control requirements. +These requirements include restricting printing to USB connected printers which match a list of approved USB Vid/Pid combinations or to corporate connected printers while either directly connected to the corporate network or when using a VPN connection to the corporate network. +This policy will contain the comma separated list of approved USB Vid&Pid combinations which the print spooler will allow to print when Device Control is enabled. +The format of this setting is /[,/] + +Parent deliverable: 26209274 - Device Control: Printer + + + +ADMX Info: +- GP Friendly name: *Support for new Device Control Print feature* +- GP name: *ApprovedUsbPrintDevices* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + + + +
+ + +**Printers/ApprovedUsbPrintDevicesUser** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy implements the print portion of the Device Control requirements. +These requirements include restricting printing to USB connected printers which match a list of approved USB Vid/Pid combinations or to corporate connected printers while either directly connected to the corporate network or when using a VPN connection to the corporate network. +This policy will contain the comma separated list of approved USB Vid&Pid combinations which the print spooler will allow to print when Device Control is enabled. +The format of this setting is /[,/] + + + + +ADMX Info: +- GP Friendly name: *Support for new Device Control Print feature* +- GP name: *ApprovedUsbPrintDevicesUser* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
+ + +**Printers/EnableDeviceControl** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy implements the print portion of the Device Control requirements. +These requirements include restricting printing to USB connected printers which match a list of approved USB Vid/Pid combinations or to corporate connected printers while either directly connected to the corporate network or when using a VPN connection to the corporate network. +This policy will control whether the print spooler will attempt to restrict printing as part of Device Control. + +The default value of the policy will be Unconfigured. + +If the policy value is either Unconfigured or Disabled the print spooler will not restrict printing. + +If the policy value is Enabled the print spooler will restrict local printing to USB devices in the Approved Device list. + + + + + +ADMX Info: +- GP Friendly name: *Support for new Device Control Print feature* +- GP name: *EnableDeviceControl* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + + +
+ + + +**Printers/EnableDeviceControlUser** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +This policy implements the print portion of the Device Control requirements. +These requirements include restricting printing to USB connected printers which match a list of approved USB Vid/Pid combinations or to corporate connected printers while either directly connected to the corporate network or when using a VPN connection to the corporate network. +This policy will control whether the print spooler will attempt to restrict printing as part of Device Control. + +The default value of the policy will be Unconfigured. + +If the policy value is either Unconfigured or Disabled the print spooler will not restrict printing. + +If the policy value is Enabled the print spooler will restrict local printing to USB devices in the Approved Device list. + + + + + +ADMX Info: +- GP Friendly name: *Support for new Device Control Print feature* +- GP name: *EnableDeviceControlUser* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + + +
+ **Printers/PointAndPrintRestrictions** From a4c6bd8998a1d2c2b32439f5d2d5dc2f5a5c8205 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 24 Nov 2021 19:27:49 +0530 Subject: [PATCH 0113/1077] Update policy-csp-power.md --- .../client-management/mdm/policy-csp-power.md | 68 +++++++++++++++++++ 1 file changed, 68 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 367d969417..e8b4361743 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -22,6 +22,9 @@ manager: dansimp ## Power policies
+
+ Power/AllowHibernate +
Power/AllowStandbyStatesWhenSleepingOnBattery
@@ -98,6 +101,71 @@ manager: dansimp > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +
+ + +**Power/AllowHibernate** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + + + + +ADMX Info: +- GP Friendly name: *Decides if hibernate on the machine is allowed or not* +- GP name: *AllowHibernate* +- GP path: *System/Power Management/Sleep Settings* +- GP ADMX file name: *power.admx* + + + +
From f8f49eb21fb57214ae41e6fad3c026c7e781c7e2 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Mon, 29 Nov 2021 10:44:49 +0500 Subject: [PATCH 0114/1077] Update deploy-whats-new.md --- windows/deployment/deploy-whats-new.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index b092bc6e3c..cb6320f60a 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -92,7 +92,7 @@ The following Delivery Optimization policies are removed in the Windows 10, vers - Intune console updates: target version is now available allowing you to specify which version of Windows 10 you want devices to move to. Additionally, this capability enables you to keep devices on their current version until they reach end of service. Check it out in Intune, also available as a Group Policy and Configuration Service Provider (CSP) policy. - Validation improvements: To ensure devices and end users stay productive and protected, Microsoft uses safeguard holds to block devices from updating when there are known issues that would impact that device. Also, to better enable IT administrators to validate on the latest release, we have created a new policy that enables admins to opt devices out of the built-in safeguard holds. -- [**Automatic Restart Sign-on (ARSO)**](/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically log on as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. +- [**Automatic Restart Sign-on (ARSO)**](/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-): Windows will automatically log on as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. - [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will be a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. - **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally. - **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again. @@ -221,4 +221,4 @@ For more information, see the following guides: [Windows 10 release information](/windows/windows-10/release-information)
[Windows 10 Specifications & Systems Requirements](https://www.microsoft.com/windows/windows-10-specifications)
[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md)
-[Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md)
\ No newline at end of file +[Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md)
From 5f70354e96cd88c2f0e4ccebda539d1d37c192f2 Mon Sep 17 00:00:00 2001 From: Rick Munck <33725928+jmunck@users.noreply.github.com> Date: Mon, 29 Nov 2021 16:42:16 -0500 Subject: [PATCH 0115/1077] Update security-compliance-toolkit-10.md Updated Edge to v96 --- .../security-compliance-toolkit-10.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md b/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md index 2d66169700..a7d705c22e 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md @@ -50,7 +50,7 @@ The Security Compliance Toolkit consists of: - Office 2016 - Microsoft Edge security baseline - - Edge Browser Version 93 + - Edge Browser Version 96 - Tools - Policy Analyzer tool From 05da0a4d72ea29d814cd086a1bc52f1b090cc245 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Tue, 30 Nov 2021 17:22:03 +0530 Subject: [PATCH 0116/1077] Update policy-csp-update.md --- .../mdm/policy-csp-update.md | 101 ++++++++++++++++-- 1 file changed, 90 insertions(+), 11 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index c38caf5830..edc685637d 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -72,6 +72,9 @@ manager: dansimp
Update/ConfigureDeadlineGracePeriod
+
+ Update/ConfigureDeadlineGracePeriodForFeatureUpdates +
Update/ConfigureDeadlineNoAutoReboot
@@ -1333,8 +1336,7 @@ The following list shows the supported values: - -Allows IT admins to specify the number of days a user has before feature updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule. +Allows admins to specify the number of days before feature updates are installed on the device automatically. Before the deadline, restarts can be scheduled by users or automatically scheduled outside of active hours, according to [Update/ConfigureDeadlineNoAutoReboot](#update-configuredeadlinenoautoreboot). After the deadline passes, restarts will occur regardless of active hours and users will not be able to reschedule. ADMX Info: @@ -1346,7 +1348,7 @@ ADMX Info: -Supports a numeric value from 2 - 30, which indicates the number of days a device will wait until performing an aggressive installation of a required feature update. +Supports a numeric value from 0-30 (2-30 in Windows 10, versions 1803 and 1709), which indicates the number of days a device will wait until performing an aggressive installation of a required feature update. Note that when set to 0, the update will download and install immediately upon offering, but might not finish within the day due to device availability and network connectivity. Default value is 7. @@ -1410,8 +1412,7 @@ Default value is 7. - -Allows IT admins to specify the number of days a user has before quality updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule. +Allows admins to specify the number of days before quality updates are installed on a device automatically. Before the deadline, restarts can be scheduled by users or automatically scheduled outside of active hours, according to [Update/ConfigureDeadlineNoAutoReboot](#update-configuredeadlinenoautoreboot). After deadline passes, restarts will occur regardless of active hours and users will not be able to reschedule. ADMX Info: @@ -1423,7 +1424,7 @@ ADMX Info: -Supports a numeric value from 2 - 30, which indicates the number of days a device will wait until performing an aggressive installation of a required quality update. +Supports a numeric value from 0-30 (2-30 in Windows 10, versions 1803 and 1709), which indicates the number of days a device will wait until performing an aggressive installation of a required feature update. Note that when set to 0, the update will download and install immediately upon offering, but might not finish within the day due to device availability and network connectivity. Default value is 7. @@ -1487,8 +1488,7 @@ Default value is 7. - -Allows the IT admin (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)) to specify a minimum number of days until restarts occur automatically. Setting the grace period may extend the effective deadline set by the deadline policies. +When used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates),allows the admin to specify a minimum number of days until restarts occur automatically for quality updates. Setting the grace period might extend the effective deadline set by the deadline policy. If [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)) is configured but this policy is not, then the default value of 2 will be used. @@ -1501,7 +1501,7 @@ ADMX Info: -Supports a numeric value from 0 - 7, which indicates the minimum number of days a device will wait until performing an aggressive installation of a required update once deadline has been reached. +Supports a numeric value from 0-7, which indicates the minimum number of days a device will wait before it restarts automatically after installing a required quality update. Default value is 2. @@ -1515,6 +1515,84 @@ Default value is 2.
+ +**Update/ConfigureDeadlineGracePeriodForFeatureUpdates** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + + +When used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates), allows the admin to specify a minimum number of days until restarts occur automatically for feature updates. Setting the grace period may extend the effective deadline set by the deadline policy. If [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) is configured but this policy is not, then the value from [Update/ConfigureDeadlineGracePeriod](#update-configuredeadlinegraceperiod) will be used; if that policy is also not configured, then the default value of 2 will be used. + + + +ADMX Info: +- GP Friendly name: *Specify deadlines for automatic updates and restarts* +- GP name: *ConfigureDeadlineGracePeriodForFeatureUpdates* +- GP element: *ConfigureDeadlineGracePeriodForFeatureUpdates* +- GP path: *Administrative Templates\Windows Components\WindowsUpdate* +- GP ADMX file name: *WindowsUpdate.admx* + + + +Supports a numeric value from 0-7, which indicates the minimum number of days a device will wait before it restarts automatically after installing a required feature update. +Default value is 2. + + + + + + + + + + +
+ **Update/ConfigureDeadlineNoAutoReboot** @@ -1565,10 +1643,11 @@ Default value is 2. +When used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)), devices will delay automatically restarting until both the deadline and grace period have expired, even if applicable updates are already installed and pending a restart. -If enabled (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)), devices will not automatically restart outside of active hours until the deadline is reached, even if applicable updates are already installed and pending a restart. +When disabled, if the device has installed updates and is outside of active hours, it might attempt an automatic restart before the deadline. -When disabled, if the device has installed the required updates and is outside of active hours, it may attempt an automatic restart before the deadline. + ADMX Info: From 0f60a6706e4a67acc18c2057c9f8285a1914e603 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Thu, 2 Dec 2021 11:06:01 +0530 Subject: [PATCH 0117/1077] Added windows 10 After reading this article, I added windows 10 under applies to section. --- windows/whats-new/windows-11-prepare.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/whats-new/windows-11-prepare.md b/windows/whats-new/windows-11-prepare.md index 18d9c7bbea..f76ae48be7 100644 --- a/windows/whats-new/windows-11-prepare.md +++ b/windows/whats-new/windows-11-prepare.md @@ -18,6 +18,7 @@ ms.collection: highpri **Applies to** - Windows 11 +- Windows 10 Windows 10 and Windows 11 are designed to coexist, so that you can use the same familiar tools and process to manage both operating systems. Using a single management infrastructure that supports common applications across both Windows 10 and Windows 11 helps to simplify the migration process. You can analyze endpoints, determine application compatibility, and manage Windows 11 deployments in the same way that you do with Windows 10. From f4d4d41af079a31a49eeebd296d6598517f87073 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Fri, 3 Dec 2021 12:20:39 +0530 Subject: [PATCH 0118/1077] Converted Html tables to md format --- .../mdm/policy-csp-admx-terminalserver.md | 3565 ++++------------- 1 file changed, 716 insertions(+), 2849 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index deab09567c..fadaf0bcba 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -399,38 +399,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CERTIFICATE_TEMPLATE_POLICY** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -475,38 +451,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_1** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -524,38 +476,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_1** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -593,44 +521,20 @@ ADMX Info: -
+ **ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_2** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -675,38 +579,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_ALLOW_UNSIGNED_FILES_1** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -746,38 +626,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_ALLOW_UNSIGNED_FILES_2** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -817,38 +673,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_AUDIO** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -892,38 +724,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_AUDIO_CAPTURE** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -965,38 +773,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_AUDIO_QUALITY** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1040,38 +824,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_CLIPBOARD** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1115,38 +875,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_COM** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1190,38 +926,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_DEFAULT_M** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1265,38 +977,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_DISABLE_HARDWARE_MODE** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1336,38 +1024,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_DISABLE_PASSWORD_SAVING_1** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1407,38 +1071,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_LPT** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1478,38 +1118,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_PNP** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1552,38 +1168,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_PRINTER** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1625,38 +1217,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1703,38 +1271,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_2** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1781,38 +1325,14 @@ ADMX Info: **ADMX_TerminalServer/TS_CLIENT_TURN_OFF_UDP** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1852,38 +1372,14 @@ ADMX Info: **ADMX_TerminalServer/TS_COLORDEPTH** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1931,38 +1427,14 @@ ADMX Info: **ADMX_TerminalServer/TS_DELETE_ROAMING_USER_PROFILES** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2007,38 +1479,14 @@ ADMX Info: **ADMX_TerminalServer/TS_DISABLE_REMOTE_DESKTOP_WALLPAPER** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2079,38 +1527,14 @@ ADMX Info: **ADMX_TerminalServer/TS_DX_USE_FULL_HWGPU** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2153,38 +1577,14 @@ ADMX Info: **ADMX_TerminalServer/TS_EASY_PRINT** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2227,38 +1627,14 @@ ADMX Info: **ADMX_TerminalServer/TS_EASY_PRINT_User** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2301,38 +1677,14 @@ ADMX Info: **ADMX_TerminalServer/TS_EnableVirtualGraphics** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2376,38 +1728,14 @@ ADMX Info: **ADMX_TerminalServer/TS_FALLBACKPRINTDRIVERTYPE** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2455,38 +1783,14 @@ ADMX Info: **ADMX_TerminalServer/TS_FORCIBLE_LOGOFF** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2528,38 +1832,14 @@ ADMX Info: **ADMX_TerminalServer/TS_GATEWAY_POLICY_ENABLE** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2604,38 +1884,14 @@ ADMX Info: **ADMX_TerminalServer/TS_GATEWAY_POLICY_AUTH_METHOD** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2677,38 +1933,14 @@ ADMX Info: **ADMX_TerminalServer/TS_GATEWAY_POLICY_SERVER** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2755,38 +1987,14 @@ ADMX Info: **ADMX_TerminalServer/TS_JOIN_SESSION_DIRECTORY** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2832,38 +2040,14 @@ ADMX Info: **ADMX_TerminalServer/TS_KEEP_ALIVE** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2905,38 +2089,14 @@ ADMX Info: **ADMX_TerminalServer/TS_LICENSE_SECGROUP** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2981,38 +2141,14 @@ ADMX Info: **ADMX_TerminalServer/TS_LICENSE_SERVERS** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3056,38 +2192,14 @@ ADMX Info: **ADMX_TerminalServer/TS_LICENSE_TOOLTIP** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3129,38 +2241,14 @@ ADMX Info: **ADMX_TerminalServer/TS_LICENSING_MODE** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3205,38 +2293,14 @@ ADMX Info: **ADMX_TerminalServer/TS_MAX_CON_POLICY** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3283,38 +2347,14 @@ ADMX Info: **ADMX_TerminalServer/TS_MAXDISPLAYRES** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3354,38 +2394,14 @@ ADMX Info: **ADMX_TerminalServer/TS_MAXMONITOR** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3425,38 +2441,14 @@ ADMX Info: **ADMX_TerminalServer/TS_NoDisconnectMenu** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3501,38 +2493,14 @@ ADMX Info: **ADMX_TerminalServer/TS_NoSecurityMenu** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3572,38 +2540,14 @@ ADMX Info: **ADMX_TerminalServer/TS_PreventLicenseUpgrade** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3649,38 +2593,14 @@ ADMX Info: **ADMX_TerminalServer/TS_PROMT_CREDS_CLIENT_COMP** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3725,38 +2645,14 @@ ADMX Info: **ADMX_TerminalServer/TS_RADC_DefaultConnection** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3799,38 +2695,14 @@ ADMX Info: **ADMX_TerminalServer/TS_RDSAppX_WaitForRegistration** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3871,38 +2743,14 @@ ADMX Info: **ADMX_TerminalServer/TS_RemoteControl_1** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3941,38 +2789,14 @@ ADMX Info: **ADMX_TerminalServer/TS_RemoteControl_2** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4011,38 +2835,14 @@ ADMX Info: **ADMX_TerminalServer/TS_RemoteDesktopVirtualGraphics** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4085,38 +2885,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SD_ClustName** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4160,38 +2936,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SD_EXPOSE_ADDRESS** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4234,38 +2986,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SD_Loc** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4311,38 +3039,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SECURITY_LAYER_POLICY** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4387,38 +3091,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SELECT_NETWORK_DETECT** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4463,38 +3143,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SELECT_TRANSPORT** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4536,38 +3192,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4608,38 +3240,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SERVER_AUTH** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4685,38 +3293,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SERVER_AVC_HW_ENCODE_PREFERRED** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4756,38 +3340,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SERVER_AVC444_MODE_PREFERRED** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4819,43 +3379,20 @@ ADMX Info:
+ **ADMX_TerminalServer/TS_SERVER_COMPRESSOR** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4901,38 +3438,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SERVER_IMAGE_QUALITY** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4971,43 +3484,20 @@ ADMX Info:
+ **ADMX_TerminalServer/TS_SERVER_LEGACY_RFX** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -5048,38 +3538,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SERVER_PROFILE** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -5120,38 +3586,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SERVER_VISEXP** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -5191,38 +3633,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SERVER_WDDM_GRAPHICS_DRIVER** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -5262,38 +3680,14 @@ ADMX Info: **ADMX_TerminalServer/TS_Session_End_On_Limit_1** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -5339,38 +3733,14 @@ ADMX Info: **ADMX_TerminalServer/TS_Session_End_On_Limit_2** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -5416,38 +3786,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_1** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -5491,38 +3837,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_2** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -5566,38 +3888,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_1** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -5642,38 +3940,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_2** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -5718,38 +3992,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SESSIONS_Limits_1** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -5795,38 +4045,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SESSIONS_Limits_2** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -5872,38 +4098,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SINGLE_SESSION** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -5944,38 +4146,14 @@ ADMX Info: **ADMX_TerminalServer/TS_SMART_CARD** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -6018,38 +4196,14 @@ ADMX Info: **ADMX_TerminalServer/TS_START_PROGRAM_1** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -6092,38 +4246,14 @@ ADMX Info: **ADMX_TerminalServer/TS_START_PROGRAM_2** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -6166,38 +4296,14 @@ ADMX Info: **ADMX_TerminalServer/TS_TEMP_DELETE** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -6240,38 +4346,14 @@ ADMX Info: **ADMX_TerminalServer/TS_TEMP_PER_SESSION** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -6313,38 +4395,14 @@ ADMX Info: **ADMX_TerminalServer/TS_TIME_ZONE** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -6387,38 +4445,14 @@ ADMX Info: **ADMX_TerminalServer/TS_TSCC_PERMISSIONS_POLICY** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -6461,38 +4495,14 @@ ADMX Info: **ADMX_TerminalServer/TS_TURNOFF_SINGLEAPP** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -6535,38 +4545,14 @@ ADMX Info: **ADMX_TerminalServer/TS_UIA** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -6602,43 +4588,20 @@ ADMX Info:
+ **ADMX_TerminalServer/TS_USB_REDIRECTION_DISABLE** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -6676,38 +4639,14 @@ ADMX Info: **ADMX_TerminalServer/TS_USER_AUTHENTICATION_POLICY** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -6749,38 +4688,14 @@ ADMX Info: **ADMX_TerminalServer/TS_USER_HOME** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -6824,38 +4739,14 @@ ADMX Info: **ADMX_TerminalServer/TS_USER_MANDATORY_PROFILES** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -6898,38 +4789,14 @@ ADMX Info: **ADMX_TerminalServer/TS_USER_PROFILES** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProNoNo
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
From 61c39782ff7a47c6cc5f3d3604210faacd5ac10b Mon Sep 17 00:00:00 2001 From: JW0914 Date: Sat, 4 Dec 2021 09:34:04 -0600 Subject: [PATCH 0119/1077] Update resolution-procedures.md Error 0x8007025D can [occur](https://superuser.com/questions/1691157/how-to-fix-error-0x8007025d-when-installing-windows-10) during the installation of Windows due to an issue with the storage medium; in the case of WinPE, this is RAM since WinPE is mounted into the RAM disk mounted at `X:` --- windows/deployment/upgrade/resolution-procedures.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/upgrade/resolution-procedures.md b/windows/deployment/upgrade/resolution-procedures.md index 227541cee7..619b51c300 100644 --- a/windows/deployment/upgrade/resolution-procedures.md +++ b/windows/deployment/upgrade/resolution-procedures.md @@ -93,7 +93,7 @@ See the following general troubleshooting procedures associated with a result co | Error Codes | Cause | Mitigation | | --- | --- | --- | |0x80070003- 0x20007|This is a failure during SafeOS phase driver installation.|[Verify device drivers](/windows-hardware/drivers/install/troubleshooting-device-and-driver-installations) on the computer, and [analyze log files](log-files.md#analyze-log-files) to determine the problem driver.| -|0x8007025D - 0x2000C|This error occurs if the ISO file's metadata is corrupt.|Re-download the ISO/Media and re-attempt the upgrade

Alternatively, re-create installation media the [Media Creation Tool](https://www.microsoft.com/software-download/windows10).| +|0x8007025D - 0x2000C|This error occurs if the ISO file's metadata is corrupt or if there is an issue with the storage medium, such as a RAM module containing bad blocks during the installation of Windows.|Re-download the ISO/Media and re-attempt the upgrade

Alternatively, re-create installation media the [Media Creation Tool](https://www.microsoft.com/software-download/windows10).| |0x80070490 - 0x20007|An incompatible device driver is present.|[Verify device drivers](/windows-hardware/drivers/install/troubleshooting-device-and-driver-installations) on the computer, and [analyze log files](log-files.md#analyze-log-files) to determine the problem driver.| |0xC1900101 - 0x2000c|An unspecified error occurred in the SafeOS phase during WIM apply. This can be caused by an outdated driver or disk corruption.|Run checkdisk to repair the file system. For more information, see the [quick fixes](quick-fixes.md) section in this guide.
Update drivers on the computer, and select "Download and install updates (recommended)" during the upgrade process. Disconnect devices other than the mouse, keyboard and display.| |0xC1900200 - 0x20008|The computer doesn’t meet the minimum requirements to download or upgrade to Windows 10.|See [Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications) and verify the computer meets minimum requirements.

Review logs for [compatibility information](/archive/blogs/askcore/using-the-windows-10-compatibility-reports-to-understand-upgrade-issues).| From 6dffc51c02de88b526c99178b9f9bc317632d33d Mon Sep 17 00:00:00 2001 From: Andrei-George Stoica <5600871+andreiztm@users.noreply.github.com> Date: Thu, 9 Dec 2021 00:55:06 +0200 Subject: [PATCH 0120/1077] Final draft from mail version --- windows/deployment/TOC.yml | 2 + .../media/specify-update-type-sources.png | Bin 0 -> 226716 bytes windows/deployment/update/wufb-wsus.md | 78 ++++++++++++++++++ 3 files changed, 80 insertions(+) create mode 100644 windows/deployment/update/media/specify-update-type-sources.png create mode 100644 windows/deployment/update/wufb-wsus.md diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 0785a4e3d4..6eb965d5b3 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -167,6 +167,8 @@ href: update/waas-manage-updates-wufb.md - name: Configure Windows Update for Business href: update/waas-configure-wufb.md + - name: Use Windows Update for Business and WSUS + href: update/wufb-wsus.md - name: Windows Update for Business deployment service href: update/deployment-service-overview.md items: diff --git a/windows/deployment/update/media/specify-update-type-sources.png b/windows/deployment/update/media/specify-update-type-sources.png new file mode 100644 index 0000000000000000000000000000000000000000..92d8bc13568399a7cfae426f1e68640c9fd49d43 GIT binary patch literal 226716 zcmdRV1y>y1(k=vd2tGIj3GNPqOM-?3x8MYKA7pTM4}-hAyF-xR?(XhzIp;m+yWcOk zYu#FF*3|Clp0&HWs(RP+)DBTnkVZoWAVWbxp~=cfe1n35g@%HHX+wm6KXSzgN`C)> zcK9YO230;reDFSiH5HW?g@USzLV5lP_dZ6lmCMc)JLiD?< z?(qtOKC$$Q@avwt%30fd><*2~z>2Jlox2!$0D2eF^Ll{)M?@C?JFg9|xASfk{|PXX z|3{e*6f?4NAMuA)62q36zE+p6I<>8No1A?rIr@||KYJxR%YSn6XKZXN!?|5RpycrM z6kQZCAf9Y^{I%lgtre5mXb~Uz%JU%2a>;{PT~)2zVWFWEUm`BGv2k%RiHU*!{;>Nu?q-~+gDw9#!LbMl_QMyC_LdeRD=RBA8ymHL*VvPXDic!x}|G6qDZFW|blan*ErbdMjla+ztD-x;+m|Sx{{H?!0b=a`{uoL{hE3=3w70j1;rh(+Ka*7}Oiw5NL`^LT zGQ|9!Q;j(R2_hma@X-JKad5eQQBhHh8tMm3tbdC<;Qy*0|Cd@^U0vO73RkM##D4k9 zQW%1-8-+j`h2kqh&fcKLJ9MssNLi8K{isR}!st*fsT+=uwZA2W`^SQm{NBSOBMA^} z^bfqp+>TClIVCkP!VngAH6=+9@ZolU3jE$AO0AGmDt8i0BZG)W@-@ z6kQ?yD-^KmgDh&yMDO3beHSMA1GG)ExbC#1U(;lJ#nixX^k2`oD&axIyy^7m(#Pa3 zL346)nr~_NAmDP^zv_jctfK=C^-^uE69ucShW7w@at*vRNF%4meN?!x*@`$aqaf(= z%Z`NxUok^d;G^0RoqsTYm|*CEg?);^75T?8k}~AexG899r4JrRPCg|iL0bMA8=G!v zMFB}4nE0c-pO$1s27{lSFC<7{&!0T^4=ts|b(j{@jy5WtdXAj4^YU<|9H{aYY`_%# z&;){rp+i4!M2Qe7sqhBnVe@mLrvCbBEOdrj;v%d3U^UxO_oeXn>l)N#_O|iNZ|L@h zw~^Szk}V~IX~W;iDs|{nRK|Vqs&4W;S|_>>AG`~ND9j4+020x#uyh2;UiPIE!g?@( z&$iQX+Pa|AFLwuu-T>hJ#@j~P+M}w`*#5Tt+Y^{MCadxp8G zR=uh5$&fuXA3YEZO9hKq3<|}i0-XgCWfzYRDk`jceI9Y$K8cJE`}VKUOezQrgkSbJ zYjfQUq0P<^z9~}t{Qd~M?gZAla`ax1LHFK300$=dTGGhS&dwfly&W7hqb`4Fu&;r^CM!O2ls;}P|EnBzzQ&7q7f1*h$&Sfv65&xqEx$2Sx9_X zws)PgD*^SY45_I)`=_^|LqX-`P|X71VWT>DEJO*wHPtO_VYlMj(`P%ACQ>aj=Friw z#s?npJsnO-SJ#rkyV;<=65qse#>m#}uSeQZp za%LeUGSYeegqwU{Je!d9C_<_00~mV3yw%_*ek*f}`mAq09zH*R+y3!o2*lv>^-ofe$LC{zF@1 zLK)~ip=JMsflm4YB@+7T43z*-Xh5(cIWe>RCFWsDyG+V6>dwVUkK*~tyI)JsHk9@v zgy?FF0fms7O0vmeUDYa$1V1PuVi6?$eEJRW#*T=I7>)yr2#MY-dh1tjcw@LTpuek@ zI&BFLCn7KS*&-lyYICAxJ^#cTlt1GE-1C9%r)*#pq#Oe`2z^^_SRMpNOS+67FNn5M zPO%cP8>LX(T}3*Q9Zo!WJ^ZMrz2v`KH8ai%E*1;|I1mlUxHJmB)w<{!rPRPDdaRlD z*hr=Coe*bPU-R4w6N3b#wa(0T+&_~th$kL#^uH3!x(Z{jROciVaLztW#&0B>hwBgS z!OubH4)wkJICf@U_b%MuP}?tJ%^rdNEu`(ZccBds045wF0%GEths9dLTh~+d*`4SP z>+}5w@ZC_Ta>v`i;%k?ivcx5u?MuwfEkhcGxpb3aHrJ^k+hH|fn=ZrBkLO@}j{%hi zRIfL&S+#d_4`q9k>+cl*NRoTEIX|L4Yd?AJ-|n5uthPEhos$z=-sN++y2_TV31fLN za=KWRhb%vQ=nfRsv|}WFHFzXT3m1kiC_*SRbBFA@DQF0gcQ+Y|=gp*z_hvazIy4A~ zMY#WYIr|azT&~dO*e6brQBA=fJ{>ZMO>FnUpVobVkT-<(95FN~9X14eZ{g_aFLHp9 zZlK+jO}BY)+}2K;`RnfP`AgjrX%_|pgy=^b`p)gLO~kYgx910!kt|wU`(CG@vpwQQ zIm9EfSYy^l*{ebcP?%mbL%Obw%WBmyW$Gm{WvEp+_ll?+$TfQhL{abH-;BjQ=Eb|* zPDq*BOr@haFkIOmXI*gt+KnJX2iQn3K20;d0D=q?_8tlcCQoa+vP*$mpB=LHRo&{m zi6XC$uHFLw4nsl=l#lZN;Blb;#%ziVc4UAES=|E`q-XW=h9xhXbv@uMx>Emq=BRofYR8 zWA~$8xRQ$ZJPB#@xKnVYj5Pwk759ZzTHKND?B!uXDa9uw1h^MW-nV8boouXRHN4*U zOpL#t4O{ zzjylVMnY{B<1Uk~gx12;CN;LU?i5+s)-$U1w^!WY1SUckk17{f_#RCbL^)qw?gcU4 z7P@wXU0aw(oxg01qn8rpl-cYz2d<56gzLC4|1mV)w>QiaNWa)KF7zD<|B{T7kJ>P{G2-b81_JkMz_;Fw!f2&w;H&&+;cZ^R)N!nagKcbzNqv&&xBUj7b~_mO zG=a_j2lSv?UvhUBauPS$u@q!&b3L#*vG#B;|IwbdiuUo+Qae1k?*FQFaj_`(NeZvXEiVsg7MGY%tPKrgfklL*lAK13|f*DAZ&cEEo#h(1*Y-YU+1#kS=<%VIo&1swA zW|F?UY@@w~vQO7$Jt)eOXu`?4&|r`e=rkgub{*v0A!O0$6bZJktLR`GrYycB9wS)d z&2S9bcB9+@Wz{=;!k!NjuXo@zocXPrv{=PHFY))cnQpflw?_-t8s%SJi_%L$vK!t- zuh})&L&a%IwI>f?g=LTZ@{&hS2fM4j&Fa8KZV-hbJnHEW)?sd3d9e0%>4l}YQ98IC z{2k=XXR=B^B`DA?Iuj!P5?K{;92XM0sZOl6a1AKajav7c`FCn6cq4$?F*X+OM|5S8 zd|!jXx7rp*R1$Jzeo66-X2yf=z|RjqK+GQvrd4EX@zMp>bjfah~%@z1r+ua4VaAQkE`p~Q1fDm4KCOo)W z#OvvuyD1o%s(pRlAffw&mW$ieaI2Lgyg)A4eES$g*&sUjjJA)@-%PnP`Y0Gu%_zk* z{!_9cVoQ;SaXHV8cn8!~?_faFjxk<#in?b&!T=-pX$8rX##8UAQ#!gFAFaQppMLyG zIcoe(SYYnV=RD^FhN$o-@?|Fw_t@=i6z7KoFvD`d>oMw zOwdO$-ekM_7%%iEqvQfwZA-(sqe-3P$1f5Rj(LREn4PbNu&r~xK80W?wBKcB^^faH zdE_}}=*W25;B?6ba_ilQ%I$bc3MTA;yeWOzr~nQlY0qp7*$~oRP2x%dOV)$3VWVj$ zhB!Q-{lh~kL_lutC+XRbWoZ|Mf2s60X|*tJRuTBj06VG+NXQT~;hVJ$p8$IstN3wg zwbP~ehuAx7VW+P+hLrxF)oPimLlXDYmv}c`zF)Jpb9LF1{pl;_*=xq2)pQATxQI*$ zD?Kbg1p0Dv?rup9{9}?mVS&9fpTYNcpI!xW)H85>{=g+q2dVt#h}t%Up!#Jv;n-G5 z350*meQRthLWr+#YZDZF)uhO**=a<4&2BoJj4{Bx?q$i_ewcB$|WS$mF_C#0<$#9N@i?4Nlw;7D9*>T;R zw5!jM06UkohEMS{&d5Yv#KOCblbDdRNXAF$5tlHIscE3C_FqMxHV(fSSeZgDj(Z$f zb5F0EIinJUv1RXCxATy5>LJpMDK-a@d6WhfI*OAm3kfby?PBV>%i_$s zd2s4C26a^~<-!s@67Ahe-}Yo-1Akb2p=#dWko4{4<}#^ z`FDt+nufct9Q`}QQb(Ub-rF+?HnmV96<;YaF;6;uyyqJ^uBSU9gJ#=)kS#V|xth&Y zJt}ELa9sxpMNW{pI0t2{EdU;068k4G-rVS}@0+~?K+hviSrFlesfls#SEK!dg1G>0 zn^l}*0Tuki{bR)U((OiGwS;Tik)O(fP!3(>dSbyh&HXbN2aOo9$i;`+ZkAKu&CZ(L zNcU`y48Y5At@I`uM>#V1mC`iCn6iW60G%M$d}3V#Mgm?d_5h8iathOQZpvctkrK?0 zrohsCa*_lA9T7ImV;RQxO(SljiHg@BB#&Jq17d3+6N~+-vsd2h9Ec#+;}rygB=mF) z5j&dez+0>_RV*wjGLM&f(~pTup_rP8`+GhV&uf0@@(m{=Fawp|U9s>{9z15@pLKMm zW3n$hzE8W*M(aV<2Ap7B5;{hjUBI57OcH2$T|LOUi5W*1RwllXu->j#lK7GFBH0vS zm@6zn(UEuuUl4O8{#afHFjY_;KZF@g5HBP+xSTjUq6{_J<1+&biyBBuh(^Rb5D)1W z0>2iK^4hfj7%9;QiWnbNme0Rvl7R#r^> z{QQ(f3V3@Lq&EK`M9sO{htNK++2|kSSOz=OKbt25xd`2gq)l1ZOaK!@`Gx>{gr#TlB^aV zS)w*b-pS6WUa6F_JFe&BcC{O3PRh>CPFbY8V5FuK1X zRRY-mKt-va{vW8{jg5`71}#QYIA||J|BLV8AYhPw2caW=h)+zE()|x0HkpuJUH$E0 zXz9N&APv(0AcFtjsUgZ>s1xQnpP`+bo->T!Q`5lzptzLHuKzK~zwbQ&2CCuZ<;={5 zpUS}}3U{>2>!F6SBSJ4}E`sIQ3ua~0G;|?+PWWClH(4&m<=x@`CHrE9rKR6NkpNir z#{r<&+=+CeTEVDR%?1a^MBv+ta$y7_JaxrEh)M z4BOyEKjZfsUg0W~{%le@+F9CHRfs(h-|@zlhg9GQ8ro|3O5EYZI{rs;cvvj>$A(|& z;WsQm`RG^HhP8Tx7gEj>%^>b8ZFQB$q>g8YpVC(wI%dMom_iP7lq_{?7unM%Cdv&S z(Sj_b8hc(qcg%A>+vh**_tl}9pFu3`SJG2j<4d;g4Y+QbjS8f;+9S_P60dLY7MFsq zS2W@&+MZcTi0>$=LIF0&uAM^fZj3fG@JpVbLIGH}LXD=*eG}okjaPh}=O1^OE$XA3 zQZPXNJ}Th(w^{akPS|cJuADGY-KD10ijJimW2PBA!^p0$hw&A`#GAZ-J5;k#0ZB3K z2VS}IrQWrLcz~|)n%%XP#Np|7^>>1VgSCWTpqFC`0xz;No;f=wK?I6xw`jboAe=-D zZzPOh1J2uHiMygd_lIC_sX8mb@qyZwM}?42%4fW731Qi!50GT~suO$`{gEjm3g?fB z<8obxD2;I+PU5Pp!yv*MNIc63yMYjUGKsvz47!$l*2Zu+ZM9 zb-78k^SZodnTN3c@0I8tZ;uwopq(?b`)O`%4l3Na9ccxb=DRM<8hpr;8N;r3HI$kc z{f^+-0BK`cgzL`6Sx?(D9)V30hD)&2b>GVvSw!g`uIt^Cbd{41hwAbDhtOWT-}oSv z=!Xj2hj%2?R2cT|aNrzHd1JMN9m&=5OXom|qVfliuSWvMIa0$A@f+ zNvg37G#@@yzO0h9XYazr3+Yl0UP%!>O0-r!Zn6M-C{rcVgdKDjqbF4k3 z=g)HfAo&f}&lbiX{W;6uDvwR&Znyis2<3bUgfPH2Ykb z0eAX}H3X)e1lSo>Y=4nd4mW?F@-27pccv#shi}K*rey1VQrWrp3+{4@AQ>5B1e*8h zC{3-JO;2$H-nvRj*m+*s<@goI2vff>BuVxq5t3;#?l9kW&&BvV)^BGahKJd(I*Xd< zjXMqP;^HDWBt#itciEdl2dMUCCOT0q!F6sSA&o*HBqa1gt27&O+@A4nSSs^WD4EGn zVfCe9d1#|K%0;yvcIRAemYLSG!PFlGOc&n$^bSYS{eh^GZ?v&!fuGsPiysi6v6YI) zNY^!^HjanbTnOw;|PfEwRD1=ba?|?c% zd%9OPBPu+}H~Y(&L_F}ldYrobKAYs;_yqeIK2&tCY%w!6b_fN@U%=A(N7`yqHi1u| zMFldj%CX>h=>y_4ch|xqQi-c#ptuMBSZ0wsPd>gW6$e$q)5S+x59qLrRfgM&x>mFK}c$7>*t{!1?oP# zWG*I?!CE6_bk#Dtj|u8Ixff|zVQrFG2ii+C8jF28< zr6y4`3WdGW|7wmt=CF5uATh}9(%e=#9C3K3(KNqM%{SM~Ha*dd#oMwLw9?=80MuI3 zc227$tS$wb}b#LD}CFwY|JCY^9$Pu3B%O;!rl8lUKpW`W@#+ z+WC#NeH4M3zJm2rKGhG)k?BZP#|LrSkcy?~)?rPr55E4q1bBLIJw+Mc2lAND3%xDkE-4m?I3A5aP4G@uY7$z#M^}LAD-} zs|n)@`g-9bgU0N~w^Bc74Cgjh&nPwUwS}_FZ|5a7t@BXD@Uua>u$Q^>8@6<4Oz+Me z!MorSM>{Dod1&Q0B=XIMTx7N+1RmNQjC}cibnvWpRm7(hQmu>iyM)aKAsQGV%5`cb z@55b$B6EhN=l?qRO?)NhM~D_Xx->{&gsg?wd4>IXAA`nnve}NG$)AMm?VdLSoqUYh zQ{cRU>;fd3dTUef>eKNlJ-yygc>|EBAxjmY-n9Rw0jut44E7S+H4i|e=NOY;!A4~ zzLY3ICu)EB-0EJ5LUh#afWLZ0UD`?;8+n9T>eO<6q9_ys)^V1=BW#wN!t#9D>)a$V z-D+MkrIcsPsYlPyW878C){fs8GgYA23oE!dbp|@0MGfG4zmYJ?mx?Q>y*UlNxbU1l z`~@suJ?w0Fgc_&9Tyl)E8}M6DF3kh~^ilr#Vo4Ugr!r36>-tS^< z+4ZXTyEkKRu}b}T>a+669bJ;LJtmD}GlS&H{gqF%9Y%FU^dWbhC{2dQ)ZoW|Qn9cQ9Rtm^A+$XZfXVuF@ot z$N??J-J=XYWUl!@;W9ewNG)S?KKf zgWijZK(iqH1xXCdh?jla#r-y?%^KSe!3}rn@TMsK-ixI-XCI47k@%$x(H-teIrhHr z$zjzfxT?Kxkfcy6!qlLegQy8B519x58$Fx3TgdugrSYnb9)rXS((KQ*E27H12;|=9 zCk$3v2K1?ERpR@d9y5APzg<7-PV5dp=NWmK#uMh{^x07CH&@&Q8_U4Ek&fP0Vut*O zaS#vQT?I^!ClEte!ProZnDu_BCha1u{p|b*OQjhVgTxbsjc3`d{-{N$*@|r9MyRI2 znsf8_jqoznA-J`Vk>m2Ea?X{cSj8F_VkP;fWbzb6L!;k8pi}KU04`zv>5A^nMDhpC zT`;@3()_!^*hToo4IWXd)12%VZjXOTHUA4VXwQC$bM0nJp%6+L3DZsl*JPkC&_~EipO17 zA}0~xH*|>9!nt{8(H{>x%PH0Gqv5=#vSFpo!FU$uiM5zpK0P&U=v&;@_?8bJ`E_+dOA^fUc%RsS9V|Rh_6#Y2u_M<%V5c#EvW=q1493}<_%Lk3W%s*&*U~JrfMVO$U<&xBxqpT|L zQ}_HK9BRLXX$lOa3OcNE^T60dMpmvhqu3qAei%aRj3WlaoT@X9S9Z>O!xo#>U!0qn zr%I--n9;4xv5Zr8aP)!3&%1wf;!1;i65ODbc!@?F7M0Xy{Zw{z26bCtLrm})Gx{g* zJTh@pGpY`w@TNXKMYv%h)2Zos!5sD@FE{EVCsK25-p_&!&!oXH@HSzEHZ0jfeCTBX zC~OV3G>O_=B-8=sG8|CDl_a9TiAEBw;^vEA4#=vd>H*YY_#y1LPrruPw`u2pA_Y$I zna^&CY<_2Cr0f2HQedE9PSc7@8)Np-Tc5pvlFAWvK$^)rjPC8do+^~+Tazv%a?7@+ zyD4s}NXHKU^=aR5a>bP(LC911z&&lStD7%1u$x*x*dGN zWok-U}Klw3$BhgMqGvSGOzN_D_PF?1|ho<+Fi?Ew2aN+^@A7oH5$5hT!txiWOcChhWl zI?nmHj63H#ac3~ZrStgYZl&;e0Dc<%6_mjzV{q^*s#)eIk+r*Lmjv zN_O-9@XZmbqkw2&%@e(TI^cYdWgvDGKK*mprA;D7Dtk&m>^$alR?JZ)8w1J({e{c0 z!1>v9L|9lAX94z%G@$avb7nkD<`(vyVECpGX$+2_9dr~Pbf@-c9@M3-b`hyHQu?A` z?;|=Z$xmh^bVx$xv-NdCqOQK49w?3a;a-T8*!AYeCyg>0Tw2QFXkLw5w=Aci%)4R< zafuu`O`c3AxV}#c04tE=UGJumMIgJ?Dp~I>*m>C-jP#i7$*bh^Ld$426SyAnW6Llv zZwv9mpp+r;$1D42om8|vqPL(IkNS<771}K3R%pA6s=-i|5cpa_=%o;i1XfVF@@_*sLM6D)Hs{%V?F_@r6woNZ!9Eob*KP_4Qbv%Adq ztAAr#VOFp_Vz?kHkc2Ur0eD`BH*7UqsQx^y6^v1=;4ND5Z_pF+P0~H+AAWnlTXmUo zYJ6(W8@~O8{#&XCI6UdLauYn~LM5Ai+@^uPjc1zK$b-0U?mIB+-H!T!GfOr8=S(>= z=kmEzsb&={#xggyMspAE^&*?4dlq4yfzBM=ktWS77w(i172|e5vHZ5_R}|f)@;(y1 zRw9%nod9Ep{GXy?aJL#xuCIlp5bapF8eNC_F1$b7k*WErxkX|}O5~P=i!E6N`>GXK|uyl7WkX$=jBfPs9<1(-2-1RXN%HC55_K zA6{jiO@!$Pw?>;p=*7rClP3eb7_nga?DiM96F8K0jb|*+qa3xLueFZ3xA0J(I(S)2 zbO#e(yde|B;bIsg#u319Ie#c*vNi7gqfLc90`9slR!1sUsmn2)@C7{^C;#ifi8vMo3HnQcf$bqz;)0V;8n~wt| z+jjVpFS6rlfrKhS3|Czt!+$wDr&`g*BJEo@S_s{c&~ehzE*_&SgFkm7x#BwyDKK@;G3CF zZxa^K`3oRs+`<+-??RUJ#7rA}&>nZcwx^{}ml_fq&_`!y-JL%-uzEYMj}rU*dwzlo z;h~5|P7ysb@7V48U2T>wOX}Xj90kK{5V75}&D#hmEPGfCs{?Xqn$*IaIG|+`9$MF* z%8SA;V5E{a2MKK{=Q+(dEL#pQDYSzM{!?zac92ItWABf=kzNdx*{Y+w0le`|{KiM(=s_oj?|H*=*hkvm0RI+1Mg` z;}yQGirTmsARBmly>}^$c)_JFwXiGpAWdW*@7cpw?DEFPr2vWP+!*MGr-cx8T)~6x z@4PqbIy~V%10REVC$)nL7_gdxYH%(RpU&G5%Dc-hDMr80ZhRZntRraf1d*m%>Fob9 z^J#b`xIKM90$oEOog`nA44RS?+uy<(Pb^q6U-Y?-gD^H6XDFUuZUr_pgd6nKj*uoo zYDWL|(ODr_d)x68YwL0@NRnz|7+Tn}d9np0v;3XIPylk1J~pZ|dOm3JUf=DVpP-e+ zJk7&h48Sqn6tWBsY+$T{Ew1E;ud>FiZD_2YEirLvwUnpylWfApKg;!FY-SK$v8mA< zVxvV2uN2D3_qtb=|L{6GEZ_kS==KN@wMRs)x}udQ88;vDGkTqWE`4&~^D9W3pid-< zPBW`#E9OMlam!^t6AUbCauJ0HbPHP*gTEf%;Y%-_)n`;4DJJ1wvW8g>4feN@_2@Y4 zB{JeKrP9>9C4VWJggW3GEMk(LtkLUn(Gw2giNYv{*>JRO`4z#dy3Iy4mxQD;Dz^OE zM?ILH<}-C8pUtGh>W)+UxuB_D`&ss(`f;C(P+8cZQe_XnyZq46v=TchD8Wg&a1-9+-0$M3w%9>$ek+-pT~Ft1yBgX z!rhC0hJO{66Qf{f-_w7ngH!4Ys(f%2Y6Yd_3zo2djsQ5UDV^~b*6|Y$t+`|SD8&uj`%%rND!Nx7uQ;db1Yu1=6`L*{&seY5?tJyr zFr;?f#NUh7Ia1=E4<0Y+8q}!j)fl%>x_M3~Q@f4nh?3o73d8-E7Sq-p`PKo|4t zUCEirt-`fCc)2D%*1UZ57DXX+fl`AG0jZ@k3XP1MImnSoZZ~COD7^y1h?Vx!i zIe#%C?GFE(llYco4M7jffoZQg?1z=qxq}b+1w^N@$uXM`yc~vqHc(_#UA>|3v^)X3 zuE#+-pOOHqTz{fOY{RQ>(ha@Z9k|)6@$|crpUNS2bCCT)>^`a3gYD_^2LioA$=LmX)u(p?}0VcDN=iRW6QDgu0{bP;$G_=^Nr79(NU;6 zE%&kKQ@eY#^vKL52j)(Au~>VF$fzPwMqfy z!FQPNw2IjU8#tQC$e1#+qSa2qjM*ScV)9soRnM#`b zIV>^sw$P!W(8ATsjwGoZB>glcFza$JaY*~l#p!%|R1lTQo-)JA;i2SUkmt<*h?zvK zAhIc@MEGMOlq1E|b zh2pV&v`~-#!rX$g&YsxHkh3GiTw?dHhRj%)l7xD!_;v*-3IP@vd^> zZm=sdUFX=^;VS&D-;^+BI;6j&D3OVG8D3CmesO!zr@P&<=qTE`uT7gX&wI_fMa zRb+aNJBl~73s-%GbU5+L=^{89&O{)EHlLz>oBw{j4FHLuMci(fHe3sV$)-5#%`RFn5HfrxP*u$;(dkoBT}Nz^NUZDm>knlHTRKXfTAgpF)XI(F*9S!Zzde0?ZOVAm&k1 zsvcYX_&%V_(zFs%`N<ov`x$M(i?a^*Di z3R27ky>~KAQX7wQ)E(DyjzWZCG*VrS>hdU`jJT(vamDP{>G(q8xcr|Hi^R?YzQZVv z?TDC(R+yPB_ED<3uKeb8J|@uAT%tq?7dQI8{TsLC(dj8EVjfB}O`&IX3O6IG5QkR9 zdjN$TCT}#vi_3vMEthN+5@5jv7)Mk#YM!6FLcm@k;KQfH`26+0HtBb6 zVuP=)fbHmvMSsg2zq^e+Xkj&$(d=VfOoul@`oOPBMawWX%doaAc(kW_gNAXi`@Ny?yD~A= zQg78?01_-`mvKdJiDD?cv=gc-~&G}rb@D!Z<^h!`m3fr@raEQAxy}JGM+gy7qZeaqb|r08>xv=WvE23 z)w9`YeO&&VI`Lqw&ug>$$+~LZ1tGJ%6k7{x6~IXn=yg`&YF~h2e2HSAy~KQ2t@|vb zl@-{h5%kz_OQodwVVlWESH-XIp+(6h|3in@0qU-TBH){<@(Ie0;xEAF#}=%#D(nvR z4t(RFCnl;Zy(VbIN4!k;P9}ZBw?Fhc-vB>SVEwYud8G7$5D2OSgYb1y-nS)9=9%>R zLho$Ru6o_+;B4<0-i|J?BHT>C*D4{*?5pzqv~kI)DMEqnAfvC-Os7koFmj@z=?^Ce zLz0e4ml78zN=@UR_`4jUGyw-53ln;J-yPE+UT`XUkY19Ra0ix>Om7Qno^))6k7(i1 zAE>vt{LCP|Fk41fGD8_JOf-U@pzqWUV_ILA<(!1THgauNu>dAHvzBmkBP?z)z+%*l zNU$)W_tF$y``-=v+SYmbm zwQfESUVDBpZf$8I)^a(P?9*jQmz7MecLkKQ$oa2siBy-95S2vc*qid*p3#vtw_Ru^ zivt=Xld{HEg3A&R60G>XsYIwa;}!#ISZ$>6cCXP;dCl}olo077(0@faOf=VrIW0`U zpp7;mRTgqhG@kTq7Z3-f2^FH`lLM6zRx)YHvKRJ1C?OAqG@5+8G7Yi zmad#H{z9go%e7L#5@5jMPx#9(_4`-__2E@(brV0YA9H3y`z=N%>{#64=OP-TdDCV^ zxGbB{${Q{Zpu~@sqPdeU9eqgXSeE=v^*qJn53G;p7kpj@&}6im2^d1T=ve0^`MD;H zQnAwJ0>EiJ*_Ky$mP@L>8TScv>TG0Jl3slFn=(3)#6pke$wOV;Z2Ke0x59k(%&FujyY-8-YD#=U zO2{AD#fcg#7R_;DoE>Gb)ecFeW&=5=1JX6z*Q!soFfH|wO7-SKgD&3{T7{n^y_`?_ z#> =UrsM8T@P+k5ugle(!+gr!tD~h>v2nKia~!dPPa$K@jM##KK7r8+qK|lMezxaDZDc)QnkQ>VC$eFlSQ)xB9 z!I@~rkVG1M8z4q~n1Qg^sGeRVh&oq~&&~RgaYpxpkWOeH(7iKPIF+=C%`o*YY$>MzR=2g<=- z2}oC>+GXP&9zI@;>Da7znekOvFw9hM&Ci9$swxG}Se2=mT9o^lBg}fmw0LsyL@G=r!nMX)>5L^xy+0(eSfLS2 z0m}q$M@rRE#mxS|GcxH{U$1JsOtHYxSXPEYLc$IEhwV$6n6sE*$9BCyZ~a`>0Exd& zI#KW@pFr}ZvA-fhrUTdR)H?$RrBZ)m=hdB;8=7VwXFOB%&ZqS;YYW9|tGp zz!+W?V)pCEhq@mzM>OcS07gzz5y^?w%H~K7f{7s%Qg&5MPBxsgOPU$^js9u+%tR>5 zZQZ5=m^S+IwMNA$Z1oM$gim#J1j!?6+^tC%60>135 zB$gnSq}t6~{%y&pu(zPd=>s$7HW;#Gys&%dDA@giExP6?n_ffUBg1gRnONWJR$*ak zfH{ik2B_*)PKBR+b9pe_=AD*uM}Kk&F{Z!8SkY}$J{AJ2NAXUU@%ts|xv4EAnskt6 zOl!zEQ5!nT!iSpX2KRp#NX1a^lg-6wBFm^qFB}Mo^CFM{+YUBI2Fo759UIAM2*a5h zq+~rHC0TfpBc0arHM)nw1->o`WLX_Ub}eJ_QGN$m!CVo`l4?fKT|ph6J!6f=qq26TQ~}&KHAu5e~b+(BYL@g3Ld#G0fw+8Q$QAYg1u~4g2{?3gO;M4Co2J( zYk{>Jy|RMEb6Yb!YyB*5&&{zFp;Ywgr_5dW?I5l%HQ?;k+hBN2s0%pjPrD>tQ;KB+ zkt7Mcpk{=c_H(^tfeNUwzrD&f#LPA?!$2?L@(ktRhi>y2|7@xH= z?=^I2e5CsITxm=yYk@e~h!YgN+D;OzxzmP_UkC{Ov{OIBsV>Qc}K~ z(Q|$xbU9^8Kb@OMCGKxDF4;u3gb3*Sn5Zp5ZAHSPS80?7o!5LSpY)r z7Y&T6ocYE|?A3_ch^}RYi!-ngWej;u!R^`fiu8aF!jlttXx|@P#Gi$aX+|#M{d8TI ziYMp)2F96cPEtiKoLUoEqDQfhg^L#Wy6xY@{e*iVg%zu|$_7kilJT!G)wdxOV5Ivq znfcG9`{7`Np*Z<&;GzH3E_qpznO$4Ud5K)PV0r)E<{gqYTiPY$;*CjfBQo6zCCH4y zeYzB>)8ewxdx72f5-Cur|LQ6Cn;+MsZ%D*M6ZNwCPMR)C6%!hQFPuc;?1o~@;)QyhorO=;{%5+dvt{@OEIH+tyq{0>1GWEw$xY1=tz)d&wAPyx6plxy-zx+0s6^t^o7@x z?}_-tpd(l+%sJdDJU;`~ba|j+v_Nrts%V*YvZZzC6A1eO2c?S=ph%Vf`Lc+R0b-a? z(9h+(LS*UB8T3R-pt+l)($3@eYyL%ZQUpUUGVUST{m4Nv^UgyZ6hwCxY~EN+a>`2r zdR;$b;1hh# zhr_nlW7`7RqsBs(x2JbaHbWfUVWnJ+cT-WHXVsq|bM$=5LUZ2yFv;wt^NV{}CW&Eb7S+E~2C%HeDAn*LD#Wyj|Y@z8h0q!yi` zLDa+Vrlt~OIvf-U&<*#ji9W5B0P?*L8W!7jjdj$MBU2LK$o%}iW9XAfy#K)!UUDV+ zL#KY)?dDK@V0f6CmX?;w!$cD0SGkE;JL`8FMP!9u#ziDH))a1*34@TELN#~n|8jGuCy|X2cesX@YAL;C#UoA$C;-p7IAI?3^$wm8m*9ce(BG-Ujbs9{kbdM2n zAoBBj5Y~OknI=Tr_EA#uBY>0Sya3ulWOkh+E{xS%%*@OP5%N*WE73Lx1gx+&|D040 zKV5i>k8kIzN6>bXv%8zs6uJfd8xJ&^pkioOcBV&<+bvvx1X?f0x z*kCGA!2p3M%*n3xZ)ufmr=Ke7c6I=O&sZib@Tz71X%+qO!RTQ^QEHNN@dR^o`n5{> z>UP0w@TsQ%{nB3CFsGrWTcHy^3f%wK-Fp8gJIUI)4eiCsP?nAy!4vVxh!vUq6>tAw zz}&A=z@zS>FLdL4aGyZc^u_p<#5i2hY4sI}MWHI}D_e`RtBP8qO(DQtXo>hbIqY~?0Z{Ze+WAjVPiCJ}9D431HRu_AwkeW3b z(JNUOfpY<;K! zFm{w|tvWlbu8`?`Ft2BJ$FJl(8i~Ub4jktA`!8AYE;5{1!X^|$!)3)Z<$yo;GD(Bf z4x{x{t91W=a-*f z9M^H{o%U<{6JT6_$xBzVBSdliX#mmWg^iE9j^~n*V8Ebdss8Opyb@eCA@DkPkGLK^ z=X1SXoTdZs;a}VJkEcy`JL(%Mc#TXVr}RjD2WFe)PI7v`z}vUYz>YNvuGZ??nXL@o zMOh-FS@;fe^d+W8Cs(2&2(4`4A6$@oVZK;f5In2F7!fsMCE1#c3LU2HAdR%Z8%ZZ;An)WG0^Ibdg=RK7$7HInM_t6%{EmW$0c`e4dK!q*~wjfxqr(n4wR*F1NTIAc56V!)Js?LIIDd&8! ze6FvVuThPvZQe+Ywr!~rH^Xtcj<%=h_O+RQ7&#_s ziU~)$2~TE1LIQe+RPY^!Q~sar`1r)gMhI@%$Cb?)-2sA5#I;fkis@}htw_M5ncs&l z5?VxOFcs@GGX@aAr26Qj1mU!Mhy1YI=3+XZGx;?R98MexLbJWM0)5>aY=< z_u56=?MaVm{P?r8)z63z>{cYInsxY|NW^;O4LsVrX++oZmx*=}Wm_c}l1%2fqDN^m z$6LFRXl|-mfmI0Kz!JuGImt^zFtX85K`g=LW^m0;xFO~zb=bFdCs)Ulxjpw{*KUx7 z8vhvM7jOQTKXLfD{uE@tN&G@YyZ_+x4fw$j2P1kVNaEOry+$lgsBU%0l~R8HB2|5y zp6F*Nfxa;Vx)h*q?mrZ~5+d)omV`Xet8V+tEO+D2p7X&kYowaR0{gycuxNA;#rfVd zv`Z0ND5+{7DSY}liIL7e4EfTV;QxYKP>_m6}){_T#B^mOxlEJ8!{NImzYI!Nwq_@o`^u z%S+&`e#K>rAz3Y{FP6V=8=C4}*6X&ZxK`D1@A`)A@SmC#%7;L~DP6t%FQ{q$hIVZN zHtU07VmFqMn^JLr*z4_{^~xjiDn;sJozDKkB!sB@yfOcHqGi+T+LAP<`7Ln~cE8=I zN!mnDK%wcX;YOs|dwd?oHujehrZHPq!-f8M`B`2m3OWrY=3`%gGn|@k8y44hjKAUMhx(DlrtGOY zG$eUPN34tZm(W~}NW^HQlz@?8jK*&}fmxF-<+^^C(hGVx_;zU4!SiZm82d{fOM+eHfuz}Vtk)gn zCxkR+ZyW*<5N27ovVFNiwN{Rm8%rKc7kA@JolulecgA$@T!GPNz}9s+FxfAZ(a}tf z_VV)69N6t!G>kif=cpr~a zRuW3vEt3bei0JeFSm`TIviWrc8>E2|u|nH0*ix~&?~`Jx*-GLdopaaG(~sNU+CP2ez>Q9<4U(5Okoaj$szlLjjE` zo32v+_xl|W$%C(vTVEFEkV;dZ4G599l^Y5Xb@Sxq!nr)Im+ zG$!rm4Ck0*BOznS&t>0-e-N0QkV3B4oVTy6t-gAvfU}dfL`+!vOl_c3I z03keha5}bH1vyiC$B-Z`U|>%3dvOWH;HH#Xsa%?I7>_xO*pmL>zO=30TVSk;=Q7FE zxvGrP4;|HdM5`3zw!WHoM->{83D7LTK>hPf()j3EHQ3!O#FJGItFWLlNQ+EjY8n<= z1h+Nn`7LbbKNXQ*D#!DXa~auS;o=-A&yH7KCp67~nJ+~KpCixEYY{MM8N$Yg_-7Yx z_j3d&>UMBA1KZIRGd(Z2QYN~rf_1oZif*tkJ0&1JAH6x1&9%k7k7-oNAspvX`F-Zk zuz*p73jMHgTu~k@bYBntUz+^=C6R$bjHq5jRN_wFG)E$b)=iXzNpGZ_nG)R!Q2odU z|C^i;6bK8is2lpeRaQQ$y%R`g;~_SLv2lAt>7?o7>KspdH9YJ62E_@fwbN#f?~mG= zh4iN)So-5z0kz`6t9C46z0U3H`W5AimflA?^B6$}13}CR@orK?q%&G)nL(HwLDYte z7cQ}fjJT~RDhCbr4AAs0E~eBeZsp4iZ+c5T){+^9&vz_C+qC12%Ad0C`geWvOQFB+ z_!@cn^Q-FNN=YeCRas<=vWY(^m`_ueNYx&1n<#dm8b2?GIc@x~P;w&eF*ZJvttiLU z_P=ZJlvm1oK7?CsnhEr`KbLUffY%^kA4)LiEps^eriugzI4#Zp7uhK(!^jnK2nLM z*`VhPkDb{#kXfeAWH4{t)=} zWsNxM3336E1fbU3W=fUK_|sykW7_HqvUv35I^MSr3!!Nqu9SAai*$T%e?MIQ5U6}O zT)0e#TMv`FFb*B$2f}|vns}WtY)JS)!bXVC_L`(3?(T)Zt!V6v7UzG2^WcAB9F8N5 zu|0Q0=X#&I(j^4?STb0JDHb_7>ijfHaQTo;@fMx@)V41@_?O|iCNcUpmkV~OM(^D3 zXg+PMU%j2zdv-9n7*4qk{TY0CiPxo6HJ-#J%2|;|f;NP6Mm$Yz1*)U6h1NNxq25z_ z;KHJ@(DPx>s&d|XZ=G@6a~l+o5zO%RUUG3%Bt^st3F7`s&hsvmK0eiFo89Kt?iw9 ziX!FSYjHZ`%#Do5%PE*L?k8ImSRdnB?5BnU%M#Wd{OoO5Sco6LBcyOqGz-n3YSYF( zNsPqsIlLSHfS4}oLbo4&J5u^nK&X9-05t?o1tGhTb&iI3!@DkqwwNJ@o4}>?dl3!i zn+kwq$eh~OK~6@#8E1 zG@dmR-1a!3W3U=rOe?CRLxVxpjU#0Drp}5rHbOjzm6a?(6Stw0A@L~``#O(CSdc-k?eO0w~nJX44D(oMA z;eYM7D&RnlAO2;XHE$3-4uWU*^uvUIpr6l9Ozd*fSANYn>{*f>$m*kBr8-!>{p4hr zO2my6_njQ8s-T2hfV&tg?7SPWKybrG?W6ju|MY9U<8?P;-H9}_%I}pu5_6mw!1Vj~ z_P6-BuUCo>cj79Ww?)%HKBS?CrPjTti|x{ys^JxXe>BF8R|CT3}(7r5@1XMBVoB-7iNJ@_B&w)^({hiCLJi^BFPCB?)jnKAb> zq8u**@s+R-3Y5XePmX&f+!1CSs0%ENgJ}e?bq5_d$Fy>}>!lQ|qSzXW(Peh0vY%TN zyG%9_n^|VgfHMK5GZx zj&v0nePe@KqNQXg?YDSPm>3qhrTCQaBp>^om*|AA?AzIK7G6xM-LtBo2RYWufM8Q zt2a(Q4q-aBJ%dfHg719C}y<}+&&ZV+H){x=^tRUcd zgoJ8pySLjPHPlGi!51zO_v4p?2l*6Q!4^dfPP)5jFjJNm;}ij>&Q!=f*7i07Tm8tj zb}O===NkX*Dt@DZteUPM@WK7|;V&r6P*1(N;cZs)LZPh(b@S=zKWciq5J z5^a(|80R;5m_*x8WpkG))xA_#kCS5+o6dh$ySEx%?>NX`N8YWf3BlJ5y&uo5BhiyW zkDY%|?|4G@TxAW<;v=&Pmi>~APWh`lhzSo!*8uheHH;nRC&b;vq_o&0B}R7yqX#KcvS|1!FIW;--GbJ2`AG!wv*Yr%<1^)KrN-#hYDWGnG4{q2M0yE4 zb7Tre%ufn#3kj-qZ|-3v&X*ch{`^g=ROHoZ1Pxng0+ar5MIhIns@QrTJQ^$T2%^R^VJVBbDlG zzgMOhJT14Csr?81dJPti@JVL7^Yxp(<`G5^xZoOj0t0oyE=T3=U3{1UR)IW$Pg9xV z=oNjeRNin*zFyI;ZdAbH{-s0!rPC?1_UqnBK?IKBOz2a?tlYZBXU-^iWzz3lgi|v! z-$qB@+HTaru8h8hoRRSFY?73!`F}?>6!kk@T=+)zBwTx)50x7h{dywT!fb1oa;(oT z3%itK=H_g_)6-B}lHPxU1~P0z!iYji!^kYLYeI5J=Be|m8)sE7nYL;m(Bip_UZEb_ zCNiY@2BWg|-o^7K3w)h$L=v}s6~{IdQ#_ksAwPIi5eJ((E8t#9M(>_Xy?Z8Y?-VO< z_Knw?XX+1dsx8}bj5*5}9Ss0F$6Do+V9%?o#$z>Xt6YE=r1EyqzR%w%jZQwtt4WE2 z!fgcYF%%p?m;mnw?pAI;K=#v1WU2o>?u*xAY*J1?0uB(P)%T@Al}Z9GI<;KKcarMR znWe0(Tuy=~x$%fQ9<(b4ygJz!==QHLCW7cY-20&y5(Zynhe+>?Z`D#+H$*sJ%jU9R zZMj6*p)lR&sS+b`^Xz+CAY>*#?UGal%hnM*saS@Gh;b5dTTS+6x4Ce(cx3Y8ahHDY zE5jcPf0a%G$aZ2QO&|ZRfG@1vJL~L^E)*xW3}AWO4Qz=K0LGpK3wDtQ(7pW#5+vDC}h?xuY_Fj*>%y4WcRnivd&6u)-~O zzazlxp5aOoVPT06T%@fOAw|eSR_Nei;zaKVUk?0VK93)r7{3aMy*^IvFdIKca{1m? z7=Q8`o%BD^-}va4c2Q&a1S59e_H;QH4Cwm`fKYr?BE^q`MhP|zCzPpSdh=;%3Tr(2f*+qQo(_)gg5X=oOdM=B( zlJDModiY`8*bRQ|1dzn#^}MtXjdWm(h3Wj(Sgi9w&Rve{k_aGe>nyG#zRQhu6ypvZ zJMfV*(pAxKCFWjkN`Hc=kUDu6*rrUJ z7y7m^8JgtVZtP+Md+mbjj&N-{a;%%%wp@jtlraR>M6Ij7yf?JOiFVO0qFDHr5%?^y zd@MEVdEZoo_%dI#-B5@Tar}Gi;5yuG2|F>yu9IA^0VQ>wcyUGF@y9THR*`@1!0ua* zr*1-Yha6g@)B)Uq=BECy4N{~=qYPAzuDu)X#JtWFH$QQ83Ymw(RgvS-kfbz|NDDr? z<0XpAW%Z3&n_`JizH0m>bXeC5`NzFM>lRjP0qgue>#mkMEd+iy5|trR`@|E7t(j5q zRX9+^1E=|PEo4WyIp1~+KiOd=P|uEXPET~ke6EmlUqi7zz((ZPwB^&fcHsO!1Rh|a}oTQ7*M0jS)^_Dn4gv_y7y6`LPGh!f~tmBmE*>e0_ zjUCwf7^m7`$Fe`TD$8>MOYt#?4fUL=UP3*5wo5k{FE@~{3@gnzE6oc<+hwp3%&8`~ zjTXsho+1IDfu)epOpUUQN2KO7hu)zH{aP3V(l=v^Qnjb|X)pv*&3ZslKKxn~=ToQV;9oD}%7jd3bNuLPvSmFpCCZ z9v`~9m}4oY9SQP|Y`+9IbbLzwnpI!j%vLJkcN0E2E@@SW;zTD3hrtYl#T069H_=GN z8S`+>r)RheR6sAHLr7`B(`s21H`Ho16dS=FYpnMekAD;^bCYzv@#hMfe5;>D(rhoj zUGlk);VwZkSq2M(a|7Pz0+`_MtA<|F1mBe}^_?+~fdXvqR=7rc9JYq8=*%^4rf|yY zvbTX6{I|OS?{@Yd4yIa(_>cvkaAzmwX?X9svwt@7Ls+_IU8Q7&tBe*Qw@k1Z#`&`+ z_D6JHhS#y0tCfv!d3&!b;t--5P4`XfEbVN&h{<7Pnbe0`tLBhz{ns7a>lvCU?cgHuQ!d~1KYUrbVR5v+)W87OBb{Hcjq#8O#cn{ zk1T0%x=wT!htmD>JY`djBv1U^g}bU5FU1p$o>t zdHh-hQXo@euGi%Bnoy=+Xo@ziD=i=#pG7dBV6}vOyeINE*&<|kW6ObyeG-D#T^%JQ z$AG_JWkZSoiS3)Q;O@|fL=pzH)u8HSg^qZ9ik^~<51$A{s4Tkhsto&9GJ~DC`X|bW z3V(iS7m{+*Zz$7By`;UwoyV=i)WPnX;VHeglF&!9MtKFSn8Q{JgcahgdOcIjZ`xKI znWoJHJ+oRN^F!WqJi1#bA${5tK13{P83PA)rCZk3l5Q96%WH>kXv`Jd;S!S)^EqjY zDA@7oQpnDlN(Z z)t+58Iy(9XPOG@MI6?a_X(Z{t!ti_cndp=+qZ@J~rKgAmyn|Fm7~dEDiHLBgGvi4eH1{jQ#uvh6 zf-m)+rfBn-rpflX?oorKMWyTi*tRfWY4W zM*-1U&8}vl0(ib{P=|+Z?*Ns(jg*kAf%cYDU0s|o@4 zJGT!AX`1?&6C;%Y{Spk-g6LW95&mgW}|tPHJk+eNj)yjHZ?rlQ_{|C|2Rv`alp2579R``^7l1kZ#CC zL>m9l_J*+!%NFb%48{yoJ6|lQw0UZHEF& zX^W?I+aHM1i?}Ho}Ca?Oh5xl^*P|4}8v6R+PPG>R>;V&opg zDB++BCScCL>vWL9Xe>W=1u^Xu&%B|aqZ5@3ssj$EW6hnIXhzKa;Zkuu`X2{@YM8B3 z`qPKomMih=ebbEe{fIBUGg*#1{AQ+6x)FK6SA3-?ekwW$Y$2z><~`5mVXE@tOO5}Q zal)7Db8k}XaH*?4Gu&NTN)?n?G=fWtcAhJD80h-6pF$rKci>^r%ho}F;bzjFml4v( zG7%H<{c5(Mpo&roMF{@cr`oX-cNn2pkv9(p*5&pgq^5nP>SI}m2-J;2+*~D=eKeUb z-dE2%XJ;Xfu+S3n%!CYrpcag6wd z{13KvSWmASee2!n3~=}G@Yq1%o|bM~v)^-aq)YlxuD>%)f)Ib3Ajv4C&6U1;{g|9b zJkg_$5>6K+`ESLjbXf5BN^M&ONim9HhnVYl$m_dCU=l0Eq3#RpZ}Op_cSUKrJB4YR zCMc_1rCtv9gi85aWnAa2eBy0nC+wlY)zN=GRXqJqQBhHaepXIS^)Dcz7};V;SzPob zwKQ~h-MHNz2WJ}h$3_$)1VUBOV|2Qabp-Hem2K-S-}+)ek@XEyjD>IVhFv{SJiel^W*?*CGr7qY3^jsuf-yozAV2dI zSe=v1)d>M!J8x&i-{gNRPyUDLV;}~Pf=+e4Da(J`SSCusq>UA4cf=w?FBBdD%hjW3 ze`)ygz!~+$$%5(Sq6wLUdoU<_}ml4~6sa=+)@7Te8` zwQ!3!eZ3O+t0|s?VZdWzdMbB$oTSUZ z(58z5Q>j!(!40lX*8LdN20gcJ5jJOn*WX2erbbCF$0!sRa)(DplG@q??HwH{T3Yzfo}M95N7!kZ*#^LTyRYZvO3#mugPmtURw)9EY;>Ym=2ipm=0tZ& z!SuPTwuQU5a6E4WO{Orc@4KCpMfB1o)u%de6Y_FDpS4&X%pj$te?H?n{ z%l;Ytg+dx`{6~DuO!un({g#cM5;ElE6S~PPIKXfO4!xSbeg%Z> zz{B00iJE{I4T-j&)GLeaQ?HdE;ie>n9pB{c)OOVXD-QeO4QBh6t!QAg`QF3Yt61>F zio3~d*IP}^Q|StJlpk}C3=`Zv`CmdxpKy(II$-VAg&K!H?P!bpVCc7GV-H6GH0CYx zPcDT8US=+?I{5GMPp$c5-7+0-pRA~VEu!2gT{eVbDZzFu=AJFy?ss2KZoI-fXlj~F zo@-@`l)v91yN<`5MNew-mjAOdHs-i{sP1V6#43-#-zD}@Yk1)Vb)In;t?x*iE92R$ zz?ZoXnopb}oh~f}`FGBSgnTXOwV3K7WGoz0r@&H!gQ>q_ABK+){2S4!3at&IIbnCb zeu&7WoFtrGU13fIHF2?BiNU{sc?64qjwczzw5(v)lh6KsXHBG-E~C{*@Ksv zTBwv;t8Td*X`o|)^w{aRT>RF_U5xypoh!Rn;<07$#HWQT%(=nQJ88vZ9((+z>-js$ zbxlTW@q&tE;Yd!qAM^58jBRS(g-smAriYuxUzA6su6A-hzg1QnOv%L@#|(gX)fw`x zjXO6(d7GEb2em#|Uv>171NQ_a5?$bPjW32sR-!#mOFbx>{#Tqye%jue8A|rLS6*2`BOhv;(F&(c06kWA4(x46*IUL8e-FU$pVGYH5)b~Z zGq7`VRCx*VA?E?5RC4#-djkQ|+V!MGPzUOVhTyV|PINgVPcq&Q4Kj8dCK6W$_0Wu^ zQlQxnp7;#5arir>Iz7`?F~=Jp4|LEx9i-R}DRS1lmf`a^cqRtorx^XZJ)X;EZUVr| zlnt)s043`$mg7bgYlnd4Pa#Di%n26G)N&g!h9@>Ax&C-1Yt5t{<0BHF8Wds=`1#*> z1+MCh_C|c@h!J!TnRgLuoyakRUlVc;rDChi&GJ6+Q}?S!XmTuHN*->PSp_S#OzZ_v-Q+^BABhYVp2GlXn`cFo%E@Ugsh1n4rOCg~n0n5dbO3KNF z&BPnGyE5*NXB6Ea9CilLspeb4P%tv0Kz*%rnr(^RqN1iu0z|!WSy@>}QSL7-uzDg> zr5wx;P*t~IjVgMChgY@;)pEfNw`GhQarMTwQdPs4)A)e2fMKLO>g?+7dm=~bH&AX~ z^ZeF$ft}}dhWKWi+es}OS7)m!^W9wA7T%W|w{n3vxaQf~TyJD{v0I+p=ZP`TySBG; zUc`p9jDvD9(Ue$THfC(GfZ zmlXlZkjbhNv?nG_gG^wp=xpK(Tx}DyV_f2ON#lqrg39b`3p@3ZI(Gxx-V}#$J1u~1 z4;yU=m8=Fztll?0Fj*-5>>bzP<@q6yK8`d%FGVWOCHf^O&rNvi!dBL9Oy!ipN2a`{ zJL&c|#N%>xUuZyxOwG&JG4e(#ct#HR?&hdXM{^-~7pfz@lPg=WA^SVVivMdc2Ra&? zsKQ-No+1A?2)jZRSS$$)IM4lYqGI}h)AereTbqHQq1a_REhGesNf@t+9`N4S^wd6d?*K3l+wkB*Sts0b?-Co zRz6F{bG;{luFLta4}DFHqZF>Lv1U63af#3n6DlYJO$M9tPQ!~e)QFP_X&Il zL&OoEmlESI7_fOL86a)#Ce!LZ@kyThi(1DSmN!Vuljs>$pa*ZK7hz=RD9nc9y2GKF63YRP@Hl>}hC$h+63X0A!vtO3=S>6OPx8_~s`S zP08VxL~vV4B#DqHem)IuawB*FZ&Nl3_?%>c@a?5sCcbEq{VsxWv?G_dkqn}3xI5Mh6w&sn*a z+?z$Vm2>pGfQ3jUfBI^y`!_#<_JP_OoWTfA<$;2XH8sCAHa0rN+^`2DI@<=6Ym_o| zkC_C4L`^Ir3R$_)`By!V-)f*ak}ifIO`CZj3>~_%%h|WM_b;zkqbV#3-(K9Yle|L5 z9!1%fmh#EgMBN+p*A%$zC5{6zJnh^TjdBB%Pd~1{KJGE_SRZ(VbgCz+bZwnA5ILRLyfY%INsr5PY!>T$(*e(7cp@rV~sJ$Qyy|1*VVM@1K9(wEV95-5&Mb$;k=(gG3ND z(ft_=*zW~x`Z6XC%3;~$vgR-!LZc<508k3-pTQ7MhbtHdw|UvM3html&U0*%$pFQ( zo!0522`d}GZ74P3=ws!(B+`b>W!{!8WRm{17t8*3@X<>0(<9)~SJ>}$#Ln{pHEw&~ z!J!9x8iqXHTZ7D?u;70C%w<|D6Z!EJ!SEqxYbmbZdsi3uw10BdJJP;)v+1#L+mTc7 zfv3`A^Jv8{IIZi6+jjK$B%~D1Md@6c6X65+{+HnDpOj-Z<;9fQJ=Qe5(NPL^p1K6@rxQS_1dZ zNgO*9?<)px@^o6N&@+WEB=pwFS`WG`AC?zbJogiXuOd$NxGDy2DCT()O(4Ab%R5-|4fsh}6+K>X*(4*8beIeEdQmF?N%8E(J0f8 z8`9UlcvzOX3`mMTF|p{?!$je$41xp&-<;k{RH#!Xr$l?E5J=YGcpIaRql&Yo>c^7Q zF!jzzQfK>QVia88NZP(J2nmt-(rWV^d&hFY`iYa2O*kNioh-D;gsp_lD7vCLGwd&k z@RYN+r5n+y_;HGml*3bB?PWJg;D2%JWFi#Eu9*+PwiZDNCSN1hOs9D&Fr~!#7%X4r#>x6)#Fq&lew{pQ>LVX z=R*ZdCW8~S;R&jr-aNvdn39S>d0b>Rp9S*HemYsR8iconaMxL=z?IPG)_r!Nwk<%g z_>~cJgbKxa%vp^8yfyb%VjEv~#|>49iw6iZwea?(@xvc&H_+Av+Mr#1gTPGACT14x_CNR*I?-1yM&Uo@4VTLFmAH8eA4B$sqizb`(E8 z^)TroB%~z#%x?x3yZCZo`q(g;?bcQs#*)&k1T!wotQSWwt-o_@N!VPU&3gL~TWx;v zu;gUGCNaV<0fqj#0Vq39i;zi(&0joR?I=)4u(3n)QyWOE{9Ygh-*9QpCG3v{{s)bQzr zECzXjc`~-!#gFYgkN^DzvKMXVR-UK(niJ^Zo^SPW^`1kV9iw5#g0@Wh5r?Gi_DCw+ z|Ie__M~gw8SIWJ|Q(>$1Z`}MqQU_7B$mH`gYjNG!ul^~a!t32{@;d#=>jz6uHpsG7 zGprETpZ#!G)-_}A`Y*QsOak5?bpm?M@;Y%mHt|4^5|WcA@fE}U?jt;rmabQbmi0>i zWVwTZA3GcXLfS?DF2)5A(BvmBb}!C0-t7(@_7l}7GErHpML+v3?6~ss^{R&y`DG*7 z3TRph0iKJkCNSP7$OjyX?q7K(Z(3bwsL;LJrTP0G?B@r*QMr?Kc6NcEuwd0(5y8!7 z&m~1aXvR7+IvP1nltKDg^{zVYBmoxD>s*Mu{yvbWdOyveKt%G+yK_`FHf>cWYhvDG z(5?~|adPwkC+uZM5?pyaXBTrt1tgPBZa6nmbQfvoWpZq>II5Ajyi8e1{isbN5u+RkU6 zWq<`lW^7>A_apnVa0lnt!D`}Os~n9@V#KK1Z$SULsCaMO%Qa4``4P1KX1KrcDzkdm zL@?!7OMKTZ#1jrV6}x!+CoWO7Lq;kt`(vW$0ln-#qhs#iL9S|w0N`CWkSCv%pvNXf z6$=0md=o@!pl0v+@#Bm@`%2{AoUD%3FM^m843=sie7w)uWoHo})(~ma$e~u%UC!?d z_Z{sl#)l@jG0rh!2yyJkCA^w+sEt=YM=Hx?YOBd^&DO*7@J}#)Xpa8bYq!+CddEV}E0OQRZJ5SoNE@4~ij54N<{N8p-Ttl;+Rehodb~1>hy2?r zunmoNVV>#_jvRLveV{hK2^(yn^?hAUiv?e=?)Qde1%PB#0{;hz17}JKIi?HL+L8T6O#6;i9bU9{ zC)cY_vbw5+(M58b7517)?~_i1JAN0cUtIN_IZ`vsS6w|O-;TNEkpb6`^Mt=wZsco7 z6_F3~$^AUJ?>lOgI=G?0#qx?Amy-a2+e`_>|CnJGX7dCFj8q_Vk;3*`OgaWW+}VnM^_#^JwdKTJty0siLMRE5k2Dk>OYFgQ6c zxHKpTjt1&Yn+m%8n|Yh z3&y*i&0mmfTjHeU*sJLi1sKHr8S38o`Ybo6J;Y``c$MRGH3V3fG*o)~&PLUIe#5wD zXqN38vT@qPh5{+u*S=8Win@FO^pK?k|B;9E)Atst#?gZ{WC88S)S_U`=>Emzl#sP9BaNg zU1|tZg3b?yMBKWqp zHU<_JO?!62KY~P>hxe`lDg4yb^8sj z1XVxN2#HQC>eV6ByQi72%ya#33dZMB>IsVF{(0h_rHF%3XeUZDBE5dl$fW8wqf$ZP zzBW>9!%B@B%wB6A%HEX#YGmfxqDoTX(Uw9G2w#~E{su85osSg1-QBiQD0Vbw zZ?U_`fJGzpxLOAxO3QpNGh-wsNfr5UpxW&-Rs#iQIWuYk<9wkcCXh-z_+aHLl+RfL z_g|ce=hC+Qd*#O^dTN>|yEu)EEwLsNvT7UKwQgkOv9Y=)y=1BXvMge61RK=el}gqY zW7yoIfDAo|!`$r#0}c1enwHgm=OW|@6Sb_dFctK|-f}!nhp*ugHfIkuniHse1s6;c z#lIsVknv;dEQO!i9V~_adzVg2|1`QN5+%#Ohd6)#(s<`ubA9U?;FPmBD%$}{Gj`XF z4~8F2K;PRz-yQkJMg5E{7%z%oF|_OK41xM<%UbdbK$W)d#l?)~sL`MT;=^$(!kz7u zr=OPn4RMt4LjxH)-1OKQk!G7pb>YQ>q2Z7FH%qNg)Ee<-WxdS@^IP}b`eAM-Mm;Vy zS`trzD+#{8S;lc=R5FZ!$C}@*CMDPQKVSXIa@eZT|1o`pX>w^uOf1FXtmTiw&te?l z1O8F>!tURbH~-T$4?D^FkiXs3h=af>!llmfr_!pU3miu0%V*FXecSlO;0+zdA6NO- z3-@uAdCGnYmx^GS-4&B5CMo1lba7*IsO_XNdl<&l-5D!cbRC_gZd>-MyZNzeWt$X_ znTXG2=*Y$_S6mjx&R(@e<;awop4o-nhKl8N7S$r zqktvN``*vu5!3kB_CeljHcxDQXV1<$Dat$PdcRbc_shSqYjSQyts-h^PSMhByq%ok~9 zJ4ePtWH|E1`&MaYy8FZCo(1^hw?fXAl+Tbf zB9D@3B~YpC`BLKiUA*?KjBy)z)L`GTX|oLb9m;#Agm69FHkPn_sN*hB7U~i6C!NMx z#%kOw41FSw;d3W8C+rnb+iOgMGj%({<-dZNG>jC;fQm8WGKsFjVY}w}63qPQYuFC>{Cav9YLL^EKu$45z&s2Gauc1NFrla0kuA zviPK>p!Mg!%MX>`5n<_8iPMUnRP)5hTn>JH$|a<@xE1%jq;Nl54grIm_deU%RedCM zt_{|0uwv{)B!p?j>Qj|)Y-}k~RN|7LE*-+*EnC))z-gE@QH+rc(y=)eR{j_L!VeXA zw{l@RcTM!1SzsPDR1!~#C@$_V$RHB3EZ)YmA!?X%PuNfo0{+^zPUI(Q7pcIu@R+=~ zn$Cw;4smJ>TC25zA~9)gf&YrQnYbbFS zTEN82j4ESP^cTp$1a-b`}6v@V_CcUbptTMsG%lu1+z!_zim=(TMgLuR^3FP@05~< zg8|p-D`~m>>FaRrEZ^ymx}y4Zln#0r2a0gQV5Fr8Z`{%h#{&?}_&5)>_)nOqbX95B za?^hm+i*IYj|i}QWEZ{NvF(pAzAa>_MEbd@~Ww?ZOkAWRil~+_E zP7sp_+TV0wCml@w0Np*WvVspUk+vokzp?x(_&FA1E3NFsivig|2x{QY=d(6N>lTD1 zM*wP(>UYD&+`%lH&%~GE2+QDkWree4N>Jn@z*y`U7k^~@Z{Y?ZSn>hbHR3=JDx#Wl zQ06Skbx1L3I9$}!^yyKsx?xp<1EIruq}!!y^^A<}XxHw-RN@%LnqS zMIFvG+%kgiPrRD$|Mi;=cdoffm&KL+bXx(yY+MJ4F-19BqI&qP96gaG%Q zbbw|poc+ZQKG(|!+5Pm5YPTQrG3QgZ2G*3H$2UFG z9>Sq$JP2FO%|#vDkS;FW9Bc88DP7n&`DG_}LBWW<-E^d)x9wYvP(k!wup(W0eOG^r zHrdtg87yc<{+|dK&KBUbfk6R)_iQHVejvKp*%vH-czJH9^Y(sQj}tRxqsgEU*W0P+ za(OGPfb}(gEVq+2zg++O?38%URU-O_epC8UW00T3{iYZ6E7to=x zlyC&NQ%C(cll~Tmp&|fUca0LJA3;k*NGMNVmV1Hk4yNNu=GXo)!ww`x|61%5s3?z5 zC_9DTXy22iDiS#vF{)%FL^^S+HSvVg!bAYAmM||>U&*doiHDtxFCGJ1JUucT} z!w@t%0y9;BttB461&F}{*7=zcJ=jL1vp*m=35hgzLKuT#!5?7!m%NeKmVSN8^W9A~ zs_3InEA6cWKnU3~n#owhJPNih`E1430*ic_&0k~f7}&*Qtm24!lPzeDiPbtR*<7SAX%5|6V`i z^NsS;xOmU#qgJ&cVXd45rE6oJV-Kr=COIBZ;ywSh%lD<-FYf?par@A+i-%`2U}_S&k-SEjI4qre*c^|^-%6d!|Sd4=`wM?eTNiER60>vwPB> zg#sIFgcu6ZH_v{1jM}XD_hrJex0z|{vyk+BwSWQeBVRb6`@%!n{tge*flXUJ9LJk{ z8sQACJ%1Fb965UCbi?=c&xO;ia5XCRA`$!R?_NEdeOgGW5;6z<`y`DVz_I)Kb>tXz z`1im|7XGJ2sQ4>H_VQ4K>swl2u|N|DIj{VBxqpxVUO z4$nJK`|l~Vn>x+*;`v3UIw$!A-jJm@vCNKw=;fy$D+>fm$a{x+B?SRLF(diQnloAF zeYbkEt2A}aOyrM9Wx^;>Cg9lU7Qrw+67?XWOIOZ)1N-ff;>C1ApSbKkSMtYS%EC6M zWpx`dFIGLCCqrsE7G$SqyyVX=_U{z98on@dBN-q2|38GsPmbPRnYJ3MI{fYe=c*Ux z{`7#uSKZf8N3L2duCsZNS&$t-c*!Z%-)J(3|C<{GL+cjb+oc0nDB?Tk5jIxvb)nX=lPm@sqq=E@oi2eqmU| zyoaImr1O`ys!m6ZTmJad%Tg>$uG4Q?=kuZ}+{7X4i?I#He0@Q)W{b)j##xsYnmyyK zF!02-ZS8%8`=TV87j4q@SUV}Q{Tnms?+%!qn@NkBJGN|) z$vs1Fgg4teXiWpEKYe&>an005bR2~-M5n0r`CqjDrS;cS+RT(x^qi4(>7^|||5eS( zv3@OL;XX^)Ob^dm=hX7dd9(Xap;ar?OGd@liSnzxSFq=%b87~+o{I^=}* ze@Y6c$q7OGPB8i1-bBh7r2_`7LdOq6BOC^qxB&|J7wR^Qr5QYvOPhb?P;JnK z)?wsBjn<#PWvv{F{OHK|FWC9H8FhRJbHxb5!`NLzoy=ODJ;qR#5L&ets%G5`$^A;A z)JHHG7E-Oi{?iqy#C0pMwyNzTVO)2HEpp}8aL{lrcYkU<hGja^xa+expLydXO-oQm=G#{Yre2O4cFa7WxDSc|QNH&+g! zMeiv9w2kE-%Y%|Jp#2q}&v%*RIHBzy9-j)*#`TAiH6J;?z&+u2W6%_Ou!PT-k5lf2 zo>wi{sD-gvSJ!f*6)c&XQXM4b^j@$}riusZ&jk1|2?Q>@Qf8xJWMu(t=o;1dHqj3Z zqd0ng8~f|_Euj){uP4OC?&PZI`j{iPu6qjSU*fT3_VmPH(9@|JvP4KUP0RLt5p>~j zHm?7BZ8vD}`cSWR2G4(Q4PQ^zOtJ)RI+3f9CY;N;C1f>J$c}CkVuk-2LTC%HCjq{- zIqLhq?RObNHWi4QsCrX)No>wAqERMD+sW4e+V&HL+a4`+a9ratl2)x!?kR1k|4j(S z@&4iCtye?-<>TeKc)au2*FvAyblcp8kT^aLcK-1Z&VnB)9NgTzH~R{QLMYLJ^Eu3K z0y%pGt!vT#{kp1@V8$c*$^y{W~iekr&q)-A7aHTsE>DXq2R zB21!E2tPo$KF!QTXed{;@?~PE#t@hVFI&`)=G_VdRgU)iFN`Z5`HIB6c|5MF65Z@% z{!Xxy9{idB&;t6N(yxu!b=I#$+hi>tOi@ zg?jsAyzBYJs+8l+0J=pEe@pOh5Ca&XA<%-*4t(UrettDp{5P9SE0&(Z&Pi6t3s7di z+RgDD!e#hvQZE%g^|cCnOxvteH{^e_&U@U@KNSD*rT@Q7aQ^>%NOY^8$RCV%{@r2m z-fzariHV7~6&3$r%ZM;b=SvU%YAyQ7<6EV&xk*d*IQM@IT4MkHdDD^mOBd?g>}*g> zOpFoHvvvh8)WpMLV`E1NvJ{F`lM;`eT6Bk7jy?V*_)mOA`V8%IDMHlK(>pjj)1Yp- zgwl71GKNf5SgE;asi`F%Gs6y4`u_vVLq+~m#36z@KwU{L_j!FM~`c0GH2V_QXQ49oXLC0|O> z55pP>LqwKbfV_kM@cbm6=2uV-+ceSMHPs&tk4`o{mUT9zI<%9;okvN3 zH<5_=eE-!XAZ!85$c2+P+KX%Lc<+0wQyH>uEz8oN9^5}B-$y---ZUlbQPyCw;B6W4 zOzwp1=4^S`SZ*O1JFA*_fl=jd;kf=>8YEpLbw6%|EY$R>HL z;z!GIg|XxVZgj);yGw%_MbRgmk7jCZ2iK0mE{zZ~lB6`P%{4DQCiJ;yv6*c)p~!2Wn5yt&op<}n=r zVcd`1_ZO%;wa;Qq@=W&1as8wh^KA}JDAk^ubx>qcF90pxj7!}0Q^x<9x70(jDEfNV z7G_YJ@POU0b3i172|ezA7IXPr5S@np;RA~tOfkn^1JR*2Un?64%)V+eP##eE27TfU zF+u?&`PGpkL;X1Wg#l`YJAdOs9%1X_V8Oo2=SY(`-Q#AgvB1tWriFei zqUGlDM`widwZ>#Fhezx;pgUEW3&Z4sB(v>ZnnFp^d`8%?J$=u7&fb@G;K>377`t4dQ?$;zl>kn_AI_jZb@k%`g`4Pv6>P!){+zP% z_TCFp_UPv#Xz^c1Wb}-^^tf~~SwkhuKp`4jxW@dsi_}M2P#pd-WavXfL4Iz8vmM;+ z4|(zM&FjJml*p&*(#B|?(yvAJ%@?z7R5&4a6UF*aQMDp5JA=s^fd*e3^@b21cBSWv zU>{apyQ#ZBXD4K||NXK^C$^^^L#Cfa9CI@=Qb{>$x4cz z@{H1S>$~Zpxy`mwm)9ROF>d#~_6E%ed>k1^%Eg?qk){?z9Sd?+1!cz&^kKX`;kqRjo#+C{`qOP_##c>-7JoUN_uB9 z4s~A*i5o?o#RMn4W^9aUbPANpY=2 zO(?ys4s7+s9J~XSotl^I%24y*%$W3Xok&%FZn=%}M|D;5@`F6HYSsS95?ojtZ2+H7 zw8k%KmhRa9-As=zQQM)Z7COU_#WlxfeMPA3RJC(iAQ?rQH&N9acKBMc9`PSH0JWiv z^nZ-B@4i7i{Xh{g*i}})Pm*RX$iJ)%lc|yxD999yIv?*y$QKz(>YKEm?VH6{6l0!W z^>wch&Eu9}?1Jd+?`mDWf}fD%LUcTV?-#VP6?QDOzD}p}tKwpT;iDCdl_y0_BmTUk z)Rm=$0Dr{fxuWZ?dci0oxFDB?$-eM&FNprRnA&psb|7%<08vh*4<_q+mLs^o20E{-7 z-gUEH`zlr7=!OYJOH*Trl|>t@oaLTDdY(J!vo;;fh`|nY`@q&AQqAaAVHA zA+CrQS*Cp_xt#9lGtXQ|sLzw*>Me%BX-=yt!0&f5E%H%zxE@t;sxu|8m%BNtq0C?_ zW@x)bj_63p9838g*t-JHGD{{)!$px8=ns3+wJAaUUTbDq!DpdY8(t`yMfCad;Bz%! zTMzDkofo-Sdh6_m9Ms(fbJp2Cc-pUDSt?KY?H;-~TXNX4|J4)9cS0Zl z(KyTSVX8apj6BXQN4hNLaD%a|UqI2?wzTmd8`4D6GPJh$S7?|#J~}F~v2hl~`QBl{ zBo`vLKhJ03oPFsOw1h4=*ypZ0hCTCSSjLpwSo)hVv5+?r1y^3$=uh8DuL>{Bzaixx zTXNTf@&cEZ2-a*;l9J3l^b9q#4i_5d2;a031LhwV^zYp{DPWIEWv1{7>wG~P!$c7^ z=*Zo|!3(+A-NVR4*_)#tS5}qj7^9PE(caffi1ZH}Aq|ql#R~e8H~z$(a%fv;psbzn z{p`(DnzQXfe~lmjK_7FmhAdU0*W6;2O@s|9#}mSh*^!0X$m(c)G(b*JY@*l2? zjrfVHQI`oKQb}g|`}OWV)n`LJy%=#T0^G#85Kj~ZH>%l#sfAhPLP-7p7?l&LYYBEY z2ows0JUKywp{V3{P3rp@QrJmScqkz#eN#CA77ig}uKnGQ1Cq@z(_xK7fumS?f=@@nzp6N6x(IMcvjh&}e#vki*HCL@EsNckY4qjR;JU))T=fCVn; zx4PcaG9!J-c^yB-@FKTIH9bX^MSd-==;6De9z?ma&`K$@?mst%2w^YrbEPZS_~sXh zGiE(XrnK?eSK!$i~yu56qb>D*qofrzQfvT>RXkGD0Um6KvDLEh6p((`J$O!g1#9WI7M=hKv z-}tzp1P=e^uBT4wnEFuOaNjdtzPaP$>D{O(b=*;7J0maGUcCDnJ;~J*Gh< zJ?Y^N90?5#&&(c~G^;}@jgV~e#nJ4l4tv>>xov6CHfM%xO0V4YBYl~@gLe4Gsh_|6 z{crjIp{X+BN|2lKFJvT&}Lad`;eR4ml7Dqq( z#mcV8?OK^yZO5@i5Rud~5x9mH#E0KSAJlAE-zuMeFIF@|u<&2wvzh`gX+LYXxi!?( zKz&i zh3C%9K%)r-1wz_?mY%iT-p(%yq00M@N9-?R!IIa4f+!g=9MxgdDB!>TCsb^y%9V`U+L;?i;9srXn^sHZCxhv51y@MYl?p@i5jdNS1H^8)y0l zT=jWj+2to7Hg9vd(QbGZR>lmcm0fqZeuZ8ClTac#IdQnY%Wx^v1)zMl*|C|Ru&l$j zj^t$WyECxMeP`!${Q>TO|Mzm8oWbRPlHc6)UkWh)um9lQ*L?qxy#MXp>0Dt$LqmvW z*2jN8!>MGtQm29I#>!#yIHFMVy$p>X#@Jkfs0(v-G* z%Qu2+kNxy$?`Dr!C$rCP;Y)&D!{hIZQ*wx3XkVNq&OWd@H%T4fiEX zC3W@SiVB9Lq@+QP|K{M@(BudDQh(zm07XiJ4Ve^~Fe2=liSqJB-{{tV$md$YS;ZuI zl+Br^7+cweK6euxl5Ko9^;6%z>r%aKP&b7#b0?^OV>L~oXvWnafoXF!BBqi}Yjl=H zV6M;Rb2F2s93=T{^o%*Jp3?AOY=qN2yVQ5t*wkCoiCeoBw&aqK67O`G*RzCk@33dW zvzc}$`Hp?o|D&&O3=UvH{m*!+wE)NH}dnbVtxO2dorTe zm!)9pptKIi+(q)%;i1)wY?!@-resIBwc6V{&5rtyU#56s`E4J}OMlH7#}wSHct0u+ z*KK?5&k&E2oFXCJi=@*`?$qDfTl-)EI+w&pLu=SkhRg!3gMFXJoS~(R!TB3PEF1o2 zd#TTENsnqcWV@iHvY|2siuFzWxBJ(7+tt=YJw&YV%8xyLbHP2Zj9R6TvcCdiYd!da zfNfb$`*5?qGrbUI7aLt>Co-v^E*uT>7Bw7>5YP4p7|__=<*tP!kDDzWk7xQ4hUV~8 zy$I{?SjX>VQITy75K+4l`Q_oe#IDQheW4oT1x7d9iQNk$?0`xFzsQOYjIIR&)fcf{<=CVOAZ6phgpIc_>*oPcQ%$@adrGh22AY=0YEq{Ct^5<%_-%e?; zg>8}xSnJa5iyD#q58liHzgehfVbfOX4@kQCTWsj(4IQI#s0CzH`83)cxzbrac(y-geo0UDtBn$59TMu;Ujb zERU(!OT52HxJ?~1FfmywPFl>ixV|;8_INIOpH#K_eQ49b^KglB_|)R!=(iT9t@3ia z7u-7P-;H#i1~Hqa`(>3RG3jX){Z<^qFysh{fJy#=nXe{25(Ba5Mxi=F*LUCPa zixSEMRE?fI5U>c&0%M!785tG0xtljFQQaCfwD?NT`3@YJO9t~lNBca_*V+zod2_fk zW|x?q-FLD2&bdvao2#Ux$}3AV0^lf^FVVkz>qd2Ozx8?3_qdHREUuyw00Vq-JEOdA zSABpG%L`;f#~F82Clm@}B_4Cm;1hYqKaCp4@Ro`8q~Bs7PZ-ullI#6)-)1=zc@;Etej-2dpoO@8X>BLRZaQ16J_kTZQFi8#*_wJvRVt`7pEc%_ ztE)#d6Q_n~vy&|hW{Aa8Lx?AOyC@tI(L!KvE$i^DSAzo4Ae)%oOza_rk2;*zGP)$a zD=bPgKN5(PGlQ1?&!2<$!IhP!=!9ZI7HsV(4s^C3XW}|dj(C!kMSxQ!%m5E~w&H97 zb8`#JFUNGn41cMqEQo5RWFI<9us1*r-d!xH&k@eI%fX+Ll7F#!AZhdnCfn2LF{g1=%_e=+9_hHl12oSZJ!stF08} zS+(tIjSkV|bIk7w3QAunPF6@1&1>%X<-dmBpMKtSq%MMYN%|Ive)$UL+iW@`FH7e0 zgA@_n*5rB*-`IGz7Qj`)vpYE9>su-_BfZ$xz{1GV#*?D`_fSz*Jr2O_e;Q(E%ETwcW9O?a27Tb*9%H1JwOCwaeMQ7Q8CWq{hhZ z$2!c^gefvGSMumtH1Yr%@HV*J^!JBl<6RW5>%KCHgq=zALPI!of@gYTID?h?SO`Q% zNmEBwPn2i(>09X-J#&pqH-|v#(TVr8%)b0o0MG84c@AfJD~vjH>|CNwpJj?GryA)rx_mN%Ze7*(b*AXL zVO{VvGZZtr9YAhqnZ<(`rfo)U{^JO$I81M%L%(zs8ViVG7{QJ{+gmw(tINnV=ilF9 zO|y(a2i%@H9H7yT=W@EDAIF#Rtgv1cu?LfNg_fEe7SkGs8S6ONvgBi$?YFY))H6d070gUcUJ6b)BN%Gb!=qOgL$GkSD+zbx6E6uw5$2j zvbab~kGXQOKDxcOk&or*mdf_+45!j}N4}AS$*RSdLtM=Fmg@}Cr#HHsVWPW~|NCG< zedRBAhWkr*L)$JRr1*3T6;b2d)ds=@!Vokya4f;JD*d$?d+#elzJ}b|B{bf z+gn0>>lRhy?=g7wK)hdlW;dvaDssgwE1{(}>RV{PSuydh7o2OpOK45QE{7a3khY$i zpZVT>c)dBPYiGW8C||ESBH8A&E0JF6&&~#hX?Cs|rH~Y~Ty0Oi*v;Rr+}|@vG1`*K z1eSufAC}?R9`+U6CKr;h+OAMZy*A+I3$nUWvyQEAK4sDtf*;Ohr&42~hE`QbZGrga z^@N%AdSB{x<&9c0WpKF&$M)zEe_6q{KNrjsLvn2EY4uZZ`o(r65+fJz8;TOx%?Q-Y zPK{kuI6ss;?vx>wduR?uDDDv$dz=k4-Jn- zhQyu}eqo8@#;GDUd1)vRGl(sT#~WYk_#osRl}7QEcyg=4Co5IrDGttdteB#pL#JlG z)M?%Pp<)Z)Ft)^sh7b0JM{Tda&Qh7b?QXYtr2Q?#ONEo3@~Ii8le(mQxpeg_7tmDA zjXtF5^_E)b+&Uxt77Fhkqn;my+Bw|`QmO3LvsoMJDJ{F1z0uCU+I<;^Xm2r|`-Xi(vz2n4>|4V) zk_^&+4mj_8&T;@gg*&`nqQI>l(X!g#KP&h29Ly1yoPw_3w7WH3x=h!SeT~Xjzr8-q z)0{|a7AVd6m+0VLp1nc*hVqM2pXW4R*4vp{+@j#$UKiTR1ya@*J+;bcuDi_zeV)Zh zflp-gYrvJsKi~kc`OJ%^$Ne)$(Ao`QHt-7Py7M96Ug(W3@7aTJ(7FM{+f1fh>6UM& zJ+g_LipAu=;AOrX{e9%j?&cyHEo1GzIRZ}H=| z)|ePsi&zJ?`B%7;(3@xI~W_ab=HK(LPPOOzhUo&8DW9;oh+lpCzl_5_x3nz z_zf!~E9JaD9Xf}1ln}jan3_P^3~WfbDQl0uW`lFvvu+Dcx2IL{Z?md5ot_`#J6sRi zY1nr6F!`U$84Lu04DNb`rzQZSM)_lyFnr#?mmoXus|zzZuM?uRX#dj5GLOfxwZ$Yx zUIHeDR};pz-=Up6-NQGei|~qDaiF@d3SRMmhKYK1uSZGyrR@>B&Aliqf=AU8ukD;( z-`n~Noq;L1pIt?SC7j9fbZ&-AZ(e6vq{Efj$qX5#v)%3^M>1w2Z6GfD=ML*a4} zBNL7W(`uoL=a?uTMl3-7?Aua_5(V%ep5GsR0&Kr7cExXx+1Jle(_qExM2Wuj+)Vnn z1S9((#^gBo@g=QpjJg=#OK9MvIW3cs?LQ4|het(GIxjL0%6A2))-i%6npe+5zY0*V z46N&W#1IWe7dlJ;QHb3++{d5bNSEEK?>$JLu6}ATy#&)I6M39u9fzGPYm!_~y=*2C z5op)>J7}Ed$^qd2UgBqYU2=4;XHCqp+2xG*CzLku~B(pxl_P{PzL5&YFq3NwRSe7Q z|2!7IVdbW?uoS=|j~>Z8qJ~peuYX2BCG6k$(}yp}{W~1e;Z(~GDi_w9IT)SvyvvnT z66)g=o#n*bggYc7mJ&NqxF4dg`OAzeuK>urc;3&g)k?WXyEUMZ739tZkty$%muEmptt}mjw(6`xE*sg z?-kKi+dK_}OIomDDc)V)x!ZFBfPo+Tu!v_J;BU+)e;J{iZj1j4r9hiMs$CdDXX;Wi zX|^Vt-4_iJp90O`y7M8I|D@Ie1Z|mwMS>-s`RSuB|ExWPhHjp2`-iqpT04mv6fjVm zYn5D#X$J{C+;9`#O~dYgCVMCOe#6vWW_x$!@R&jFl)3IM*Fi`zanJ4BSo)TS+tJYx z%DML3T9>wgfrHj~J}Xb!JzjbLeuzctTvLQPorVd|g|!3%Z|O~y(c9p8>OI8S?M$&S zr#>R1uZ>${TcNlL8MlJky1Y`#e0PN-1tqO}HxEGA8q9v{Dt@xs9Fg5=Fxonn9zMY| zI52~bcU<_)o0xyPKFrj`XgV+~ZyPNjk~vI9nx!yy_EK!eS+$W&mRxPD%3dQGV{}d& zAvyrNH<3M&hRQ-|o}l9SB|dQIaM2@l%WVCsGcM5+?kiwh3n&GO)zwnU~HDlE}5JY*|%ZI#QJdLgZP4`gLi>TMG47eUcimaSJLnbW?}QXztba`>r7K}`Qm@> zt1DTPNp~B5{CEYrCFZY>O<_2uorcc@`{tDq*()mUi1iK#WnjT$~0X=H}N?v zg7e}L@7!8(-O+~?h)r%|+YWe42s=ivA2&xPoKmkoH^rWW7m#PC8(Y|jx@~bLk=C>B zktHImZLYkAE{z`83^SE+ZL)6=7K(YWBWSDs1v?0t|L`Kq0(c<^*fO+fHOg0W3|aK_ zl5pP<^`rnvqn~w~)9;0}Bjz@2KCrD1Cq*z;PB=HSoih3PldsWId_b9piHNEI4wQzg!VAN`@ zIMP)OnIt(`xHPJyZmgx~5l3LD#`5gnK>KKDY#b0A9J~pESg8E?A+4hF`wzwUw)t6! zcb4Z6sFWDzOA`gywX`wwj_;q!ugyZ`-!VJl%x}=@DSk0RX|MpPkL0AoUrUKtPDaru zmhvV(PV>SLWMgc$IgGmlS;sDNnkE7)0%;G&&zm7=FcmD?RSMldC_y{%qz2+uLaSqw zwM8ZSqxak~GmAYzE6%8F5;4XZVEg_HqoC%L?Ui5EgIJHt$gYnB_&WPRzL{o ze7BxNPGlrYvBidD-n~zoyW9SNW9YlYm~YdM2Zrrpb??$Y=jYp2xjos6OZF@6g-~4+zGI%K`Y9wyQVyccBZdgWnBRZsb3TJ5>) zb_6%by4Vutnr_UU(ww}*N|bR*uTD5SL+6e3T3K;MoSLqhSwfg~jD^%{`^{&yyrk+I z)mahGNi~wio*g#NgDg8L^kurR3w`gFs-NLGYmP6Y1#)?e`?tXbGat3nG#xCCDMHvn;uSPDR`@o4-XNCbVk{VRb1*gt4 zr%t+6=ldF3A;v12h|O@Wwnu7yCX~IoJ-`#y>B;KbBXEJnFB3hK3{(o!pMK%6h5(~H}S9zhrzhkl8{sjX7X_J%oxX#n6( z1KwL9<7;fOZ({9RH?9W5kKi>|j6N? z>2OfzL0WHl74=>jp64}4043F#&S&L#{F^uOx^NUBrgyDsf!=K*akP5$%6sg}u2bt3 zx_GUJ0W^elAdRxXD#|${3v(3(U;%dvi=ky}ucj39NILu1XMPfOK|20k_Ytl}%Ln!Z z^V*ZpD%w+yU?a-QaU!Pcp=6=zoo-CqcEHTcDN0{v)X^9bcjJ|X3WErN5G%3H?RhSQ z=;39-E~@!B7Nu0tWcBVFwE>?D#{>?>JeOLV;{`;F|iJuPASqjiMpk4}j> z#G$V{nbj65sx*E{O`6{0*#-}IbeyFoYI^d6uRi5E4MFmk1rHKv6y2R^2`P{5FIN1b zOhk$~e|pRJC$HWv4zh)cW?esTO9tZ~jrhFz<&agTJOf&BT}#O|MAv#po61@#cwpwuG#mHSW`l72QzU4>j$p=|d?(m28=dug+Rm>gZ#K1b+_oZW8iU5J-})qF zV_hEO-!|LCvoALh4KDhK6b+kP$jO-2g@3pTxVDn6JkA1ME{2-Ey|h5Rxd3C6oblWh zs;NeCyo|=jE_&_nt3i^FTi3B3?q|BVz-P<_F`jJ<{tQr-XPgerO;6o9ZPxR#kSBym zk(FKQnA3V-HYUs;&Z%0)3^KkQqOMLAx`+jp72k1u2>`I=OTtTk_>iI0rDKo+s)P$q zi6N4I!|l*2qALsARg%Y;@Oj`lhpdNsv+kQzo-cH7Jql%dw{P|T!D)wpbxZT?&0qJ| zFD?NhnQ|78d@_rN{;4f(I*S@^H4!kh%th_|XG@T1>cc2Sxqz{le^&znV9}m`T zrN%(LbSbZAoICc>+bNs6dXo0q{NbRFHRa&37`SNk-wX3Q@y#^Jz;7`Hd~@Qi+Bo+R z7t(B>D^dgcmyr8cZ@9HneskLe6O35MElbEU*+yTHgR1XaC{8-|*V%=vjFPsi2Tnnc zTOnen^g&;sRyT;ucNqP;YqLdJ;f3FUG(9b(HkpLR9s-+d?)$fpLDutl4%7myW+LEQ zsLoq*ya%tGzEpoB=rZDB<5Y8>-|S)qu#*T0=*ik|$>5F}C``~X=2gW~>{9*MvCt|- z{;iRWdt^K?y^;}f!~fA*TZjYLI$VpzS{obRy;#*($S1&Kl_S2zc)$88yVk@R;|aO>c=c{p>+1} z&6w~oOBfla_#n3OK>YT)W1?ON+{hC$P&|vl2mYvwW^FK#e{}2_|6<+G9ds-Z|A2{KM}|NakBcl82u1+~>Up@S)y)_BCJQk{z;P?qg%e%1#iw zE8JBsFv|h!<}M7DL}`dRPm^AKYX6x|X|oI&oAA#g7+w zdMR)6B>#i)|8R6SDEQ5Dr9t0hhlYj{lJwhuROVwt-`!gCvrcXT`$4#+A#X6mu3$Yw z)hD_3kD(`Wjke1UDUVB|(}X%iHlwoxX)TEyZfmN^5B1(C8!}YC|eC;EU`5jxR1RZ-QNr zW|+uARqq7RcDXn&Vr{i#0$iEw+gxxr1^7{)4-XDNIPRmSzlti1h~z!Z35lA{zw8Wx zn$3Qywk~aAvipI^Ql#_ygmD>`Bnza`2lWUP#4mwpMe5T^c?z9v?nVMHZiT3qU!2a# z`^v8phgfW78gn$)mCA1l5;T%j)CxhvU^G5S^j@!^E!$NO&Fi1MBB3h-zI&s)Rj~%K zXNzC5G6mA{^dV6}CxZxMaj5Iqdiec5_hk>ESrH5Q%Y`OcouR19u_fDuvxf(4W(b<{ z_))Q;L@{VtDA|JW$J+p{j!Kp;tG;wqchK*jy{XbOgIl@3A?45}OrD@eb`BikrN%Jd z&O3Ls=heT+=qum-HqksXhh3u6>q{#2?WStJ`S1*gw-DQ2>^^C(ZyCG+gS*;q5!O4e zzvSK2yzF1&m^Nhv*Ws`s(|O&Ig-LH=qV3`+>trdubW+Mugkn?<3tO%uC9Z!AU(T** ztfX{W(6>G92tPSq=n0M!5CyG_-)zD;xobRjuf=s@+i%NM5ynuF6o@6Z&0PHnta(9e z3m__t>1kPtzQXn7%ell~;^SrYI2n6+99L?rdP;epGC>c29dkL0r<=o<&5}0?3RRB5CeSY*1(KHAgimI_yx61jMuc|GmhHDfi0mzO z&pg7I=81!>1*jU#h@&54gx0QMe7&y}+pmXc=+_&wZ_KeVttal+o%i7usb5D$(O1R- z$-Kw2wrR%CDu21)C!@O;a67>RrfnAS+7i7&VZH!7GrR-+w#Pl(3i9JKGsPlWbI4{# z;&EdUn|fAO&<)P_@+f{bd+?aJIE(2LfZ~xIoldFDt_75*d?HTT@3K2Q&Pz=j0S|`MkCp1Ei zJzj5$LFQ2-#B{fUUwMq}XvE`24>|e=YK60FpP6Tuvifm|q^pLE@6Wt50wnWlT@Y=Z zobGxXe`u%bG;b3*U!_LfUH@spu_t9*%(6{y%x-F6-Cb@HQh0>_l%Q_7yE#$~>%-H^ znMCjNLDFp?4x2fFAUT?5 zE?Yp?r|fchYg%0|L*fQ(d4hmW`6V~@&-8rKFMUXOD}PuYUt=8?PjYJ^-CxF;&SKnn z1b)E1(Z$6e7Y93IUdz*b>WVK&t6YKd($}F&_P71}iH=*GY@cTavR8<_Jt58{ew4BG zq1bG+;`Je473<(cuu0_pRX4@Ng^!%fHoR-{;-rnE@6m8AkGCb=)YK2|I|9+>Q0v|F zql=Fu5~haKmx$Bc&8~349TZ6S*W9-#$3M#cfSF%^aMUWu&RCazOV=ok+-m)1Z7o-S zY|=L!aCuCvkrcveemEQHFUUd6=aGWF6izI=fQd^ersQEDr$D@Marx8Do-fM1UrUrY z^PS}Nev{yaL#ZwwF7f_#a@IziFGR{(`S!4F4jRBv$2;S6d7c&9x!Iy1%Rs|G>z`>U zvnJaoQeC(p?ue=FO5;6~duIC__ibsgc4%N^o>NSe1TP;t_3BU5;Ag^X9eW8Zovo|p zyVmdreCiAv?xKrj6`dr|Zyu(rqo!~a;7<0-cK8nz?xh?SSZXTj-7_ z7id^l0R#m0-XY6{T-y?!%5hD}{Rf%0V@$adDaw{hk1H8p$vBmC^kz=R&j_v>IX#24 z3F+x)U(<|@?HxRVdcL@Dg5JJXAm$6@CK(KY1tl zjPZ~fxNwC;kp@()8qM4B$fWX;+Dw-rwOoA^aotbSY}4Ru`?WVXXK_6Gk0Var6ClwW z7xlyx(M18j03c7d6#V=z^#$(dYuw!Rmr{H1)8&m&cC`?0iq4Nr;t!KRQ7O8BXbRZ! z(~5k!4foF$_e}IcJH0-NFOjipJ_{G+zB5-7cv(h{PV7PsU`6pd3z@b-6g~hGfBWj? z$Lv9hSizwgMWIz=&xb)4txu%e-Do6i_FXa@w%(3TPCfIjG1#f#i#=7jv5JdmV$jHW z2gsf5EmN8DY8S7JCmq&e4UPs=f@e9o%1}r8D=gfTNs5qcjq9QCxsru(qePvLDnD$g z|JJ;9<4s*&-&&1-uJPP2*%^exY?aK$Sb-9G_hz~38ke4diZIvZ-^H`gQBGQ^rPF1( zD9N9N>aA+af3AtiejQsH7~&G}2D1R4;s7nV z*;Piq3(cA0?h$kh>bvjNM*u7|(6( z4ev~tE*C2TFIf~W=KrG5%pIU1ahmD$8kLqR7RZPTlS&T}1c`?j&-84Q6VlP(dBF$& z?lj^fNQ_43!&gg)*VFp0z7FH1_45lc9$5&KmvNY6XS>=KJ?v-rZY3iMPq6SkI-!V< zG?vg?ZCbC01;Wj_6DebaTy?eDZHqi10Gka(^j>kA`kX((I)y7Q4vkDm(;4{=(^m=b zcP}9%jgS@nv`7oE9g$f9W}*{8L518oS@oaHh~q-h-h~h>_N2si7-AC~fon7om z%um4k^K*Xjpi2Y^xzE#qWWlzV!XCd!~u)vmqghX6b5B|7;?D9QBE7i#1 zPl#R2m95U)hwG3?#pH9rRC}J1=ZBwb$;9;MpnB+V`liO&DVIete%ahd>nYNJkXWj2 z?SUz9C<}#G_4dBOqTX6$52RtU0X+F+M?5^P45~r#sraf;I<=**uLvc$68&H7omW(o z-M05t6hw*zkq$OQdT*hL2uO_xq4(ZG=rsWq1(7Db2Bde8-fQS3NQcmb&^rV|3FV8v zd!Mt<<#%!J&K+y;jEt4JR_2<|T=V~%9&}IG-C5_svr3A-X$zvwi*2v(43A23PkxFr z01_S^JhpBVJmgaOjR~K(06KFq+Zrh;-sw@5YU%7?e=CkQV-DSii?c?yXU*@S+q7@U zt7cZGqI(F3Yro7#Ha&*N6lgA@cKJFB1oFlgN1?0*a;x{-quF!bH!cwPqUw?shu_}; zW|muSKlSC@9H_Vt`&qfxek%;=AEaK~o@Xoy;h1T2+7@|~VmzNXuYG3sf};3qTZT~F z?ws#8slo8(`)TG$;C+5J*^b*(d?w#;G~O0Idv!_!SiLcw4n6S$Dl9Ny8)(8=uj;Tt}a z(Ce!O$Lv>Pt!7SqqqhwDt?;BHCh@RKhfq9TSF*&t(%zkOU{KSlSINqiZD3nmjDtHx z$YA@!z1Qa@QGY6%*D_Hvu)f1?m|Sl{ByIC zZ^oNMg9pF+1HJZ;fv2WmQ35$ZA?M1{;(NybzxjN(d(&(0E<&_o%gv!~8^Gx6_`*Z-{PF&!e=XnE=)>PC>+W4| zrD88HN;_SBeqZ0IIlBI6o5u`m#JJjP*txo`%(1t(3#?HWC32Anq8;noqkX4NqIB*P z_`O;zAix(v2J!nfe6W@;D(;AJb)#om{YZ4#lHrH@_}vF$VcPr(WebR1WisAzId&YY zS=V`Ojsf8^u1JZ9zuj^!K_JYQi`BI)T@HNl;G)Zm0DQtKf!9g9p{(*vAd(m}n; zX=U5vpk>qOw^tuR+*#$}5p#ll=v+8FilWYae#r8hmg7r9A+P6I)4%+>AL}PsD3a*; zJta^Ubr*>GP>Q%c3QrA)td+SoG4IBN@G;*%mWS|UA_$IW+f(DfR=+_M`w(oW&^EOM z=3H6-F2`zVQb^ZYte)p#7Q~4bDgl%dp$yOVy2a5zO*0l)W|pT-bhmXdqcqJHO{JLI z;bclqNf$6vpXi~F9sE{{z=s|rujN!TkgN8t;jt- zdwLHk&u9LyWG9kunSR!fkw^#6lUif&?uV!-q6=L3a!TON>cPjRjda~@|GZlczObO% z*!JEY8tyA&!n@(^9d&Rb^?v12t^K{KW6SeHn~?S8B2DOJ5JAMo4gJvIvnTv)XXhx=2^NnRufYzytw zZR&nvPzFhA^c1@=J9oc2H&ETxbaHj>8t(|d^w&rPuFXFk7?eLzsSth}uQzpnruuGc zYbeH8z{s17zJ0GrLIZ&cZe^Rt9yoQhwWa({LC5<}!)ACDmIJF&lr#(awj>Dkq|Z{NXR zywFCit*u36WIcUaVbk;ZUOH~baLUxq&MsHE^4rmCt;N@0%QZ@@1|zFaaDzt;XC+c2 z69y?BcmdD;e3sh{Z9P48H7DoAIFi?!*1s5+Ik>rV%F2cvw^5YD#KZwtDI4Pt|J1hE zw2y&6YPz<4-Kx_-1aM8M9@j&9a< zc64k(AP^@dB*1@`>Q8O`SCa0rF-j>Zss8@{5Ib5M1_Ehm=}8odc0%9t-y{e8WBRY~ zQTWZ9H-E3JSn3ntX%u)g1HREB_ylJf@!z7X#Tz5*uAe`D{=K$lz4p-2!$UZPoJX*+ zX22O=X8rFebKS7Avcf}E@XAjX4h~ZM?nJXth2v#K|CIXUlZ79Jw&w9kbsn`JLU&s_ zprk*7{^P&1pZ^yJ3a+lM{`(O8>_YsApS(GK|6f|H(XlZ#eC^Nqo4?ciicN@*H+FDP z#p}SF2ELf!7eKqWuP^T(jg;)`*Pj-e|61?cII%Gp9IBebU;GbCVsUsFUmmEVldymq z>+I~TsdD+d;E8#~#V@$I@8VZV22%Wwt>S3G?fHf!T?j-*pK!@Pj}3W)@bC~(r^U|; zkbmsOC5Ree!&~(A>(_NqwBmoPtV4Pp#j82I(&S&Jccu7`1^vIlz1OZ3FNTJO$U2+x zT?Bb9-4sDsUq${0CtLtHAFRl!Xp!zC=+*P`Kp!)Rg{8h%@wdF9UKWQP=fjWwJmK`A zcTzBq8t|rdn$u9zQdb@BwYG(Nn?9nIgNXgK9&ap$%k;UBKNz6)_69sy!NX#flsCpA zWu5=X&Xo32CFr$$*y-t{{yJ0<_J91V)ALu2O`p#zU|Z7_-v^sdLV&ACi(;n)4C28f zd(l^NPI&kQ>Xy>PSoEs84oKE3)ajOmMhv6H>N$6iUNiheU!?B`UQ_p#L>Z`JL5_RG z`P6qpl05n~d_U^NSu$*?o!dn1oEW>j7HTJ!{v}cs&wNRjnt81V;_L`z`n$1{%iYDU zSCD_08RO>luy_DuHt3rU_BB(n=P2!5UY(i~2VDwO4+fh!=*RBs!E@ZMJ@2ni>GuJ0OFgM$BIZ ziHeG7N5>buMpl@MnR1Cv59bET3LyWmsQ8kbJ*!L`ryt&wo#;&&fW64i*FB0;YdkA3 z1P0y7`N1k)8Lc7U7yXJ((&pSj7QLH#4z9GGhI?1Mx=@rQK8sXOO`XX`p6J>7<=btL z0xkc@OjkiktCh}diK#eU5sav+SaS+g0Qf~uZOD^xWIQ?fMEbo0? zeXYCgSFwHr*vtwEOi19LyY3^R=Jb7_oFTD->C!@9{Nbc0;!G%SJoYI4~8vO<2jziRKN@lSL$|Y@ZIl%I#h*C@&Q;qsAV)fk7B&gQta}ihgi;K5R=Kx5mmJ@Ygw|@g@n{jT?pf{izE*fq<}*cZMHm zs|$zVIl$E8i1D9I%oMb?1-T*(p9K1RGYgh`=Q=VWa~-W@NmFAbQh=OmaskI?zaDcZ zAH`_Xi+r8<5D~8%kKQr{s;&4Y`x7njITC7x(sh3I)jUD1PhHNbxh_c7gdB9$Z#^c; zKqH?P-;+voFZH&i_;dFA09 z;9~;$T7=)cL;94JppNH7=dtZu_Ek(G?P=S*_EYpS%F5_6QA>WkNT=2PYl7fC7Wa%mPAz0;>5G6Pn zO&It~sx4{5Ake9*s-vBqy5#JFUL@0M{yw#v1!SwRe~9K-`_HbM)p96y53YwtTpJtn z&Sz8HbN|_@HgUNbqO3CDtfuA@Jy!dq<|q}38I<~;j1`t-`TKxN z69-0zj%d~l8lP#jI1FR_;!CBiqwrtyic_F=S$c@1hZOP%DDKDCACzJle^nI?p8}bK zYzY_(#+*N7P`Yj9(zZVfm*~KR&mbEo$d}&ENJfs7u@?iK&o!rBkSa2u(YSQ_5zVQor~1J5O#C^nnmeXFT(@8Ga1=qW}w z7Ce|;XOrtY;splY=`&MV_nU?*CrKnt@k1=J72d9oShO2hi{RBe6;5G3m-ka@JlH6r z{IXVzZzP3HsN1C@I^_cWGmwsvajN!z&Rl^BOO_9Ce|{vR?^X{$+S@7535?UH-@3hr zZRuAg;rcJMi!Jx5u=v}1(v$IN`bT@$%9Kc0Io6kcx7Pu>6<8#AK3oXTbbr2PhY*Vg zepw$_BHEa86Ny_QUfIHIHHJaa){DgHk*)y}uLXXbFqUc!Z!*~Y3vhK6DV zjV|#m78yPV!>i!Ku7+a&378rF55P>0Wkf-h*oE>`rzkn3aGQ{SduYK^9uSeJ{u;h% zpt;xS^uoaDwn*)9bS#!u-D0 z*^Y zMokIIdEb&Sl?P7mg;iV%6e|}8l}t}^eBI?_BN_%GqMs>*)(IV; zYmC`|PIa2AXGSp5@T?#UdQmltcx{EhLEhr0Ur0Mfm?Moh!ClEyjzRGp34E-+)BI6B z`v_4qM(3rPr?Hx?ix90+L+cS#xTNKsrN*44G%)-Xi(3u5vwSds6cThgqRE;gQ)<6k z>Gksz8oakI-yF0UD!99!jj>odmF1fvK)}7 zJAw8uLpxqY{A^=oZ{d2?xi0p_rOzG*_m1V6sx@^!=q7ccQkow^RyDW$YhxkqqSWvUjx>C(gQr zn@M#u9jkrxOiDB<=0=P?O+Av2d^`CFk)jPAUmiEHg%G`bjHfTD;&#>^SI`jmzs$}~ zpE`^1^|b0N6U1wwIdofBCb!!i`iy~*lt?uhnq@874>nDIzxNxWifV%B$O^sy-R5`w zGKlpeRqB-iRceqZj&(p(nKXm=sElQ11mB%>AaektONuKmcw6A{qD3_IuxMbO{9TYr z2eBKMQfL1(q0iN8tb;!Auv5i;sw~*FYv^VeZFdWgmU#Yg`Rk6k5H25d8@z-{6$f zGctgZT-5jPo1AY(2h`Eh+On~}97#En>d?S9S8#I=AW4!#-McU-#92K}TD7F8T;Mu~ z7dnmEl@sR%KOkY}0B?zk#zkajC+8;u6xlTs*6fJxOv-4XW93W$p@g-U& zxt%_~r9ux6qGL^L5l=T?LM~>j#)Yp82)26%9>}|uTAd26xNJ#rDgNQ7gU*UZg zcvv-+Y>f^`ol6n0Us|J{h)lDXOjBi@6c})rMtW_J)>ek0^1bsF?Mg?HDw%16Qf)Z3 zr2RzEWJ93r{Y+$^N{)t|yl_A0SHR_-w}c?uiDDzRDz%gM+P^&4-?vo;_ZzN;eX1Y+ zGL`Ba_aW!+{zM5@oS_HVsvo8@)^O)<2=gijaASX=9mq`lyQKs9-|+QsH1R*)%Go>m#UH>;}=&Qr) z|ID2He+|AWDGJJZ-HO)2L+D_6dGbc@-xwOQ#%(aBOzpz1xL=s*QiAfE0nU;bFu~Yz z$Laz#yu|TRs}l5x>*!4W6+_l7=aAv}YRIu3lLLv(K? z)hzTq6hS*rsOJ@3za0}pj z!W`xvKNUTkA1}5%wr%El)tlYNI&9} zi3I?v&rmDiYR9}}TkoHpASo>S@L45T$K&xtO*)>#BzntBR)g+pHf1*?oE^ zr&37}lB%GGgL>;UecnhFGDvoIZQ8()L;*KI1Sjt$<*52}vSq|pE0t8-+yv#r=$}YR zri6rqVCL>W{+nxU_cFG%k?sB+arhRcs{EP|G=Q8qJ14E`+!x11QTI$JRa?hQ;h8W+z-UptSMOx;-iHhWdtdbzv03jxE*o=i_Jaf>Bh!q&GO#>Yd|Slh z`(u=GcCa(~DLoN+7tl)ID=3$h`!WCS7LjhEUd;nZbJ7KAMs343EqW>|sR5^BGPB9O zw>G5bcTXCZwpV<^anQP8jWDD-?6Nsx-}gPBph(~`xuL1)?Ec`7H&LRqtTsUqo}ZuJ#^ZF0x8vO(jC-$6i)ra5AWCQT zw3Dp|z#|!s!+DfP-sBGFk-#bxFGdkKzAgE7@B2C_c4X&l!qIipvu&IZ` z{o=XnHM)AaKz5M|6IPO@>2Nb36`vVZ`EOk6DY(yJ_(%xPe=)J~J&UoCF(4zhTgCX1 z_?k@5WhB2Gih@_bp9!WMV#}Y1S~A;J3G>*jXtQ~6@CMX|%6O|&W($vZ^4Jwb>YQKR zeXc2b@8McL*Sug%roC=&TZy0PdfibwJ>ZkS5~LxSlPtArwC2jFM4@YXFeSQ3sv4&k zYWwo-eAjRm$%$7Fq|m52NybaC#?u>ZZ)Q1@9VtVnMUD0AMU31ot+ch00s%&;oIQ`7 zo6c0Twl`Glr{U5jzTyR%9IKy;S<(!#ot$(aX2{|N)41C5y;nc%Hq{t%!oKKT8S7W{ zzb2sc3Yz?{W8K!$m@Q!%_=Gir+iUG$ujq?tYq0<`EXOxlhG1 ztYgtH#T$5_0r1Ipt>O*HQ0sd7B=Ji#v~SpA^J|#s8@NA-p&`<`HixxnoUwd0ah;%N z7OPahJ}*9RDB2{fQYz(gX|JIb--cQy(b+@47m|gfb&oQXQ`DbuW`9yR7GTUku0ch% zb4+?7LZOmZdItcJCW);wF}Rho0es)xt);@>Y$E3TT|!e5_lloPn8mNWi$Ye*Sv*6>(7hWmw?dZ>b5iO0))&rc&p$Pm3JPz!!n0$Zy*C56HPH5%Sz))M@s2Rn zu-dg$wK(rFEVVa^q{(UwvN;LMy=KLv=YDlgV$m9<%59efs^bLUxk*CElN!<76SzUj zJ_&hy14r$M+h|_H!bCc`JvRfupxOh#fGQd3AM`YI=@{;_WpmDk^1_q}1cO7sA#1ykE=lh&I-Y%nGL= z@8@i6`DDQfsyR<@ful1>3JGBfc_w*P6@uqYCQKWL8qu-&Ss}yU2rC{Kr^jaZU31F& zlb%KE+D? z&oGBHxHC+_8ZJp4du4MZ7?5@H=E*W;WkAP)2mLY081aWM`3Sznsh_rYB}y7%c|7bk z3KS;~W^wJhhpU(MEH1_i-WxvQ#*43v`Zt58&M-H8XII+#S0PVF)7GCtMZF$X+D})- z$B32Z4WRlGEu_kx3Q?BqIUODib9q!G42JKWHm5Ey?Oyh`KI_mJr$^(_!7s4JtQUcA z7A%Ze6{f-*h}JBB;muAI zZu!n)JIKI*SZJ=1hGwU=G#*rlN)AsLV_bojN6=GRCf;#rZ8H+prRk~XOw|K6|$ zE)0Qv@nZ=n`Qq+sP~8M_Y(O zQ}(NrX4MN#(Jl}B<@(e|&f2?(Zt2F-5r@*TxKgVg`V{CQgu}q+b|av3-RJnH_Y`pB zb>nA7fBAb$g$5$i6XD_fUXh>fw@N!&^0#61h{BjH+vXv>K z8`-G-d}r&Z)Jpkkgf1N3lbXF&?vBBh12MZy8gs0yTHps`+S;|U%k^eUD`JkaIRJcT zv3tmb5yv;-rYjd{&hdv8fTp8-WIRrwgf<-V<8()LH31#l6hh6YCzC9$%y*}h9RievB&yGg8KZ1J)R)qHx z1}v}Ehd|<(L;1|umGYgg@Kf7;F1(71&!K|JhG7Y)PGNQ?b-}X2J^Lnh?lXlC#bkvO zlXRSc^iQrvbvIpg(L2RJlbv}nNkbDxH-=dFNHH%`2IlKMJFI=zHD7gnqarI`)#m_m z?k%DNuTfO^8g8BA;Tb}UxoS>@1^5jb*uJga=zUtnY1j{B7y5299+!3j z`vppoO`$RFSp`bWuLF9&3#Y*Sr#`S#&*L=UbA|xdI)_~iKys}r-J+da047n2>@35o z-zPLWxXF zOgfhp(>o>msBqsD#OI?*+}|d7x!l#0JmZIi(+*A-U?wB;H1i1WiT3GWJDCz_grYy1 zlNfX@_)N+eVE5B0qo8{|$uIyyb`5$?;YfPqXubcHR4;{T!vn5TnKE9RW4bCuXl-xiWDEPKsk)~PVsKiV3YNqv)X5=11UUX7Ie>|%1W zhYul=9(N@O8f#5gNct1_16dsCzf_jSRaIzzNx0u8#@2r;fT!7F{4w1)^nkPe4l3nm z!BaFfNpq6?EF}rKED9&stZ{Y8gc2g#~C4)Ho0V zl<8C?s6X|XCfF~jkK*pY(n@JsW>=A^Ub$0Cr3Fs=EXme9yvConQS4Y>ez?S_>}BOQ z`MHZQ$V!3dMO{45u#u9<3Qbs~k?pWD@8|9R{Fnw>rW}mEG4@rbzYm>!vVayX6swhD zyQ2Tba!?g_+8yt=(&$YhT1t1KAQ;jY((^8d#2A|@Wpa9MG`fG0cq--B8>302jqRi5 zQAf931KXMK71 zUI#1_Ys>p)IGC6@VA~eIkDJ+(ZiB8)YO2RdU1Js1r_QD&&=7qe7n%vu+--B;diRd=X+0HZ`%S4as*3>sps<0W2a>!{ayuwz=;IF)VrLEWtn`r z*&g8hMO&N;)!s;TD#rK?Ss)+K;EUk$Rc%sPErtxw!f0Anmzl#Q>&YkWkBF6&uW0Y+ zEGI;68+qh~ZRD#?Y{TCY4J2$-Y}N56Pbl|^_4|nS$Rjt-$3RC%M{BNiLR2IqB#6~j znF+x4L!Hs3-R0F=Uo`Ycmo@^KR(vbP&-Xwx{N>!SEcv;TX|zmKG2>B-3a>_&Lu&AZ zbZ^n$b~z7z76%*}DD?>P%S)X-+NtrNM-!bb7F9LvdGN?ih!{IicK;CDwQN86NUBbh zcVv)gt1x{I4t|Eka($LnG40j%8|R*F z3F_?}wzU)fKnL;sU~-*HL}U^@&i;+AIPt5CrZ^D>g>1Eq9iN<{}bz=`N) z^PYrPA=&!n8I5c1jP%@Fx$V&Gz$Y0?V@~7Es;XsVq-5bmeCsq}G+sN;Q}p-pRPbAF zVf?SS+-xzT_x+W0kSEyrkfFHCLlu4OG)&zpAozqP&UUM80nPS(sUK{ibTXodzJUqA~XH$@TYlR;N4P(P50M$=A>9x0hm5? zIwZcgXoTgr^G47|el{iGx~m97_CggjV8&B$JWouIah@T6D0a1N$vteB2GjrJ_SoLW z$z+TNvsC;E?|$Oj-e7EG^m_#v6=wNrNSF7LvgI4EatJVep+Tb-&{ zPrJfc3i5%7PvY@nbyWC&{yPBGtKgV}0f|OcsR&zV;Sz1wuo$DOyl9A~w^l%Xb)f5TYQxpY1%os!S*btlm3 zfFH;sI{NJ%3rHBWsW5xWo<&|A~TC z2#BcX{03uYaDwp0A#-N29~>?w`~ape_=qlqN#D5n>U`e4_R*DuEKQ(@uOoZ5mPE^E z9Aq_trSpNUMX_RuNT||ttx)F-&-n-Lj3p+!E7lwEPc)+wn5B>rq*MKrFGpy9Apt$- zZ4+%HZUiPLXL4a>BeV`H-ZMI?X}}>&_M|W;_qRw-pt{I;Uvup`Do@{QIVQBv%>&cZ zOYqJ>A6h|l1R>C+yZy6+hB36_Xng>FEdFiwk|{oq zt7+HQhg?h@lehiD!hurYb9YND6@2{Tlh0xRv-cY5To08L#Jq24McNRYH~0;K^}Cl`kb7sPXiesl{4pSMCMeWcSRF) zfEUxfQY(*APQIjkQ<5GsPG{BQ3FkVhnhKAm zXjDV!#_0-H%Ci$T9gkgGi`5C(HdxsQcFaZKN-{Zf>IwICd^b)WWtEzCKps~5K*f6b z;keoFT+2jjyeoHZ1glTc$Gx#xb~5!~rhra?XS`*l-d7bq%d1I2`(WQ~O@*t;d?j>7%14$<~mk?6YX*Gb_QCsH=2ipfD_umG~mDvsbxf8Ii) z)Q{@T#D~WkT3@mOQ15W#caDI1iuaRD<*}c9BLeE_4A`?!UmWq(iASEtBxaMjLm`Z_ z6(Os2^*gKK3&L>^rCkTn~pT>yND(;q0W&1*r z?WU-ppeK~duCW`snQ{j0beA1A;G5f1N?<(_mqKL~GIR*C@Z;GTo2^}8X$6m%gt)BL zZU<$x5zypZ^}z_HTeK=L%Px%XD7)wI=eFmk+!x4JwAZ%(peHVk&Iu5KCmb*?r8L7- zoK4*5;FPF+2fV5#Xzx*%j{us*ppRfsyv4%5Q4D6H75iwg{>sz;&E`ErJA z!NGQ@>C9&qqr*m;1-GNZ4pwg_yB)E?>B4pTTs1cf>~eQC^fJ~x-CiUkv(g57&~$w} z8KUM)z~|m}jKWp_+D--&`0X_I!FdN^JWm_;obkDl;H&UVouOtRkHj+sPtSB;>nOS% ztk7oF(%yNt3N0I2SX#_YELH(f$P3#Zy@*dl8B{e*?cGBR6s5Fl^}J zae8dYh9j$qb%McY=3VuGKJ7o2MEX`rRy`9^UdxoyyjrShBBf>e6n++WN>feze%d^; z?nz+ur0ESt+8{4Oju>L46Rzyf8k?cfyA{7f(}@oYl(MuyY_bGQPk)UpEWu@A`Q#DtiQ{-xjFG+(!h2A|=8Ci~*|^FuT!b&h*m$o&4{&lO^2* zqu__Mc;w^)sE`uHiFgngsn}pdvxJngi4)Az~hvhe!|_w-}*V3N=?v& z8|Hm*nBF2vls7tDV$60zA%$1Epvz&94K64aHGty zPca<|FqjmvU&>SdIJR zA6D1Kk%G#N7Yf;5s^C_NmC$(-mZc+3tvZk5~5f+N|#Y^R^BTS4Azja*@+b$qQak0n(YkO3R=q~65lZlbnRFAXne24f*C7?GqGnqo? zbffp>p*f41L8sGuJG&4ZRMBb!i_DUl*r57%1TqsKIM zzFM9lAM%yEuyU2y3PtGMKZ|@;=m%pRBANKP4&EuJ^fXmHMK&OyiJd$dyJ8qYDyToL_(B8@G?p z1FsH1Z}={=S6?{vUR38wbf*HZs@n8eE}>DIoF=Dd98hxH_ey5Pmp66op_{aR=F|6j zicZe-J`>#N>0_xSGa2zY_33`I4y-=;O0Gz52v9-Xr+RlKM;6yzl4l2XP)KsZRUG9E zJ0d*#beb)QQ=w%c%Sl+L%);bFGpFYjCq=0zrk7mrHD;75_9`xVzOKGHEIH4V6t>6A zO+b0M6SrB|dc?ppiY#c)P9757Z4A&hRZ4TZVPFO*WjS;?GIH*@1>~4B>b^{-M|({C zbU~|y6>tJ1cXV-C{HHltWg`cjRBVvUdr6V=wP@`e!HA0Usu)4YdH;9~GY8I%71N~K zH%B43B;-T8QZaufyNt;4nR4Z!0{0dYy73iuOUWg&JxjH*$Yd>A3|0WBSy_j;6^B%~ z?l=h$j@}2)AH46jbqc9iHfXxEAsZs@h|aUyZd;;`6o$3rBPi)vHGB#VtPPq_f%8Ip zXrfI84LZuviGs1Lr7lr*V^Uc37oF3#hf_K zYBuRqd{dd{GWGB!(-}zdlE|X)Dse(s=I7;gKebub*MyBklkZ}7&O4xWl0l0bgc};D ziH8g?R&v6%55{nvV9BMNdDE#Fbs%_5G`2N=k^gf^)0}rs(#ALP0~sAzVjU-!DVpk- zWiiFc%0vFx3oIQ5^aDh-c^W(a#BRcoi)pzNTgfh}zto@m@na`&l=*Xp@U!%QmQs+t zgeA~gTZC&M0PGQ41pHpNN3Aey#a(J_Kz~b?IXX7>{k!k2O@d0=jVz(P$k@4B$gh=IkueH4aBTB(=PfGVrHHlM{ha}%`pI3{ zeXnb4$x|`~#~c(x5YL-ejcQB0yvpR*a%&U}ShhB&q2#vcpF;b+lB#hi-RJRQ)Wq7=4}) zRtXe|Q=x7t9+a{?-7$L@lMB96_V%4yf28cRH6y&OrX>Di4Rh{|A|1`HIdPN3hh-*a zj5QnIq_^}AZyEW~$#lo}Scx<-tkMMXGF&)JVEps41RLd5I}6MST$<;lyK{+e<_Se2 zvxz9=aOK;9sgr7RfeQq)q4PCA0jks3zV(kapm36J6~XD0m3SNd---Yrx@7gi)}bdNIayo3 z-x46ZrE^G}M5Vg;Elzpe13?l}e?iPhea$_9>j^kuU{^aC5YwMgUFtbDQZsF#78}>n zrPcWQ%a{yw3oFmKXNW8*=sV>^!hK>LTBg+kL$TP8vqt;w&V)cHeb)-nW0OnEDyZ*= zCrm}A?%$umNC*40%}gx9uvJUrjqfC%F_{|gvY&j|r$4Lp*wi8{8YSbo12~P>y9hw~w0=XV9tO;? z=eN6COH*`O3+}TT4%#>_7jcjYpOX5%%3{I#)#Lqan>D7I$UK8OcUxsd#*AVkPQ4KI zJE%a0%PnU5WDzSEZ^)lD1+np9<#ckcMr3Ml16L$dU`m7E`xqCGF0SN)BXm%52Vpyw zXC6K^9vUwPt?$kWuPf7syFSdmbr%b697Kw&*iPG{^V^@lp4H1fZ7RwR@f?o2*ZkBC zoGVzAnA;g7ggZM|*=F(>>n`usK@Ro}M*CrN&-s6w>kH`4IZARuL>6?TeuSa3!@|)r zTKr>sBEK0yzqLvuN@`cq9?xyBe`pMTW;swyjyf+g!PZPNc4b1PEQ|WyN(*=?=+)SE zc#Cro@;?5_l7b?=x~ddO`KaiJm?n}$bsVG)(>NYb+jKby)6IvOb!7}5Y^Dnn;{{u@ z9=G#EzdZDuey26^3W*GjPJE;$@hfHW!cAm6ZqY0ifeby04!?QTn(u5|9$Xgs$4@3T zM=eXmI?X2wlB(k#ITQ_ZuG?K6c|C!2wDOOIKB*cFYRI{?HCX*10qAnfZmJFHIoi`K z(wubpdbKW$1)s;N&>+4RP6u1fY0hoz13YFYqmJdyXqxh7-Kr~c+jm+-W2Kt~cCZq2 z?kBc6Nfr@uDEli`cy2voU0C1lbc>9Hk(F}$4bu!Ep8W8;X8vHkC9$E%FN%kA1peI@ zuFt}>=K3AC*$RU47$kfGjiba;1(NQI11h+!Tn4Od*Ly{Q}VvbX>=yi&ZUt|fp-hZPx z*~3@e-?y&`9!q@GMP&$RGrByz<#AbeC$*I=YcW|?d^7i zd+XETj>iWtx9IMaI({?nu9@57aTsfF%eh+>*sQsJ6{YCcB{b4psk%IPnKt9R%M_$^ zLB&1i!_0IO+gdK^&lmnABv~@ykg~HSmzmdH0vBcA)vZ+UMUT(p_69yz0+az?$>*W% zPLJj%w?vXBN|GEq(bFa=we=bE48ZqP7=jm%JPAoNn_Xy(7|B=WoM5!vTcAd!N#W?3 z2`W=}TwutagXWd~E4acmw$~=X>^ZRMs#9mehJm5Pg;k6y10PfF{!a3;$2u5ZELs%L z9r}^(yFYEN`5;N*@H_F6hz{cYa(kr_(Uq%dfnI2q@XJqjXC2gVtqm)4Sw{?%L(CC$ z^G*}+AyUkC8n!m%*U-Wn(G*F=JbpKy)!{UZo9^^#We~$s8*S3I*7ueA#~V3xn*E2rp|@r$qh_6^C!4?&N&K#vF``aZ zyRKEt6J_b`Npw3YueiD8#Tme*m6dODxVi@_>L<+|UCr=%wZ7X>&*u(Up#YL43Ngv_ zNsH&8OD!jz@1kLKd>b4aL6_;@-*NkRlODELxiS&&d)X@u^O|>he$sap5iVJxvrQBE zC{Z7&fGT6!?T!!;slT_iZtWS@=(T^JjsFq&mZ zQtz*(oq#qw>vH!OVGIE_o!3A&+;d@7QniCzA}CFhY`bRz;nDZw(7o}jYBvFz#vs`1 z4q*^X_+EJF^%F~bQ?#^1A4+V8EWb3iDWY=7s#}V3XGWCwHeDrbCyvZShc3_*s~=vJ@bQ(HG$s-fR=sFr5Q5j0?aa(W$9=S zhItD_+AqI5)g)3rSkfNIH{d#{Pk6AF!v&>+WXx!6t8>fqfdkRI+NwYtREQIa5E2Oa z-70;u$@kVlvzYEUjbuI6v@O5)nq@w0vtT=^kz6mB?_lH`NaoFQ*ZRnw+h`?}{*{lT z#&V;ZRj&_tRJ6ECQ)Fzy%-2*{uiC+4p{&w=o>6{goPk~>@smS8*i-M};?VcjbS8I` zBA1rY`nwChsv?scKLsT2TKpb)OHj%ccbd7hRkJRcCJ(_yo* z5w*8pIGvkMMYAPOfRXAfm~z}*-N6u!*luOj=F8gm+?+>>*2T8}Mppv;^YZrd4vz|B z2nY_*u6*uq38jB3I@UK8CokPI`;JOImbIUqZv2jHV=|7LPJUQ;kt6<+4=9Kz#T>nu zF)%M+>`70%skDw6=7U*W8SNXj+bs!ZQt~Py{tVqRIr`m^!~~xk`iW$t;*i(v+hPQ> z?m$1WkB8@gvmc2&#SxVCh^w;;agra!#tk@kC5G~t@!s!-W)S1 z?F(8G8_5UcjDCja8Q(hKs*`*#GVG0>*OU0&5we+nv|}~gNI^)A*&Mo;)r`}`b{pC7 zs&A|3UF?!u$8d{LdH;B8@_2K1zENIs{mY8V5r2z2;Ue$58qus;BX7_0bjbinTxm2^Z*ab4a~ z5(~r#u`dkpvG&}3MxI-H!4q))_|4(4b*h`N%Q(peT#l4HGmqu*W>6YsWnIt#XHQZh zV0jLD7&*Ydiu%JK0J(3oj3fQ(f=WCG z>+xNag4IU6)4r)CCR-APts=MH#UADYQ9jw|#E!Ke>M0&w7d3})Wi zMM@TM`?`kV9*lNKb|#+&!BQ0Jo-r2D;wm%X%d#wQ&7>N0Ed}8BC%^i8@>)L~SKU51 zSd{qP*1A|HVq{b;^QB?THD;7dFY#4*8T${ka3&R!( zPbUrlRfXq+5GkJz{wCc_ zj}}LDEaQBxIs~c2y3!6)h>u`7{*xvJ8EyHsOv8^p`*jwg&Zlsno>0pDzXHy!d*;Q&0S+pG2(WojSkylO)ViFL5wBdw_7j?{;tRPW-g)QnAyFeMQ=vfxFa zWxO}5^N@tQrBavlG30VuO2?5R-&Rl5w^t`59h%8C3}f@Xe{Q5FdrKQcpzypH;x=#DNHMgm&lOgy;xQvb$L|Uo-(4E#J zAD~KgjJe3|Ahhk>GOclQ<&%qkwhK%Y&DZh>~G*G?n867AK}}k5J{2Z&Ajl zEfqJK`4ilMcnVoGE>Z*E3vn0_QXi~u_P;FpZ4xU@5Ii1_A8mlADdGqgZ~>UQc&}`U z-i&i6iBoO7Omcg+9$=$=A$Vli1s8KkPd&Fb>Lqw@WKRl-vYc|-*Z;TMObY-z^i8eC zXErJH&r4V)v*#hO5ql~?5BJvg^3Y|y`uzl-gjyqV@&>M!4*45hSz7mU)e6KEELd;c z8U{E{s+B8Jb=ROdikeMw)2lVdZ_f^yZLRAi81LjQw-#oZ6)(GoTe+0EnBZar?3Q$7 zR_+{gn50=({MhSkR#}y)o?3au_#5us_t73Kfi^^8Wdj#yudFY3B$7`gT3(@S5Lddy zg0@BX+~0Yxz10zT;MmST2My+=IBA@~xMmFh3C)Z=mr5oH=;sQ={;xv_OB7uitaa0?a7L6@+o?KN?tAuT~jmL_+Gyl=Ynu~t5S*u>l z$l@|-({V?bkKf@w)=qFs866~q;={4PATkz`&B-eInJ_zjCB&0^+31WAR-5E`UsFRg zT4iJTy$ZtG-=`KPsl`l*GfTAIl|=4S&Ro)1=wV2#Q93(m5mYQu8`2=4U?6xOYzRp} z&TH{eA#0m<;nCBJF3G?OY;#v}`+<(Fk2Yyf*U1Q3&`8+yW{-#pB0y2stKamZCwX0~>kt46pdL^qbFL@^+&iViVw5@ZUJ;hsQ$1t_aVRJer z8*O9*%DAxEib?Urd})9mLoh&`&uwKPAXkB|B$#F5v&&T^d+?qLz;wD3nq}n{RsU{!NQ%~ET;}8XuYaqH_^PN}qCV=T zsv!AWK(89o{q)8nYKA&<&MgwnC~x2JSjzne?(IVdpE=@psj3f1a81M%WjbkUN+p^% zDvu=b0Q2)QT04;a*G2_s2j~7sBn?FI8+aJsPXD8`NB?w(Ohfz8(0bW$1E*zYL2Jl6Vo^Rkn>%(;etCEw&>g+=xigQ?$bfN^B?c}&xI5Gomg^F0TXg=B_Ht0vLr-6kUqA2_94qC`In!7pj}KLE2n}q}H@30J>52N6-Tn_){zvcf~}NCdG#2z(&pj5JIZ5eVQJxE zIeJp9lwgwOlDd#D7oXsRT2ur~Oc?BMCraRYN(CGc<~l-y3-WON6iMylHFIQ0W%Q}h z#&qL~7{6-FsOT^EcxMvRZmUnJIC@Gj2&s7Isr5!0ymR1V^l}y2(GQ}q9X&?_VPZhd>IsUZ{PXyWDibF z{$@ZM+%6Aa!1_7Tcfo9Z7G|;eGujdai{G^J#Ovk?{qVX3|X4&bbSZ`~A40M3|bL4eBeGv!VN2Re_-a zGURzFbh}1;Y#09ZGST;MhKSJRkGs2;1DW`qcF{_|>FoPw(${dyqFc$T%^+sDKw+|G zlqRF)SEf8aZ;#^;_jzI7s+50OSM3+Km8kETjyHzL^R%xA-;t;|NL1+HUitIKB7Iz} zVs-Eo;#t#@kn>9`pEt+@i+Qk4ijew+MXWq1k)h%eTx~y3t`Pp>8M_$w?Fl*w`I@>q zDVqN3>=`qU8-hi?H&Yq$t_2vAK}s?k@j>r7F}ypE=59a4xng@4vv6cE!^XtlX!3}S zX=qo#{j=)&1hnDFFNM{e-NFF)aD8-&hg)IRO%1~k(`<9lRApd1>U3TcZ1(N*Ec!m} z|5Dd}M8_X1QyxekYf|Z0U)egWx}heea$u=SK_hvE@4h61nv^-UAHY|!10|@mZ;SDZw<6AE-nKT9YLQM2 z*u($-MzUDkJ`{}7DMH0O;3--=+oJQ zYh*Ie38Fn>-(SQdFpYr5@(YINaMpo&9QH19t#|$QeV!x>_q>}i0MIr@yx6D69@PYS zV|`$;uQ}PhKq#h0Aw|&vAKY1rcD^~!MORB^G8JP-BX2WZ^UXEsU4Q#Q?mMo*J%pg6 zNS@xT=U|Smj-O4s(2Pk)@55nJL-6UsaM+dPmX&KiU6U}`r;n*lsEsFYtV>ONze5q@ zLm72Y(Czr4BKnE}&o5ABBeFk;*XDMllJwUyO2rzV6?Qi9f6hsd+AbR8P5Enbt=Fz! zp@!+T+54j-8J;L zKO^HUM0S_f+BSWU(K!|QbKu|@o+16`(!Dtw~izRd8mS%2%pmUUG4C- zn}**r7goAD9{~dXk-@btZ#&pW2kIHzQMTHokvJ&eyDihF+2wVMogXbnGwxmr8>S@a zoh5iIPI~k~da>7y9kh;yYm2Y*qC-QFDo;t!j;zBX(vuo(?iM)*$-q|fjylc)Q+3rM zx()%4H>z_SJZOn8JPmNsS_qApQ3FGwRS$`Z!!A|(K4Z&7vMp%d1fl!V63vfyMQOCJ zMlBA_BY#{2_*dXBnCJUu24iXAB_AJ4rW26P|G>9RG)2;ETQxqW!XMci__e?aFU z%Az9hve0~k{qX~wh;B1<>6UO*$j;+;qLn@LN;gEOSWxzUSf2>x@4v&0s)GZo(5l)n z`cEHUyVX>6KM&6-j@Ryi?IbVPhCyjoaW?Le-MQMtN`Z zK^LH1=2in3h93d0n?ccD96v?()y(jK=k@X|Dy5RM@NoUZ|K9i^C;;^>Uiuxh7ehRs zbRCidCA}Jom#ZzaOXgqAf>83}y*w3)!bULU>(GdiD@U z@7H0J^C@Oh2;~iLn)ttuedBcacdq#mRKZ`}$Rc5=n5JvmLIlmu4qnOs2tZ`m16S~> z9l4vp+VomSRt>L$u;^??S7uB|R?u;!&RO>ZoACHjg`FimcVE6>SfzSLv@+f67Sl74 zQAxIJi(X(i1$4Yp7gN(VBR|Zkii@~s+HgfLC#6;N&J`DMSJ}6!&!{P7uYh(N>-vSd z11h5lZTTWfRiKqBO@AHNZ7x49K`NFMP?mbolRy0GTcC^ui)C%DQ6V*S9=@*sb+)$U zYh8apsSDtd`*|%Y*lccw_3^_zu6f0+`2>)(nwb&M>m05c((C-m&G7tADa|FmKZ}2O z(5biisFI62*(HQnt&$HRn9)0=Ewro0zs2R&Lp8l4OEYx6pDt3=T-rfXXUh0<5kUMC zFjhhxRX6IDH~}|(tE=v`rPTo{V%F1XnEW)s9SUd-!}Ra;v%45S&uUZ>^Vfjed;HThn|hKI;*38GR8>$;TMr9KcIHTo)y_ zXQ+2Yo8YSJmPj0XPK=i)`=n>+Ix)uVI&k^tED(*9J0@mv?*tdfC+O{*yo=FtYTfbB>4-2Qa! zYVhK~rwuy%qbaJQlRl!NRHgCZ9VldxN|DX{|p}admvBO=3HDdYH3*UdqV?@2u;Mu?)kq zH0GnjS40W__S-I~@9pysyX9)W{M^!n^VzJ+$K0EIZ1(19pFCwXr*95IPY~^^2`o&O zz0M)D<7p6Lo8Q`(750}E*5oh0z-9DrSGofp994WXe^1Jn4t(AagWp!Tb!?9M8g{e7 zl0W?SN`V{RD*7_UDR9JCsMn683vXX$3%vA3UoC~${mQZ{OhXjAzTG!3<}Qb>0rQIs zn5m+JrjC9cH3~?fl#Za#OtTLxY|Qzc9uywzC5jLdQaL^&U3cC~ZgMX$s(L!;p>gHlv10a@P3Hdb@{8I=6~qc}OCm9kQt^%Ny9xi*(Ujz5p_g zBLI}(e>fhtF4~mnZt1&He|;f89XIblNh7(|=7As)PF-Ak$=(38?J%Dbk4u@FHPfDz+^$%3|;9bVRa_x3Oc6Z>)YU{S%rooxkPm zu94_>a_I_Y6_B`Q#aEDn$4IL_<4Bzc)1)?n7Eklw<;>o%g6lLD$U(I|E%DmL%n$yk z>*5lAaHyjOmZA01KOBZ4YYhSz)mL`0lP;qt=k1oi7#|a&F10^Il@v?_wx2ZV&nxk?6%OqB<^~7muj{|Bm`X>7k)Sc3lG6_~o{plOV>$FdV-dAD=mp_2Ig52xQuJPF!GMs9d zRf<%=vnOi_bPp=Mtf{fSzh2ym`CtNtvj^@ckG!jyLnQ-?t5NkYy4szr7)J)DTC}V> z4H?k}HmIHRjkWW;RCPWh1c`6heQSQ3U#*t1K|To?Pa}97O^~KEWqm2vbAnfX4M0yh>RY$OGt)Ldh?-fQ~_?X683e{D31>c{1lRP`fHtS{e>gc{%oJtXCJ zPz;?A-mG0-YzAhR!Z>H*-1kq0Pke0!w|~bq&S9Sz=qF2@rxpa8r>X|5T0=lL)72F& zZk!aaj;(X`&?OH(U~H@~OjZ@9MIk1ZcVl}LO-WaF3Ie#x!_BCDRi+DbMkh~j+jkaF z>1-&-&Sg%bl}?jcRBOGNN26%KPQcb2%K5@Tj$ZorZ%Kj}$YI)*SEj%VAo82#}(H?@Z?Y@yMX6iJaHrMkPiYx1sgk8M&mOTXbuTjc4=GdYN~JfRov zD@s6>#He*XA%LiHvldt34wNqE*_ZGgax--d)Mj_&Yg)znJb&=%HE|*o2yY)-zq**G z!elMt zP&{mWbVqt_ol4IP_ae+cClET- zD`L&m;6b3PkBJ>ZlCc{OZi%ORdam$n>2+`{Z+>i!g@DyBp%=+ zm%gnG#NY)M+Ad}CaMh0Mf+d3dZ_igM%F1yw1T<|z@uGsq-~906DMIv>NY#|dK)8KU zwj@WCem7lA`QsSUDo&usqEu&T8C~)U?;E;hdS(dc+hCmAURHF!8NcK?g`F4VA%0{%?=}GHjc1ncC!i zV^flyojoRk|Mqu&I8~;E-MopNE<5Qfw`Gm10YFp7fM!<1AmLSuS^n}^Q0mbEY)r$| zBn*;}*!p}>QA8=@VBjHJw#}w4y+it@j^f$~Y`xC>;nyXoA~QA^e~CI$pfg*QR8m3@ ztQs+tecz#%&l5?mc0h9#pRZ>;FUi$KLQBuJj_ZPXWT+gAAZ@x`4RE z4R^S9XLZWdv`rd**OyFupr~wWa9lC*)zdn6hwl-Y=3cLa)_}YeHGiXOS6aXqKA+2f zfreslS0<#iwom4>GPnR0*IkOuu2mMZvqL)Zr*z2IHjlb`AHyhD7A`|bo|23rKQ#m1 zv^>Gn$`=}SNbV14_4O!mM*bwz8)HTb^--Y`02oKspKn>F68`7~*jc4gdNdyQQrG@_ z$(CnvlMusnnpUMddhiJ-^M{BZ)-&D`i1eL^~`UluR3Yq~T8i%6WBh z%{dt7L1r2=b5i|_xcOOG#AH0tekw}=w6X=u!-q?p2mE~QA+Cy;9@f{>q*5$2=v(b> zF*_EAE5c3kN;5K`{za9A@o^b|f@#6}ZC3o{>_g+OW(xWhuWpj2v45xQuOkl?;k&h| z4pdEPe2~nU>Jz9llKpABp>`E@$Maw+bA2tgox$}7-FV;>A04K23qo!ALB!NJ>VVY1 z+H?T}RbA@CDd<|Y$dYYn)Ia-r9X+gIMsIN~Z+MyjDLz`&ZUXzhC&Zy4GLXjK+lvmGm~lxFA!AOpDEGX4C?C zzj-0oZ4KQ*Wyx7X!7)OAN%S&N%Zp0?Vw+s*pLsHC6*_Cx#H=Fgqpj+C6FPN1HgqPC-)mem)r@4BUE8JDgeE~?yBSoYxocZfOE^b|wuh`C&;@=t%yn0Wa> zspUaD_{SrKlvNkGsv&ZcexCZnrCHj@+_n zouDzO=_HO0EfC*<>gDT*VPdJO9-p*MEwAZ-M9r;P#LdNbaFg;Jt%4$2h&ywDlaaDM8djN~#VdylBS7CpAA|u5>>O2Hyw_Qho_reyhlcaZ zYu7NV?Cw@BcWo05hmsCiSWmixi_ZEb^*!Xw+7z<5upCF^<{TnaW~Vt9o#xMu2kXrs zk*Ijn%jmKV4sDot3Yg23RXKWN?&wysi>i=xhn3yrl5Mo~!Kf1QYP%Er2n^%l-_}5U zwn8clTA!4yIZOT+p{b-~fwu6DSV`q+&U2JYyku94<7;c~)Eyw6*Y8!^`8pw%kjvq# z^zqXFf@X%aYVP$%eI1}aCGl_@+jpSh_F4VJz+|gi*02(KR5W0`)C2d0cyfH*yTZD+ zLGhQLRg%G&y*;1{XG2&dG%#crs0_>_L*I! z8&mQ>Qb&pcRCG#?S?5N8qbbpbzt$5Xl17~7?fh5#zmyIubGvq!JQ8o(ur|r*x@O9& zs4!~mcHVpGmX4Q+fk!cLmu>gIa9x#|K$_xVeNB=K-$$dk3|R+hYyB(*32;C0JR&)# zy}iI<)o8VQeXpD>Ls}sxB?hB2Rp+Vg6U)HT@cTu5rkoP%ADE$sq&fC!tC7%7D^;Dl zf|31}o4h95?L~TXfg6@O;k<0A$|C!^?ThWb>V|7eqpX3}4$dW&Ta~HEDP0Gb`kR`X zx;`z#mltm%vuNEr5-ra9q@@5o*%6wG((L92&T0fN+AD?2r#7ZvcYar%n>QiPwT$6| z(=-W*n#HE|5|T^xWwX%R`8dvLQNJkI(TVr;D(N8EzjDB>V@@y3HY?k{{!GTi22dG| z^-7bXwS%3z@IZA3Osuh8?0dwUsh2KauUnl1~+NCmc1a}iH^v3op?>w_~KA&T4p~HDyEjK*ZIFSnlyrQ#(wU(Gt z^G)M?5WGhm>3WO$oKeAjHUFI?^ND>#Y`l~=6z8

ukBe_jRWuc`wuQVnmVo?gcx2 zq$+_zB~dI;4Ab$M5M;{jF_t>c<|1KYYV6a0&DS$)=8)33zml4Y0+OuHUYDUAS<1ei zv)a|1b>3?OwI`gF)B34O5(>aHfLapv=t&!H!Bz{{G=A3Fr_-@^+1XZ~rA}Qt?ZBz$FxR!^a-bu4 zh(G+{%+eOLtD+piv+a}l!V0&rhE%F8Aoc>m_-G22N)?WAU!PxR@_VbKXgVNWL zi<5v_xs*g!2Ov8(O#JNhg;ZHNCpbL}#T;HOPQgv%>ygm<*xJO8o!(NgD(zGZ5Vs?B zqR#xX1$#!r@^jm(%j`0T`C$mivtj=$CDaMCV_4e+-pyX9dBaY< z8b3QoM0-Ua`~oO^k^;If*WY&XX2DVnWrd;zK(Sf{!A)Cr!Lt!#HbS+>II|aa#kcrO zHXWKa*iZVi?Zm&q1r)k8-yqCB)w!MT%KnUT3sYap`FW?$MI566uC&V`G>n;ycv_w; z7u~p?FE=oGZrm&j6U9BsKRI+s1w0&PmVGYYRk9B1ikR!0u;%9G@CavOf$lJEHVk=t zf%GT9P9BBq$Hy1cP^^)73f&Uj9w{t+Tinz1x9??|ZxBn&C#;)g6?Y0V6QkX5m=h&N zN8!cRNEIg?7!@b}v^0%M$ZRvPRh<`$~Z zemU1rvfXh@D(;rV%zjhXjKc{Cf}`>|mXC7$_isaIq9;Gv-BH1|)3xT*$qZjy10^LS zy2$x*D>s~GPEzURG1O8j_dp~|- z^A=|8=U^4-1m4OyFrbvA#>1hb)S~TAu4iRtH0 zSRZjp!D;iKMCXe!i($YM@%qa(-Fis+j~zLZ{+lZQAy#Eoxy=?aqV>8Ip{@r2X(w>o z|BgfG<&kX}!_tXXHLJ;C*3wcuwlNHwGg+k3a)GD(JP;--m$RYXhDP zeHoLKu^neE5+#SDty@H2@PLpd zKXyDSeUsS*c5C$^>mF3`y2>*C{sb`G#p2_1Ou5p~CDyuMOLW7xA|7QGnle713zeC6 zQb38q8=v<0$U>5yw2TIwIqpYTR|q{dx#imAGG8R!@b>+>J-4WV$mjn4ezSBwO2hHQ zPnui3^~wf^_x6&il1S(wK|2X%fB&Mu=$8S?Rra1ynG!L%csKz!$jZ_wUx!(-adzYU zUq5^cu>W2uMSSr^lXk@VmQ+Z@9mrBznJM@vA^lUb9|&S7%JK;8pz}8slk=-G{6;GK zcnTz#$5s zCp@^ov6g>lg2LeaAz~xhtcBFM;D7d#N-&AlyB<6eAJxac)(YC#KKm(~f;f zPX?t$_BE!qtpYTd0CF}$#q;{GvLpd)cu7);m~-eplTbCqBRzt+b9%e0!tu&bp<5h# z*%JCBTahiMqAR1r78jHerPRe`$K}uBx#rI+m$ED5<@#WuM)9}|kHrANr|qbv0J$1h zhcf=wWS!ydzd=$arl3cro#z^6jf%CgMau0hz%0|vP*SswzJnyOb=6v`lX+IeY;9NR z_+CNA&N9Ls%iBoBPQxz&t1g(}#S^R6Q04N0+4>8idoUJm zdvFD*+&42A;*TVns;)6;X_Udv!2S2#8r^11f14K8XGy(##w|+Fv>18TIK~iqlk@lN z`yU}x^EDf5#C>c4A9t|Rc{33gW3m9@+Q4luW`tp53NcTs7Wac{g>`pJWXcRId3P-R zGT}m5SIxJAe*UaVm&5`@mF_26#>7Z8GVo2`S`hG^J0NdmLQ9-hFJv$*7xIh;`*q)^ zu6u^(WZMXgi(d~|ZxuN&u{di%;zgL97O$R34217#TB4BCw9f7L3n=fdO7sS(&GCgY zM3mOAo@qxqBp>kLWkQxGUm%*vFS10RCuOwB!$%XovmHrNCG`Eae6Ju5~eBm;qxpey<`cE9Ur(P``wY#BQxf# zS3gQ)MqEaz()%0Js#2|h^I{+tmph9eG<8|8LJnLL1BB|JgckAyg=N?P`f2LG1KPTPG?G+ zm(MFXf6E58=r-zdz6({?!L#L>k%GNvBwrE06mopv+%Cy|csRaefaCUEk1FAk-q%NP zj*64{O`(AwNOiRzv|e+b)qOO+8lsPi8l_KHaZpq-^JIMFUS-!EP<1SOmj}DHK4y|>M7g8Na11vcX3Qh=ra^y3Z&$GE~ze;8qSIZKh zk`j;iA(5KRiD7v;iG6q}1oYpa9LeTdk7o0oT6q2@rd#(F_B*A2Sn+GdJWuig$um0* zG?mdj`Fn?gPqV;LPTQXQ2mQ&I$u2_y_43QKF&wWzN@IPO1g_J}!O?@5^LyaB>S_rt z1d@ua}yUQf&+MNDqvs9JE>oCwD z@ym4b|7#~UwclM(u*cezO$>7jyV`5^L}qyYyZT-Pw2h#twHUoNSkR<2)yf!mMELWo zSU{00{(-jpa|{Ut?Zh}j&^jG`gcAA-xl$3mXSf)xx7H4WkvCHLEzmWMH^EvEBbjjI zVSl#vEQ!ChS$BGI{r!;|l-LK|J)!M<@c6T96IUWBh zyHiB!<2I%2*@!rY6us~G^rS?=T4m987b1$L`ojo zsS^5OBNx18Po9a2q(6soienbwlbvnrbkva@yHp%9#rqk49_aCab%i6!qU3sFt;3o4*%suki7 z8Vo1@8A_bpQ$yIA3BSK*^i$pDLxFXe^wBM=en$DeIb9CT5x?2G6Xyw!sM8_>fHeC1 zqtcHs@;hfT`K&97UH%=-o`dGAAEDsQ37=1eIEl^6DJ8BsdNUe1zD+|D?;RH_72GLH z?|gsi!?tWLAWVT)R7?!2P{2k)LUNd=Nku~wF*7q$rbh>jEbCmsxV`KhA90Q(rVd{*35@>?;6j^0&%5N{WAL+mM7-{uJsfT$x7}afTy8^6 zlqgJI;M=6j+TPwG^C)($zB&#J$i~D$*TB{6?6I*q12_f<9iu}fbW}0H4lnqE%~Xty z7Rkxl8#5)CrbT1BlU{cl)^nE|RsFSc8KWIQ$!)vr=*mVK0XX>mT^m?U3f=z?;-=aSDZQoJzxNMuTMDLoWz~s;cz%>F1{c5t6TLSrIQQEKSWS zj|}>8>^lKV(XQ09GFJMuN$8Z6n$oJONQAhgkDk2QOoq6`dIIO9J5+Z*QI(}G^7^K& zx1{n$id1%ExyankvpOUXB%U)ZOFT~%!RbWvdWf&?>^#mkj#k8Ow2yiSYxgTA#6zLyt%7BwcgV!aZ5)%ozs4#bT; z>zG7uEO&W^MNG5hr~A8{x)mYoLa4^IX-V0t@OaV)wRD4(we{wV=_diu9`)+oUw04S zlkXvrDaQlbkao{?fwPB^_i|3tansVCY|l7&e#3aw$N0Sm`srU~zf@R@sbb%KiX4+A zH|>w!UfSGrqW%2B-J$DLVl5%}HQ6sEA^vi7sQ2OTx;H!vh*!Gu>Phv%3U=4;ffF$? z_A!0r^RvjLjJU^@cMmIIJc^N%3E|z++8>-utI^Y=nw}Sdar^2TCUXU-+ZLnH6e^3U zRf)U!lV!>n91RkGw4|eoxIh|C2gay0wwM%;M^oGB6a)YF&02#nSk2=sp8R!{PSUcD z!<)}|2g5#MV z2pfmtU;4)%j1!xZj@f(;>ezlurek@HLW#t3DOs2%{%}d~3?dVKzt76Eq9T8VUR z80zMIV$bpk+dQ9PZeJ&e>>`p4Gm{}839$dQ|?T#M%}gmbUSQeRZ3`JM%M6`D^JN} znr9MMiWvzQuh+`^gmf`K3PJ5_VXcNjy~&{2b+G(t&|u>25u+$*d1Q zo#F3&b-u+;`Y-)#k@(xo5hZJsc*)Dfj8heQhX3{53UhpeFDshXOg8=nMiKLAz`!jZ zkdR!?H@eFV>0qEYdnpo;GyW0VHlhdeePZv_w=2Z&^J!bhM!T5a=tpl)iHf_3WbBlm z>PHLZ)6}>~aTxW&3wOr|i88pIL~oj2zU=P@I=<`FW;XZ2^SM3S$>&ebuj4OQ2i(dr zoslUKFuaj80BHOT?pwJ_vG(!)F6po`W#%=X^DSvtXriWspAO zjmmu4QL2Rf(r@laoKo~>CtmeFS5HmH@%gW^T&0W^`H($ik;U0F0pPTjtA2CTFKHZDKTn2a2FyO-f z6#ifrt~d-iF{|GIbjrjHt27BcQT$oZlIvBqur3esgb~vF=pYn;em!_@>Yd9rU4@31 zTLPUp0Z)sm;fKmN>3mHZTgMt1e%kkd~CkB#GFmi<4x1wSK zMJC(p9ab9~E1E3L?$H56-KzJ^cWHgSrmd#Nxnw_H`PDh(5qBREt&)>XGU9)#dvos1 zw9%^VSOT+r|JHHLvS%(e3)|a&2s3rz&Z=C&Qm65ywMIthvqQqwRpo7Q>zSEEZ!*Q5 zXpZ%<#)U_jDpmlPSgK$nJLks#P)^7YHJ0aDl$dK?THG|t`vWrPd7!c_Q98X^ARwp} z7^ANqWa@$5(>Qa;m9W%wOE5OkYH1sp7RDr&qYA)djh+xYUE}u>lf$J541@M(=pp%i zk*n|j?XWSksR;5#i7o1%Zi0%2H1Zj)+wTPGGecWZKgh(FkjkO{7%@}bH{Rb4!g zp)(MV@_TPrPUQRa;G3|qN)1CO`N(1FAuQ?Aol z*to>CC5q$nUwi9M1*S9;d!*|XNmfS{GJSmpsZkY1<^?l1T|X>#^OSU#FVs9~KhxH6Lobd^i_O`0D*G> zkkr^gU3#qfkjf!BLkKEz%`u;0*%G31{4`?;HRvtT*p6Bm1Qc^}C%~PKm*UMKM4 zh-w5d^0tO1;FW4Lqux^)XvEJ98bK=S(BrOO9 zYCM2{j{m4n2{&b(4HESrA8Po1{|DLm5VZVG9!+knhJ|Zi3hBY{FXOHT4xWLNEpMRk zud>NNP6b&EcW$4-Kl{esef#KQlUC5T5x$RKbq+rLFWjA7YogB7>R@D1!EE6N-!4S3 zuSZ%8@8~4@E_>1w3I7w5_IYhrdYiMgCUpDp|A+n`a_RuHnj9{hb=(pNkhB6LYDb4X z=Hy`{*+Z77tD|e?p`dq$6VvY{ab?@#TR&Iul{(=wg#wA6NqUj)lBN@;Z-@i$M(L+& z)9=@}JCnI|zyA9Sk7ZccQ7)!%m@9j^a@Q@>DR3rnr*lGChV_&irl-+q`IP&#!|w}a z28vrZ;Q7ALV6~6#Z;~aAxezh6$18LX-6hkEY?dXMcazHTE~PAX>O{q2&9XE1IrN}~ zYGhjOG_j>H3#ZJ%Nyvqh*_we^%VfD*@3&_CejFL3{L8z_G~O?3idsjem)N^ksXxtrI_m$)sAYL`z?z-Z0{JpR7$8Cw(|~m{VdOp_|R8P?>mH z z>Cm=$cE%L;9_`~tv;Boh*9NYCb4rk(DM@-b(#vS*0+Q`WE!zjmRDTLDn*%ur67}(p zr?aEtgLD|gO3{c8j^-6Xl>z^h5Ru$-95s(*FAXJLDXp{fszN$Da5Dsa=7zACKdrC5 z>~9|c92F(gkI`n^sCHs~i@(McA#E(Q@U4*y-@pHWMiOMW?%>LzsUR`vJrnDeQxzEK zr#kc?YUOU( zqC~AID2d2-{A0Eg9`N@1;r=Gp{wO%26629Fks6KoU|mt$pnwtNg|IQdO6;i1Fw4`J zG3%WegY@B%#XX>9 z?r`1M%`YBEpH_qu=ukLU1vW4L7rovr82*1V;_5j;&;pn(k_bNcTT7mg)T9Rr}N^7$cYk+#UGGC5sL25%6&Y|m92mb){Zb! zV{RO;;NW^uZCUw}`Q^`yICO3<0>vBmtudZPQ*_7U8V-6-~wDvC7PLtxHgs4)WrTbdpDW)toQIJ0t;uC%BW~?yeyO3+_$_cWc}e2=4Cg?(V_e-KBANY2e?P znUk4w-t(MqZxvNk^#|zQz4qE`-S_po7L&3RoWGU|G~_{Y{ZUS?ufw1W*t>M|M#h9W zy=25_R0hHMG}ZM^$ExxED$K?UL&{XG&J{ZAX)g%+B;lZPc{e(2O8D(1tHsatbm$Cpza&>)eZXxDoRQI zFS25sYGidYS~Bad1fL;X@hvjHlL!CJDoX?`p;NeDo}|u1^n=r8kk(c~)-t=I;k(PW zxP&Wk7-<~)&GEU{q}%glutsMq$T@kg>3evTJxvS%t?nCvmE`ifHEjL zJ5@UrIy4R+nhj(XV^CY~6|@1>snuQwSBgKc1aGx_^ZU5^W*I!%LxWOOPgkd3Lt7Yb zULTp?ZXn$+&a7n0(1Tehr4ctDZ&nSa*CnqaLTzd0W#|sGR*bU1t$cfl=M|Pj z*SJCLKKP!>6w(Nog3hU1v*3qZMB<%3%i1jyriX5ode5K6_m_J@Y2RPr*q?L`r3s{t z>^pfK$k>|@VpWxmo`RLjvyAJY>+sZVw}+fH9usbFokW7Mzo(|g|3v)-#tXzjHvH2( zStBDOPEJnwVcIF#*`)Fc3K}iS`zD?9yVmSoc&F`CFNUr_uL9wveI9$lU_+esn+ZOQ z=UJa{Ul;);6-oDX7o^SGr;FIQYJG=SD#gCCQw%%Iu(RfrIPtldeZlTh!>rI%Txbi;WZuuQw`glOcb zQY|s^u6Dyw*#eoIlvzG@QY>~-Ft&<5z*kY9U~@F)9VcQ-6q7qofwoVRBvQe6(_AHk z_ct6Ah)o}mm-d@Vwiqr0V^k-(=Z&VD>;(t;Kz6U(rWaB3Ee1$~&+xh@t=90Y7Gnc^ z10#AtJH*t4&kF{RG!Qi1*Kdb&$@5gae*q*C)EI(Bf9b{o{)Q zmS)Mm`S{AE#yON}p#KU+S1TfqAur=go=5VU0^*=C0hLG)V|2gXy>6j`(dr+hIs1pZ zHJ2K9gXgj_#l7Klp=-MTO5Bf?{x|mjUwHz#9lR!kRaN?jo|Tr*Mi^f~YhE#eo99!I zJEFz~9o9n*9c>oa58h?Ac}tvhzfz9JSR{etCoy6TR;M`&<$&Ikks ziSbs)VwkZ<=`AF^Ai}x?oxKf2)%C)>_=#{*bv4A*klvllS(}#5SFx2xs<&(F*O*nB zPRy71zd-NHL79r(BboWK@wh#qB{>I;0T!9FWgeM}D?kFGr}4{Uau>?NFLPCw7_I!O zos0l259hPzTi}ij{6LWyA8!9jHLfo*u78R6MTDv=1(f1_!Ug|$x51AS&5qoBMAHd{ zd9>z)BiN0KW2R_ApjhE>AIv3iTAyWPH}V1vf+a=&~#_C`R;hfoF~OgM4bN2)k_Tz*T;A9 z#XZ-a&9*FK(=|c#fevmAj05&8rq1qK_xrRFF${6=dH0~(EyyLtDq1DY;PL+Ib24?V zO52M=D>!lLCHOC!q~ z@ozAbu73vaO5vpRTy74+3OtxQ{6>n9l`vCv0Z#m_?y!^dRj^MZIbFS7;acQ3Bp1wF z=y*Zf`RkVz=2IzFA~y3L8%4ZM2Rll%cUMNS3=bg>E$d}z$~M$xpD`#XJkW@m&j@0? ziFA(!LcrIPz?r8z1ewd??aS`LlM0$bX0>M!EV!D(+mHV)LMrJ=zkgI>zWf5q@U>~h zwI@-1 z;`wD9&7Iyns4t6IZc0Dxh{hnFfB^*22~&jhOzb_f6dglm5}D9DG9nuCT*tD_v=SezL;% zfh_8_G~o*ZDXH>f+;%=R5#0!nV1;@6qG^i5e_)|U zOiWB2OG`chVMBSI-lA#}@=j#NV zgGdSZgFDhi<1yDhnoIJ6fG!5&89zw(#)f+l9?x|H2Lk&T=tWn@UZdIaxY%F+oLF<= zH!%LqXT|~vb93vja7H)7F3Ai>>2(>lx$348HRTta`kyFO69osy$#vuNPLHF z89gz1izP=O`(j-|$PhlZ-AM{|_U8(+TWpNNsX{JCeSx$2*x(d)R5P_B0_ipkqTM$l zxqR`bmo2w_*KBb|X1cR6dl!Zq776_ebaK>uby=636dIQ z)jnA|;O0~kSKA>mva^2HP(ZWb6H-$5y>E=pN&8?7QRe10cX{T{JosuFz4{FT*EQ$x z@maP)^e-y0bn#*CsaQrKUET7fJit^3!WG2b#i(HSBP)*AUIzic^NzanNpRjJRKd%i zr+iF9iRS!%E~T_CAJLa=SlUn~b{dV^GCh)tI}_eI)~U2ix|7*eYgs$U^E+yV@y{SD z17WovV{}I-K)MFUL1}e4_o@Wkh7R>}Gk|l9Xmq3S2*VLZPln6HVqJr^eL+Vw7NGou zV#>3$P|v!0{Lk+~aOiP>_Zz!hOQHhp!8Uwi$S5B&WIKG~vEh$g80*vU_|XWBe9Ms9 zn$H-~2;HNFKZsJ5G=FkbmMB6>d1v8#TJn_N)rVVm%va8;=ou%sUmGPu^qb9OHa*bO zGYYWrPI8QKrnq}t#;Sj4b#6Yr|Ky>D^?7R#{mbA%Be+CC5`6X=K1%O)JqH#?zyqAa z_&9IXPf3|onE8p2nKj$}UM0iodyuQj5MFeh@Q;(4(VHo3RR@Csy|VMGiPgLNm@`uI z`#_GByQr;&%-Y2|XuNqRDSh=5`Ap)U^{S+Ct!uoCwMW_QM)(TuM_brOkX-OBL}j3^ z;y$D*R4Ng2Rk|}1wo)2G@g=(U^iL$URv0qvXl7>oHwxEtTKEM9`j*z(QiA@7IoRtV zSF*V{tjX|V^EyhFOoDiNb#g;=p*_n>fPbhc{OH%);p;4H5%0yZ>Y=W2I) zm|%2e#aN$cM{xie*@t3nmq%Vn1mR}A`Q}KT-}791$ab{q7DN&M@B}{sQqgi@t^1&^ zEM1Q+rWhS9KY1w*_(jPZPzGySn>#g0X`m5k9rdJOgVsc;nnKxK63k&WEu67~M6T|mDUL&zz=%na_TNz*L>{}!$AzGd*gL8$G^A0znP$JciQj&R#Ix7VB z362V*C2z+lPg<|tY)NMNuBwx->^CbMvC<-qz+i`484b6Ot8aKT@PcX1sY;E@W%T)C ze9)D!buFyIC^7k?(vsGe?>1wLT|JZ|C6V7@os9jQOf)kmZWJo_dHEl)A2 z3nlo<6T#!VIBl+q5p_10&A6o|u%Oa(_8j1|g0|->sIELLzm`!%f^?$<^m?Vl~UV1L=u*ldx zrAgez7@NH%aTBhjNKUlb*Kl8Q#LCEA`*VOiZSB=rv=VEpg8FajGRv(`Wwbq_-A2ow z2UU6wkR(=dBJ*5o7;lFs{>=nx{GrbFeM3AU6x2SmX(q(xo^k=uzuI5DJJj*a^w1b6 z{SidRzfzcW;+rRdEaykkPic;y#SLiab!Sa%c~~n@?*>Q-!#O9+v!ZLsDT)8gV1!RT ztl(f01kAp9m8GAlr%+&iOK77;NU=E@p>PvjE=exxK=IX-$EyJarG2;`#@3c(;JhlI zvT4D!A-CSC@$1+1?k-rs8syY-D|~IY!~njOB*gNCyk{3yRyGhzS?Fm??Sr-iqyjd+ zI189@Wb4kkKdQ81!86%gKjuhm#W$E95zD-`+D<RBR40v51&YhB})MBhEH*UFchd7URkfGvO)kMgzp$b4OEu zj;%*&PS4$PL3H#P;4)($*^2IjPZ8C_UUE zF#9!cO9YkD{L%eM-^5nEV>B#h^K-P?k^Bzr{ZL=%31z_o3j=fMUB$!cH1mUgg+GMQ z?1U5MR;n4VshKnOxjL|Z=w)CKe4j)BsLZMkSefrJRTPjQ!9Xs9+jVC^bh_+IvW0;z zr>QB~)1c?}(22V7#VwwFpoqS<6iVB>M;CxTAX5~&#^m(c^1NPdwH%G)B@bGI3!Uhf zCZ_bT5d5b2s9xl^o=o1Eng7P`4La)CBNb!wo6!0+#huP%=6u$w7ZVhOO4!?(Z+^nU zJfYIN&3~F>Um`5#PAiv^xYg4@pLgy?-v-&R+To-<+W0=b5`~;HhAv_BA21!x#ROM{ zEk)9duzX!{GOCs&9orT!NkB-9y|QNCot{pydP`E(0M-FsdP#|pr2}~Z4i|b{w5$Tn zI+F`7U!blkc$(rfnSngzK}9)Z*yRPqn+Vuan>ZHvN&d$=taVq5o0g!5*|UdM;}OH1 z0=LqS*ICK>YTIcyx;pzl0LLcexw;SbpcKYZhKd6ZgYLA4Gi>HqOM1gNn1tC_4~6P8 zMC=ex3Zz)~OZcFh?r^F&8X0;O;2}Mx2ij*J3x<~u4QvZOS)7}1f?{bY*oF6=?Q3t> z^H%*CZj=@?ORi(gqW*>`ONx`Q=9)G**t;}Cvp)Z(Gv~E^(Bo!xw|0BtBfP~_@5u*+ zkhRW3nwwd59W97Cw|RlphD-1c=0h=HFzZ8DTDx7}^p>18_bv;e%b^;3a{WRP`b)uw z-z!ZcJG+q6{Y??&4IEZT59uQput0PYTZRDzu?m&bYWL&E=VQ${oA}_URl6q^E5F!ShJ7-f&J(tG8&LhZiX^D(q_p63d7E*lSCHY^%yGf{$O8!D@2@V zVknc=dDujxBW?}%=*yNm#rzvDj5II9acd_2A@5T&z;S$F)W5MqSaK2KT!rnqLono~ zhePEYL$|-FT&|~}es$5bT?u>^E-s~(p~^$?DK{9j%pA?0oB;a2?5Ig+Ga5;*n@$S| z3$t=R(fd`*fAjPK;=Xu?i%X4io_uzCDofPDEiNveotvxus9uocQ_%7%G*>#f(Gi!V zkt=ih>!cA20$y;5<{3i0_gR)ZlbN-KbYaZc1bdF?*B8s0C1Zj@PkA9Jz@WO1M6}fm zqpLIkZ;l$r-nurTYhQI>?__-GqbS3+DmX0tE1 zIm-ykdv%W)%USQTCeVjMLqdYzbY*nAmRdiTsH1E6T_KMjvYSZ~-C6d|QyaX|SSWl} z_c@flpSeWZ^(#{HhH^K9jNYn~gud&e<8d67GWz;P?)BqMq4p_Qr}Khm>zj{Qpb0df zwu?&5$+Wq?rA|;q4TAgqYR3;IcicU&OZMs;B&owDq^;75?@nCYx|>^pMjS*Ul1|}y zX=$B5_}T42@^Zg~9zV3~wn`xSjM0UUwIT1cz5SR@e4v-u>S;vwzgub?nSIswUQHKt zT2RljG7y>lPU3vn0DITIH+|b>#{ipuwD<{@NIii}@Eu z)}W!MXBwCjg0|8^an|R#%~FwucTb1dYz583Ud98ArMtVE>R;k=Z#3^IP-T!r4WXqmLNH6ttvA^Pkx-azc?9yqUd92uDP zT?uY8p|m^mD&bkSMkCWbYZW7{bv!m3+P-HJ<)3M3SI1_^~SmIc}K<(E(r8;pvce`ODL$4VFB zMP4QU@y|aqhN`Rc@t>dKiOhI7fn~?y%4lPA^OqXf#l>ZxM5-V?x6=Q1SZAuSE~_62hGeobj+UAa?+n9@a2b~Z>8Eu+|$mi>aE* z7t3p0LrmJ*>@M6CIX`0^@l9Rd4Mf{AAtE<_W@5MC_o+?7TL{Fz4BD8#>;yU-FAZOp zKUN|Nqo@016p@Jl6GMWOJ}Rlv!(!!p-8cz6vPMbX%Cavipth=s3-?>a~2?k%_Ivl}AfZk9P_sR3CVW~)5!H7bOD{A|1;c-cqQ-{*Z zM6lyfjAq8gKzEX_e}%7ACzwi#WoNJT-5qe?8kcVB>sR=?8<^~7tAPM%(OHNoDPd$} zWN`BEY_6|o@VnSYMn;NBNwo~r$o~aKFhlgnq!bh^=5vg!td=V)>}mrxIg+pxP!96u zAhD1rJZW45#TXSiWo4h(R(@Q0w!|7T^xVVEwQURVRcD$xw_Ciwzoayo@tRE?kurG= zc3ckd^kH_cktSHc3&r-(Dq?U4!JH zyl&xEt?2Ke4NR8jYf24>-wpe5zR-(YRJdts*e{9jdqn21B3C_BwV*rjN%yV1_NvX< zbng9nStLI$#??OI*k+^x@v)$!ty$N@DAg*@T|0IQsTB1)P#vYbrtA^q?j&NVjZ{mJ ztW_fhJUVhcTpw+o25^3&Y5Z!W=hK#i(O9WHI6^>9r;9e~Q4v_~zK$OdvQyqlGmTYg zP0b);l?_Dw_+4q(CvUg3S;vgfvr2gcyHi^@Xw(=1-ah_-VCwHUE zrq>g*g!(nVdZZR%|C(=39c>_T5xce4QlNOV(Ba+Vvnt~NUYqv7GE@&5qa9RR4<>4w zN94~gI@;S}FWnQ0J4*Uc5}-eVMLq2d?yOg^Fy@N&cf;SqRjc_=)2GKslzmm4!zQ`=|^6@vi+DpoxE&hp5pxZ zPM8-R1jIA`PJBc&7^2t=TG&)dZQc>-Qp%PdI}S(p>--}&GYCQ?2Oenf5}YF&Xt19O zDMFJKXv{SqzBp-7`KcG=SV8_Nmck9oCTd_WBVyFZFI}|;HAB4jiXHLNpsCq~tO;C` z^3TwV^7gylbClFA8vx^s+`ylM@vmt-23hhYrHoBi)(NMGfMy#{`zv1d6XbhtY+WUV zU}6d%z23Siog*u7wedTFKArJODR4EH*9FC7-ymIv?1u~ud>O?#a!k5=ZREBJ!yUrw z)KHMQ1Cp?k%PuY?KuC$=9&*XVTG!E|NyH+QLhiU*=KE?vy=51)>04Bk>>EOL?}OFP z`OyQ2DGU#dv5&qGN`{MjteR+|m+vwFpfW*eUT$R4 zvBuI&J_3RH${kM)WYaN}Yr~V(z7cbTAS$4RIv$96GEg*f^#d0MZ1`L@4))r^rN5?Y zhP^`yzsg;G*J7fWZo}3Tt*B6(=iObgtm)4;oEp@KouHv(Vo6Q@;_o?ljp!pRIh6VW z!J3-3^BFzZ!hY+6BM#en`t@P=tHaeQUjvBbkeJKurq?0Xk5o@x-AlxoDF@V`-+e;n zwxiy9ckJ5wV9Diqv?TS}g&D^geqcf1r4_W1ojn+C*Fw+;)>*$a-^Yvh+*TSbsXj?b z!sBa!d~3JFouw_W4aHltio0GVFr6&_#vc$wv)dZ75$kQk+ z5IMb$H@?l$n8HqpVJa!hY|VGoNoI%#FER@7QA!%dc_udd?j|qKhy4rF_>9kphf@O& zQ;*Uky+=tgx|-EI!MKJn-eIQ2$D9Zp_ee)MCt9zR3ap0s2w@$Q9MeUie>^&tR_wl_ zrXyh|c0K~mw;~6_qKiJ+y|!r^+Ky?xGxlZBnL3F@M{!G8KDX)xy=~qSZ*2w;lH(Ol zHbmS?cWm#0eu(t2#@Z}$96s6+^BdmB=V#66P=^g#>>j3hy%hF^jT zu1r#;^bXW0 zE&a6h4Ikc-lw!Q+nXDo+F)3jx1L*TRXpCqxoWgVK5%Kgbb5tAPeFEeMYm&?J7{35s zc=>%JTXfWmSZU6|SNnu{S#UB#@9D29-R`S0!ND^E^|Df_lYe1p3eBg7ot@(#Vc}!e#!H3Wt~4UG9btqHnFI zVcko$_MHnxjNG5(Me9u13i_-W4SNf(=zWTOAl3Uiq-ZXuu@JvdLUA>yhG5K=sJ~hK zyPbW_dnTHw1$7Ypn}1yt$hE20`ZYwzA?SAEP#(asx8B$QLhJrZ%1jnaUmt=!`U(#~ z0Uob7xANY4+m(5WUJsBKdQ@!+O@(TOn(PmR+gap-LX3Z=Ni(OI(1Z&6MfvCpduj^*X9OX^EOfv&X9U=kQ18g7BIKd0*agQ$!h!lZa<7fg5N z?ncJal)(HjCP|KTR>Cvt_V5?>tLej^?=t>7_84_pGS;M=R^P5zoVzf z_q#lj|3p}eByGoxo4pbJ<7l1c0m?HhFAwKYVTRj&dyYpA5`UyGcyeQQ|eHpr5)z_^-PC-H3+Cr zs0hQfqH(hT!>|;A=a__T`z^dhT?Hhb_B@^Huam-@e~oABz&nIJ&uV zZ|ECkH#>&G7^*sRuM_V2`qa|K$%{y-u|u?|QnYf|+!JkpHWB9gtJ8K3`gr9mujz~& zGymGycbM!Ws!sQlWo_rYY97w-`JBX5?j5SSHAC~np_B|7@HL}-3)=9c(ZIX<>j9nu zo-nUpGus^+H~vyYa>dnuNUOZS5i(q?1 zp4>XZP^Y;B9S7(pySPDf3&Srl-$~pbqq*hcXvz`Xo74vr6^~?oUE4Z7B_*XFzP=lW zhrxb+e)qf6;$OZHv$0(j&VKpxmi2N$MMV{pmNuL#*D*F;YJR7rtQ@;v*3;_#K+m_? zV!6z{;=Ds3DY<{FhfwOH|D{sqqQMaxSq7=|p`_w=P_(~>DH?jzO&+dUqmWJa$2F`1*B;WYg^*Wro=4gGJ8Kc%GQQoI9 zVg6VDc(#7DW`R@~IS_M9?I8$cPrD*O^2Ohi79<=(LjDiL{@3pF{r}G|Jijod8X3&0 zt`vEEoXM$d{s!T0E31MUu5wC5A?FHoSdd>_tzDndd`~a&|3kk6*}Ya!QucF;cD2eP z6Yz;9+#8diE9s{M834?wW7y!YI+7%$#4$yQuOUUOg)eiW5Z+X&&bR(3+h3uV*i!G# zN^1Z?`fL?a!5qkxg`euR6gIV$uDp#B#o@BVc3i%Kfwc{sZd=+%f7`f=ag6%}|4>!d zHpI0PYQsqWeZml96UgK6?`Z2!)4Rp1GC*A`fGR(HaVV-{{cyR+k|Yd&T~nms-tl`n z*S}ayPuf3_P`_jR-Y&n@uMc~?S7$JPft?rYxPb#a)_Fy|VQ8)#Z-LAb?rRHFfk^Ai zafCbTeniSX37b7kE?rK!k_8V>r=4LJT-nN3 zrW?MW3h;P~W!!0e0(4s)uE!w1mc4!NtLUm7zc{DU@twIid0X#&71+o9laK!kTdf}3 zKzL2PzzX+XJn{{(|9h`D9F&l>3@)7oPjHcAR zMEcag2~H=D33?h=j3D``-P0t#}zOF@2qdULbp>vx~u3jV-*OHD)5t^aM!S2x|N zKc7iYO!Wb;%@04T`TG7&<4*w9N=2b}$k&p;Wp6SsjN0z1Tx50(l1w~kz1f>gqL;?p zUGW`dF+EUSpR{_zZ&?fZTAx2#{y?ewVo&8`0BZsBiau(f9SAqB8}S0ckF@R^-*FWQ^L z%)cwcMqU2zcK5VWxr<6mMKm-t>?K7-MgRPu2l$1Bg^HeRtgKUXWosf?Qw`@W;zmYB zyu7?qkXo9&JZeEf!Ek9z9X(sN$ce6m6Cng578?b>pE({dYLCz0OxQ2XLVwpnLof-eVJcMN>=+yBYxHA@@AbGjY3Q71A} zF6g0VUY@IqeiX#TM*N=VWI^`tP*fRuaRB=><7#v+Mw_er=*Y=1-W8}WAwPh=s zu^=ZUjhrmNn5*Z}%`6I$-$Vj2QN$3Kd4S5&mk$L}LJD#St}%TnO{ux&kh$>WQ*46` zXuPN(arf!{bG;L!3wzs|Pf5(uelQifD%8j$2`k|x0(UTop5 zCX86*q27_JCE8aI>prS>-BRdw4f8k@ShM&hfLp4jglA+MhPA{&rF7Oed9f`;%a2Ti zk2(6BB&pOqt7yt6w@(;kZpVqYf#men^u_jo8mcgK-cOIsUhf`W=9SR!T?I(gEikQW zqH&s(V5xne#0dLhN+S4z)oQvdwk)`FXfiVB9o`hPXq37R<)C?pr5|{I|47E!l(mii z!CO*`qj4^2Dka;}^XbiC*YKcPsUOf);{*>cZ2j;!(4n8}r!sh?aJb{gXORIQZh;+* z%DmxLx24|r%;Y6LlTXKTG5zZD^w?)nnY@nW6`I8jAYYA0;9|E7jRPu{XYiQ&Ig|V7 z;CWF2Z(W>~vY)KUerD$kwtJ^A>IEAco3W{Bq1UfE zLaD$&zcLft>CJgr((Ac6!8H;Y#^u@2lmnHwati?!LXCRqhyHb}aOspE3@3H9ou1si z9MW<>&8Y03VS90u#qg~EA?OW~BQrvVt}>;+)#>+*R2hLSOMC0*v^wVzL*8iR3#Ib1g-Qm&h;fX%bpwj(aIj!5U9 zvWU;9E7?xIsKk(09j5HueU*B1C!7OJlsnX}i7inh4@NrePy__Y$M9NJa+Hg7Gwi$q!Cf|o-0rW;2vB>&DCUMf-Ele%SNqTj!m~}gJ{L* ztq^CGLMT!Mqul-D`5HQnHcYta@I8PQ;R8$Ef2xTG;NIkT!t_7g{d_Rzvz4YdW}*l^ zqA-@By`$>KzF*29ELQqo7_OE#3hY-S)vo`pln#TbQu=~Ejh@QYRjc*D=|l}DoC6ix zQ-e))v9Bw38b(yJ7DZx1$vsalpt5H>^6)uM$y)!0{^uy^J1n%H0JGX~%^dNg@2htw zJ)2wl*>BM*BkdPQ)(!=J96R`$LLJB|#sLH=YLl1Sya`}|V-rC-XGA)cA%UEp#&m*JR;rh(_G_u$eXp>y7PKF$g%&@S@0>hQdg%XW>P9_;LkFp!Qm(5^6K z;mU1+JGBukg+Dqis;v>Y2j!_=UgsUo?hamlI4%^gJ0DVTyBV2udsHFsBuf0&6hIhQ z2r1dR`;?)~Fb=820kpvatxL|yUciRsznO6h1bfXvv9PY?BDFd|>}V~5W$5mwT9Hzf8(_mhkkUm;BkiUjHKu_kC(|Pd;kb|x&$~r2NSQ2s5vdpI8eG1 z>^vbNTsE^7oXhMeC%yi<+UhRv?(}rGlarZAT<`$|0!1zfDtSWA&wwyvxz*K*@|5WN zR$gtdKsD0N!x}9vHHxybW83M$s}nWnGdYsnx05W9Wg6+12WM{Lg~L%Ztt=2_GLz!H zshO9eT2U}i@P03WhjbL@IjS;{TFJ12CZ=F8GR#2eWK`;%Lz7}YYPNmo^L_jli*<1Ip55}z!a&dj5yBSGj)>H~ zE{p$>n2O}g|8hnFjf|tLDQEgD!9F4>lfF#Jh{0rJ2_?thR!v@6xm9rea16ZCUC$q$<;x%c^fb@z(Fs8C=*^sf$dg@)>^0jQdAS*66JIIEy^cB# z@do)2h^SjV@eoALcX>oukgtuxW-#$REiG!P3L+Wt(pTL7|y!2TDf#-ClQLyv0=! zd!0bw#e|9@N;J5)je<;($~He@gz#3avC1!I>+8-3_i_>?XW2s9FVQP$6EZHlo$sk` z^SB}%(?0I`@$DRd1q6h+V}V}==!#^!Eu8=@`N@WF(vFdIh8AQlVyDr_NV~(qgafRK_%0shf zFB$#{B}9C#B^2BHcqs9Pvt{}47aTsdg#R4D;_O(8^-hD`hBxOelGdwWB&6|~sm~gt zvKXTfEAyW+nc=&)u!?FSB?5cvjd_1U$~c`}3OILwGR+Xz!6J~gY{xxw@6 z+B)T()z@@dh#^RjK=;^8r&x*#pOkxL;j)LN_?kb{>&xqQ`2w^ZLCK~n4onB>B_@#e zz0*SBh~u$9{0p@@u7|LwT>h#LC41R~BnW_G_j?aeD6J!VzXl@?7i=6{|mUF?cwG%&R1W#DnIAkzC(g$%DIyAF=Z)4@gal05uJd527y?)_}e@LM~?4A(!3Ur)l=T$kJZDm&}(r+BMnh!kz}a~1Iy z;ti?^4;woc1^mi>Kxthk3VsUEY_oC^@RMaux8oMA|B zs7^3rWUwOc;dujn+-gP0(A*jhn1O!h%bHF=pIj?3KSo_2+>N;k7AZj(+^NKJ>%6*7-jFK|aVxiG-h;gaXm!Z zCT38D%AL#JiQD6V6DqrVH{JYk zQ=DE!01uZ4kNNVad#@x>z0p5=IHzGELK0z?oyR)?O)#jnyBb~_Nh=7&u{;(7P&qKe zJuw3}*r4}&##wm<1unfcTmw<0T!}CJ2v=@VAYgkrKjKcQ+J&>>h*&Wq54Ul&EG2b8 zL1|PO8IID#!GSj6W%ak%6gFk`D{rsbKHirI?mo$7P>tN`!xu^^3_8Xpp)y$)uW87$4j((SSMFheqae~}dLmjb z&tL`t@DC^Nk1JpYI#2VZzR@(#&Y=v;ee9BP_LN1{In>)VJlf|c77@GJjUhmglhg4e zEehY_`HLHB)~kMphlbi*-nX-sLOa^9eBO9muXl~LWOcz>}k@pj2TFaB`t|uz;}iy*TRV!FW*;Pijlccpv{rK{NtB zyiEJJV|HQi|0%te&v7MVWksquoQmt0X&HpQaOd>+3f&Z{U$>0;N6H|h>`Mu0pLF6oAU8H;!{)3O-mb8#s5WB*fJmSv(SNnbaB^$$1eZ$Vx7LgBFqDY$17;6YRmi%DXw)MRm8r~V)sVPRY z&FPg8P=cDRJ^|=|K)>_gO&<2EJZmQ1!JwojSgDn5wcb^!->*C+VO0|*!ta~{2Ir2QHKun}ta7@DlYK5; z?fU*xcM0rPA1GceY5ecBWZGZ8+(NA zYTA?5FykJ3OnshR@Zs5M>)W4hyMUZ+_W7|kS_=+K!_7UD zESi6Qah3>a*fdb$YS928BsZ!_-KG8^B$q){t%fBs|1pWnh&O!Pop(xuv37K3cmivQ zwTtx6G4cEfk^5@rOl^`fP;+>K?p<_#7!6NnORiL&;~iY<;~~OzuYtU(rlgKGp{P*Y z*}7H5B@rj;taMM|T;f0q9XfoZLL?P6b#{F-CW$CVPcZ)HpA#Hvgh2mhFXBKD>u<;I z#nwOUvHd&M1X4qqE==_Lm!o3}tx5OwfHUg&-*s`Q|v<6UB&+j<8V(ks~6#;j~1Qz2)wix@m zrUin6f}|A{&_M8~5h4V=>HXzo3*Nd(WW>`%PPjO)EL!ISqYZd1y#9IA1@`6Lqi~tN z8Me>KBiZ%&{>{-*;46!_6?gV0v>e&L5qm1z6e-W!J&uh*_i1*vcB_r$IZ$^6I8Uj| zVBjneev4HP#0rT<>;e-TUG8`B$leiP$SBuN_%W0_c3YYInkU_v zrF~Y0nVFe8NKDsK6n_k_*j&OEu%e;c%jR(iVJ{)m*^4?%{}o{ z#le(bUoE#qddKq9qdV2Kxppv59`GhvG=a&PIgI|60O1*@`DsaOu3*)N?Kdj^+eBMf zZn!YXU<(kCz!bQl)FbEb8~P_NZVUb+*(?-Nn3axsO8!7!tZ}QV zbzf!3WN}WbENpx>_3+%gbzDL_G6R2QQcG`3#_dwFF zvXBL?-Z8J@o5#~VM(?X{RXT*@_uuS#z@F$Adz4tzH%qPkKP9XLZI0%~%VBU(O6JR` zKXgwC5P{9-TB>@3mXc|X3|%D<5o}aEi)(Fh+z#jAmh?9@TdqrY z<+{e21l(LwogK9iSS$0Iaxpw~2AV*Nr1`!+BE|^@=_UeEHZ<{IoV90i@KtB=>k&Ne zw_|NQvj-R#wRcK9N0}MkDH233YSC}w)<3S5TNbJqvD#l+AFcQllVphTdt>jW(`I!g z(5*6>O<=3-TqLj^5E5$D2h+<8>q^Qv(lZP@B}5*oVm=zd2tD>Nnog0Dhv4=0o!wN? zF8af!KA=E3EX?X7kPVz86B2&2bYX;rKa97VePfQx3$`uUL$E~t+k$dy=t?v@HI)u& z-N66anbtr3KgQlNEUu^R_Dn*6Bv^2V5Q4iqgg_uT!QI`xaT1(h!5xA&?(PJ4m&U!J z@y4xt`u{wyoSAuN&bhAsv_ExK?OnC^eXsRfYMPq)`Rzw}RF#PVg#YfNj|5Tu4_%&G zC2K2_e=wFW5TH`hE`c(0Bgw^eKPS$kz8}~UZ?6uc8eJ|O6hz3{ke#HB4E5|VI5_LN zOOz;2vmZZAium)L79lv8h; zCA`^VphiyT?E4+nKiW_L z{onMZ{#U+gqP6#swdjPffC8$jsqn)>q4obxyHD8MD{5yPq;JWDZf@9ET@6&q!4`(C z*2y1$nU4zG3#|@yx7SCp#MmAM{S5o*R<^;6LN>!5WOI~CsIzia`1D6HKcj_$o}SIt z=5#fsMqk)A8C)Ihe36^wXF2Ky41A z4=R~L7LofIx0IXhs%Yx4H(#Sm(n`G$k=SxdsI3a`ttG~Njz@->Lzy8%ovqSieno!l z&j=cdj!=%R7z1}sgg4!4??-e4zA2qzZfseD-o|zHu~}GL2sUkz2EPE}+*@gzJ{(81cRkEKGY@W^E_Re`_aP1gwR=Wqen3? zFYlFoOOIyg3Q|Pr%*S`5+%?r4Ee>e&ZyfN0{gC0pBO@d1?Cc17R{-^hG~fT|Sg`Y` zz~93ki@{{|J$~Z z;qCg|7lB*aMV|bp=u;#$_9MT0jh0^lRZ^x9!9-m1r}WB<{9?vEJ-gS^ICUkJ6|`bZ zKhOQ7o3&Qs+|_jR0(Xu?w|~l1Rg1OJfEOqV=NVH29Avv za7LQONq_ssRM2wuPPTRe`y#gCY`ord9HUt1Um`KRw7|MHP;GwT&wScV2SCTab)n~g znJt+gkUFaNyE!t0XP#P+XgdvqkCrFglS1c?TE+{*^5rM!B!$^lxpR9R^!*;s*JCX2 zSWsQIrKQVdzpr8f)5TSk^u2?RFIwcL8V>1|Savi1G1GrTyB5Vq`PO3iicbF}o|!`bieW7c zsBt@tZGT*E$~+YePMbwB@xOGi_*c{+$$`_Q{pMk>k*(=O$T1=($WM7ZWQhE@ORN7r z0Vp#xVqLwY9BmUjHVY(sbM7u~I2rXr$iVzQXM?k|tVM7_jOgpjN7!AuQs-*qb6<*f zhxb3?2(zOH_4WWwLp-&5Cq8{A5oOVz|4r$#ZFlvTTbjPwPzU^@Np!j_W}suC4UZLr zrKYBfw_mQ?-T_+IV~=c2jBH|}Tf_&2fd4Fj6)w4>C58|C7A9ciUA{olj8hlroubr0 zo-rs|QT=TnEm%cg>|<%^2b%p47m91=r*^}yFN!M-x0jZG1LzMDi(}{CBG2?MZwrPcO)PKZWe2KP8Ut5Su5N(-i z^5y>qq{97MFrQ!EPO18^`N;XW!lzD&4y;u4vwIq8HsT@N$@jO>JpOCT29mQ~}lOYr@_wkHcm`sXEKXj?Rr44Dx;M&rsKAyTnzTO39qiP zt2p|p{nMxKvZK`>B;Z4xZRJb`)*d$Pk+C%V0Y<(Y_6gFeGhq>@@-Y*@H5ceG6Ue|q zvX!fSvwn^$J=(_QS}V5i;&n7VHzU>dGX}rmUh-`H@5o*NcKd&3FB_Tvp+-~xkM!Ws z3}@_~vgA68BkhT-m9gxlcqwQZ{U|NB6*AL~&B2~SY<8nX+pJ+17Y1rWG>J-_dz6?t zr4x}io#}%|YkjE``M)$9qn+rlEQEhlW%+0MrPzJYUO{oazvON3yUh{}Dk|h+B}i$K zRGHy@l>PtEE+~Ap;g(BbHGiyR-)6;AP0o<=HF+l$vo^=HSL(Mz*pi8`REGaYboHea z)71jvc9>2~eAXqI&k`(Um@K=zY&bf4dXiV!YJz_5FiI z+@u_=XcX$^vBxf+iu;DHGcJ%-8AY;8YHA&t~G=uHPd0iPs#-u?t=nGdLeqj7We3I!%^Mg1dCn!}R z(rfGf_U*D?`n#6P6mQ|s&2ihe5v+L$8=qI@83jmhxT<`85`PFu?KqTFjZpjd0>^xu zIrz{R|0SdyAr7t4_x6#Ey5HEg;Lqb88r2F2VGilmw#aDl$*gDM|I&{-#%4%r7qf z9{(kBQpasG{IRp0{tbO`(!%{s%e~9`W%i{o*lVKYHq$3m$GCSED|+V7O0a12Dur6f zpWL7qvX6@Qzo#;NV@~wPJwTm>e7O8X%|T)@QpTWKQkEpk!i9~_elO>89sZ11UWyMA zF)9An=#Pu`CYrU_&%VOSlTkEIaH@}N!8i$Ju`Rj0=H`3#R!7kZg@V(T{@{}q$2w== zF{zoW=o7mT-$}veMlUb{?|h7v%DLy#bT$`k{wT%-3#E{?s;j^BNAD`L8uf`Ue;C%+ z%^9FrW$WA9#6cag4C=DZ@+L7fM!_>GDk{Ae7i2=hl$9*M{ukXpkx&!iyw)?4USkU# z?}J_hh?ua@dP+93bAUO^OJW=EDo(vTIqt|RI27+1d3nTF4l zT;mO@#y`^E%gg7>@x{ky+uR)ui(rdSnZZd+4rPe`}~p zrJ=AAf&IY@e{8gEKyEqwsNC?ej2Ud>;rN&o=f6MVYx~DqzN(}O3jO40(%3oLJZ*Ys zc4#p%Sm5lF&$nkud|~1;$R|BsdMiLYrSu9JouHsWYzjZlvP>WQ@g|#DeQQ)J_&hE zK^s1cgQ=zq$=i0WHf3SkXL662Iv8AJ!mKv$e^;1Ob+?6_PLjN;nO(5NgmG#4vle#= zs6@Hv?27PpQM0ird7UgbpvlB1l7F?g=ZO55lNE7vpWmG;2fZNCY305=euF)&CqMCr zn=hme{PFwkRZ(;e$7#iiv03Is%_ZON60&6GyZ-JaOeHMfqnTZlQmjnW=?u25E42Uy zBAhX6h`kM`QqtgK-5VF&ZGNXGJcS&eptmB+rVb{7ad83_zNlOt2(wFBdwk4#R~mZ< zfqW)!LL)2hNL^O6g2DxaC;JxIid*X{1l~cbc0LIPYEl6w`c*#xI^UTnxpFsR?--=9 z0)*MHbCSP$!4zW1G4ji`QCmz4#l;PH4@>yyzt6_)aSsf%65HD|s|zejN{mKZUnW<3 z96m-J7W6h^S#VlE=sq8{HrGZu7KV#F`*r=3Qm`miG&59eGqL@CI%LKNK<``H3qMsD)HIAqvZFSm2RF` zBRY%gJy>btX_S2=+1VEOotChI>)}L+y*NAU@WbyqitLcj;**CIv7Uf);&VphdtaLD zz&u+$IaUb;eIyYii7U5y>MT%EB{3PQ? zKoFrz;X)P+?jW?F5s-IVVWt!>plXmIx6#O&TK3c)0>H`~tz6U0PF#ILd8~T@GL$D4 z^}Rcp=rT$8)}IIx4?$%HasO3ld+_idY#}Josf1nOGY~iYM*C({&d3xhwFRGFLNoS7o^i z+fsxC)fW{;IkmMjOp8;Ssy>C;a#(AnHs(u|K^(c~8{Dmqw<5GnL(B}A)SCvIG|J&+onnY<=NjmYe`B|ayH(|YI+1*+=6Nz z@*>~iwf4;nt)dxDwr#AYERLS;HI7pZ^L18yzH7 zi+{GS1A8lXORoj*iH0$sURB!}K_5F4_d8JubakzCDm7PuOzq397A7nc?wCdTzi1hM@Fh2!V zE`Xfdg9LRR8tW0YcrUc|f)w{RT@FH04*n6$Dguoxx?A)8SYllxWvJA&6Ptw$9o17+ z2d{0kbWOh7SJcq5_+a%nMPT~?kQ3BZhHA*$dX`hLMb`El@sU4>NIvjPS63rkOL^>k zRTh@tdB2Doi0+{%E@^9Uv=)`OHCniX%Pi3DH@sJx61i-Q2Q`bXw{ z1#Dl%B+v83l}F?;f4Ul1xG2^j@V`2E#^c&ZmC3{*@q^4zhgJ#}~KO-yFz7scT$B$qQ~$>SE>;IDKlEz4kI zhN1Q$IIZY-d%w6@>0cPdZj6BgXB_q*zc2r{7Vwv;!`Z&|5mi69Wx{yBE7Wy}npw9e z|6{_R{!5~1Q;HrJX~px!xCETBb_!~Wpqs58dbwz`VawUW`7R-9srK=UIdsnWd;yPL zZa$ana$v$>eg(lv!Joh|vez%j<$PM*Ad)w^`LDw$^1J&n2$@{f|3bJAcNMffJ{|F$ z(u(wEVxEvuh^n?oR8`pj$QI9BnHepw8KV9n z2`_;NU$LkIgIDSo#*&-UEhI2OhD>*XeCJ?ZZ~2j1da{;7zhgPh7xsFZP$|K7J<)t?X0`}sqpxYnwlqgg{f8VTm zukc08KIU^c%q5ge`s|oEhLn`NyeA&U+h45B?jjlB=W+frIhNJ4vyUi7-B*p9IN73t zm>|7|2r6mu$|R}DZP+b1fbZA%b07MT0D-T=uYI3Ua4q5TnX3e=3gY`T{+T?KfxS!WbBO4lCz~ZMH+cm1Lx2I%R%|8WUHpg$BTq{RRD|G+ba&@&2hLF+KtM z;-uG9{N0V;Hak; zGi0r|)pySx&*?fe94C~SoV;X3nwzFCX@6ZxFOZ$3yXg9X_GiJIJSW#4(;+Pwlj75z zvgmWWj?v+AVrPdSZpV}U6ISLY5!D5`WIhp*xNyIfx9DwB;`VGQ4yw71vrksZ{w?9* zPZsEu>x!5a-Q5#=RI^nvjoHW|p*PgFa1{b(gNd{wzC>@Dwf2D+maf`eBT*4=K;HBT z^?{izCx5*kL)V$8gzN*kuJ6U8c@j$$sga?5)cE|au+n?%IEJJ6{sz}DttNjl%`G$*CMQDcV&_vHy;{Z?&e^C2JQ|$(Q8hawx>W9S}1T3 zixu_?e}j?nID|V`kr;Yk_xXco?Qn}rIF^`ijyo`3jS5TA7~vxB)?DXs1zZr|aP?<$^ib1+ z-@W`vSZya3xM<*;Y)t*ISzsPB`GfDm@KOXRBdzq~JIH8neS*>#zktNsh5$hSuPWL~&^2aoJY>iOJn=iOQ%lxqX5!a~n9t^735iL0OJ z6nrrexG0y)3-1Ln&%#`jqK`>=$h(Ek#=ALvnYcpHE$0#sqsV!q4qY`(_IZ-;t75ua zUDjHXS@eaP;={u|ud>o-^@L*n6r=lkdzuz9e0MtfD7TMpdG}{pK1Vdd zxR(}N%VgqCz|=_%24Nk!)f{l3v~STkyBIJ|60jy%V9|aDN~4E`}U-*Kc%JrJWF7mp}SkrZLPu z5pW+564S?9%fIC`soqL0_K^=Oi#TioVxu#4?IJepJA?8T`)Fb+GtC&7n1IaB61rg; zqJGvn^*Of|^7|nzmu9*a41PP~0H6v%d+1v~^-c~CB0nibOHfZ)LrTA?5n_89owQ`t zQ&Nf8^V?-8;4k?JV}Ac8+e#KX(-H@@Y6X`7Z|k`9gJi14cR=EP=T}#Kvx_O~lfsix z#7OXXUP;x_SFthr7f#la^A%>V11MCyh_y>1%=RO4O?q-Z%TQ?F?^zM2<@)%1ETGl6 zsW^u^FrhqB{0OtA%L#sf{j;UGaTm#_L9-!T-@kw7nGj`VVfm`BukSSv4_3UF(0*tAQ!(WIYI3Ue1v9O>PySg&lFJt2>&JSAcDFgM+&he;Z z)0{5U3&gPUHn+CU=$#73_?{wLD3OHLeeH)mLLNLk0VndLnsVh)(Hu>+K=qYed4F@1 zAfeVFj9ft*$TC0oW%pn&_IMj+?c&tb-^v;!DGzc_@3|K`8cdgAN^l46XuE@DpAY`_ z=|+|gO4Nj!g5K9#X@^{C*LnaDAnB);N(sN*gIEMEm&r@=!#M(DFw!r zO`x&dWdB|4(Z*h%RevS17ENKtqwjlhJo@ zj7-;(uU!z({kQw`O|;_G!Hmug25uBy=k!v7KQ$eP-|{RsN6F!BEaE+BA*=Pt_h9$! zm7PP-&z_E5=l;2JV;HliTVi4&eG1M~7I*-*LeI*oQK=1Za_Sx*SHSlUFflRt_U&7- zb5*;7HE-_YD}I;J^qR@*KAol!X8N?5zh;38nT4fg0P(j zn>M=~(0pREHdS&3D?J(y7$5)|n)^?ZWZRl>_hXRHk14ssR1op|R&&yp$`0bCUVR?Z z;vdcD)OM?lp+Cq``Eh(BI89yc?8c^;nW%i>jQ&>}0}+=T1?GeXPvgOVIM0l4( zG_)4|%k7z21svrS79}mW04|y?9dqdfr1Xn-p98^JtK?C((sW@`8eoQo#+NR>(Uem)C)JAgj!`c|8s@H*Y^{zpFS~W2f{=+z@3ODa zayOK4{$*3e^GW@Bgr#hDENR-SYo}kIUHs8hZx*oJX{AHQ8Pp+DSsr^)(eGzkSz6-HK zXM$sHC$R^#PO?zu?BM9bhS2HQH6zQf3iXsy`W@yq*~}t*+7RP%-Ny8jN5ur4kE3TF zMh!D_Gv}MVXB{vzTO?(uHOb_!6OpDcMm28=dtch=bwvC?LVermhHUBzkcYBX``)|2 zmH^>si>^aTa-Sfw!YCf&HAy*TrK;V95^W%WY~Jmz10p5GA4@D{Xz~|$YW=!=r9B7< zb(jBbh*rz8aY2R5K;Z{}{f5xQ$2*A-gX<8w6xMywR@DIdxw-u5u%a8 zM4Yh-dyd&EUs@ZZwSXV3`M(D{ztaXV!;pCHiA%e3xQsE*x6%`pe;ed37O~)a>npPK z^vn|=-FuabiW<%j%F7r{4s0yFuQt3X!vj^7*Ko|H=>Li8JAY<|Pv>;dO}MhKWMt}2 z_c5)|i)_ancL$sxGp{t8ROXkG&o2*{x~yo0hXnBg`O0^Ei=I}Cs^w$|a(|L)yH@_t zn0G6${yNWnWWM2Zuimi&X=`bMGpST*5-*643;Ig~5@`2V-+)S?y~;T6uFb{j)v}A! zf4|qU^lM^{DbFt-WAN{5opX2OOrh*J0~kKGMa0C=va-gUuC>7{CVhs7@#SddV#ows zd{!F9Gx+M9w!Z9fSSR5T5ac1+_U*3&!)WMeeiLVH{DpRHT!PeceB>Po-@rt6!Qgx# zkPhV~>D&qsLG|wi7hoA9 za@rO%(F5KV0`dI-QX@Gk#H~IzhqWmLfu%`mpEqg71rF`sGuy1{H%gUg>! z`4ho7jVG4tFe3&+_h{=KBMA);OqvJY1L^E;D9G{7p+|X)VS9UhuN^-BjLyGwch=>@n%J1UVJDe}@`*n{Hi)+kI07RHfp1?)dyO zxZYIMvv=y>Ve2aOCk^^%FIqdi<)Y zZd2-G&ZBRW7q!EcQcFc$6Mr40F!}LvU%e7Y%;C1o{g9Hm`@|QVf$Zb&pkWBFa9hMCGo80rQ_u8t z8W<4>xwbm4#-O3H1+EIn`uj(dOaPlKtR;e>Fk(<3!J+#PL(b)1nMC#6>~DM8$BjVH zlM_VHBbp>XB|~1%Oi)Uxs|Nze8D!r1P)9qqHQ@KOm8M~Hd)<`&9Qd#(ZBD$tS4O?> z+e7F2+)Pj%6_WFao52EJnfn=Epth}|T606ztD7@cm=d|2*80*N{_-g1OLkLH>1EMK z(MCHcDBS!0{C!J8(Ze<`KBw=+79hCK!e|Q;;jBU+^Oax>{!I5k+CM)EX7W9zQE9vW zJ3#-l-HgR;E`c9#NMb<|bbmfdd9bBCa-C0l=W@ZgaE6tu2c!{cYuU`T%NJg{9k$zl zR-WJ^OrDyQbqKSqkG?_d10R~AE#_CG)E}R$Z31Fgyk3^A$Z9O**`&KK-*$<}wB#7d zT-%q~x`@G>_@*lji3K%v8U=Y)k{R7yW2jRw`;F-r$IJT?f`OzL$L*9}xA&FboTVY< zXZF9E7Iiex3|;6p;|^7(vlrbRAFe70htOa(F^@WYSM|1Rv0aGV*Cr-I(e}#;pFdFt32$U67>>k}0ev+e(JNK`ppSm9O~Th4G&j}~!3_<;Dqs=ER?!iU zP&)+OJ3kh}j~4Zy+0Zz*kEOq!s<4umukT~=h%)HRGvNwQ*Xrc-MsmjI=DpxVCnoKY zp?0bYzlyH88OPeIFfw3#JZV^g%-Zsh;4^LEP%Oj9W2Abd(4KOMoDk*VNzRR|v$eHK zawfQf30q|-?Q&-P;BiznONHU^iPl=p7GVAN7PTxmHL!tn~vQm!bD__9| zI3_W@{($+p8d!^tf1jO9(9W;r;!H_X5i6?#Qz@wmtGZghksIk^D#?{&QS0MKDHl|T zYs_r@Sje#3<)P-?5x^z0xTFISR9`r9iRV1C4I_|S)8UIl>Fm%~u~Oggb=^^tVZ*Ru zzVssrkor&ILf| zRKiClRr9dqT&0^5jxz_p`QX$ha$MH!6pGj`j<{2OjY*&ZddUga-_exlkFw5;C~KEO z(XIVNo^nND8VL`JgF1dZWuIkBb(E?!b~BRVsK__2gLY^0Dz3(ajtX>TH%bBwu=D_C zUYup1dVf*93}nYqcAIQGA`kUL$9EkcB`{^T7R|LGhnM)G79Z2csr_f9k)DL~gJtTv=1!D`gWa%Jc_Z{BYN_%@9kmj9Y%ra-EtL9%!vp9aA^Nr3-Y)oZg zJZL5ps3U{9&L&I6=X$EWal~9ET_PuPsz5Bz(y*~ef!k=mQsnFZO-ZTh`hL5rmGSX8 zV1qsQ->p3wlmQlE?jvI1%rOog-oHbw#HK~jz$7o643F&G&oQ`&)id^HN#(bvwI{bv z4cI*${9@M+1HlZKIpN#T)Mn%Ozq@Ol{vZ91|r}+$0mluDFiklg-3;`W`0Bj=WV0 z#~}$V0s}7D3l0_M4jbvZ(h!D8dv2?_xeR}iOo1oe7Z)vzGA@oTW|yq!evg}n77G4f z$WUW)@(x`c*>e%+1tavNyIs>_YJK^3@i{V3nnz?{cegzQOID9MQiij($>228SiKnl^62QAL^d{$JNmYSD( zUKv19$?!Wejzq(vn)G{y^Ip^Uq8J$=jvt_TmYEp0#)1N6HpLuTT?V*0RmB_rU?8VW zEc`_u;_5iUJX?I-Nn4!Ns%!IeQ%Rgu6^-kPDHcHsc^w#lV`Fo@Bq32Tp!S(OC8oaP z=!#6ll22HEOnG!HnKIk8nIIuF#9BzOzEm_qZM2UBC{B$rY^I=pK zU*A>`aM{CZi|RvNmng2yA%5IdAhYO?5VuZ$-~$sh;V2xQ?!_q1^DJ_{%V=chq~a01 zm_~m^G(^q<9w1WJ4sf!OOoq=~?yQ~hT|740KSB3C4gg%g_ZOpmC5g|p|DW4PT>vE&1%1lP zffM4J?MGkk-k?iq&AKzUUzwG`oh=L$^E21^(r3Wb`vLg}x9SQ{`su~~xz&PYkuQrw zp|BmPIA_-2snkyn`mx(X7kJskYq0|;4IPJZ^lWT-^^#cjEYUh6^0}5GdnKX&*`|7g z^DBskklp){TN4;W9UQU-=%zV_WZCTMju*wgP;hTSs?d%N6JT+>B7qG7EA2x!nwu`* z7iivsI!<1_CfPZHXz)K}?jCL1u{?n&ml?CscjM(RWxs|&7v?v>=g#ggaf5ywI0Jtr0}UR=?;HVK!5mx{ZPo%PbUq3R?(&|S~?+EPH-3|l4@ zGZzLLpLEnz?~>X_YNo){X2{v^$n6Pd!A6%;O9qCfyfHa{h%v34V`s1L z{>vEDo&SB8a9!kLrCA)R_I0hCCLgr{{E+)1CQED}CV_$bkP8QEFFn`?toz<4B)nZO zNkQEV9OuEM&QsA5Slf5hmjV-5J6@UNG7KRnU%uT=D3p7vb&oF+Zge=KuXfD#Tr9JF z1+$7Gy*7hft~W2~8r#@>_Lt&Ba1~1VId8ASP@Ad(9~TFO)Na*9jXMSOO)qF$fqx;EZt<9yybcej!o4QB9yH38c--A7SXFPEN*CD*5VJLK=k zCq$qX{g_=p zkH~`e8=NrhmL@{%)J+=lVj@&YQLY`8`t~=pI%tWSDxa-R%~YhrfFEJixmhiZ5NiJ= z?}tX#CKEPnUs1B1N-V}$iqoL5?L@ESLNx!aFUefJVND4V_^V7CuDxMX4{WG{d~($@U}+E8IWAqaZiliF0flE+9aq({}scFjq73T~vUaoLznN z)EH}CEmM9;$yXg&oVQIX!^7i+^~Y4}?Rn8PE$PP+bm8I3b0N%?SwelS*N-ha6=z-n z0iHwwZ2^AeXd=r|WD+ZZPMz>=ra-o0Xwp$H=#M%g`5{oTv%|^3uK1T>S35=J>D)jE z;%SF0FhO^*Ss}a?O_O5YkPY5EQ`x#?g{jt>EPS8I1cpaHMQ_F}A0$vKRqzAe&a?gW z3ojdGLpc1gIKVHUzIE<)U2VlrL0RZO1ZRQL;hm~%h_sM!(;j3PpTm0z@7p4!9M~O( zS6XDh!I;;rh;MmWSIw0B)n8V3k*a9Q(LN4buhK<&4f6S|ek?Foc}O8=j9(Z>J7)zN zVH2y-&^b&#jXU(aDy{1RDAL%TG1hFhuhiMc8^c!mJf$v`+u~hL%gYl2sWfU{imlZ_k$q#SegUoR&+9)788NGYJ6@3*Nkpc(WAclMftfLtEO z><>|y6SYB_whB#*kmUup!>yp3@y{_9I$Um&O68{)+tS#Exuc1digx~BIHOw{e_R}O zQ7!Ks3IP^XY^S+2$~|74t>ue7eUvHCsp4(Pgm0LFnSOYv-7I{)u_V{abwJ(+g|*y# zJ2hzwXnu6ZA9l_T)5v+yBK+mM;pK>u zyrrAQA(?bmZ7iSDhQn1=GZx_fdO^LYYL2cdtU{>4nT@hCy7el(#Ysel2LD9L&lfiN z$KO6bs+B4WH7YMGmdAF(FQ#W_U>GJAx7bM0GrtnK>_OO)@vxM)4xRf0gTVn))ekT$ z_YynJGk|01NvFoqjPOem)gpN>rR%ifVtVhJ<-edU1*|`SVZh(r4y1KfmmU~M_OB)&-987XMVpCjVI=h;J{ru$ARM$JQ zo<=(^av)$uR%fAP{2Q2L!qD{V6)XAjcrK|2^PR^_a^`F0MZWG1IY7~P+GsfIIJ>gD z-CP5P^+E}jf5nNlnMp)M7HOxc1*g3ep%kqVLQ@hpz1`2M+uBK?)3R8k^SGgBp@oET4j&>sXe3$Qp*@7&NgvP9&{ zfWRq*~s&wx4e^MM2$5r!@6Z+xD{# zrVDu#qvhE-IeI&5=$@q%O&;oj)+Tw1+AU8;dA2e>+60!7=~+0cby7q+f?FW#7l>q5 z6?ZJI68SF@v#H7c_uczma`ubxFS6tc-k| zy^X1rfkH~#cSsr4(Mk)hf?c#@&aDA!z)YP>VVx!_h^_QVMFLAMh1c!M?Ms!xy^gV& zSx7@Z^20z;Y8q(s5R{Ns)j9Sj2D7%a76+oECE&FQ>LbwSa<$7^JBO^kMC)jy(MW*L z_O;5$wLb~7x2e9wlN;b@bS~5fVlExn{zuP>V~T5Fq(1_tTEyWWP8e-QX*=74N>?X@ z>B$yQ9NRTt0K2YHG*sU|>V465&R2a}V z=U^@V!R!cC%>F#N&r3A)&pqGC>h-Ba{>Bmm#3nSWv!%oswlKvr*r0$a*t}A_y>M07 zx;zl!XD4vK!um`1+SmvSfLEC30Evp#^jSsV&jjq9&!NUoiST@YtFB#HftTas`U(M} z=yz60^KK2Y1IJ+LEuDL^e?GF%zg|<5z9}RzzdmsPUSD?G#y9V7s2YHtU6q%g9}yXu z?{j+^aCB+l;?i%z%F{3Kb3}u<;iH9q5a^jBsU=HJz{idU1x|FJ{FV)nl% z+g{>CLPAmxM-=clqMdpIk?$TJW~vOu)DNEDqNDHLUF`6jCSfTGzC<(JukiDDqCgb( zi_|H2kz-j3k!8v~{oZWQxmn&TQO>SwkV#xmZdR4Y1~{(4`R<&&?;M3iu1IyBZc#;Z zK*-K1_)l4O8=d<1(5)=M`n|4UC4#8S1n)Te@FNfkbty>K)%%BZyNUg$nK)egMF0!p zL^)?KFu2Qt`#^B*3}DHzme+r;&U~_Qg;ii8K`-FUloPZJxo@a#nHc%P*;vMmc2eNR zF>rdi_F61^tN$Qnkk-XP+q(ar27F?!I?ZYy@%#_ z!Gq3P=E|9Nq#u60e9@E8D>fH)$<=$emDKWd8(F2@W{#Vo0q+C58tzu)P#+3=(o(ng zz4-CjiEn#>1~HYddNx7@y$6c4(jXC}&>cnVml4JVc)T1M@!<=JNsN|4I4%KffTX^6MR^jDi9c4GjX2 zzqEtE<{lpI;)`_Rz_{pXxxOY|?nnrPfYM^U)}DMA*jPSssZRU9?ZSU@#STLFE)Y{8 z%sDcw5JR*3?L8HcEnYqEU1iYUW715FcOU6L{>+kdk*>+dc-kUyO(krT@Q6>+}=j!xQ>1HQ2|02KE1zX?eRi32ucoxqRT%#y@lZ zlNmUM$61HAtAw#xGq)!`M9aU4M5~ZFzTPaXzLX=*Ai#j7JQ4d#=j2-R5cWa%3kY&P zAD<^Yqsqyk@r?Ko!CLFipk&?h^+w4h6$S6?`3$MLLD6uQ+7BcQQt#07rN#O$cLuq< zyI+Jx>vng_mDB>ClIAofaI`Pz?jUPt-+0Io(O`z=#j(`OrH-Tn63Z9Pj+O;3wc8Uo zPMbu-Ehde93E@Pq|9un2p&Xn3QLdmh;abf$_V zN(q*B(}iR*y?$-bUHkmTz~@3cH2NSYA-Ram_rLT^*g1MIfmWg&u1$rfMc>J8i=xu% z0E&i{Bj<(Z>EWBEI~y-rU`)tw%Z0>b2m_grdl2oo?jK;%Xxv8EPMssBDc2pwLe)ku zqTagHU`|dMV^yV9a88JYGp{nS*RR+0ek@K)j`qp&m8uk0?_wSC1O5i@@36X^o%M-C zLa?*lGkDCfJ)}>bV|GhM68+zSP3Pg$^RD@}giJT^n&_dUmT#r!LWwRkQ#tyJ%m<(n za;Z{fWsm7}4Nw_ zZ?6(xIXb|9IIdDA>WpYJ0zZjG`npS?U)QVs#2V=Z{cEwHoV6;r!(%?%MP+Z*tmM-; z_eAC`^YZczKy`G2g7D3@f3uaY5y*0;#e6}2{>}aUqIVr)2+r82PoGwI476px9Ef^Q z$`zjV#TAe(eYU=QdB6L&tpHz5K#3GTZmnyE!=!T0;cM6=K=r1hsFw@9`tFn-Rp zTm`cIqb?+yQH^z;#5{ho@Xrg4Gr8`Cp77=!-E+gHkd8q`rxImyO(ESY?lL@28PT`c zVR!QZ$zn#;JM2*+fa7fgZ z2cJKe-AxDRX0;}!n7?lgptF58CnXn^w{oE+XjIgi1Lgi6Qfe8?ooCW+qW+CUr}$gh z>QADfuKAr$k#_u7t4*ne%+bMq_Ka?KnBA&-($W$+S=3Pf_&jn@DYeW!!)xSni<1zQ z!kwJAroiS*&{Qj15xPSzVPErxIsXc0t|V`fMNwloA&w2(ZQg zhU(fGc4m$T9Pjjn9O3N(u>($MLt2{dOjo2-+%l%-iXcubc>NR>(+@~^#6s$}RgBF$ zbV(lN%Q0#3-PzGyHB?4jtLsHWClw8=>yV8V58iaWrLGbkzl~ZxY+dsQ8ux{eU+Ey_ zu8KB0IfvjHJ=QX@8}jYH*JRLHoQPJO*q{2YcF~j`=es#_ZuP!OQU7|CD=wKY7Ye}t zN3$XS9|akh`x7YWg;0;pOQ(N2a*>{yehXn4(_3sD?B)C! z0@s)KRb)ivedC`)B9L-H+^3t7k!h{W zih|M_e#7m6l=q2R!8$sx!Vu||E{9(ylL=hTXi};l3r+Q;7WNX3*8#yhgr@XtGrg1w*m4(#@b6y%rCPcgV&{HDrVwjjYG|?9uJB-1f9J9t)F6Qz5{;m z&zkxp2-~c0F!zk(^Sl5HLNsFNdHc);@?)TASmn;cM5$#sK(}FCcdK9Af)0PaAr~-+ zWR3Y2!twNwWS8&Q=yV}VfJ~zasx?QWB6PKyokk_i7s|?(g~rF6gQ8k|>u!b9kX>4` zMS8aSR9f9{3ghBJXHIYBRfU4|#r*r=n1!Z99q~#j_Wu`oZyD9*w*76l#af_H3KWMH zcXw^kLU4DAJCxvFpg?hV2~wcAyA^kL4ess|$dh*Oea=4T{h#x^`sw||7#V|*gnQjt zYtCz4zilfQj4-0oa;sCC__dR0D>4maIwvQ%LLD#4+hSYRRqESqap4|Y>BW@X_VNKgA|n(+G7?7=IA#!vel zf>Bs`${p!aoRI89vJukeXEXB-?7@Ka^v_qih8phQhvAfX_Ti{?Hw)2_wi>X#G1npD3NuUPVo7fdi7^c5^MhV z;!f#=(7(+-GPlrGo<;k*?<{{SY;&KrXUBe-#vBjv`dGp@rya9-4Xz7GBsFbtvI=ei zPAaNA+JjBjW$UGTw>)n2oowbMeT*e|Ys*%T?4HO77;5$!Z<<&Kw@4cDI+*#?`@GrX zZHUC~Sso(b1{unnQw}HM@5wj6Fnixzl3;ax1{(f;d~+(x1Hk(Ve?&!n=BsT|KbuTI z+SktE%wc>SeLRTW{ttJ;7s*QVl!0dO+4Gm@m&Fa!=@xl>ABv z?w@0;?QL>R_vD+lXQqFucI?BAk2P)Gn0p8R2$8J5BgW79Q2RoMhPS3+xMAh6NIiV? zRco{JTn)>B{;`jUsP1zLN;N&3{c0LIx;!y0+f@2vVpI&}v$~hhK5z75p$P3H$0DW^}{l}Ft*B=dwHGlIEIVzC%$PlOG$%?dyiz_+zoVqG@ z8o)4gI_^2m#-JQH{Shk@$*SFJupaaEsKta44ahMdAl(`gCC*{Kw% zq)JxS@9T|Tksg{=ap|t6X%2-yr2E5!D4N+b$|twO;>I@#k`$d(;~mabtFWBd#AxKC z1SX=SLcTZMJdBHiIHSR_6yqE`y1E~t2veE5j-j$==Ii7#8n3e;&7@77tiuBhE;mxg z)~(->^E1SgdZFOQW$r%J4rP3vOH&$tMww|It^WAUN5>+F4cp>iKagUulBqBDNarmr2Q@@36F`v z-TaHu>JFn!(p@>$>lAtlsywMv{rw#MBgXNs$LPy_wd{JlcLRmdmWA)e1K4JASXJ<9 z%JAt9B}-1WA$1Sq&`V23*N9{)gaDnmapjtDR32)bkJ4^$iH>V@G{#=;Ue}Z5P%`iW zgbwnhC00lBauAr%;_|m%SH|w_z}GkI8d^p54v^G+cn10nvq&wudX`O=jCg#bB9JRD<3=h< zt$xXR#)q?tS|ji=0?my<1*@!rBwH&4%iOo%|PNagSMjP9lKG$$LF~ylD@6H?H5qqLx&-4<_gHox0pfDTY=? zU#qp~nigQ2jMHbe(h;g666eZ7Ob5lq%pB93XOBZ)cdI|GRV7t9mbZO;3@gv4(QWQN ze^hoBcCy*_@OYE6nS-@q{5N`_+(ulB0ATz$b}5~wEkfWa;^}~;B*o##9J#)`Z;_o@ z9GKbC0&FPF4R1NS4nC3a@v#FS4!I$sQ`u{nl7$-8_ec}S(VdfX9`gHT^%nLWtG{c_ z&&Twm8p%+q-fiZs+T%?mPD|^p$LPvWYn*L1MVbi#N&+OwOCxz5^UD;NW#yWO={gn+ zZEQ%rO=amo%cwhBy=`CKjw4$fb?L??h&Xw1;_)Et>f$N&+KlIKzc_ZDZCxT$9x=zSH)HTvtekP&dM3xRg;s| z?UVbIc=LlcHuz^5(Fnf)Cez$?s4=+GYO7 z5<;3tVcs{^7};{(lZ6Ilk2QHEd%jb{ugY!>h$ooXV$eSvzs8%8474U0G#bCCy|H$t zR^ft$#Hq%84+tS$p1A66$FU5Vn?+jWs$Yr}=ElYlO}E zHF77Ly$3}#mo<5_=_33M%V@y+7c4{Ux>o1%&L-GNV7^3ZZ@u=KZsCE-aEz5%R89iL z(edTQ=16}WBCfBBe2XB~4S^4RMJ@ZWx0+Arc8i@YL0r+v7krZle+Er>RG?KA9q2aMY?|N1# zBQh~rZW$u6&L@B&)6so#1SV)KB02~gR1C-g&9(1+6s_luFV-gmP9#!CVqvuE-U zC`_2@*ilad0_|<==*D7?bdPoxRi0wiSn3-ITXi1>D!i=VGE=spPHh z8<<Bj%hY&nYrg8g7C?1yHoqBtGvcL62Ry&xgG(+mR#Ah;A4^sfnv&!b0 z1ACK1MpYYEs9EqRym`}dZ~$yi#|Bz!7oM_rc~F>{>>6@Mwe@I71W(iF)|!)}=%$YB zt(VtE&=<)yx3pT(q_ze^+2J3$b@0Y`6WHDb!t|u>c3!WkeB~6@#z3owMJnZcA@Abf z)bxsZ638%E5++Z#0-T&ZZ9nSNwSpgcoN)NPCc*1Rq*Op8j8>W4lnAO~&FTjGFpyjX zsQt0i=L-SQls^&VMsLuuX85(wMx7K2on5>2n9D)ZL(Khr5J0;}_8~Kn^x-A_-YI4q zO??Ht3T!}cALAf(Ac(iQ9R@?Ls>RXJ}erhsSX2aEm)$9qIvLZPNj$PsU~;#Qku zk!+5T+H5u_ND+RiTu0}OKeX9mz4YuHsT@FKI_=e$x1W9D^=PkZH8&I-S9lAYh9_ho zIXG#!%Pgz?17$fll!#cCV>u5?y4d}6|Apv(ZIasG;a__ZvBpQI3jCXq|#lDxZk5FtVgt$Mad7j+L0p=ZA({R*k1FKvf*A{1YiB}dGEBX^^Z zM{Q87&M!-{An}EKWQxr4gK7Je->-Yt;6QfS-K3v;G#+N>)B^~3BE{(~bqY&<_R08w ztKr7#mc^InRBAYv00^qE80w8`Nu1tCD+=(*M0lf$2TvSE3MJ-ZtF|D*`j51Qayd^@ zLoOQHq5Emycn*9KB$!yV%wd-?njmqQ>>Xc3RZ4z=c`bG4VIQR}*8WA4rm!gMn^ zg3V{<1vGEBa)z`O6InP-6MW^3N0Twz+me!9PP=o3y6KS2C9i7cLD^ruBwF-D91|0Y zANpWgkL&ae*VER`z2QNir%tu-IHG|Of(^URps^1+4gjc`q^Ve3FneT|KV45vhk8E9 zY|*R#d^UCI=8Y6!hInSb;) zOXRNBpB)|6*1E(HvJ#MSGvVan;aLoB7CpKB9BnC(s}aFT)-zi3HubpmCU^x!(x|Vs zPfBjvYLr$`7vlpJSeKh?I-vswc6i`QCh-6pfO*1RU#iA9h1nXvWx3@U{^+lDnyjvp zr(>dG6bwH&pa&vbcyo_dS;%TFprRejf9%a62Ub){Mno8OTt5{x+Q>IpdiPJvMul?w z#(WMr3wfTUqPCGxBm&J(LO;#xDb#qsE|R=wU^sRnG;(55%;+kOz4~v64Kh)wy~`zX zO@PWsEvF9Zf%eWqA=}shxC{ETZ-G-vPLA9F?DVXoL_ukjkaUEIVy~NlCyfwUYLdlr zE!5G5hr+*WM@T+dCBIDP-^ZXs8mx(2&t75RbE4Bk_`2Vo^Rz(CX>fo7HVa3(XJ1X? zh02;O&deZ9UhI>M^SCL6QAw`8-=6z}OzjRA-%S^TN2cyCtoOB!_u7j`K5G7Bz?nAY zp99Xls$xY*V!$4+?deOxZ<23mIFzO(TB2=$u;FrF^v#KpLIk%0L%3tT(tWap=7()j z#mf(E?%Cn`>+u(dyY2ZZ1haPw`r44Y@x{K4ccuZ8G9p%L;F`jg$(f_%WXV=u zOlMVTwWav5n;(r%+AL%kI_7-B-7S~e z+l!&3LEs_6BUHkP|Gyh&*3=5~)xyzWHRbL=3NyL8kVGZm4Ep)nzIz1E&#-x-{(Aju zPzsd@KjF8>UB~V)f`Pn3^hl+F4xfJkNnjw2|EoTq2fcR4MIb>?rcuUcJ--Y z61NGd+$DZjK{jvG&8kO0^^e)v(UuNe-K1&%5G@>LBNuO;Ar@eA4A1^SR~e^CKX)(= zvTE4Egrz#4Z)bJm1{q;q%K8G91>jY;;gSF8XATL`Y_o;bqYh`dQlk9g}OEm`-CtLO8DVFN%Z0~ymG(_Sa zn-jAJPEL7Pn2h6`+gAG}c^v<@aE|;5(4WvuBMh3+Svs@Ioh({{TPWlNyJLCj>fxK< z0Ga~Ox+*T{Z6ojpZ&+fIZrdYb*=_v%M22`3;_mizae`T0&zJIJ5lZ!i^;D8ViNrxs z6B_X^0nl9XAnPU7sgWDX*;ydEZoc{XX*!fNZxo z%IveuVFwzLP+Mz*Lk@<9tIO^^FHAjR-@Ap9M{70De7QLbv;EQjJf_2#tMld1z9wd8 z;tvYg_u9|XQU5mhe9e8YPI-=uz(smX+m1K`iz}K)!qT!#pEx7^2RAmcA8yHCx z=>j}ZnJ|f>K8}tV(d*EUPL97dce^T z{Fp0fZS`_=Y%rHwC~Q4so#hOetALJkAW6=+!9>^h9k3@fIs#!zuaAp9|Q~5y7?YtzlkG-6`>Z?NhtO1QJHa= z$*H^jJwaDc3O1IaX6%Q_a1|r2v)suXg0w@-dN0xV?d#|LLx$WQ^xqu!pIMBFwIszR z^!FiQI(#Cbv+1etiqh&bOXKki&_ZEPsm;w%K%>Dx3PRQn^ZxnniX?U&fn;62#_H)y zYr?Rp4Wl=9pPHP)!NNp(pQ}mBOZHRs)*T zkSFfS3~`?L9d2Tx{_$?#k9?++y+MUKe9OM^f^5tG8IU>aNT)Y#9-aa$gTj&KApV}@T&y0$oCo%8N+6^}jMSPmXy0g{8GwMeq#o}ZqjJAM-N zxI@fDY9Bj~jFzFu;=J1TeA7>2fx~I$KXHA&wx{`ecDljuM)1R4rO4f+RFJSS6;ZV9Db-#oXniu34 z6Yp~C`YG3iGQVS5gi0>M)SdtpzliMedONct>EX@_(Y-!Hjb>e7V|O8w!%K&FQn#kU z)^ZAPo$RFxsLz+Lt1J(rJLFZ#zpox;ZZ!L!X(AY-^_wP|chA0@))9Mo8)rNoM69DZ zU<^~9Wl7_^kK1mL=gPS!Q&Kv6xeKv7hHY#s;4CI{_Kb-gNz^rrH>r_`3tm5~q=|*5@SWT@&|ka0HaUDL_P2Epc(L?(SAsGd@R_-ei}vLMI(D$AzXnV8zG1 z)GnU9h?(E>eI|K?X>MlLYprLh$yKhBKBZT9n0mP3!m;0I(mY>+cw^n%uZluPh0c$C zmYig`e-NOyji$b{R4M;BB`P6-iGw3?eYCX6TDqs<&Cu7^*Y7=rwGB@z)MvHal;n?s zLmT1xBkZiuJCcw{G-XA%X|@>;<&LMYC0|z32HCXb)Ts3ex82&bqLb?Dm!AeTBx9RP z6xn80Ss~^c?-m!oLTlP-SG#shx+?6CD&bQBhBGR#Qfq7#p|9(V9enc`9ACC5vLe%| zaiPd;%WRq|irZS3BpPGW&rA}V@rQQH9SH^s%WbMb&2(XlAePMrAXV)EF0Vyum)13F zUv@al_pq06I@s75p;a-KbwC4@k=y}v1h1pP<6@UpH?JT@=H>ny90eGnk-xUZ|`brvec$XF<|pERD@kv69_18 zR`&M+tzHkm;74Xy#jqy=e6CA#L-&#D)9OG|^+-4v?#=joRm%X~uPV;Kx_0S6kkE-h zjNUEU2v_atoPF^IWA%G^?;2ZhiO1~;OfQ{L;$`}3tCW(TU;Eb9kG!`}ifUJ!e$)7R z*;r0Ti9kz&DRc;b-kx1}rqiztL}D^_grZ&dS-0h?a#aIex1l1SBj{Fi^GDV)T;nj) zsG;mDuw3<8^R@1$X{J2x@(m&g*fVNdBFt#J-mHBMJH?nfcZ%FjfHDw3RqbLd&*xT? z-%z)z|D3GS1*J5gs>|zSyMkE%Y;$CMnAv5@N|ktEW47yKMOH1_^(OUMX!_>)0}i*n z?)3e6Ieb-Xx2?W0VN>o$086r!OvtK{zW+4j>=AxUaAgW%3`Fyk(OVal71`>6-JY#5MILr-t>YB>XYZ`F8J)v zGqMWc375~$OR061AkRa(YsSUEZu+n&bc7Mr=A(ax*I)KN;tn)F1+mdc7M*e@1emUFm8 zS`<@@n_gTFGIPZ_s>K&D%;Q_{ZZAEH$h}h6;D|1rc5!J~pXmrCsK5PAk*ApM7-C;y ztzd80HPVI5XQ`pOy*0~e8B*$JklaejfPindvGktdmi@7nA!fjsN9ds`;AbUO{pSbD zpxumoTmSTy7r{PC0dYeX+6W|p%#}F{z2jQ1i_?|$nqu?A5680Gr&4%Q_ebN zIqMe+Ge3p8qV79had6&ycZ}?ZuU$f@n)sVAd0)X=*{WH=9J7pq>0>B-a9xN2&)Q<-IuM^a9FCS*0dOLej3|lL zXD+wvlJtbT23)%=cdTsE(bon8NanJ}Qt6c>nu^%RSXsK>3gLt#n!TO?^hSDT%)Vgb zdt~KeQ}QPqUo(h{0h@!RlLnuq)DLq3gv<6z1}lkDt`(6=n(ve}a-e_Ej@q#q&fJ zS^8HRR0wWed_ayrerUKqcZ6QaCyqGW%UG$5&R@mnbh zE2;eAO6{{PsIXqZzMxWiN^}b?4XiA5%SBbylsFdD-nyKbue|-jz#BibGtHM?;X84# z;2HqnvWbd}7M7BV_UHnh-aJLKQtx?3V0%`addjRK(NTqAvgtZYo%_9q93v)Dczh^@ zyjy!!+>JIEXDFBvXs1ErN+Gs`2TMZVR*D6NOvVl@)}_l@8FdX_1!NQ#%bDvF-zHUf zB>7{-#=bK*(_fp$uO8=T&6Wk876{;PcGq#mqhwEy%flysGRh3k)In^c>UbU!svsMu zrmI#86yWzY6ff>$t!V2~KXRti`eqa?MfzO8IgEO9@=oi_F}#q)RWy|&yE^-Ytc(sz zt)*mRh#GaXL)>SWk6kP|=u|r*e5JRV)nMbXR#{iJq$p51JtDJ3)D9NJP7}2FG4vf} zQ)*R8FoYI%h!Y1)H@=_dA)^b7Juv7WJTy-Qi46cU2^)bSD8O5_eo&Os`}nm*g)X4q zpu;%pId#pxB+~J6=+Rtw-GxzfMTJWKuTtml{w56cmCV)md%~(2pjwrJ*Xd1#`pIq} ztZ5XC15zzEn<@zNxZK)>BAzO_;FzFYDIQjpax+yBS-Z_om`Wjo<&N9f1dDfOtI=)K zSvD*J5Ojg4T^sn>Zw~Etc_O!KhPG!fynt?Ln{;2gde&Aoc!c5N;mme-#)eH%`}BKm zyn@k}*}T>(i4@4q%@j2X+f3_q8sJ}DUnRQHmKVuGXq1%Kb6_W4G z9o1;LV=%dKcWb(weoKjJ9#lROnG{9BtSeiZMmkjA%63si7Bg=?I-$TBoh~@-*F9dmgWudjGV<0|Ow)ds zhx+S=ZdY)Tjp6nr+Vz{}S$^AB6M4;|wOrSjnF}dLm=Kq3A`!3jF$s;wxF=KxEKi<5 zFC;}jD4(Hw?6PgyG)qmNlBn~0Lk>UZ=-OJIPgfqgND-p{L0A9&?4i&9cBa2Ln8PF@ zB2xKyXl6!`k&_eFQjV}^BC|7Fj;X7wd$t+o%%|2guO3O_nLhAt`vnhnL@ofc%E6Jj zwnBWM=|viE-)VF6>E-?hy4qZalh57RaU6Ha_+~$Lv&ryQ4yJ;(fNr|FIw!ja!Fdrl zHYHwlN#+IxIerbfJd9o?vwSHAzPuJ^P=@5$^}TIhm>aD@kp~~hADU)o}L)d^s%lYPc@3 zw?;utV!T?IwX6fcXbM7O*d3oICbMR62pgoCsm)gE3CF(uv2i@w9;X_{9@}cZG27Ij z+noF%lWA|BwzRr=YVV-&b}Q;Wo<%SIBB*aU-%rmZX5$p|!W(woY!>|qTn zGdgEQs27$JxD;r0C@72g^;7u?pXNf+=uuQ(?kw#oxep4{=bgY5ht?DPp(0efk{iWe zS4+fGSY?@Bz3hpep5EQ%ejW^@_3`l`6!L+mH!>D z;s|Gm>d>iC=S|#Yl)I5-Oy7T7nv>doUb)L zZtv)bg9^I62-W{sVT@fB1M7lswT-V=+>ifIn896m;2i` z_iya}^}k^E_ZkhgG=nW|8n>Bme{uH<+vO(qr`pf;$AYkgd?c#kbHpn)Dt9mTz-bs{ z%UdpcWW0*o7)p_@QBWC=WY-YC8)qADEh%vzdrx@kmiVwI;pMwt$rmQN5f~8~JW!4X zx{qOD@>9n3x}X;nloWcGLm-)dLin`%D=|wouq}>6Pc{j>{KS)&I?_c&%#{^C`}^T_ zcs}kQ6P!fm^VhGS%iekSn*w4!($pBt;xZA2RWaXa8N-|dunlG)De1EollDl#&_oDj z;5xGMDo0d5GI#l@NWjHG-%bQqw2r);ww0{O^WzcxjuasXtRw^qK37xvS&j`lTbehz z6NEC_>k$NJ2c;9H{vl;8N({JhkuO;k><|_~xaCgop=(qtlLF-XZH2~P?;xZiJ1BhWXCA;ENY>t0 zd6gTISHHK=noiYV4LhAi#Cl6Yl~2DI|9J+Z5f%ooX5;XJuSLHgWv{V+9cJS10DNFO ztz;EFC}x5!1t_D#<>JnKSMY1XO-#7jX2G|5tmWxhl;`w8v{ww9`T;@7008`<)zz z!2{IiOBG?-Gs~z4tFmG?K%TE8`s+0u@CV#KqgDX1cqxX4h5;rTFIMl>PP3skypA+X z18*ImveS11oV*^1qZ`unR%vCUh5K=SqF(*RXvMmH4MaYK+;+ZSh2e4_^RyjcwxMWx zVK}aeEp0)@fI0Y*bJO*b!p`oal~1CKHYJR>%7=%Wd9Sd_lB;o~%-1cXJx*jHGqA~# zFuJW;u0y)ax6SR-DK*NocR-65XeBkcW)|$~J!=qLr(XiV(iW9|jhq<;p0punNWDB5 zl@DN8kbJa!h9#8IeDRI1B3pIoSWl1EL+(`TFBf04{G8KW#UZ`%f(mt{ntHGo4gw(b9I7=K^*P0f}t)BG0b$vgD_E zRy}Zi_&Dv}vZr(tdDyWiC3Hz{_ZBcET_3&neH|hX0IZyht$$=}-kBR0J}TaP?bPZJ zI?&tT5xsOD{uyF`x+&(CND!ZCx%y4Ti~U27a2;;U$Eb9U0OPrxg@%c_j{LPBi?kb^ z2diQAfKjs<5b+Uknbsm+5)CG&?lOJEFxw#6E>uDKC^fKtx4T}nR24Pg@8n=}9G;m4 zR}?Aq9v1Tvc+fydM<5h5Y020B z!BpPk;<)!z)4@)ZHgt8S)QG^d(mzD4f||O%Kb}GBd3~ZtO1R)G?$iNf zlY(fq63_nDx9_o1^EUglImf0qX02349}gA z;`8Ym&aEl2A1(sn56g71pzVYtL1BTQ5i%{X}Gm_AFM(g)O#ptEEkC;92Z07LF0nU|*H< z5N$0$9EG>KTtsdzp*ewHVD;b_-Hgdz_SRcT=lbrZUR%$IN#$-?0?H>`bEPqTPeRJU zkU~erRqnQqrWm%cMs{CgAVg1QiNl|wnN4B2ROgQr?no@L^xnH9Ar;1(Ahm!R2tqBt3Fhu7P}{~ z7|IU>ds+k6cv`r88JQr$W;ag--7}GL6c%oGip4f+Ncw^gQ#8sA@Cu!640gHLdih$@ zL0(JJigrA=umJkHE1dqj*5SMA)(WG`Kl5U+EfbXXV`P)wpy`O8pKhP;%ycH@K2V+C zMpHBiwg`E4k8Ga1Dw(fY0ib=h6{2XM2Wgy(Dmt*bAUEE2tvzcA5x`3$5NZq1Xm!K} zq1q0e8iOm2q_bGV6(4K8Gky%fa~3ak2OB?HX`a(T&2`#y2&S9^m?j(z<{_XtSO_vK zxklAmqyK%{M<=U=o?=#!hET6!C!NXjSk60>a}LDjTegMkqSb`W{khY_6x=lJ4reVn zSTEP#R!559loylO|z_ zpZ<#Z$|DNW?=gT}=VC<=$mW5!P)dXt7sFp5|H?b|SIo@wFfWhhwI^DtMe_4*UFb}s zlVuw|4oxX%YveT^=NJQMV1ss3An(FVney&PE94m)eL&+vl=#V zP^@kc%XWf!#$bsvzF(SO)ZK;WZG-D;V8hA$Sby0hgb;`{uL)$(ub)kqF3S3@Wjx6b zy(#Ok;*B3%@o8aaZGvi5K~fT4%vNJgcvZSu8!)8~4zX~uw$B%1FCS_d7P$CmUy{CVmH}8f7Vg>nF#m=#?%*8Vu)8P{?p9%L1ANR!?`FDJUJQE7GpY^KhJJTr0GZ` z9WgAsvG{Fma#-hJxzcZ6tR99VM5}#FYfzr0{xhiNkcEpYs+BD-PRM?l+u5Wu`%Gfi}p2=JroK^vnAnQDzfx^ z61rR)Eg-oi?P|^FxzO;bq{0#9n3y|3#~ntgQ*ylvhwG6WyQt?%9L;7W@)vUcv`oil zW()LjOc_y|Jt97Mt(j##^%TEqSCoDR^N*|lrK9nF zv&G=*_L-_;1inm&)$eQ#W?8m=S39SKdS;^$F;w5*C*3N0U@UUyY)#|*Y466T1W&eP zhRDK1H z0@T66#_MJ~dwo2rW_T*Wc!#HPRo@^$)1+q6yg^*yhqnarx#2om{P^JADD%H3(!{gUKMcN6l_(gi)+0%kw$N$?iA>(A z<0rYVY8fKkBh8faZfr%-PrR{-hpT|kQwp(h_r8$Q1;VJic}BV^w8a@0MX;a_MEIb*s4CtiqZzk+(}oQv$!f&_<1Gy zej@j}9u*EWPw85-kTB?V8bUS@bI(8a4wD_46jYnlO*CNe|ikP-P)+YV`Zv%>9_*BIC{{c{3{m+0RcxAg< zp2XYB0XUs)JqF_*Oke3-7|szo#E0kyejB^at<6i}Hjsbo(vG2`{_7+56~b_|hMT|e zikGzr)Hs!3uh9`-nW<~(vB)=En+(tw;j_1%l7N(5vhOC%ZES3Orn`FGw%s9Fa?qnH z@_&)|yX|eJ`BUZeV|f?1;H;R)k%3{de;_C%f{c$ZB-NL7ifd}@{|Ce$L_a@5NQjqb zf1>7x;cOj+r+dR^iz&pKM<-mI))sbWR)v?`@%A(;D3lQJfYnRyNMl@B-TGMguQ7Vl ztXv<*5XR8G32e-TVQIXX;{K|K`|J|y-{~7Ug_tSeTcJBN;+~rzOgtU~T1!9M-iX!e zi66U9mjCh?8F6RlN}C@1tIKHK0&B6MH=3sdPtc5gB2Ug>woDQ}K9S997?*HAZMd0) zN_vqWZ*BGcg~(W&6V)C%XWp6_=W zo5&7C&1C?c5zF-+R=Yvb^gWJX6$wX|(~etIONH|C%zsr|0h0|k*s1<7TVXAn(2f2l zwG|z&p7RfxgeD*$C+ts^6`d9PzvPW%cSEd#2KaDT?9B9d((t5HZ`dcm8e$VTRO7YP zbPcqPT=YYG{~ky}@S`O^t-(sbe$_2nideKKd2)B8gR+8ARHSCf+jgPE#+6gaV*1GE zP$lJ909nXeeQ$jvLUGuwnju-$<@%)UW}0$ZcOuJD&$h@$?xuHrybtbRu^u!!z*P^e ziG=+l?LHXx$I=|<3u0npJ4RGS{Lz~;mDkpmmY08phK5#GU!O00EGI3E`r^fl>pHdm z=C>SS@|V<41IQEli890IS4;t-0I(BK70(~ zsvBB}T6Emk_D!-DgBBN;(`z~cPY25c*{5ejwPvEP1c~fwew?NMRwxOgo>)dGk$Iv@ z50+j3)A|!uZDc+*#!=BeKlaSiP-$?`>I7C898}XYk(WTKSE3rwD0Mi>$g~W%OhI$_ zT&vJu@?K^p*~vP^z~)nERG7e_k%mC3mAu+_J?xh{2U<>}MV`tD z$@L*x*5RAzo_bAZXgFAWU_RwU9ix}jwi3>`Go46N>gQ@`i8_eN%v$qvxdpF7LS|D) z32|b!uDuq^snt1ouL8wYHOd(HMz2(;4mr^b17oy z*DMMDYL1EirPaR&R%iYIE(vOn7sTrELFtw{9WtIa(V)L>OjvWQBd z1WfN0cgof?qI6rE^~!C{sq*sg@88zpEY#YnwRpH}r#Z{3m4dC(g#1oUK5w>O6Twr{ z(J8gCV8A{7^|!Y(GBbT@YHDy%Z%|-%8#&%zrX#tv)64C%wUi=POG+r;WTLGTB;sf~ ztKIh6z0_NiC$K^|thn#eBrh>Ci$zyod2uZu^#VR3xMvhp zSz0~^CGgU9#wy(wTHRbt`(-*hK^I=+`@M2ud`sf^y8p;*-I`-^h{h9Ns&v>d5xJin z2Ft)7&UL}$F#4t$#dolTQ3&Q=!kg#m-0Y61unauKBVEQ<{JZ>4k3}Ux<@r3Ss;anq z76r0|zskQ@f9>>ty|!Nuy#D{>fkz*|C$GC)HNJn}kS{>KbygCWb>npv%VPgq*AzSq zhyE;fi_)HV<2jD)#t-2FMOZ|iVQR}OkyRbfk+U^^12SQ5PYVC&ir4>0)00wWA&wUw zwtf7%9WYGBox?fzDBd3;86LLMyGyqb8=L>EFpIkOcg~-739{QqWLBoL)*v}HTf0|D z1`#0VBN_;{!U0XGI+1Y2~{v zG2NfHC=6Ej0z|3ufUql`CZCI}-eK$w$Vql*FLC8>A|7tv9-maYz?+kfYYk^wN$h`+ zQolC8X-Htq_pKCuh;`8*?EbDB50wmGVNyBK43p*5?yfP>&Kw2BTjYki$eXft(K)WX zxNL;vGw(mrqX1+?Duiu@A0%~oxfDB}{dv{=`f)>b`icOqU}7<+rZhN-wK|P~nWqIBBwz+14TTL{*o5y>PW_^N$aZ4u0Uxr0p!NZVW02`_X%umXY7v$>BiS<^Sg&DZ?ct%c5jAsZpE#z89iy{bE4dK zpsq!x<9wj&58rb5_-;r?OW!<~A`t7frx_cdWqxofE0`N$E@AGbPYrVMFf*ui!)aNQ zN`B|?*0LqFqi6<9NnHZ8`@rMRHF9>FisSmw!8B*L_7(Ee^V>DpJL0&;zmG;OlRu%% zT8P=Q;lL%l4}A=j!DcJF3-xTtXyjCgk%^okor8T$iJ@Ln`tCyugAB%aFvcHA6 zdv6xk+g7+N5NBn}!3H%+bv-v7;}Nm$ z&_f|&CPNR2GJIIZUWvzo5GJO_Ywxd19!3Osu!A@}Oos`J|MpMgb5`9ypxYaUiO#=; zgox-oWF~9;bsJfUI+K^nbEA~mo$g9j(uXO|NS)a?!*_0#sCp+)a^0y+lWWa<^~V)t zbqiepsjf%dJr{#!;2ff@>p`BNn1tc6t9k@_-D+QoLg%xA`;lm@*PXdS;Za(QrYfnO z@wS3%37AQPHy+sT(?$BX6&yt#&hT!v1|Lg+%2`8FZ3eoxXlEW27{dPflr{vyb}W?l#dq zi+eqN$jmCcJ$p+4Ja|Sb>u>PMDlji_!V^Z#=k<__JMVt0u8&F$peeqWHA>WZp+?FS zr2$|6!j6#JD>!$gx$P@4tX{~{*4vw^+Tw@D*F?1y9E3=lb!|&2U5bF2H}t(YB#dz6 zxuKF$lUvyKL;lg%gT>+7n`c(qe5<=Ez4`X1Sbb@8zOxgAVb+~>YPs3Y`>#*UHDb5H z8?$4~{mG6Q`I(3au5;h>mNP_UB;qG<3HD8@s>_u(A!f|XHhmcyBP**$;rZp-#6aSI z7C;qb*GqG=4gJGmiPos;{C={W;@B@}#{NqpMTJiF<$p`07%;Xep|$^;vVgde4G(tM z$5yIm_#^rn3R6HZGc$i0&G^vo{l_*2_T|$P6qu4%kPld|5!khI^M%VR0iL@(Tg9;* z>w*oE@h10U!h3AWdURgFX){S~Ozs*Drd(wBSMOar8hp#~XF$9w5He=3F0wPzq_N?t z=c%oWGm~;=a(1XH{PAwU$k;kOvt-W}_|FW3#{k{G+w}v(9SwP%t-3Y^+7_vM*T(bL z7lD_?7e95`r&`26yO1W)(7^7fD@%=-j5fr7x&B?(%qTtUzp|a?$4+0eYRkNQdE3DC zzX*HFs5rN+OE`o82@u>hf#B{AA-D%Ev>>>$J6VW)=|!wp6GmPto5p`2#55C(F+UqyixtRo`e|%x-D$rx^?jt3s6DXpw zl&RnS^1-E~q`W#=0o-c<0ExhMcN&uqe^-#uDlL)_mFxYd*VW$cWXjX<_oyHDhV#+7 zV^XK<%gK2OAPWx+2Wx8)PkGKFaTpS@trQ_%7Uo@RhVPt1uTXk&7ODUtD{R+CsahiPQqG&Q;T0#q5{X z&4)m>UO*js{LPCV>TTa7@cVOUQKd-ussA_YKB1On(={215bEJh%p{K!B9P}3zM{K# z+v78(H>e?8w?n)4&YH0V&na6{B&L>Opuvc)t>tcW58!sK*V~KV#-5Lh^PpOw2d!So zM#skD+1|pVlFeYpwxi{4pjUq0Y6#hrKcfMqfLLS0jk>0$ zei1<0JV$@1zkTx0VDJBVf%9Xwge$Z<#9?4yV1fO2F?z0kdH!rChsk^Qpa=90IPv&q zXSp0A4t4=wXt`b$gc|WeIYnP4TG%pNGI zYa=&fRD)`LD#&l^@Oc6o;5I#9`vC8BCCTWhg37KO$KlJjwz1J2AtwP220bB*F`PI}VnM#Nh!R2xasfJM90~`a)qt^4p^7zoov*w?hkg z!3v~p1f|u7v2OG{Id@i+2Q~C|=#Q=@if;nKmp2xs0!q$i9IVrgFO+=9w%Fncqt-$M z1{6lr&{QWQqTAPY@!TEp_z{n;knWhY1_HkD02|V*J>L;_fc}#Ak|X`MzBk0aX?$~z zZjnIkSzW}bnJrfhD6j2Fw6vtLgBABfZ|@rjm>vv#VSGW5kIA4(Y^GOmcPB%CY{0~G z{>YQ^?{kJGC=z87Z?v!S-3`Hf4G%-2Ix_<^g_vrp^AHO{?(Kt|@%WM8rW;6~*x6JY z#SFXi=F$PvR3A;WO986kd6S)N8gtS@L*S&Ht590$alpd=6N!s|L^NHRu6LlbujtJ= z1Bd6z^=EcP=Ais8+Ef}vrF`MphFw@DXSA;fJoC$mYHuNK zwp}L!>i=#zzn(W{vltD>-Kt~;hlD7Rn5jDPT9}y?+vm1;q&t-x>j#!+!&wu1;&E1? zqENc58(5f{>Kh#WtoD+~z+cJ)J5v^cPN_?VUd{du$e5Lo$4i--63k3b1cAqK8bQBh zl#kMw`FX4h5B_2-TC)uldS}jbLpM*U2VAT4iI5ra3`6MyTXm1$x&)P-haxz)O4er^4 z5BidN@n$?A1HB3cp$s=61Y%-U2C#5qD(|r3);(5y&USM?o#d$JTtbd}+8swm@$OUJ<^g9HtC-wD;z6!ot1~#kb)ExG31O*!TDMclY<3 zJ3IcZt*x~6#!vz$be(5~Z3WifskbPks*0J6ocv&^c8~nztZyKZzpldW?tF8lwBKr} zCcy0yOr!e&AZ=~UxV*ePEO%Zd)$g%R=vfEy?QGwhnqK`H&j=l_eyORgWnpGUi+zKN z-j^%uus5C${X)iL{u-~zCMYNfWumrqH~)*O3iZ#Rbv|CqZo6YP8Ba53st_{$<>wdw zN}B#(*Z8mCL937PU$NxfuflgMAI{ZtgMEv6IKlAU-~X#qZ?frKgjDyZ0V}-+3b4wuqAfMJJ1=8Eo(nvy#dkr&%q%-X3=%=ic9P`>@9!O!zAXWYNQ(ndK zb&>vf?7mI?uC))^MJE=^hkyMYU6?YTX{LSmm~J(#-X>CgmA zlpGeONcGut(TiWF^r1JCs|p-w^Sb=Xs=|XE{+|EA zJWom2i|ARJ*q*0zmk@|oA-_^ALy~s3n+Mz)2%ccE5H>@0LmQwqtDTU0ik2znDXAMC zlH~3#1Lh77Itb0ix0_?K9mOCV*hCr-mhF3BKW{27ZC&K{OTD>RH~&}v_fnqcV0eHl zOMJ;;GA+Y5fnlZy^YnCJ^Ccy6CtYD(zX<^AsM?u8PL;eNvU1*zS1C=M{fQ}b$6p1a z3MwTdzkZiFK{RqKbc2>zDD8>dr1cU+UTBGQ#+1Zi^A8i2(->+=ruh3n#hrFB@Sza_{L$C1rC% zFqCT0^O1K29gKm#UDlteKvq%f8yB9T2esP;J*Xvkx(A?`kE=?^gt~QD zJ=0Rb#3<13CIdQhmb6w#{ZOoQE^HDzt!aj(jB;0bUOqK3tl;|Gy2`zs?FPIO^Os2d zM3Cr%eiN2TeddC`nn0Gzq07c)GD;X)CEgEN9Bz=EiMUL|Zz3WGYpq=F?z@F2Sn0|E zRr;8zi@lT$Euh|ae|o5dgmm3lo$c+r*Vc5PQD$><6DmRmxL0`c4{g@G3LOhkuqN2u(gly)IBm38f{0FzSO8M13z2KLS3l5Q<#^|sC?9rJ5~XZc=!pn;>r!pMChqBpf{unKBE7|P^HLl7 z?>Go@W9%Jc(&YzZe!UXq_TuDPJ?Jl1&>G`v(F0M~M z_qEB5+8t#As6{k*#)6H{3OX0}y}r)>_*EvNr4bZZl171rn~&z|hLAv#6DvQ=IT}w%=8jO~IvLsl3Gg zy`nW++r^^!RC=@IN|msEU;0Ef4r9ny2WkmBl`0a%6kB5UOAR75UnvkIc8QUWJ9wj2 z-yfucS!mB$vH=Tc_U^$_|D@ScJACFsgK5D`7x{*Eg~rL_>->qi25JxrI$mZ-d^?*O zyvvmuFvFmRpVO2g-3SzI`5;eo(OyzCI4=3$_7(j{vFdS!&ipCCGSIg~Xj_ou~p>YTv2yX)->p0-K59;A2d` zqjFg|EZwNy;?5>^9zvkjyf-@a3H}6IT3*}g^#;ZPcUj`?(%1L57g|lN&H8yQb6*cG zM_lY>3P~z%LRgKks`dNK$BhqiaP7*{&Q!00LM~o^pyS|(8ybFrB0rva&mDJnF%qh? zDgWdwsjcGlcTq~*n+|U}Lvfq1GJ@OlS)eXua#}9kOAq5ei<&+K(NTFV`rI|8F$MC& zYK4VPv((*Y$%MLV^VKA_OJGh-Bk50pUV16=9iDfL)ohmKTr-f?_}II@OT?DNDSHZ8 zlO!J2=Vz|M%rHrV&r33st`Eqb^dXayA>c_UQMbZte{EFS>8i%i*0OKHvyt~*`SJEs z+b}>-4Tnpf)MO1Tr#nek;APv-k0jk-ZV2L?&vt$)2$%>`XDJ zgRKH5gwdc+eq+s^V9+n&sjT$r`smT~`I0sQ*dlK&4`b4Bvh5C}#6^AT31;UCytavW zIqA^;EP>NGVq!6|!C^@@cC;oCLt8x3*r}5@bM={GAe?X1WkzUY!D~-yEP7Xf@K1Kq zH+RPaS%KIP@@fnoq22G=L{t$r+sDc3N;c^xuj3zykVE>*XY{m3v7P8CZ`D2t`J4+1 zFGW4+&r{)y3)-Fs`TcUZ8_E8EW4pnyvZ!Bc`aM2ixr)jcdfS-7vgG=)~%mM?ic}5 zTt6T9-QKzR9s3<DL{-%!g@tG0+d&M(MR;J8uLAsTJbGoG)?{U~$*8Gfjv8&?3YiE{%Vcna|5%JY)DoOO6f-N786Mq34w+K3FQ>Jn6FeaC_!4e6tI6 z#!rV@UQ>KS$-#e@$@lBF3r#79jKz{gl4G#sq&lRj&IUiz`vvn=JK`HTTkxcxpydsp zU!VmQZ*$TJ0+U(o*)Ss`oxd5P+`t-h&za;{(DC6$l#?vg-hjxxIrrcxuyv+S8GR^|{@+%p->pP5_`%%XD1c=1#xOPdfH40R6QXC%EVl05kGCS(9cy0H=Dtp#)MZpw$HgnBA@2SJ zG)t3HHhVJR+iCwo!*&>V^^oyFvt_PUdw;Ij8p>4zSkfZSQwQ%Kr7naT8%Y@;=@$)-^C(J%dre++bf&(6!odN+LAD6s zAoM!FB|g&0Hh{gvN%>$G?nTL5ylxq?8s5^NoK+SYTRvNKZF}IO1)I0O=(-eXpBFOU z>I0%%=*W>iPL08!c^0_k8Je3th*&rGD$~|r;>(8(^2w@}AJ)T)lD{Q{;8jz6`Wc?r$>s}XQrGx=8$7b8Tv!yF*xE_w}MrDX=(Wr~|Uc{x` z#Tk);RZs7PonwsWV==lfxl4zztOhoQ$gQbQ}7F@FPEq+#Ke_pm1 zv=R_85)^snYdj{@sN1|xX4~Jf3~ny|Fdxpx<~{p{$kCuFUi-dfwXZK=$1p!O%{BJz zM*&$`x$0UgSqnZ3)reshR;&J~Std04q zu&DG#k1F9%cVy7V>2%A#>#~V?F_^8pQE!Xi^w&VB2xq@3fWl#H#`0oAKXP({ zv1qSt-|d;KZ;wU)bzyhs5`_f_Y$sPDi|7*1G)SDRTpq>T#NgRU1p`gsUAIgv$Qx0; z>epX&wEnuR1aXTCtE&;_0*RqGNM=$n;j*O6gw#H?Bd2^+NI>8 zU*o-k*^%{`Fyp@r#2#xA@eznBZr`{j3AU9!D7^hQY9L%bHRaqtRDH~9wG8<=jg~GA z;!yt;?T3I_(B^v)@Ue~F<%ROO?l+raFxEUX>w?3{SBpdlF+VJ>i)NBWR&)xZ%L`i* zNrr#C8{sk+QzuqZK?TXRR$U+2=it0idUGJSDQR|xP*j`6Snt-@o~lD1FjVF3B3?hb zGy1{Dx?se^Z~)zQ2Mdk?p0y^toE9*~j?e06XJx7WG9-hX%oz^XVKOw_+8XM^)vvC# zL|*#9xy;+Z%|RPqn=~4xu5U03^&0nG*BNo9yPBWv4eKpRl17k=SB{l8uY3)8$&IXU zkLRCM_EJqXKP)Ye3@@kX5Ag^*Ll+2|uPf5!J*1fv`2uKo9ZfO`WOY5?h_Rae^0MlH z4ykR5_dX)oZAMr*(Aqej$Ge1#2+vBMcvhM}9wseqX`fm9P%AhM#Dvr|Z8e4zZ&R{f z$2ZS^56PNOD2vzh1f$l0z{khrMMBmN#k8;S*(lbk+!~+uXX)@YXcIKwU z6{^t+X`9WzgoIvF(=&esNR;Zku|7~bBNM&S)9j6-5u|@zt^d?^8^q=~`sR>Ol?}-r z7stB&ZtFJx>FV$@iAu+0>amh}cZ5SUZ>N++LlHY4lDMD4>O~zReO187agfJ&t*cd1 zYQqw64~MnDUa9m^vteG{EFNVQD?rBHDWuwFo@k)V_5trX$V5BWHP^s%9Q6$VI`0T~zV*?tm$pl~O zqXOpEU5a>6R>QXv5zH!E#6Oq%XXo=U3=b`b1HCeT^gpugFRZ^*bZJ>V>9#{Y+6**e zz6%^c_aKk!8NhVy7`{_e_H0UYA2Lmy$}^x4_#uWij2f^2Y@`aO0huE_lRLS1q-ONx|2wsU{W z&`mR(`8mNis8w*oUHYz4l+b2i`u@s%d&1esyy(Jm@{bviQBPp}(|HV) zi5k6;&*B(j<5P*kHDpgzo8k+daz2++u@se4@#}JqZ$$+yxJ2%DGidY%?B# zuztd!2hD-Tmo;gXwL|T1ilZNM5b2Ubre|p{HNP>)juKTlRrPhunXY^JaFY5w*)^Y} zd%4Ff zE{IA(pVt^<_YOSYL3+YH^56xN##0mfetZ0?l(l0Hi}W-fh`7Ujw1jO^E7?#X)IVjB zTz6^y%h$=P#iQXfRGRT4Q9jme>36>~C+epL{-yU`|Joe#sR&Dsn3z2zG&n5ei-16Q zSQ^gOlT;~b(}k}_-&1cg zgv;i!!dqJq8UOLMbjrXi9dq$u4i`emVx~@!1$s3Gkn+b|BS0BuvCoXGlrn zY1HpMXVlic#`dw~le0H(Ic!Sgu@_9bz{00mzpx4>ok7Y%Z4zL08V1v*3+v zY&GZluZP7ur3%aYQsR8nsT!j%_;l-i`mRX+#o?*LmIaqptLRGYS3?7e)CW7!0m_)@ zWT_uhYZ8@GRDfzyO~6AXLy9_YeU|PSXPQn&l#cI$q+FtrOo!Nchu85U#@80w!nanb zlywaXT`sqj^4byPBIBt*&ixu z0$7CWT^fZGD;JyD`CDXDp(_o`Sf(oXA$P{!p%Z2S)p@PoWsPgvvX$~SbEGm73Z!1S zwr?l=F*38xlL?75Ykye@V~>pf{;2nobGY?Y>~I-KLj_>H4o6)gPRW+0nRxD(z4gvD zOCagZd3}sv+bnU8OBgLb>bkRD?Fv8~SLTC;*e47jBGxMCBAyrhv1Rfm7t-%?&=6~! z;#_IfF3oIfrU07fB!U3@`-miXTljKvvlT2V85esq4Yq}TsJqn-^lS1Xe%I>#^7q2- zU(zfNHX~Iy^8O5-kr&$o7bgU|toCP4WM9dsZZJaE@rMRK8zgaBVUUZqsu<(QQ%~3-`$lfE|$0@1CP(HqZIpR^os;FDJ z+)AK)dmD53+GxuWuj3i$10e_QJ9^=*;fi}%qIKQ*6GuvU&j>RIwWZEn!&QFzm_x9Cl8BY!fS zZ{>i`X`fZrSY5LY1eb+Uk!xxc*{g~>4VZ@+JUd_EPX&?-jTufa4#~RT7~wn`PG_6+ z3AaaxV1`wcMQ{J9Rqgj}E!OhD#&F;IgiD54UCXAFAHU~qP(T(j_Tq>rCNa;N-C05$ zPAJ?tHKT5SPM{ed)@`xY z_6!YuaB*=_H6Qa23WEC8JTvhE%m;mz7db5hO&W33sR3$ub5_SGLV&84FlSdl)d%gs{-1|G-A^-&>M1FZQPTudoV zi+cL{epaw_$Z})VRaLoGE9;}KM;`+nZDU5tWJ6+HcppKIdZ({r`R(;EDS_gyjweI2 zE`oY03;lTU&M)lOwx(NsS=J}E6(+xf>B|)t+ zv;D7or|k#F)&<(_>(f)w^W+lePrtpnQ}?ND(7Cu~zUT#!YK)WLou8N#z39)b4RHLa z>0l7Y5l>3e+}vMGik^_)j2{vy*6pKRh#xAJO$?cwp6;&Jz}4ielhDPfP`VF_+&Q^j zH!doqgU>&lpY7^zhO@$c)KJ$y+lnwryir%J8C0w1W#Pzq5jgCOYke-H)h(Arg};G% zU**G|&Ii_5-f+9!?DY*{+J^8AW#qykCsnvpH6?VE6;?Rf?E05Ca~Pw1+~;@3hz)Y? z8()OTCljQYnjUV=Ho*ZI2(om*6ktRF$HVmiHS77sq!fL#ZOO~|9=H3k1LTv9kdEWn z_z^b04mqo8v&p0z;O-F+$H@wyQdShfakArlpl|d&Mx6!<6Q#8Dv!5@Zc82 zjZYcktkTH8_Bf;7BI7J9&|djIX;?{~j;xS`hw?87V2Q7I3?qLg#mO9JxB+hMexha0Syj-FOvc2paDIO}2AiYEU&nT6Mor83Jr)TXQ0s`Hu z5bxhv9_{^0KGxoVo#8Ev(iH-0PGxG+8`nInm}CqEeNDkWBNEe2eCGrm7~JY}b1B&N z;ffW+cZadqss0)x*~n+7MbhZ+U)q05z4?a^>Lk?>cH4h4`nt;pCJi(Gqs6pgq$9zE zfxAk6kha?NGjcs+jLGLYpb;uP^m(K?^SOc>sA;+Ex`R=tKE20ze+nC0Ad+;u&F6@7 zqI3T4(|@YR0#kiG^N8@~uI-s0Qk~-obDfaAhg{c=tB*Ee$G?H`rJ5f|PzsvrO(V@T z@w9v%qInzy_a4O_hir+4GDo}(MfnCwa7m!fJiiLj{+YS@Zm{(IXCS;|=a$hb%=BW@ zXZ&!*-|goBlkxW@Q%#_y*H}Yjm(0s;jGeS9^a3 zHQhBrJC-MlA|q3kHvGolt99>`VlX5nn>VSR0T|iSThsnq&f&F@}xO`&Y@C>h=jd9?cHD$Le=Nv zhb)9jRBQQ5uu)?Kt@gq0SPfWOe+E?lQfv8mjGSaTB3D)H7yoE_+Dnw6FgoOUxcK!W(QT;UK-%>N` z$m|s0Z*EMbTQha^*8zar^$Wo5IsDkod5dQ`K?xaVwFPXR9B(xL0|3JsL^<#Loy%W<#j5xjZYpn^=jt$ z*#QY5x27ptXO4P-$ZH0Cb$?C{A9gGj`CwnXm0V6sGb~4SxWSdivpum%_??=B9Qwea z!~(gHK}mTv!3ydk#Nekgb_@*GI8+(L3{HrYoU79EV5|!6_27sU1&iW^dV^`_+w0=m z?8bx+{05QEz50c~YFA^JksAcN^CvHm$X}jBP37V(2?98@tGH-slxb-{ZEvBBi<#K6uj2vebQ}@&X(UmM2D;~tS6qGy zyhxniDkKuN-~=*)@z6#5LD=IJA1E~*v0fy`s}1%j>U4Cb=I6S0ZY=Z-@oQqaJ3b*| zD&QVo+e_ex)IU^hDS1#fj+5?z^YxUL+XGAGV8-FOc%Yy<%PFFUW}-%eCFbMpDvQKu`WFqKI~y*%@hYj`l6=<4v_u zWT!T+8^eHc_r^vMvPFjap-* zbw~%oa}SR*8TN?U&Hf?w@I#4uhc~>5)M?FG*-=X}&^0mDuQsRPLpHd%|0=kX8_$K$dM(h8Y8@&;M<{Rgbazp4 z)_IYpir^m*fR2wZHIX4OHR3>ZwSHH= z(${6ccXv6Fe$4Cm3#qZ9<}CF&?V_`{{#Z*J@`C*;;(h#)>HFF#P}WWuKA393fpZ_Z zmC-~oDpSN+8o7~?*x)usNaJ#V^yy*%XY^ivf8~HB0gR{ z8LNp$;LcR}>Y1U`>+vOCyO|MTw}oiEE;HBnQN7JI+Vcr?XE3DS0kRKy&Zam*_#P+Y zJW63rv^IW*gnO}aR+A?4vV{r?y#q>7Zr{9pcaJsbgt}7e-|j=4y-{In2JX>6jG!T(2SB=}@Rea9<91lM4YcJvbmm|5VUXZdEOQ4mjj zoX9sI0bDVFyT%QMPi-6!|B8@$o4#S0=34ew$jo>ba#_pWu<0QPtcp*X=D zF_qqLo@~x~$b#vli>1K>!C_Dnh5OyTG9ijg=A$Sdk+r#9sgjYIKQm@b%5Cst#@EXr z{MAM6_#6KyJ8YXwB=ttZzShd;AoSda%`$`g#f4jt>$p3H+k54PB}hYr?P!xJTV%U8 zQj(Abo`|K90bQi^ua0awk^c6t8Aby0neWM{6gJWDv3C0G`aAK~JTakWQzA@8sC+KK zolsRy*^3*4o&Y56_q>AvbJwQ zGxG--6VN=_DpjQ0lYOmd)j$gL_W6DPI_Sojme>eu`J{jZ>}*L8VOh$n_lyTZH?%%t z5ehyYs~R)%3IEBF8a@2*0B~V>4AN#z=^W;&VU(x4+PtJ)=@{KRauT*&X$lI9@_YLJ zN|-W!5j~)&F>d)PW)F1z<6wr&Ce%JNlDb)^7I9eR3PvwZXXg1An+qHhx ziXV-{gwq&Wl`VQq&3*mo1W2SRW>kPxC~U8*wzG^dDV$eW|5NiRwC-5nQI>wP)2r}u zTNmWB&2uD`Cr^s-J;o!n?Mi)zp4$U&WBz;U2HXPk^>N6`Z|f^(ww~Tksat8Rja#?2 zePT?$MGk#m?(?U2lMD9Ezhp&Yj5oZgx-yj-P`j>{JKx)gzC7l3O$j?DOcU}5{1Xe4 zhREGJh38daqQ#mWNm5OP(QH?f1kXk_Sy26P%rZQl)jYoS@>}`GQ{OA5yQn%2Bu_5J=XN=V&C$3KXIozlWfcu$ENXnr-W`s@4NWGAUI&A zg?~P{dOJvT#gG+-7%%L;ZW+laP{JZNE{n`~Om5{0idXZq)4Q3x4kG zqqVgIYMllIQAm(??7zVzK$+oq3GjQCjE`=$?rU(P1e*4jy_{;5py3V!U(r2+EwEmA zg{S^s+?Ips{Ntswi2y=;L#jSBcMe4IAj-vkvD*J|dSY4w595ooK3x!%&fi6uZ~2GL zrKkEKU6P&B*7|SdV7)~>)?YJk?)Wce3bsjVY3vfv?X{5iq4?J?%N&s>jShDKkK20; zR~~#M1oF3y)>Jd)OnxJ)huZO@2`y-zdf2a8?dd-+H^1cXVGufpl)^Q*a%&9jDSWIy z)JjI(0gFN=IPX2;otQ*~348@p)jb%4z}C+DYp0fL)wxb|T=ds34+`_qTXlv>CP1MQrVBltF_c>z10e_%%c@q9@W%kt^G8 zoCH67PeK<~%UO+@7)064RuJKW9cQBMEmq)L4l@gkCAzCWCHZ+9jj&-XW_Tx|+_Z-X zkJ*}=NgCm-{ocZWZ@RZ9pdvlHztGtf<7hz}5Blpv= zeH+QAU^0yHq^Xlj!KNjG;qmYI2Q|nvY1;PKxi^gJPBzpd&bMFwIBhW&8gSdb`$)gr zuarhPqAl6un{k!0m;gWAGH7pxr>A5aMx7g|J?x-YHLv&tIl17l7-<#U~;Slgce?EC13ToGb&l zQF>ca#_d2yyLW4GGKS)5Tcu8dqS_z9-N`d)O8ew@w0o6%S%6CN6M-<((;VTQn7KSD z@!mm{_2m*g1}kDjj=DZkC}!zu?q(bNCPa0<60%Tvc6mJkH6}c0;XkL_7;W%copj1` zkie}t1@`jU_yphjj_eHEi~j#y4Q~k*Ndu?p6nd$H=9Cg01*={7nzH zS3fb+dVEPH)Y6!eA;bK%meSFf2gX;8inB_sW=D?jv|kpMYc27ZiL9n`T}Z8bp%>Ic zA?2FJCL?6OoQrZZrK!ii3~H_a!@A+Lhws{p*zjWZk1LWy)~^GP=>Jgj zdTz%UFc4*;7it&1id*#;y$fEld6Q!nP%2H@l$0hXZcN6-sH)_0)SA&du3&ik+Of63 z<}OPx4MW~O9qSxS-1&S$mR^9Wh_V>(ocu)Li@!v)(ili=qEFL?Jtmx)e#}D<;#5n* zUJHoRl|3#0>iw`G;JsdzdVWRkHcIJ|aZ40?>R8^92}xtR zU&co%1C5@#V#2%De`VvyG3V2?z;FiJ2;OgCa-PJTP~SF>BarGZfOU4%U9x19`Run) zFW0V6@0>txN)Cp6nIAX4%YGJUaV%KZ5zPJi%v-V<+d?C~_OhQDX16Hap;P1c=R1SD z?0%3%@-HSA;T8s2;-&qL$mNdS??6Jut%fZsw@Fni;;>V%EO4`m}lPa7CT z{NOul?ZIIylPSAH$qDO^HVTIE-}PrQgj$)V$+>N`g}zJw_V#T1-#Ur--Qs`&pZbxsx~oMWTTt1h!5&8;^lxKgC<^>7RnHqOJp#u zQ%^bL6Ws=d-Ys~;+76+r%DlwjJ<8mFD%}!^7}+( zt-VV4ni$Bg?!r{1sb#0Dd}T3Mh2P`6s3UF9VEe&CwBisIrPHa@DJMdoPApwRV|t0q z$p+ZQMRR<-ao)X|@I>(v^2afLNGhsPi=+MY?GmrJ@z#tw(lPJ1N& zu7KUxB#u)Jg2trY$RPRi?b5O2DCX47cHZ-?0VH)i(V>TbNjHo55N9rQ9|StfLbF!# z;Eq?T6IDkNYOFvQ1*m4?YWpZ152k|2C*rmG12|Caad(PNs>aiiW6ijY-X?^hH(mpW zhy3w<_WkLoPD4hY4}-yV3HDPVkEM1^hRjfM6320O8ILZjB1slC@1aBIy^#04J}2vm!fG}HLAn`$KQ$}#vfAcSkm0kP`Hsjo|1HWb~eJz-B5_a38MDhP!Nu2;6)nk0ygUbdV>^Kg~Y zNC)P1JM}fb(#~}1_N~`jXtWqI&LYLR} z_~xD5BY}P&dND}|f+tA5B$CEVUsj8&w#}Wb*85j8z?SMw??FYD-OiPIGAbl&J~{)S zQk>c!P`|b(Pa+f?S{Pc9aNhZTDz@>HPu#gwbf_7-Ngx-;S{jfayW?r^AW8Ud!REv_ z8ekV!UNAFc5wYfa0SUBVmPPyo4FuN~_K(TT*kk)KjytNP2mW8PPx26s{ljnCf1hc}${ z=PN0PMU43`_&FRub=B@_oca*++tnDnGo#6YS?Shz>k^F7UMt4;+DL+udeSESA5Hxf zDR9F|X&w4Vp_wg7QRd!AOIuLl2p3%Q)hN^`^EIdm)7x_0Ax!q8Kw3-0=Fyo6OI9{g zIDE(GZ9Yp$44o&o!8RffCu12Np@j^^i_kYA=h-n!&1Fb z`@rVaQg?jcI-!I$gXGW>;~#8ngV52BgJtbtwLmaDJQ@?;Vwe)nt?mYwaI03gW%XM9FF9{K;N;Lc%#?Bj503U;A$1_GWA^cJ|RK`=xfPDk&`-R-t7biKCjH$Dmer|o7gRZY8|^=v)h{%50`i#}-@RPo8d(ly`Cll~WpY7pla zatf>6A+l!c@(;3CV{_{WlT6%u&kzJE=aUUj6@q*n1@di9{?}Dx{`6gYS-C3f<30zG z2R*wZqC^bDUFBRHc=3L`{evtTAI>--x?%eE@=jKB+FH)I+1vNy6Kw;jUWGK%t-Mu)8 zW+f+Aca0oxgnxKcQhye1fm?C~QyF1Z)mWC^K06R6pDQuh=_7NGN12qAvbF5Y%m%cU znCyD?UzMa3;KcwzH{M@$Kg#Y?jMx;!bY6b%4?hmi-%1HXgpGwq#^WPEh{dXaC))i3 zE+=Xx5R+ebsu;jkwHbIWX~kd&}3-GMJUV10zj{NW4>I>B+%+)@|6h}<#|_5rC@j~xskigh^s&SacX|8 zVY*sw&gdpb_+?CUm}w;^(K57xxJq>?$LKXU%$9oNux})fwjV*W1&@F*VYQ~RJSbW_ zgG^jCu%)_sUS%s&{1%<-R9pvC5xyQ0iZldWYQ}Rx2}j^A?Nj>?JrQ34HU7SuU?(;< zSz27_?S~H(TF2qGqv<;~9WtI%}z&Tdm`2trK3LKNrYW#JjTD`jK3X;tEsb_ z`)O5E%Jo#BVGzo=nk55%HDS2LVsh=mba+yJNA9jggzWTxQp|Hz)&E8x`~lEJgV6Rn zl;RRTfB%p`DJfOVxkOvdoRNo@(iBf)>IQ;e^NrD-U#UU(iP($UG21ou7g2K@h^_8q z%HgPIc5}`2Sieh^Ckq!lcmeh=-PM|+tU2T(Sp^4nW81Alm< z%TK03G4{?O(vvK9LIgjiWiMs+fpA|5f}P~R}i z+$PXpZw~wwgRQfL_E>s$pP`zOGCq`_n39qdjfb7v|7Ho#g3cps_)u*|l4LLes9CDB zqA1ZQeL7%cWDbykLwpU(%E+fmUs1Ea27nS61=?&SSB5%5&4%;pY=uy?=L;TxLg(1= z$uzBUPDbmY;k3)&v<7er#cwebX2Zj8zf!!ook6n^N!WTA5q}c%?#D1D%Z=S&gQTk& zvT;!g+5sa4!dpGJK4g#-O2tzY>H}w?S1Fj?W<8CwT>_&2B*Bf6I+lGFG{4pG#G1sN zZ88^@vCydZBYN;UC9fOu1Y;P+Y*hdR zp4T_-kxyZFk%Bo({y&iG7bHO5)B-^(tVYvPVC1v$H)6>;4^yivKfe$Cx)shX`>o?GO()S=qEZjXsb-kYz z5jfZb(QuFriRdE53$DIPUkK%aX>MV0F__pYl0b~&i^j43aVp0^tp!($6Wy9S%l~5S zETf|Q_kJy+ARr(i9n#(1D$*%6G}1YAr-*=bcS(154V?oF-67rGeMbG)e)itaIWNvy zx?K1I=1zY1{rz0m$85!3J8d4GPS^p$ahaKB_A3oI`l0L5Ek-TH!%aV3M>7PK|7{h= z$jAiaQaN2N*LBONkd(cWHmBOg-P1s;ur?%~$^$CU!Yj$#IFNDIq?c;BEwa#H@>|$l zR)Iaqk6YsH!=uSq>-OXS$O;nC)oQyR-zs>zp1TZ0l~ius1L9BC@kkX;ViHR*Id-VM zB3lZKbr>|vi>eB|Oq7>8L%mniDAwn3-)CZcYsC6``C#oAiu=}M-D4TGObdTU-_lfc zB5qt#U)GQ_<|Bc|v78Rz`p5o#I(5FKL*W|eP9@xO{GiWBQclV9g>J9*oyYsP zhj1#IGj*Tias~{lmpIfE<*=bc(qS1eGGsTlw7D>)107f@&7GMxaTL)lBy!VO zi2$l#WClhi?J{rqJWQ6x2#tA)vw%twCAx3I&IwJ0R+QmTw>m0QC*!wF7SR->hzaL% z#&@}cO%-!aR1#KOn1_Sj5#`|Qu(viFyWI>P$OtRW@F+K`gu?N5GuGMTyj#Lv)I0H# z0w)cbTOsRziW9Ah-OYG$?1X9fIl==!SwQS~bnUUf()rGO_+&S)S<%E#{`2YiNNevjB3%-ud#GPzirb~K%-;#l^{J2u#FGF7 zWXg#V6uv0FppOCyqm|+fF?kKo8@^`5<9~P^>ljnT%wpF%*@kti0*#N~&$vTpKI=73 z+FN15hEmOd{`;+-CyI6f(N(Y7$-p|O13~;f+uuevcMrsj94-jol1a^(xqrXF)Tw`` z`7Qz4Xbh*XcEFrgD4J;2s#eBjP{K2c;%k~Pd=Mu z!B>8!&5P15`4}akobgHc5h>_$&@K(*Rl1&kW-sl}j-le8*--?6nZSn0p_fSyjQE^I zYyNTkJe7Jhw;h)K!U42-<)KFL6WyRhb&gBl{~S-%I>)P=y)B;Qj2X#uJo$bT4-K!! zgcnH{&Et1JqhIf5wm+EjQ)bv!> z{c412J@m1gTf`HIr-kjHd3Nk}pQvuzbcz|_J9j|>!2sNd;fkil1%)9*X9PWflJ<0r>mTwA5uk`0kBNfN`dVAk+uCR&?>2!H+ zsj6>2JH15}vRivkV0vO@+SiwSuF*9`_kL@-9+mMtM0q_w>|au(%N~LU*}$={lNU5s z2aBBnU>k$1+^9dJp|);W-y(eI?r-f$EVgrtE(BZ}L4AEJU-y>0<%S(>3!D{7GX`#| z@H|RySiav68<)#~T6ZXR>tDsuf|F^%1f<}mq@eBUI5kBv_>dJn(o9kbIXN<6*&>%E z6Z>7jCTv?L*u%1VFWXpl)d+c{zTW3`;OjF(d;@YS^d^Wu5MM65q~9^=3+9~@{l=l! zP($4WwtoKV;WDOl`;^3tRM}1V!yq0VzH4S^J3@o)!yPZ~17_*G6kLN$Wx9aY1 z7<`la79+@yaoPw=F-Rdp1ELFRw%S?=gY$E&MZOriNK5*6S2pgA-El>FyLguqBZZ6b?BmsOIV@Um0#Zy& z8j~J3PlbEJ;(#m>PPK&H#ZkE@`%>%7HW@PdiYQDjDUT1vw5xC^2JHhP@lJ{E8dkG8 zC3nWNyY>#Dx%8%NBVVcM5re2Gs-^vx3b9@k+f4@G&#yt@f`zMnRs zi@EBc^;N06wdK(EskX7Xs;lK;#bMxt9+PN+gRDpaNg0UARyHV1~y#T<>PZ+n7WHSgN(R&pPi# z;}^;x9?B6NxB6e=s3nZFsldtZ8eKO2#_HCLf&RY09z&V^d6Thn0Y|?RHE~6F{7tMX zph+0Wm*Rr)z}e9>EW3nLeKv=EcS8gNn+}trP%9@^Fm$kCv^fT&W@9p*hyDBMw1hO# z>}x)KFsotgc&*|kW0h@XclS7^6uwwuEzuCzO4ir}9&kq2=u?B3P#hd=EiWbXdSsj< z$EL^A-h5kJfX#Q{pkjb6o)&EJE9E)cSCnogl{6Vr#?IQ+ITXREO=z-g;a~G{@K)sz z7H(Qa#mOg7uEs2}@yGfM3aSQKJ%L*?f3vgAiP!dAC($jdqY?<;V;hD*C%LPU>Fga7 z6KbVs2oAR;Vrk0>sSMEGYIm>|guBpS-?}g>uWaO1KY)7%Gz*gP>8`p|h|c$oadUHZ zu#l!~~!^x)h2X*l08;^Zf*>AS4kyonX<#WseOvP3Z4l;k7F89=c3r_8<%7=^$ z4?F?i)ZnP$=<1pIX6oyU3i9~^C{eRPrtA9!oDM}ZpnnEti`8NP3vKh#QJ)Dt4S2$S zbkwG`H5ApepO0T?H~`g^icI__tD^3Qx(aS!OtK$1-N~(5E;)q-v{>pqtR3`45F(Yn z#>U1HATemt+JrqS`jt$bUt(hWXFvq!ES7DPIH#E504WdA@R-D><_kAqpn#KmEuyUl(Ycwq>jU2nW%^fCdB|av zOIRD7thyaqIWL--@(`X%@C${ly;p5WWShqt0< z4j33uyJ*hLL<@ z&oh?sJ_^!ul>!cFJYCruihl%)NzLTHyF1>1cfaajDw=CZ7&ON^xrZ-39!bOAX0?aQ z0<{gmFU!3nvzox*xEHHqLU-tD*APpSByeay`n`#8N@#TCII8 zE6)*@0NstRFxCd4$h(xhF7}4UFR<2~w>$u4__GMybMXX!?++~&y);8e}2=^M83 zV`nXK*eXI^#t))b=1+fZQ@(H!!W-ubYH~6XUp-+q>5v2ZoC|~F7dxt&;;v91_Hz-O zc-2o?r3@wUlQd!JOB=@F;juxnp(I8dqH+UIe~4W37#MDZ>p->S&vX4^iA1|aakd0$ zINa~he*c7@J8$O|P};(R*-ek?2_`?Zg4Rsm%rYRvT~nV0=IDv@%X^in52jXNDwC&g zy<q!0bO#MD&zmHs- z;+H=ZQGXsuns?H_Hvf;W-yTJOpCtcGF7bz-2EOXg@bxoPq>v7O)TIM&%ik_7T|K=F zN$-pdQYb1RA_i@heL?g}U0r=^XD1__WbyrdS#NLer-S)=`-Axe7+APG1@rEn9{<&z zFaS5;*Rti!E2XYbLcXKZQ~jZ29uqUchNNSkpZY9wXb2b#R&53Sl_k|qzHvJR zk72j>HJk6LL94Dm^diXW$bA2v_c{8CIh0Uva4`6(a_B8Z+^Gg=*>|~;J5oNuA}oBx zeFZ9DcfX;<#ks<)-5^JIl2&(B~nAW6Iagu>wrS9yrcXsDyjK6R25Bfi)9_byLVEfq7G|JqkSZR6I+QZzwqcHlg-_oX2;Y;P~N-1jdq) zjzKIf=(yO0; zrZ8r=CRhFDZ_C!N+sW_U(bkgUmimm@Wco|VWcP=w0}6VXn7kFyR_)OFfz6vP@YgOX z+s#BLl7L!9+v`XHZD8`q6kCV+u!TzLeM(!%pt8%eFj!o`{q+eLqUJ>_8}m=Cx)

  • 8o8L=YGCqcIsgE-SAD-81zI^enqXOalwBtp9bjJ5HbbC+6kMDXA94y|S!l{^m zy*NV$kN3tCU0nf!xbIs^UnjZ{pslmXA~&WIoS{auX#@f5}iPpub+kS7`VVF6nC`G`Z~#8f9A zE^}6Yf43C2L~VGz4q^D3yQXr2^O@eRj7jR@PCel;i0QGDi~45*=bk3~z(D7m}`lDQ+zh1}lRdCt_Ofcs+1wca>K($LeBQ&WFyY6^rLX65E$ zprgOHw3M)bh8llgTtx5(`sh#2wD?AQc%!6@ArX0duu@r?^&dW{z-V{CjnoQbv&zDw zCuvk{>1ey+*p-_1RK z>Yt`@zu(6iN^R~nO-mVgTyw}7yhB@h;liwyEM_#0;CXv)^+lge%87hnlS%OY3h80d zC3JMW3haNil;&ki$>=Lg2Quv5Jyk8cETZ2uqoTTXY}T3$t}UdV>SM>A^jcF)_b`hmo zyh0L)-3K>P5L1X(YMF%As!_ejw^ULX44`X&I%-;4Xm3X0-fVT@{3o3eM|Tg8fZ*T{ zil?CVUy0yf&z`ySfWz_DA~b=9SzFpIb}o!H?;QSD0$#MAm5OE0_O{+famP!;C?wV-B#R34B?ZGd$dt>dgd+J*EF6>frl0dU)*scJLc`h$3{Gs<7CGb9`8` zkd`f3uLZ&wj8B*&L;ce*uCA_UyHjDo!7nckm*iAbVr}P|-MAvjM;e{1>>V7G>;IB^ zi$OeOo|8M`ih()f<0j6(+VFW1LQ7VavYsJKp8B_zL*&;e=+OJKVF{7lTvGK!7!=)v+jaeEqo zqeYKDq$3qW49dKhJK*m`$lP1|VhTh0m$Go)KfLuAdmB8WMpK1FL5*O ze$z70UvB)e^GhBDvp3^b3rUO{FjuJ!-NpDL&vXK_3yl?Do>j$Iz1pHjT@iM?vdw(s zrHr> zJmqDHKb5ZGqTj_JSSNjId?M2`s795XJR&;5Hx=m7U~e)M(=1k(5Y@e|*c0HeI}qRI zVUp#RLe|ETMM-YW!s;XI!MC!r_ys|6vGuAQPCJ#`PeO=cMOul}S6S=j)bLxW#R9R+ z_Wcgm5<-)G1<&;lf7wN3WjP$iSt`5g7gJ8MGU!XLiuHEt0;E0GfuIzjG+@t{dhJ!x z&s|xROK(;r|D(vmP=dUR0rP3wm~TP??)~j0z;kkHDpxK|u)pycw4vUIgo!GqvlFT_ zWj!dGB74Qpff<#Q>KgaB3HBH_s5l|Y#UhDFi*bbPSN-&!Dv9uUji0+JHFyvJX`L17 zS|pyhII+=Tu_HT>5rUjQ>5C;?ZI{7$iX08;V4}_UVb(ilWJ6BUQ~T zh1(JzdRLbVCYH%}9J^RzCoIKyoj33(69B|sh_V57p9V_TXU#=&Lg3k&cdcJd!U-B& zN<5opB>ZjMkl65dUB!8e-BoSkr^4+4AWv`e?V2;Q-7ntW|7EIkofq@n>MKwHKiE#O zx3~FprE_jAJ0jKmTXhPdXe||s0UGjo9&@sMZ}C-bX^^ag13A>9!55G)1v%cGT0%1$ z4w3U(8d#dEt=!AKZkp~;j>)9OG!#G44f+pm4&tJh;Q22kulPlv?s3|~7dX83dC(>F z5za?xBll-iD7Q8z7S9X;-|A&-1dq{32v7njOZ(OK#NP47g{G~%cYa?F^WlGTTlA-Q zY2Q&I&b?$0rhL1O%F@oHT3pUAY^=2T#OhWe6zhdBYz}ZdJw4ZJpc-lnPqx@SNj_~k z+Waeq_^v$dN^VlrveyRW1iC7v9|zQbP(9w%g@dmdmX6ww_-qSgbQyL1+-!Z)XQj_Y)=!>cG0J)J&zKBP+HrnRrw4+ZLG6p~+5) zl+C>^17&ptg?EB1>1|oOv%1E5^x$lNe`7%MAn8oQ1JovOI672_05^HQeK6y9bqe!U zi&rMckPL5bhI%(Wzt~@~QP928nPrjAD+il|Ub`vjDpGjfmnHPTaVv|corzo`#?k-k zt(Bf1;$CNtU!t!S5DhJ5S5xXX4j1iGo@0|^FIzw<{j1xko?F;I;jk`>^JEt7A zJ6H}>lx1!6hr&PQCu~d2krCEkAZZD`T!nJI9U}_1+%+p2o*LM4k8y(QK2H8)tpjh* zlfEHCYk!)jW&dX2uydJNuXM3@&aK1+>%9>a|Yki*)@> z!MbrS#=ia0R8TRHd#yP*h$qzE-syvwaN4A{R#|{h4|Mcfc4871QXQ+=t^9Nd9xW~r zs`KSM`G&`*g;6zjx@HM5G#MK%Bu+i&P(2@{$0AhOOOmXhmon(}+!(l|tktG#aInta zJ3kAa9-~)nN(|3aT7PQrZ>p2qbckM(yZ40Dq#cRuP#j|%{_FPcB_}(Ud)bbui7~My z>f~0o^iC@3Gix7VbCoiNJa_BiXm~cfuC5QFB9W=7qN1{Bq9`S2hhx5F*=ZHCm*jo< z6+?zDkx}|DW?Ep=zVG(V{9Gm;#iwTjgKXLavF@sZ3!P-c9o}~?YF!6|?!@ zvX-pu+rjKQW;$P1KQikn2_-vpuATa{w&n>C-&Z6OFA~W%`*YVOB;j>>liAd9SOpvP z!pKt9j~rasWr^D3-0^}rEdV7g6&?^Gm6EH3%~=Tx4c;IGtHG{Al|b6VRS_FctR7Bx zNDopCdK7I*zlxNNAQvOSvh`OE4DE#0H5Rh1`5G3(RCG^Cmacz1RhmwGoV&a9JKFc6 zx)efqgRQ$X4C~h6{Js=_bh40)(@;IXBmxPj#Zm7{0aq)SV#AS_#1>GKPxqK`!K;;` zAI}D4hK?+ZSH7kZ! z(#F)d|6O$g9VY(M?(rsyDkNt2n$=i~A9tkxeS#PZg05l#fh=} zKOe2zgnQmDMS|{cF=||%(|JH56qS}|%H49_&?O{sl+Y=PVH!llY6XV|JipP~dwe@G zS)L){e^6yzEH;xJN5ozmdbpwqqDUPiL^wLmEi*M%UpT-v)z^Z=s1(nQ))Y5697sbv zA*VNcLTc={hU}rhjkw4C&5|T4Vx+7U(ouAM@j>)b#S*mq_%D0x6&xWfoUg(X7T+E8 z@NxE3Dw=apZI~rJF1`ZYAAT@DS?f!Kwt3>=6}V?B&&;VIAtA*eO(C`@64hsn*632jNW4A)Zz~|66H6VVIHcFO0zi z=V0z{Cm&3W`6{7+&@W((nS5eBXcpfle4hULOu0`qt!aXmNu{km6 zDf4bF=N$g9)Co5Sr-GB1sIRL_l@{*Gwpz@EGuoEF^ZW@1d%5{&!bjMK<>eo5xMZ>M zI8EOjlB_0NUl{mRRlg&#Mc~oAc!YmULK(PksjsT#d^e`1GyOkR4hI$b2!fk;+m%gj_>Gy44xZ>=JYX0$Y6{};h>UHyx=boKf=;aEP9 zob0Qfgry;!*t! z^fUa?y!knsH%u$9PPwikjdy~BVpdqb?Cj=cy$N}nCQ~F3Cv3;XcV?NERaw8cIk@A1 zU1quNm#wW#)k;9>gIZ~NtKQ^vV|&$W7%0t9URg=KtuxOkgb!G?cb^1T>;<)HD;qiR z76pIlv@23y6)p&fDhQ?chdw;!7M5bPzk=|@Xe@Ei`Icy{cfBxP-Sv}kx`xC9-#Lf5 zN#7vGoNBWt-EHV|^c3@NNj@A6PQ1(&Z)QIDUsbxFyIvgdiT+sEEK0WLX|@sARFvuO zl}}ykBoE$o$}k3qos8MrobAaPVBm~+L4#HvwIF++S{1aQsn+vips zTVw|7@Y@i?n6(e^753W-7kihR?IABKqV!%gE z5HEFi+g^W{zdjMMU#jedk-O`f+nncqV)e+aDUi%O65~K|*`bdKw7%s@p4VjI$TMlq zh!#iLo9)~QStQ_f4_1=FuZkS1I27mf$c^q*`_j({Hf-FB*+<6_&v+*=UoFM&P9v>QLs!P55irLwRa;|I$J*ZB{w+8-%NUXxR@H({T;)+_VxZ=dRQ8IBima6ty$PWE zAk4H>K%`1E$#ctF5xkk~=J5s*W7F|GmeDdsk1VVZ4GE7PPYS|1l{c?9jKm)bLE+sf zCJbsxJCdQ=5OHXkO%zCTo6d0awYW<{T((dP5tW1Gn99zqZrR!VsRu=zicFU0m|)yf zD4K~vsjrdv7wu1$4d9N0z^KEiHNBzPHs(13TSnsK6c*MA>ajEu0 zO8bdzv*pu-vTS_#vulK1dv9}jt7czI?aobGd_J3O${!6Eyw76EOpStb2$7L7a5p+#vFALB}V4a}iTW>n^pNk4M-d>u4Z4^y+0wMFz9(ESt-gMS(N-pw%?+r;Q7%qvC1KJj|}2L z{k&(fxG_@SL%{Ugc!2{(e#eit(Nldm@%@{SSW%QiMh+|0nvgZgI9aARZ9K-gE-l?S zG=(@pAbD7*R(2`Za|z!*-BF#iCKBYW8Ku#2+whw+V(8_}u}4?yl>Nwc8m;YWRdc5I zxDgp5gS6eUbVsIDOnR@f!Lbc-N{djxG@(NFwEW8M8Xh-Z@=ia0lMgCYju8fo14W`; z=GCS2wUg-X0T&63l4-b<)h5d%)kLfxXPs;8<<9pqz87$+3T{Mi8T9woD4b3*DujK^ zjP_hCzds$VDJxXoD3$e3D1R7Dj_}CFDsB|_5etribGV4)l}V<1-lG)EGjVg_QPsAy z`?}CkQ<=&VptH2%7T6I}?s4mA_(;OTQ$PC9)iEpCb8nbq@kcdsy@~!RNAzQ;#fRSR zCDnbq?0)4X3}L6E39-{Y3$Dc1d^KfyUFeg0vjZzSxlsp^8uOy!v=4)TdB&<8TCdezxg7{Qrj{Uj zZ-ue(klhmwrNXl7B-P-AH)VtOM!s!DxgmU0D5BMQuWR&T@ixO|_l~q#;B2BmUz3nN zNGI!XU_9*6V5(rh!gI3BY*!C%SIc1Y;=XepEiBlM@5RtoU%!tr&&DO;0(};qJ?i)XqjAdkZH z2tu5PJfb;G<~E*C!`OWwg}+|HQHn(-p}AU<1?qG?7$~47T2y19xFw z@!7LDdQye>v{v8B@+ym|*YHUvaXwOE)%0&-wwFrv4ri?Mrvv{BPp1UmJ(vjfw%+O+PkjlnYgrbHDKVR`t!g&@VB@ayLQ6+W^ivtrQu8d* zx=(pbRuZQ9^1KZ}A>d&BFuU-|yo1y8+WL*D+e157MrYatB^i1eFn62%#GI4H!w7i} z3(}z#>-L)pEC6CV&`d~tn|$J_whW$pO&9G6S_uP~8fYKOi0o`JTU;X6d{}2WopQKq zHe}_xhPWNw3eI};BWwNv4G!v7x%=g~i%VGh4_AQyd8~XwiWz15i zO?vvM*|pxOIf1&4z*pw`#wSNQnb&8s#4$cT{?os)T6hg`IQV!O#rXj>sp+g~=^)0L z+L9m5xBuj@9*rdIN# zXCK(+v}A{ylB)!75>Rl^zghWV8QP6AVr5TUw9XRT;Ly}^kU})rh?)(+HfFW-vo)Kt ze3)sB!gom^r|1k<7QJ`9v3%)lPMM-kBWt@NgUEiy z%)-$%RKrrdFFA=pzn7W{yLyDZ;25fmpe=rgb-?jDwwF@ki+mJY}dkuGzv zf)sJ(jt%WS-K|Zg0>pw_dvRa|2-(*mekaBvAlopxc~OtFd=v*m@Q8H=MA@>dklhJnAsK(9`YkIbrQb(fxx`^g-db=L` z>4ymdY0KULE(2mS+a9hzVKUS@zZ`EgN;p@OJ{yrK`G=xW<&fLdy1-G`puc&rNjN*j z`$!l$ifvI!WE^Hkb`(k)O=RwV??DY7TaLiwrd`dj(tWe39D6*0FAw(`dZlN$ikfpM zM&0237rb?8;rM-7h344G0UT&GUKDPt^a*zd@Ml*0f!Ug|?T{qL9g#}c*Q=SlyaWCH zZv^;KqJs&}kk?(~=SB;>;bUWpc5^<4SS`un7lE`X9Y#eZ`wDYFJIUY!Dik5faqeA2 zBEm$RUMfO-J6K)npIN4H1ksCP7l#Waf_9ao7Ka}3{9&)YAFj^mDjPtPrKUS&T^TKb zom!J1k@x5l32I89rcW&SeO%w_(EDQch1fO{(q9ts*BRh*1PEPfe!U}L&1%p{KC=85 z5{UkzBLR$(LwMTO?gUY<))?r$+(y(kOX(QV4j0Eg|GgOzpf|D02I0*$Hl}rsn zHjU(6fjT0Yi{jm^?VVm9$70^HQkF@T3!E62JDp!NQ1%ISRKj0uRHHd5xV0-Khth~# zv@1{GyP`aPT7KeepGwQ^Tg}l7Zdcae;AH${ZhUWz7Hk}@GTewBcLXWA4N>`5rZt0G zu2c9$1p=|Z>8jmA5Ez8!Di~bV`vwcd^$;ot{s%%u+XBeKy50G0DR0!Fl9zDRJ`qvz zd_aLfD?j*%A-dOCR!kY>9A=LKh?*yde zcx#IvP*Tyy$I@@Zaf8kEJ5J=Z^?IvJ>5l}YRJ4IQ_fA4AH8-vkGWhkvQM9|aTM$Fk z$dg4X=K<#2slugl(=Io57VN`!KTE^f?laS~#iCLlmt#Jr9P1qMEvB;+=t$Cp^L+`F z4S{=o!x`8Wye2aWwTvrP4rDYKe%vGPoB2=1Z|GEELPtKoW-Do$#rm!?E16H&#Qv$x z)R&`0;-O&{*gUJOI$p;X2c@uq-Oa1>-NP3gTiv-WRvU-=b7~i3?%I3H1^qVgzZe`z z_$gFv|HK9?d;CX)!pBS4W_(o}!_}wSiL6l*o>K)lU-P9n8h)C@5d$2AEfE_ZX2c>A zU}f;*1)tqY{-TrQZG-zmGo#%rEVaU7)p@zX{~b^|$?v)EoZi`0<^ryvU@1>>$(0;t3d9MBcapd2 zht{N`#l}+RP1O8aZ^^?8xTU(R%iM4@4Oj^=tlC!4Y6bi~#;_H7^Lh;f15dgjlhBc} zTiKqpia7#auLh-Nx)yJ+@es1H8YaY8+kE=oi{L=psDW{0w4=lPg%&c|^omog)VqhT z_>LJ?8cq|t2WC1wD|B4n=&0>D==p*)Bm$J~$E`^a%G000Z?QR!vYnaif2*$M=!Wwp z@19p$r}4>ANwB;3*kKk3%F+lZ5F?SK4y=EtquxYFfZdY7R6waoe0 za@>owp7kX&N1V6>5($6B-T6RMuU&Ge^OI6E#iD1RYi!S@2$8Vz($#GP`!vBK6g(VU z4PC>iFOU)W3Ole4&0s*Cq__$tbZ#R52=h(-MmlC(mQw&0z5&^y(|4@rXsOPJx-rz= z!op7?O3*nW2i@5KRg8?yWMkb|D_aqeyJ2|hpM*u`EPsC&bF22 z*PrUY%u7eEqEiLoP&Jrb#F(QSa) z_ZJKTo;+7!QiJ%`DXIBE|GZN3`>8CiKTuYbF5w@Rl#x-k3Qc&P`WmpGuaJ~ zekEpaL5iD@fQhBtRN^WmXy-rMmy>V)Su74_I{UWV;NEn;@uGX;$rgtahOktFgeeDh(4DC(L!|$iO zcy&!X{EvLl=RBPbx8ROPxIfdTaumFE=Slqo%g8k0@JfcaEdSSOM)8h|3fpDPOY`Lq z)9sfyLY@RmCC3zn(}_O?>C*60Sj`+E55hgCE8_t#i8#Mu3#o}H*>WaGOmSB@aowUk zk5aghl+j8D3g>ET$9G#AEjSQ1TpoUy5gD8)$^4&q2z1sG0G+ikTc+@TEMk`Dff_Ka z#M01!+$Uqwlp!etS;jg><#LpSu9Ne9Q{&ae@BCd%lx_3JrYjKia|KbcC;Mzsj8C#8 zY!?<+qBHTejk2e(DQxwa%C}M?f(cmtOvfl$^g7Ai5$RoyQ_9)p*Bbx?b7AX)`C9c= zK*kPHlxRa7I`Gl&AxS|bMfU`y4_Twva@VFmoBNe@gTtCuydoV-q}nJY#T$ zv%T{5A<2IT;fspPz}f75t=3gnX>KDNmemAZ z9I2T?JrZzBAHu%e6kFRWJU)cX#dDA3l+*afH4S+^vc=fI!n5jbkPh(4fcCAbD}wNp z);HNUfIn2AEyAXQywPq>c zfJdU$qZXLI@fGT3w@XpE!=Vsv5fKp+vwm4RtDm{SJU2u{#Nm&cGRpi^RL<0Eo13ef zn^aC`$<|Izfb2sp$H2E=d>x*~sX^oLasT#bE48#z46`P&Dty5K3QBDI8GtFmu;s0&!NtK2Y3 ze71K)26lNy47z_gY3P(ELdY?wb#!9k?_Z3TlLNJ;yB@EsJ&x7}2wWg1EzcA`$BHRB zD*+k^-!f{Ms6y~O=-BX_4m!M+@WOI4pK~7Uo6L1SC#%OOO3x2cT*Y#Z+0pUM(RJXp z7ip?ppx>1GE%_;7{*$%hrL z#Mk36hju9{i&PDcL9Ip0WM-Jiqn?MxV*C#hX(<*ecNO1VCUd!MuEpKi4r~KbjsBa2 zJ|;#@lp$>--z2EtKt+QS7f9&wQkvezY9flnM?Gd5P(IrjBfvSS@)GCfB~YuVzA$02 z`)^cdLi7d3ole+^o0bgmFyx9z`V7_0bFb++^mNe5O||wn3pB4e8yI{F3@K!TrIK6k z(oG$&G<{omq0Oyf0@y}1?1P{fZ;rxpgSdm7bhdo7wTX;E@K~(pF}1zcMG|MX7B9FQ z_A^xQi`pUnE&Se#w(hL*(nm_YIw>f~Wkps&5x!`YIV#+|oJMPviq3{7@;gZ?HbaH| zwIRU=^~frK(uaMG(PDEM;0MO{#dTVC9)~n2fcJmd;!h(kE>~8ih^|Jt-J$IOe0(() zGwn?-r_rU>)FLbh;fb-L+Lo3vwV!|Hc7H6&OP3|~vrLH#sv!~)145dhI4yE8S zfBFn9?sj)~=k~mF_O;9YVUrb4y|lC*I%`#x(wuUrZBo+IK;vvr4*%F?*Ws1D?eBGT zA6)V+kIGr0SNurVH7=~|;m8S;w4z*yz}Pm{2IU8$v57YZ5>CaLO5lI$;-|O~zJIT) z!^v+S4gGa1K*FSgwZU%f5P`PyUSn=9>FtZLU5&H|wjA6=q}F6;JRFHrG4i5fXy8j? z4>1nN=#I&i9u4hi3~1LSCJ3YyfDox)-GQNL|1XKo^OP{-k#9-zRxYT@17s}pFf9bePkug!Wv-3L2>;x9KOf3Dwx?z)ZU7IOUYL+L&~iuw;mB=m$^03U zh(<12v3deVxeJGo2X7n%ln7~96=~wWr2^eM6P$M$Dzstv|6*nyq;#;UoNxYu6jBNB z&Q=~(EV``@EkUV^@bH=ala*Nf;`SkXxE#0UlY4VLLLm6#^UDsWLp>w81L2Na7oN}1 z+=iasSjb`1qtV5d%D3ClXMe8(zEHu-0Hp^RpnCW=RUM6a$A@pjqa3Z{qv+-{D2N)W z8i{(}H6He%slF&5PRfe3B-{lTB^hMBc`}z#lUl)Lc z2F2Hmvm?U8y@$IyDAUHDE&GQNlM0T9>e-GdioC2x`U@06lNXnC$ALz8HjG5QY4?{S zacn|Y-{~5xV;3q&(onJqe!=j+|0dqAn7u&4^uP*}3qg;{3Fm{Jv$C%+v4nl~4kD7r zrS7a6!`V~7BxUAR^$AbZW)8k)99 zyTJ0#MC=n6Xxn7#Vg1Qq0Fs&N!~)ktJ)h=p^TfQYB4)^sd(_>iGrcRPik8d~dvW~W z3)q>?@x7kOBF~O2y(z&myLzjPX&_p@QCNFrbE;;UywE#W3hMDLtS`_>ds{Fbv$urc z@WcO77wMfLf8N#66Mbm!_pjD;_3m&gg1>kFr@*Q2Gez3Bd_MR|g`+!uD|hsvz^l|S zYzqp?>JvKk#0J;8+CwNZq)31eN>VC*?jvof_p(PWm4uTojjd-WJVz3sfYXtWQ68V< zkR_rI`%m-qnBqDbzwP+3cR{ZdDjEHIq|%c8-j@iJ;2I3AIrRchkCQrLt^5ujMjd$o ze_cGi^W9$;1rf~bH22Ru$1X21zf_kD2AFWRa#^w*s{%^nKI?<)7zo z%Gyj+F=(lq+VQ@5xtR)k6b`)4vK4Aj@Q2p|eJ^pgW>Gu3O8-?6u9Sv=jGXOsxVW{A z07m+G5ACB65+W875=u_~*F_6QGM(Kw{* zxITkN>Zj{?K9L@NPwy9b$2mgsK(EuB+I$;|=FEdlN2Mier3txK!qC(zS}VzVs)lMd z+4Za7d-m__01H)ObJBxe<|T}pKSBix(2x+1_L4r`Rv^hx>(hTU94EyR)MH+UYa;P? z*T}#a}Yxt2rSQ04mi?ta?R$&^H9Z*3tb;59_e)%L24l|Un^7^t z2^ebI)(dAE0G2-9-sE`W9fPx)lbLX8^}aalXBkd(c3JKiv*+7kK_b~9q5(?D?J=!d zMVd}MjEO2(s#0i0YCjVl7>p{}D$&*UwU9iEstZldlJ4!RqPX>0Y#$Frsf@c?WobY) zcD4{f_`Pnm`~2Uz6<86%iBn-;h*CD4)c)?CW*Iy(a|2uTPYAh>jJ z2<}b?cXto&?u~R3+=IKjOXC{co8a#5-Z&iI_dom0-gBL~W9{QI2+m z|JL8x@WzI=q|%9-nzzCSY^u_=?ZjH9oAP*`V7}`^4dO;7aTW- z=l-lB8O4}hY_9D1EjAN-u*B2;a+=EEA9Kb$@Tv)X6vG^yV=WGkM# zGHwPTzul#&ZaRtUUGg$(R8so$eTJt>{>xi@s8dgUh_)SY^RFf=DSG`_ zMhNBgj3?}L=}%{t#S$-SU#~7iTfn_mwsZFf5SQs4W`<>Oel??*STDQnGNSom3$H8h z!d8D;x4r!*R0N=iGa-EFMhsHEzs_dOkTT)WvSO$$!%SXl&+8ex|ny{b(sR_C1d&SydoWG9|_Jw3Q$yEmru7! zQ;IRBZ-1Cc5kCGS0o*LhxSxhD*i$juGEjZ;EwR8YX`y+dKDu0&3;ux1R><$`>*B9H zW8;uPNBh_;uySKB|8Q&P^MI`(fXjv0(vWzxH3}zt+U!dk|L5Zleytwl<{k0{eQ{Ymxy6_43Q_x|nNPU+jg;r=Jr(g}bQQbo1vp}M^8P?j13(~+#x z)J1off2rER(8}7*vD6Qt<+R4_j<_f=zjSW9kEM~h_k-KU)Bu||@S#H&Lh`4GQSL7t zo7-4ud9(Mw(#-?UFR(-pz;9d9{_VX>q1&USaQpAP*Ng6b(>WtQ>WE4-wIhg~558p3 zY`Fbv=)NX+RFu&6^_-<{QzQhSuI4+;Sw0}xlB2vxX%KsOHts?eSMR(va&W=YbniU# zZRskvv^=rg5QMth)1t&QgHHo>v|6}1k$TgxA^AU~kNY?OhxBo!hFVJp7fFNE8#I6* zeY~B0$5VY=Mh4@*yRBywx!kj~P)|Zmo8QVRD$^^U?@IYJ%*4}U^Z}{{2RF~s`$MCu zv;qur&Dexg@0X<&pEHO(zulkypi(Y0He*e$< zmwhwkP;V5^)zbca^n0%853O~Yp-|q!(K3(mxX= zf7w-tjRMf!F?r}&O_r6`vNB60QNDJiUiAsaVeB_-tTx0sc z^&$z1LKO?HmR4-?3xozaV^_Cr6WoMsgJq`X`x2Qd$~H0d?%JU)M$2BxA_(Y~J1=Nb z_+rzCO^rp0Lz0c83|_ghTik1E`vdtN`Dvc-FCycAV^+x?EEGhuyLx6_c)1-Z?O&4| z=O==f$a^UQq%((DZ@|XUE+Pp{H0wF+y8-peVYJBkI$H0C9w}M57*yP^ZSyJw!!GQk z!C+=>tGU{+tNs-gW#t%Ma~}Jn>B)(u*+A(Ek}+vQ;Z2I-+vY3qm|Frr0+=*ln=Vq3 zMvt#qmSAQ?x~9Q3v3-HCTr%!rqEgyGa8fActgc}TlIP|d^Dnt%O}Kwe*`IHtwm@8y zzbRvq>3B@_do)<6LG}+C=`=^Xgx#{&vVGfxkO`BJ5d+tZb^bmJkyvs7)OG%Ys( zCFluujn#~lr*kjjC0ws+RdN~f&=K{AuZ+*A@lvs?8g7{p8XKFj@k=GJ#JI(ZunTAx zrq`#M1%8R922*3xjc^8OZ9C!eqbgpl_)7DinC>RktRBKN4F=ml#QzH*!^2pV_MaY9QB72g96h-Fl{S= z8APknRixdN923*K;Tsyc7CCiarpeXIN%XH{SGJWX-UkSj*&ZGp#qv+(jxG#V?UG%iloE`9>Jp?!HWqVUqFe6?yQZTy`o^r{G&Y>Gq8HCMOs z{7^7X`UgLEoMiSx_7YbkmwY0cGk>PACF`tmM-L+HwUyE_VqrW;jIT)F? zz2VoOW)p zo87E_R$rKZeeEenTG5S#Cs}YFFUUM0ybOv6EUq0LeV0DOm`K3QNRuWE%B9zJ^0z?- zg3#@y%!V*>av(|<5S})7rh6zBKK_ANPqt)@n6Fl0_ngZ@jQA*lQLG*pUz1?C3lUG6 z?^DXA=|pjK){I{gXEkaNr~Q`=VNA=}`f(xKTsApARKt;AeeOg=o}xkZQpnFD)XTXv z)u{d#QkTiSk`aV(@SEiTADcO!(1i+vOxJx1y4kY6>X%7=zIHA+=s$_To^PDG!#$(q zKf~F11wL@({m{I=vm+^0byfF(EW2$-y_T`-;UpR&@KGxOX87G5%vp&-&eGyRe3f!k z1$z<;^LmQBI>jHD0jN7M<~CyOn(G=Z#&FEJ9>^Siib4vDP%90qfdN#@kX`wY{(2GF zE7%R3Ow(~Y9jEe*OzB5)ac1bEbLCXlOu2c})OR0TtOf?S%YfW3X)9ZfJYaT9A@11C zD#a&h*qR>geQuN{Ceu>&btH!)`_{RuNSfRet|O9HyEoOKWy6t)wWA%5qhOA|?k4uS z_I98C5D&U4y#2gwu9OrjEi5d2$H1XN(^^jl-ieJ(kP{aUyv_UYV~MeZPUA^kQr_yV z)_l`cGwrl;jQLldrko>Ix=%8%NwEb+@N*X-NqIy+iexm(X~auE+n0r9wg~^+7mbzQ ziiR}uxo4?R(nZh(B&VUI4tE>(U7nFET&`d3(=Xyf@BBmUf7MUDU)xoo+QA{zZPR7O z8#QIT>Kmwp&OgFd+1hs_qh7Py!@~-Z z;fJ|EGv#}FtFdiU6Dm9M{Se?zG?-`)CK5vD)(q%Ia^f;TpT?MPNLO19ft zqT=_ajQzY5xgsKEm0CWE06bx1FNBJ;Fb+Mu2RFiR-w$})9x=o~u=j2NZW)JF1bntE z#Bn|@jCk#y0FfZcYYX8-HzD@Y-1MyJnT-u4Y9hf)32Z+)p@`HqUGc&a8=urVDrUCS zkyfIKQmfoo$2N5Hqapec4M@3qzyd<9WQ1VP>{x{9-z=g0#XYe1;C3ASg_D!)Y#@h< zsPx2pXhyB^w+5=Yg(>>@lq#G^ZMN0WKs8^mRMU8x?lV6665Ey)-%0u(t`2}-tIY&< zZ(K8{u~>Qad6x5yVylWq^|R(VADgm5Q1!Wgq}|g4=9=Ot(N+@0>G=`WNB&teO>2aEj{1h7WL$vZo^NF7=Se`jRBZ(Oi0xrq<#V)=DrXRPRc7 z7+S2=5pQ_77~z#_UIo6vVJrxVfo#k{e3UC%y2F>;+aDxe~ovVv$8lJ|m24@{GG4m5w}|QeR!TuWvE2-7aqRC*!(_r}{REOWxw|qF?qt05FPAhYk%GcM7+M?@lK7!w*SJ>U|Uzi#&Rl~<2`<2FmHSMXsWTJ%|sXu$p)Fev7dXld@W++`gad@ zi3WR$VkwzPy(Vc@O$jSHg@BwKU8IY!Ni|7pQdlY2rc8EhSBH-yr(8j>kSxl1dxAwi zy`exX_xnMeO{iEGMr3Bo9{^wOncei_RA2KvqJ^IK$G>!2A9u^T0$TSYt#HHw-?R>| zNKaZ;)lS5B?5Spks2$oBcWaYBtIzk5AzfTdmyJ&Ksh0|4h<%;o<(nvz(P(ySYrZ~m zMxT7r5p8L)G}}|??}Bo~Qz8U)bXrVGrYRZJ zI=?wMI-zmgAGEMt$uzxu&#@>qI%c?Avic`i<-Y=LIc@3i%VKkcE7z}xHfs33NV2;# zUovCNU_R&IctUx$t)I`g1SR@aXW$TCg|{>TcX?v;lt+I(+e1+DZeHX}E{vnjlRUku z-n%F~MJ6xieB|?S?E`MR;F)v!4(zB{>Mo~C2-%_GBPLUc6xrTRN2usEm3U%Hyfrb; zi`HV{-Q}ejWQ$K5k##y?hG;e|{ZlVE73PdCTEhY?D6%U&#Z_QZ%6j@{$0E-6m@JX(~e{gcKns*>^%Yc5yQ56oYi z#)IbF>nTny)NAv})P|c*JQ@hUAyfJ-%V<=QbEIe0m(yrPjX--d`y$fjTW#4|xQM^d zfyo>rGbdKbP?;>7>97l@kb7ffTEPsDg+*gy({J{{JKsf7nmkPz<7#5KaXb^~ zl6Ow)YNkt=F%_BKw5f;$hWi9+=zHcr!j3jkEKekkb8bs#WoRvvDfF9-(0CXNm|<^s zk-j=IaV!i`Ck`FY8lA311T`S&GrY=C0u4(3Mw*ix1-YX}mFhAP6jJdsH=^R!mznHF zr3e?Ok&dt+>&zq#|AFMgtRXozkd;+s zR4Vhgg+12*R|97Em>x?j?_x=8@hrBrxh7Wl*UiCHUx%@-OvTG0uh^4;{aF@(<}-(XDS;|hVQ zs;~1kG{7)=?UD8oaTl9oD&^T}d4IcW#w((k%&7>7hjCxSQHO)loE(y4A{1h^e>1X_ zCN?H`?8x-60C_a2FH7oG=s2b(EuPy!_aEJk&6J;LSFwNV6T$t!k!xS6PIUWhtq$N9 zkxsENo}lcStu*hA5y(r1l%$vAs3fEMe=IDNS|BxhejtZsa^7@KQ81>Xn@=*)af9lz z2#VyHsONks(oBrWwLz2+%hAdsK@94vRH`d4**$kkjKSGeT$B}|tHb5wSHmOol>(sj zu$*)#rBOH13^A{Q8!@@O^{Rot4=TR+w;?#QwsT?$6?lA>ocK8%0qo0$Vkdr8+s!8) z470^5wq3=H)WZIheysGxi2d{XE47F7de|Lqrr&|N7|Y@0zNiUDk&ydzCWNdugCmY` zblX3r|DbfrwycGPeeRAk+o19b4Ehvc3bdgtvIY{o=T^n^yy%cxrh=P@igvVO$n@C? zh|NZRx%2plN^CPU+UMc!8*GOT9veoqJ`WfCBC<;P`is246(W7Oa5NKS`-R~L_&yYe zhyoD&>3RnZ_cCLDCJXR-`q>KGQPu5EWO3d5C@z=Mm9*ZS44c73O4A^v5-kw8H@NW8S=)8Lrazr@V^g;L0onb{6ORj)gP-3e zq!=FC)O{sXd{~pIR48zG7~`KBTSDkZDLfsZ9a-`IU`x#ZhPblu@vzN~=MAyb=uVl(?!N1VtWCb}|#+&tX6awDgj+M}DU1huU1*O?% zqr-*B&TP*zt+tpPM)>_By{FILT$_t*_|q;Pqqtr1RICW&9WSpmFFlOh{XnhyKGUw= zMRL!Pf_nIWsiH;?-PQ%R;F|9ULcvA9O2)Lpf`{G9vzLf2HcAqY>!vKrT9jPuT#oQV z&o7K{(i-w~IwBjFQ{JTTVIJp6#jdb}saRQShTH+El00ItUSn^Zbt#9!K$L^6sQZG| znq?Ke_o{7gB$v(&Fpt`JY}EiAYz7c=8)BJ;euph@I9x^w2Y$xPtSllUH!4gBb-*95 z&s{e*rgvTOHuE*TF0*{SoS&EsQw!cp#|uwV^hA#mYH@)P>BLe-b>tz=?nqFE)~Xul zw?wb#<4JT!()&+|kQ+Ap6%0m`Z_%j;j2p7*OK?-4Ae!>_Qfo^qC~pCW;bEOa|4g50 z2IQ!mrgbNl_>@0Qr9%a)b?4k-{D5MLTiz+2h%Q&ACtX98BSf;nhgxSMZF(FNoEtD; z#+%An(I##uCTz#3iQSh=Ay%_-=vija5xv@AgKL@}{R?OD8#PKEmV2J}^P>9+)o4?I zC9@kNWPh^om5nUk&@JxlTR}w!1M{o;r@p}DzC6ZcbZ@za`JSZ60<=1e(0=Q-(povr-r>xg3aBs3xn z9+mfc=Tspg-!BTwj?~s-ndXyU{(GDaqC=%hMB--7?&1-o6)Twd*mvzZ`>?`t25378 zUK+|Aq2AfK<)2`sSWlCQPu>yn>6;7=h?X*AZk>2n;!D5Y;xX?V_MsmCXh{V!ECgb% z$w`o>z$Vub3T8ya1~E+ zLCsgnlG%683~l`I*Q)N8eP8wxw8G6hLt!qn^fqO@IRlqd9_sNv@Nc%Wj_%M(I%C+t z;@*Bh!+4P3O;nx+xqU6cr5fZ<=O8Ly;CM+UD#3o1@$TjTfHoRo=j52c=x;Qky-Ic5^n6s1m$|U^)%UYMIK8fl z8fNb2U8BTS2Rgk~A!&~S zp=n&J5q_N>4qjgZwlcv*y4`Z@3pe2SdT^KAU*q1V|Dnh>P~h7wpBU<**R9 zU;{fYTPH}WJ-oMSB5rXl5UZlI6DNn-39{Srgoh}|n@YBPv2m$u=q@qYw#hH81zNcp zf!$DseHBa(4i(1RetPB0+t5xQ*Ey{t1H~@u{o*3Atmi=G_T{IP-a&6z{`!vn>Fp2L5441zlQGZS%9wgNbkRI z+jbE5^y3194YS*+|6WN|nG9mCfDRcZOYy$u?v0%GNCb@AxdWe9%1J73P?=wpGakd= z!NB7w5$d@-YupKz=f+yq+w_-iJ2B?lfv%EZ{slDC&VIYJN3s|{BWs??=+Q;AYL9jO zXdx=pK%h*bBh#g{0^w2Jo#tn=7?2f5$LK@)d&o?ULR_rI9EwCDNoy+%;Bqe0M|bx* zlk)(-y7Fgv5N6+ii%8LCHOavAn?&K8Pg?EAHt@MZKW-s|pm z7Cs3l%yydifm0yK!GZilr4o+b8uPNbb&SO6lQ8TbISPGj<8I=`*WEY zJSGR&_RE!+r>@UEBr%F+0us(A@6+U+;ioZsOG5`8tf^yFZw zVBfd$?D_x zk*VPXaUwT0ZElhbPfof=*Z7d8I{&)M?&epwQ#l01wek6{U%Tf*8nhAqY28a6NE0}+ zAezK$A(y_Yz`D};?l!Lc6pwha*Dh)mC2L}n;(A|5oI6N& zaQke_BDJ3aYHkWE=NZ-J%ClCWW;8R2#sdfBObrvE*@cKHGVA#*oxvQs8LBY!QMD%q z6;LlVE|te~Mq7i$9tC%vm{alD+P4p1B}$in0=Yr!nAK8Q5Z6*syBUjECQQH+Ld%Qh z(Br8&_V7l>Dzou973?UCjEDCpyR~)MhWy%Xzm=OF&6@JhwxUWxw**xJCyLi3!IY9S z$tT(#RS-1qoam*`c;Ns5U+|c~&f!pz0!MphbH6`@)r43Y+UkD_PNTUyTA5P7QH zqTsYNdL&F^9%n~{MXr~jrOI}rz`6GOefJ&P(7vSPpJKiw$(p%;F@TkzT6;55jcs`8 zF1XpRdu2#8^s1S}ET@cO*D-!#ZE22fiqv0KD~bzgBY=XaewHiLKek>y-(xC%rzZC$ zqY+nE>_!y{pR*}P3hw!7vlL|{1VXL!e?6j1FlKICt*qXe&B(St9_W}oRV9t?Mq*(k z$~u+&HZetp;DjI*Qbc=izr!fxtZ|r`^)4MU+G+5v`x=wm&$zA~rw|y+W#@@F1*}W1 zL&%xOa*g))f5+-S@wIhU<2B$ZVzjd$WeQ<9k!gDTQ3?iNKd#kO=r6s1aIbw8L2px( zcGejkWjHz_y|k(}vC6X8B`Tzv5P{klbl~G}k@xAIhv|v?U-(+L>?n@;Wp;czxscue zuG<67qA-qM&n=~}7r6sYu(?amP^TYS$B~%V9#K$FMJN{B{?=|^HCP5C8L>+ahKY;H zWt{L=oqOfw=6w`Y+Z@T3X&LQgXYU5f!_WeYU$iF0{=PK+yo==vAk)n}M23-qqwO}4 zkWzpnx-rZ=AXC4$#Ykpg_=kuAo3SZHE@!RjeTwZ7jxA3ub+~6#%j@lyN6)pk8KI$n z7o)zAd#c0b!IoF&g(K7qRh(rfV1MMJ&Y+H+GY{`3+=Bc5Am1S-vj7k2zadIo&FbNJ zDs##PeggR})+Wp8bj{Ve;V{V^$hDP*smV~}&$YO2=f(riCkAi^I6_X1%8vG#PxRbQ zmbz=^?OAflPYoEowJ(6bzzWX-<}8NRvuDp!D;|W;DN(gkqXG@*;)e?{jH9p^%!b%g zT;d&NbwQp2!1Usbr7kaK-?PEJ=Iikw-IMGP@wcPjUqj85?e*h^H9xsD54e-9TMiBlyFaj5Z zGbw5|rnX^daD%06t3iAMfpbNl(Vo!YPQ<#(;!lUuhXA2kRrBb@DMlmdR&_LpXf~rZ9Lj4 zCURul>u5N_T5ZCzYZx~Ow7FacfcJ7W70&#I*4N|AS|RK8&mEtv7+#xBK-}D1cXXFn z!<-ycN~rH4aRCfN^D?AH+Yo-Jbgw)Hqm*t)$fOga)-~=^MK5JrxZn||%hlVM=ROQa z%DASzJL_7ggIj(`%VqWg5UQW<_Vf<-P*D8-{fW9BlEzybd)!fJ7NsEJvZ$=q#Q#>!sP?5cIKRdSr3bw7_|eBJ_E!RznG6f>yaKdJujbo#Y4p*-M3{8ClxoI731tnY2{ zg)QZAC>Nd=W1*H-F17xX4j@Adx&H%`;c={wN9_pf)e2m>#attoj6U8-Tu^4#!=-hw zSYqIrS?7lY9XzyPLU~RzN>{h)$^y$l7Z&lE3bbWI%8Yg{_fl` zd9aFpLHP@ccx&fxG&^UyZBXN9IG4cmMuFzLH}8J52VBYAu8MJ#1jPOiR>hvZp|p1U0d$C zfvSXk&HuHezaZ%^2LSO;#n0+PHdBjznt)Tf?$xNE4e|^Fx4NKl_6(EH0hovYUZbJ_bVWJA0^ zS4>B|SexaS$xv_F1k{3 z8I(Bj#9M9fXjUq6xWz=YDZX>jGs6=17piA*WEqya@c8vrS;VBH!&|d;3{MX;{VMh$<+Mk@gh`!>Pfrq5q*3lYiybU-A}L{4WVVTR zwYHPN_mSU=+r_`tPA>GlZ8L{|l(n4V=NqpUbH3-iqRKLL_V!*nuYrgcI`)imeYB4* zNdMXrIl8}6D0ofaTG+1eMJNYOd$i8US~zh>a85_d$oNz?x}58Hv5t;9sy@Qc@}Po) zc=NNO8v>tG(Adv+EUmO5Sy>HkDzk*Js$ z1~IW*6p4V9Ci}|_CIDc6Z(VJ>SU zZf?0|Ch`3|>Yuo7LVmUL+Ku2^$xv8u9+z z`+=J4A+?o8mvmpM*aAfyWyYzAXK;BS-L|`-{zclVI~1EvmJ6Wobldehgi!d2Hjc0aJue;RG6QRy5{aDU-KuY254< z`+Kj34Dj@DYg8gHE6;DvyTX~bCVFF9qWR_n?Ok8W`7T-=sJ~Fd{pU3-VNR&HUBWhV zJ@-pjL&i8xTeVE6G1^`6QzNm1IHm2^t+-m7Ns*-2nyEkCs=FcgWhO!gr2l)0fCo{LuB?h>!D!d)kFxix z1;9U#lxKDoSl{}1$1ms!!aL#eL=3o6(eb!hZqRCMXudg+J`m2omj?C@xxT_k&P-#1 zFfd9-0~1^V)E~_|#1jY}%=!?yS(xV{ZcG2ky(y0eQYnbD{;CTQf2Al z3K6L&XZrUv9o?hXvzVzM9R0Oa-8`s4beAlpEBm{1lPgyGIzCg%N*yBsCO;P^C|TA$ zT1ZRGTOWsejyaeb)_#|EKw!9LKP-5J1M~A98Kc0VGB_ICB~?H25*<)FQ*Aj$65aRh zcMzSD&d$ZE=kUDq7JG;#k8b3`aIrT!!F|*B{I=!;r-=~e_RI%1M9%A?Q!QW8{w0V` za=QgqQ{S7ndRImYf>JEKAg$&cO(ts03rE;l*Wk=!eeReGcnzqFLWI z(K^iNZp(mYWa;iuvf5pYr}^jn@2tD5lSQZcN zkKc44_g{L%hxRBjJ4L~46@ghWPa@=)JRh5PP|U|FjGRS3kah~;4S^`M5dF*3#(w3#uVp@LuDD~; z1B7Yt+{IDz?R)`_JcV$VW|hJ$p}U0)j_)|GuzaNEGL$9DO2W2-dbu(Dl`5y`cWb5; z8wjiMnQ(I(87stAS#F~52#wAzAnSVz??-fMQ+zOT=@sK9$0!=Fdxp40@fT>aG$c$iT4w4w z)8o1+F}cNwF42izk{=T~!+`Pb`uIJ9@5XflaJvC(w`xF=!s(J1C+N7JtcaW#e!6PZ z#SMBFe)C)x!CneapVAOOx3O_D1qe%iIs96Ir-Qjb|0cE6evd(fv40kTd;-aU?vZG-Fb}Y5V_mS8B7K^9v^1nH$+4g2#(<%M*WUSml*jeU=zWRW&NO@ zCvIodU9U$3B$laIfp6(zw`n7o&?2%1=~d!W3WUy|`g8^6eGi0Lhsy1{YQQa;3k;{e zy4Bq-eP*F9b~;it*GT6-9@@AR7@R9#ssL{(f5@qFZ%50?sz zUD^H)!r_}8Gw*#K{;V5nc-gG>*iMc)OSNpdk-t;)F+FYLVeEPE!GM1Iwpg|1a;)lA z_R$TXP$<@-$R7a7E4W)nj^25d%H;OVNIUX|G3kuGrvqqn4s4VLjocsLh^`C*Z*99d z-H3s5N);sLEy5^NJbV!M72MYZvsxVM7^*A{K#|&%yj53c(wD2Z=HumpiRPL(Smgh{ zWIL_d+0r5%bLm32H{ag*7&9hjylC@19!*sZ_P5QMdTI2yr2bfakZSqKS_aci33#!7 zgiZ8utatW>A7Xx#@0%&eeo;%;HXiFDKJc_%oaTBw)|O6a6s>aeh%Rom|Ey^6OZKAJ zKYVk<!L{G)OwGH(I`5>%JqbNtQo`=cy~e@#$ZZ5KO`S$;gy;nn<$cG~}4Ta33(ej_WuU z`hBJB{p&DXx^Hll{(jpXYW6w|Ha1=-S{5(>px3n{!nk7GIDju&otGX(Hq~K+c-%D zr)YqoStIatH7TvFo$_y~KKR0V&?GOg%b;B=DJ3OUd|gmbd7_)_XjggB^UWat6bM$8 z*OyhAP*#bTNz9ECNyL=xFc-5|eO~E^o^YH(9%>dbj}whnuyU$#vbizaw$M$%tagpB zaa<(bHZrQA5h3!jO1$vy5SM-_G^1rnwn7UT3gznms-I9l^g}~X5hhCgwYb<)T6oHA zJJ~Dct1mG?#mzvPD_$)+jo^}Lq^;=j>QORZe-k>SVSV#8BxlspGGwE%X($P{5}MkN zXKL&1xCohm(puxvD|Y2##hHvlYioyx67Ush%2QmFeEE|sq+@Y9)bTfGH1QvHkd&O` z7iPgP?y+$N;;)F6jUZ+nCODWh&3=FPI14M=(m^pUTCrz-o{C>xu;%5C#PHU zRuG8|4qYUkDy6ukmOc8;P<+F>+ee5uzpvN$Ab9N;^ShD;5#uucA>|#N4*;yd$cdRY+OcCyR1xO#62!-9_o84GG`Ob#VzELHT`X>7-OZz1HDW(FyD zY%_0n$lTDdByNiF)nG@<@L1I(8{zZPL<)+;*(VZXG-K6#vXnp8&I-5DR@i?Y&=^Wq z9S?r|Y`WY5P*15n%xQ%v?lF#+wTwE)dFgPfQ$go)@=U343N5iqTJNtxl)Op<2DR50 z#UD*?p2>#-kZ1Qwzi15dHz?r)7KHbCEeo95RiW66uW9=)qm47n%)_I7x8Fo6UD_T+ zbLjs#Jb0&@%x=F__zwSRXiiG31QMiOC$OC+<^Dfe>`IzlGzR5BE)->wdnZUt!GUJ} z7n%9rG?a)_FK{$A_FsZx3zn%|02&czh*`=MmwRa%kMMjCw* z(jhNvW7$EcNqO4Sl}UNey{Gu005*={rnhD-<%$id-`NUbvo)u2S3aq4OuK@@!~|){ zmMKjy(=_4>Ks|>l1-KZR;M5?O;!f<_dK17zw5jta82{0}P zqiS$H2N`_wj3f4vyH?$9Rq))bCY4s~RvO9~;8qc&H2x)WDL>RPbF9Xg+UIX#dh=^H z4zz+A-~ZC0CZ!>!AM~tq=(g<7!o2+fip)j!0!-Z=PE4%;#KgpWZEJ7T(+OEMpsE-C zPtrvws;Yi-Gb51FV2rUhjA$DVE|h@R1~sSnMlGC?TW_W%UmaauS>yXd+62TUBwjTG zq_Et*QrrlI$DnX|2H_^B2e0HjbSEA51jKLCSO|_CZ9fh9 z_<3!*>@)XcA&nGQ^fvcBvKi&f*IF}O10Jc-uWkGwe(*3Dl>M09pM@N>u1nRbZhxxq zGERP8udp+fL2RSj8h2a>jed0_yF3rrQH@tgz27w}h)swWcLH&8*2CubK!3YBNTDF> zT6NHojqSK4`(Bx?81Zp+9j)h54hl}B3o#q!)16P5zI&1p#*VYwC4pNH!5&`?R|Ri& zVuTELp8d#eP~kZ1z+_xzNg`TX|2b?c@JPSy7x}L8Vf%r5c1A%r$y&xU@!7dU_qc`1 zdURKcO#vP`u>@M7LC1~<53*J;yHGg-i>(nMn(fNBo&X9~#&nbIl;d|xmqZGYpPHRH z4;gFG;aeUco~C%XP$Fzg_072#%M9Yx)Hmj&;Bob+-vur^0RKk)(tqRNdrZ)K@eq%Bej+s2c6YN= zaZj|adIWmyIv>m-Do?5198Q4kv-GBw!&s{Pbr`@>o?8?@{uymha3TH=2%9GJe?!5QSC^ebMr|Z$WF15=bMXT%m+V%Ja=9# zGkgc7VQJhFW^T#zpqi_d^L|+ z>FQ-4A1dR9*{sU=Lg2zJwn>%qoS$9D7$eIq7HeDe+0|!mIjtj9gvmnilWBII>iYUZ zeyn}qUP$TC5WeO#?pu>q+@#`894ySU`Ma zT+0;)mb?A`i-K3Al_^1aRIhh#E?i3^mR?Vu<{RSSAK%{&k5C=>JC|^AuN@r!6dBCr zCm@FD!*yBGKWhswN0q1APVqCUEw7~5Ha4Gkq*QBUp`&D1x4~;bdlQo1RdrAIB8w!m z2$}EyGD6 zY>puFku#25_P%d^PY^-8P&3P8#tH@Ogxvtilvm?tJ9I}Bh7&KB3n%es1qRYK`igj7 zr%nG*$qb5>A)~XsW}!3#!-Yjt2u$B!ekt5JC{YlnvL`f@1~+5f=H4D%qT)7xTxmSS9aPT{CKP#Jw4_9956$dvA1z*%=*Z-0K5q~OV! zz-O^pSus9skdmwP9!bp>y(#A^WntwNVm8`UI$RHxX+kT?mC7`9DKQ`W?^rU{4a|zh zSMAW1{7xgPPKA8oe#`mm1-Awx@#d7LwKh9af&OrTCI!*@Z4>fiH5<~YdYk2Xc6mTr zTS;pplR?8mZ7Ef1vDa#KRb4?SHs;WmKB@A$D$h#|HdkQ1U2|!&)q+m$KgXvA7Ys?2 zr{om_A7WSoT{cF$O@CwP`?KJTe0YZ|D*yK1&XyC__+Ht$^<*l#*{IQWROWc>N3&6F z5q^;OTip;D{;r?KQae+W|8E>J?x>}m|H792&-i$_HqsP743@2(_$KW1_@3$ki0&Xe zm^#vjFqgUc#^_>|7jtVfFgN#S*_MY>P0fg<-Dgzw3OJPXd-^b(rvYm4;h$%o)f&li{}T`!e0Qy?b|^MDM$XBa_8FkSe_Y8(py6`y*745NDms2JzlY8wsUx8` z2PYOmZ87|Ht0ZOvbAVRGL`k1f32ehMI|_$@V9(zwaAw64WBzi7S=o9a-E^Fc@Sw6f z50BemGIJbEQEFqx6(0Qq1hQQ%(F$i5i8NS@krvqw0;*7Q-7`Nx zOU{R2ytuN9zY4lk-3hm(d;Uj*cipf z_RKE_RWn|buHSqjPZkFg4AdQ<5P@St?(eHbT-kk}(d=H*iO2WZ5m9@kR0w$<)Q)Kq zOLc4))M7`c+D@1B4~kj{#*JI;2rKL!8~%LXRnAX?jAf9KvB4*P0^7;`@mgMVh4lYf za3sG-)D25}_xqm@y;YznYBfO%BjOR&mFC^w@50B4tS^igXs*?D>U}R87M*LEObkuT z^zMV@I_4D=h8g?&F{Cy5(TdIC$vZoMDb5iOo{??RfkCE0(gLT1T|)~6fsY*jPqI~; zU|%Znqd`XowhZjInLMpi_nwWA^biRdnX;&k3J=%=85!4hYouxu59Q&)m@MmlcA4cswDN2Es64#IaXRI`dNw#!m_-9p9E0FpZ zEFFZkXHCt|DM7$q9JJkwJ))#h%r&?h`g@Ew;i;x2+}lbBP?qGy?PM~j zSl85cb<=MXn46h{U8-7=P=(rN`Ko`02&T)6s>6$iTTsGqR3J8`Py;D}{-qnh_Pjk; ztg;kYM0`eI`om^2PTx_$!^i!JurEqg5#>y6&G!)VaU+;1XO6Kom&$$0wvDtpo!yd| z{5nTog3qqPhPaDHG-37nLEnolQA4poKpOhx_AG=uWjs9Ehaly$d44KekIM(8?6pt^ z57rI5+5`VnIoKf~%_l~&T_$6M<2}AnDUkhsdxlsx>~6NimV1s%yL5=YRmWAhLC_vv zEF!^dHSxI*1puvWNKjmx3Vp4gs-GtNlbJ!7SmJUfGtDRq*NynNzPwA`i&IG*P`sWO zInQ5=aMi7xrk_OmB26DfL_FN)?G_^T6u$4<(rECa5C&Rz!s!!p_&erOvmTGX#4r(k z0CuE0R!XmL9qfk#W}>Q%3t4?1ePlgt8Lt6^3LQJ01-&yw!rE-L$p9q-AoWD}diPzb zo?(XjHuE7cLrCnRrK4+in`u+xzyqR;% z@yc_LXE-t;)@WsqAQH#%$FBdIn5F4t?A+(JL8xR;<2QZDYc2xb>eS$9IYRae!)eQg z&k||~BzSw&c7`Rr1ER`uaV;wlTAaQp>>SUde!Z|&?z~Lbl^!Wa#gHpe^R)^$ z=WJZEHZxuIF}EigduHQ6oyYHVqa~=`V!CZZ#GC5dSj}^N5{zW2?od9KEK$5@KiS*X z@H^$ih;SQEWU~*aL7TD`T`c$hksl$Y5%KXN%E}2=%8zg1;Tcbh6Mr|{Lr0hEu9x)= zZN?{hqMO4bw6?j(wm;OAbUh$Ove*UCv2@4g_TZfgXCNId_`PscLqd_ht+E&{3q&0+ zHMebW*p~!4Dw(Mh7>yOMdwQDC5W0b^5RC;6g@5AEOdGb^J58B>@h=&+l2vkN%QCRM zM9NiosBv0Qv}3b_WnXY8q4XScWz8_%b?~WM&|z^|pUoiNqyYM8EfGTxAR_~j4DNgo?jR|=p-pF0 zlOD*s@^(u4;yvO5BulR`ZJ#Q7a$p9`-Gm+O|$%y3x%=x&4q^Hj68NeY~;;q zD@bc~8<~UPEym+&kb%PwRO4AR& zn`14lCzvjx)wZMUavla_mQbD}aeD=<{~%NioK4E@{|2a>?=3FJI$VC%(vf zxvF}VqLX}%WFh%bb5+Jlzhy|WP*Bb^mM$c+Fas7eElC!pHv1N$GR#%gv#R0_T5}0! zO)oAFttM6~UG;;R4tf5I&m`T|CUd&4&%>P{dE2aFj@hdK_Q?4Ei!!EGV-UENVS!1%3*$so%8v5ysoCmGaICWHVFHfkSwg;2FW2$i-{~|hZT1tE>(^U0C*|Q;x~%OH`;oF+aeHS) zb)EBz|}|y564eu9noP9jHV$TA-~p z55wD`GL6xm?KEA8{N68bwZ!yLDBlq?f z1E}?>iKU-XV`^ykmga~Di{4~jo9SO)yj@s&M$>9yhF#_UepU}18m{BQ$IqdxpFYWd zqKP7T0nMQ{g?;FoMGa@Mf)~5GAL~@qLJGdoJYH&T=xm$wrq=(oOMCAIUT(!%*`Z5% z@l}j_G|E})Y`BBa?sgFlqAU2&X!0r@=MT?Sd}TTWT@hwm?9m)fX8MvDVvlZ4&aSQv z-{e+)S0dTeypKWEs<$OLY|Ke@e9bESs;QbJm8c!oB}nSec|sbTM?;&^O@8Ey3({u? z60(=Sgej>$0+^$hK7y59M#z9yLig%-Ot43HG?_6mSM*cUuq?-wjj8IEF{jryRAyqF#<^$?YGD6SvY<=Y zQtyV1nw6D+tYmzP++kdiheoScpM|nI_x8+8{FgO2U#4evYEG^4OTT~ynp(h&c=-4{ zt`d0e^uVl%jPTFT;j%&dUG@8Ci~BnqTi^bFzYwJ+{hrg9^5e&Bx$i5sj@Gra&(fI@ zm)RegY@dHc$@dLP7U$4DPV3uqN4l$%-cghML*cLA&VI+X33GCM_iC|Q$l)s68ggcV zBGetFq_=XFC#UjgDFQ?k4GY)Vt#MbEr1wy2UzT=>ni`MbHPvaMGBr$X_g3v zBx<>_^DQF!VvYF`w?`PLkx`SDJ+;&I`aNc{YCmBpDbvPi#e=6}t7k6J^UW7M@~CIb z3+Cv$1gpoND_j!TN!5qKl^-07PSy(U7v*FKEqJB&$I7>*9JgXJzsQz$MMXKo`Km2_ zIl*fDl^S&YHJ0eP==y2;NE~`wQj7pnNtd~I%#o3imj}~`riX=w3$%tz@OBkU=KB4> zmZ;XpM@omC>Wx&3cIBj-LOsx8TP2zBnL-`RiyNs*fp417K8SU32YEo!s^1 z$FuQHmx;c&NDbkNL~Oqike9nRk3CUWVwWJEkawMgY|ANxol&KHyPc>jJFCow6?W$) z9;v`&U$sr+g=WO|6Te0(9y0O^C8CB?OgbmWY$g0v8;5kRBRH(4PO?$RkB78kEmoe> zCH@&=j^OBIY(M;F(%Z?agbqI#_Qq4uCmIiU8C_Ab2mD$IvEtvfkJQTD-Q9aMG@TVS zW@wXa3JQwcj(S-k${~Q;ruq}NC8ui`h=P&UfAE_tXY47z0H4|jbf=5#ig_=2Bz@h2 zIiyw>bH#mQMJggtR*UVTQT~KzGg@JGPfBVV`Ua-qZLJ7-@?J6Zo&A%JqQ%0{HF_Qc z7kd{t$<~%p1q1~-A;^qQck}4YrpB@Qn9(w_l5eP$Ms)XsuFO{4BGBRQI9#39^$J<@ z`ggkGRwb{9Zuib9a7y4!FD>O-3u;%Co+!6%22)QpsZ1&0f$KuD99Fce z1N9`fIq59U=k(x}rdpqknjtkSj9IL94zXX+<5H$h;BlGYg;iZ@}n8{fp*^epQlaZ@BtQN5I_l`;?w9 zkdla4moVBx>~gDqDmHVpiqQUc+BtkzYC;nP^gER)aEDR6SvW05SLnL`>NhKeN%T{XvmPb^%U`}^`Is_6`zNuh&#vGRMr!oyIxeaGVTCp$Gz zt_7Pz>`{Vub!DN+gR1^pR|$^(xI4ZIt7$H_<9RYWJ%%fN>YOgv3S+#ZK>LCbs_PV; zi+*XUlFp5sZhH=Aa^lwSB07#mh10*Y%z?DLJO-RlS{Y+aTJ~!t>Rdg6 zo0>i~2yHzJ>v6t!%aIs4Wyg8XXXDsv=L8orShT8x7u$m>m3AbjD~o=l>ny9jKGpqiDZvFlnZ!i|QPLP!q4a)P|H@f8@JA zC_|QSXqJgh#kC>{GHYnGcS4*YJYZTP)>zE`6MYG%&2oPsmBGM4mbAoRCXOlyHAQ&p z&;v2udfQLkBemL~{ZiicnBM2^+)4#LCwp_Cf(SW1_~WX_1&$oCYvL(Z>BeV4AFJG4 zX3u$wnJ1R;=b=Su@$yeY7-fg?^tbm9X`+3lL*-1h+m+;?ep;f&;K9d`(pCrvd&MO- zE&ho_uOcjs&)u&#%{8`cZ=*&5P`gxwMAy^vE@SGJIs&0o!CPZf6@f@*j^%wBq4Q5M}ykqq&|Cc+)W2RnS5hzZ)VaeKUJf@H6vBWL4!YE zIvgs@s;9{a5<49cpH@1Z6Ol??-;soergfOEo&e^TRu&fKs^v|U*vDp>Hfzq;SBbax zaa$2w(cPWzm|8%!puOxRS^V46D2=V1_~!fkIY)7`hroVx=f}rVWzV&;0+dQ#NR-BI z@T_wF@L$txiKqBz4ZJrTY;>$k#OCe*>R9i!;P>^Vx2sK`NHftX38OD;I2?_zBY8uO z4oXJ`RvH*uxg#^PC5l$7UJjC=JDsmH`uO=xG?=R`ToDi4?&dM2N210qPev|ruru?V zj*M+;6`n%p@7JoP+zmWuG{mh8i7r1ikrHmvm<>m^_8%J4YpGfW<5L?_`sUv8K3kB0 zJ#NFCZ9NTS@zvPez|3$_R9d%m)YnL@bhlw0FGtIb+HZzHd}*t3o}+ywBRd$e(QbM$ zo`SVHxdlZkG^%XzsKP9UvqzqlV>~~t$ZcRwn|V?~*vJwqb>MAxh76t#x`*y{s1il6 z;CJ2Nt*hO;3O5_&v#^`_U)Zq1>Wh>x(=u_W9SK% z*|;OMr}T^$YHN@tZQO2lX{$opgEH@oyk}AwcC>sZwr=cHhCE0!3C0#iCkr%>G@UIp zhMdk~j2Zx)1UQ1zTES=;Bq(}mi|vN=o`NxpqAe;p1A0V-*z}vBL}4`dE)>avkBGrl zZ>oqpn}}yGCTnf)w8xovJ*{69v_5|T)g#FvOI5gEQQI`~bZx*4CNjGc1$#cFiX`pY zZs=S^kK0d6+^=K$u-9u^3H*2P%ql{wl()`@W_`y zhRQ-hA7kOo*%|d}nahcd_AWTF(GJVID7@U{4pzrEDEMMS`M%rLtrp;0Ks>5{Jjw?? zK1#bgzj7Vd;+1ks1l*S>DNgU7tBM~myB_Kj-S6Qm7TqSQP&`0V88xbDo*=K;K$MLM zhQn+QwA0hO!uP6ENt`sC@q?RMG;4YFne?S9J?xg@?Th`O^thNg2cH_gw9)yl2~Jx{ z`vmZG)|4Yl!i4(hpJ?T^_)sDukTs@hBrC_^bcB%uju(SdY3555emu={^~O-N;FXMX z*8Tx$`bc_1oX78v!g67a$(f%aE^&L~-)ciu>?Ey>+^%|YCmH9HvL<_}?UC|GV%dC! zb?N~|^dHe=%%Kd%GpKo*ozG>lYz6ZU)~1jyLe!k6-W7GyBt6rwxZlu5KH0Y1=~Ek) zV#qxF(gumlJh$zFJ*aDwOrK&qA!pNO9^5##)uHo@MF~LfG$EA@#BsHFhKEPT;VTgB zfy&(n6?u6<3kNoMYcUL!m_|&mnE^c0<>{{stm?;Y_gZ)ATX!>ymf$=3LC#1$i$uJq zn?)Yp2YdGTQDWVG_B8MaH~4Pd|Au;MRZ#JjwnWQ%r`An`!Hkdw*t0bx%;HV7$MZw8 zSSq~!<--Vj<(xweM0|m&da@KR4tLlucJ-_s?w1AMMzS+LN7^?x5l!UL2ZQ@oeFy}?sX9J#3IdA287GlAIN-8Aqai9IlQK&Hphk7$zWGDT;Kp|z7n#cq1U z@UbEG7No;nTEk0WVmXSYJqiOuz-1S(v=kIAageeW5b)N<#-eFe^n~c|6hV1yZSTy^ zK~;Kt0p<-KZ)n)d5su$f!&qSX&2{f0Rh)#FLMSJUo?&jJ-8ShR*32A!sFMpzdQM&; zr_eS|h!hUw_K}4-UY|Y;_wkG)iL1BV>B?hL8L!$J-v2Tb_xX%P71lZFz|_tzTj12X z30P0ks8qVvS3fZ0Rv_y^K3=Z4LZ zR+&6oMmF<#HL}^7mbh8-weS~L>9wD9$7fbp=FD7wSIh}8N^*bT@nM)EFbiwkLTNax+Ug44hZJ!cR7i* z+-j>pW{;&i%z7L03tC{&uIecT`v0(oQ_c%C@=hu1e-KpjO~H|3!~HiBQo@NEt0OgO zA+R^k`QtJ;@<^lEZ*`_*%R|>zUbOy3hZ^qj1>XXsH|^wG>>uEr5D6_oh0p))clEm0%~xm_c5Y*BMlqc;|ycD4OPwBDU%nG053nSyylT?PxJY zAZsnRj;kQ+`O5z;aME?TW5@)dooax5bIIZf+%4myMVEL-M{2T++VnKQ4XHX{Aa|9M zG23okb?bbp+v4&yIsiTHEw<9f!5N%)w8p)&CP`^Rh*a3I8VD!egdX7-o>Nt8sNIb= z(qGI4KW~hYlkACiJbT<)v*u;pFg`Aq&f7E`k>Nzxt$(uR^-OHeLz4vLANIHYI_qfA znK*5I8b)0m*-^+?9hJIY?#jMDtj#SO!bg5+isKdthp|Ti7Z&i^ zqjJV!U}4!DOi?P9YHEzkD*;}xnJ?(MTuYFF_ye=wNNBw9;MGrioQBV9#~L(gV*5LH zVI>G~VF{h)+ws`U z%FDLWr)ir~8H;^EqCisC`*&J=>~Z|wu(1~Zq#DrOfn@tQe9-k`KEbvINVD3nf>zPY=R)k3*`_Vmc(H{f4*K z88@A8BlGU8?(O1^k#^noy%L1ipYRmEL{ypE&wk4B_2>YH8P~`y~=c)$pP8d z2cf@A@@SdizgC7$r{W)){#S>;={Hge`8DoXj=Ly!CK@d$`t_-dzc<(JOJjY%9P?#v z=!lMhRpG(#CPzxJBG)G*LW_|^$FGg2>WCbyxoA8`71DCbguOPDS#nCZy($PT|E*JR_$Ugi7%WD1hy{s`m_Ucdr zG%iCfQz01731g9ygPMj%ue0vH&!B|`pbJ2a+fni$I{nVDt(VBuGfzW~t8_Zkty&#V z;c0iH6~OG|&h7!f=i?R56v~^h49@kUB@a+hR76FGS=g!i$jp{>$o?vV_s;!Asi~88 zb+$;Q#XK)pm{XdT)P2fmg^J~S8w3ht@RDXjN902BA8^?F3r^{&4lW* zxz$tJ#pCK4dnMu+K|wZ@eY3jy1;xFLgyC-JJL$8R5H9IJ*Xr^KdUdd%98M zPgz79MkkXd6@NcG60M}u*k8Chn5i5EN=RvUTh}#Gbu4Wi7hZ zs4Wj?=0|m@D(Zg$b%FEU8Oz(9&+2C=#xkcCyk?KubAPs!Qc4RU^a^8)6Bu7(-k1QtEKUA;yVL_)7ke)t-vjV^#5jT7lisv zBj?i-fpx+5@^W_817}QBfJ6Y__1-zW6*=AcTez@TL2b;et=;$dxY9x4fYfV;>N@2z zDBj=|tj2WcAQ;CBtBg|2iYx#(*?mnT(Sc$G8N-rZbjX%Dj8MBqsBIV=7X94(;!+wJ zm+2Z;(|J4gVzDxuIlCTn{qF<{MbFFED*fkMda;rOhuyb@5g@$w{k@8Cb@*Dg-#|xF z2cU3`>ymWDymqvd`op@-$8}dT9N;=pL+xez^fV^7`%5LA=|dnUVo?#&#uEN;djQTP zs{*Bp7(p=4VC)27*g{aTI>+T!wGMO1NNe)@HeTCU!Dxlic(~g|Ey__E zm=-^iE>1HGBc>$!|^iQf48YFkelgJVVrCXE7TS zZCY!~$Q_IB>S)bbhmMMLAmv^NHbV_3Cnx!-JHBssG?|(nVK9rCS@7N-X`ds>(}TmC z*dvvnxL3F7e2#i()jr8djzgaX5bxRZ`Ua^UFUaW>+UoKVXG=fYB2~DB4I*Q>E0Oln z{Y+Y;`(C%Z)J$}tHRi6DW^bmI{w0d4ZQah*wiczTIcK~_Y;#4rJ5g&>U!p76`dIwJA-GiF&)Z>8?ZSCzpJs$59c^BvA z#u^<@5lX|OA@*a+syg4~1uyH3CMIOXS~D=KgGHsdx>L#g10=+-b+fFPd^@*|^~33C z;}4dyE(aeH7)^=Z@5)M!Q^k)G?HtbA1`Jtr_wgbNApmKG!*cZ^F zD9Eipn9-e%2By2`t-QHkz%*2*#Ups7%HXDKI5O%UUK)2yMoB)bega=Z3=iN{@=mct zzrRAzIbG6HzV1}?YPin&_Cp}Yk%jO+sB+c*Bhxi4D-5A>KcUaLfn;`Yp1h?+`5E;T3c zHzPW^m4u?80?F|0f)U<-5+XxO^cJ9?tMdAnDY>>sXDFofnpm4+T=RE$paYnV$Zvuk z(nLYkWXMTVofjJjJ4JjtabQf6U3;1beMe4CB?W(7Pcv;9^*i{4Uz8hN12Rr~r_bM2 zoccG3p@NP@mceteYFGLJnrO4%i4QT-?o{A1K~SkoZQPS`q1;4`)ZS!ga#5YPpxH|2 z^{rmg<-yP1D`1VHUowV)gZbOIk@m~C-ug!#VTgv$bymM1hpZHHo$>FqIB=|!62Kyy z(L4O3Ge7sPX0bC>LSQA-=vD2A`w=ah1TDjt-CErMxGHy<;zCZW#^U}q83BLuA=Lqt z>D;D;QMmh!7o-9YXUzbteEung9aq`+Mlz$=UjdSb&JW-=Vc z+n2eLiEU@==*sb@Lv@D2o0ifFxNJ}`yQLz)us2j2vUk2T>55_Ns0^NKEM;i2w)P4C z?{;~AS*CST%Pa?r&{|HK{&(NG74AfsMf#v|wRGDo-O;Zh@z|AXP2|h>_Fcz*rSMc) z2K5Dq^=$vs^R9p*vFY+&525yXNZ@gZ36~kvLYBwi3dXI%DzU?1Lz?w^-Na?`c2ihJ zZz1cMe6<$F!$awm?4gQqI2zS){kDP~hfC*0G(`xOv((n-?{I##`5r1a$p!Jr;lJJX zE{Rrxj?;KYe8!^_7)(ejXY|KPdKCbwhDaOFxjg*wKa@3-nF2_3dzqdxNO&5}*pG!T z0cAt9H_)Ykf=g2z)v@iZ6V}O0kjJ@>ackZCUzLT2lLa09)04P-MQJ!Px&H$$QVs-r z?EcK!!#!yCnk8l#bZ&|Ovw3klq#wE0{yJbdE*4U!ayB;#)w9_Mmnzb1j`Rl5eXk*BU6)>Y0*TcO5+jthC3Wno%y>NF0i{#5r>D?8Cfgw6!Q{j zH}@w=N_DA#zZqVc{ZZ^4jBe`*h=A*)>1SSFuy~+WYkIGpp%A zO#3S}YTq+pGKbN)FbL$uQD#r82-Mv2&U+Sa)dcRXG`sH46ga=V7KepnFVb^$aL+|D z4R2@JlnwD+fj_PvhFmUwgW%0o+MI|l!SW4ex9}_fIx&-`;%0+5EZ=Db%Np@-`O(jV zj)vP-Qmn?cfIqhZDf;WRTJQHcBSb_TI>yD-idIYGq9^MRAGzTllcKTVA5YXT>EkGz z5H*mxHR|Oh9x2K%J4-n;j(fS&LP@%e+IoZ~hFW52G;8B~1c&qWcCSA(mE89*4imcxH_={Z90fJ9bxX0Q$GZ69~R4wv|6rhsEuOs!8{QTIJ z>ZIiFqn_qfsRXeg@+01gi1s{x)(1r+d0pP%%ElgLY7bYk@Y?*mYC6bTfxnP>BHQ#+=&R+j zTF1`LRT#A_GHL15DvRY{W0^P~q%LHA~798}RdKV>&M{3W7mnywvB!~+=u zFD>T0^h0Bw{x6Pttasm1lh}g3Gb&=meM)%AlOE0^OQ+BmiO*B=8 zqtc2X?LMu$!Fah7A2!Z@Rq%)?uNVD12?SQNYL3|RWIFxK$x1ME1%zuoJ~;OHS;)ys8alY5hMui2krtB`5wYOgDP zWsfNAjn9iKaX%2SdF7?KCXo<&jU{(0apR+JD>yjI7i&!CmTCmE{vKj|jFBB;X5rmQEAabc&5u*mhtw+Yq=!Grp?E%etK7 z=HA4Zi{W=~2+?ta!mEfy%r7bj)-inDWa zDD|Cf-9Z(1c7Ati`WRH@$+^@i_;z0x?9Y_$`JSq6N+d5XB^qN3nhz{nZaU?!#v+miL#CJq zl)~+l4p<2bAXSIiQJ|z>+2oq?VKfhlxEq`K95MaObT*MTGMyiCHs_RL%-_eyVvP61 zbP4LOHsFev&d|n2jy`9r57DyZC|u~omgZf_zv8x&yGMdPTpV&Bk)8Fl*oYG*W z&-JI>(8eH;FOj`s`Zw#|1KV3HB(?J7jOP&-*Xdt#9@ac5^Q1�RTExm1?_;it{O$ zZJRF@Q6QR{LF`z8R*&M#EAt|rt7Q~&vcrmsv(Rzz!JZ6g!J`9ZV1K4YW=mioqxkLp z_P~PoZcNeTU!6~`dfZC7^0t#~TZ0x>w1<-@-Tg1+7OLvCRBR4@Nh8`?@;p~y?Br6a z8A!^1;dvd)cjczx$V-? zIMR5Cov62NmerWjY&{>iL3LEXt0BszftSHD7yC9ss9M_OW~tUaJ}>3$Xx>z?+34)o>^u5JC(_Zy39c%jg??sPG1AW}lnJW?J(~7r?)UP&j!B9_ z8XZFi7+(7OLbW4OVtn>kixFYBu2_6&`uJl3!iwWQLKNr=a>!auVef`BB~eQ6qbOfL zOw@0_^Fzk(XRHR<4yIDRqe&3I%E^nrR)W@d zC9G2b|E9V_M9w%Um$Z-x)hr&8LO(7deRoP*Qx#Sf`>QM`ap`RH1r-*Gw9|b3y9u_K zb?^HPC4+UQVnzSFcw*r+hb2Cn7okmrb$G=N&DtK_B+Avu%!TfCSwS!}u&y+Oul6QO zQHKv3v1Z$QUOFm~c_1$`*nOr~zrr&+z{xDAEC+o06cBMAdWL%Ok%J>axWk#?ZY_%k zsLk<{uA51*bDGQHP%`+t(o%>pXxYtZ!3GCC4Kxtpz&{tjrhxsF_n#h@+j<_G(7AbJ zCECIrcDz~$*p%XKg^G}?;oq{vr;iuTHzzRHIgR^ba`VNiMVH|cBG1Ej%OYD_>wK-W zm%0?-F0xIdBLjtB!3+CJYK71vS@^$>WMh2=6|r}A1KYo9xO-XK{W9$<-!dQ}hO2vA z8t8rbH|Nxo`VIBEqjLx4?W`16`+<%EKa0iv}ToT3*_21`0oGs@9)tdZ)D} z?Ml%01sRUP9gRk%!l!n{1@Vg2nEY?tTm82Q^clu#@L*lbEjh6i3atj1AIf-v+hnkB z4~XcO#EGZkmQ1D;+W$`^bA;3vIjwczAz3|v_eLm*Yvm=G`6Vm`?;Vk+dSCkJ?Typ= zdg?8X#Y(W@A7iZgXqA6smAOl%lNR*r>+89#7d6p;%KDz=I3~d3;kWi9wk!?k6ffi< zt{11A!SHI0em8m7J!-!pI4Bi%k@rsy?T%Q$(7bJaex(ZUneeBu|M)mAw43#jnVmjS z`yWdfL7PS>Nfxyjf*D39J*V1VX85NJ;IFt_hE@gin|H4iQxg|M0^@~i+IpH~{zlT( z!a)ru>WBBr9Bn(>t*&VQBGUc>?dpO5EGhW&SN!9f7h@XppV8^l< zmGq~-h6Vi=3sx*BxFt7~rc$8?|6BjNzP{c8mTjtIwF+ljGZw!PqLiZg&GRMyh@J7G zAe!M>oStUE{ZJ2to_~US@GZv*2Ri4ceX?W+GYI@G$;B|p9~4!%;>4@VAqe1ty%1t*CqD&%5L;MY4Yx_|Tm+ zh`or_tQ-Lg6D!q#`k79D1BU&>nIdJhmgY?zJCsj5z$mrQe^lZ?FLRwK;H67Y@Dw|{ zI^#e7d1JVx#3!XcD*8q3`@gI^p!2tbb)M8Kh%@W&3LY`eprD|w1?qncI!Z0*&*w#P z`)qCL+1T1jMZf&VpV0b?KmV!j>L>hSXU9@dPym%Jl5YOG7to=xWB>I9j&GqolJ)fT z5-477>HhQ0QEKhab02@e{M3XcIz9QU1|9bLtwef;sjUc+g>i7abGV>QZB$B%6hA-o zGW?0e-}eh#PscYuKiL-Y;O^9zgRBZ}K`SyZa<=wC(r6vl-;V|*+(5OJ`#p1DuKf267L4I(0~?t|0C<2%EJ{b6oP9ORT_t}|us*DE`~ z>MsfYp|P-rg~>($Qflu|^4H0n=beu&W(n#=i_=+4&L2ecp4^hh7}=)0(}e5CN1b-B zUyBKCEqneW@cWB*8r)7}+z{P(%yDMA;#_8(Tr5^#dsr%UzXE~$eib9lFele8!Zl25 zAz%12tQ1(VFt8{wu&8uKwcf11y)i!>Xo6eX+s`2*%Zu3wCPA@tql^>3Y;%SrMH>28nHbOLXVA6I)A@yc%&)mtN4lwz^wWe#> z9vkv1%EuhP`4S0vY}Pz#19tqE6dH>D&r8ZbS>t!)iQ$$EVp59_8GyH65vZFRpL}02 z&aH1HqA&J}jb=4Ju2N3CDMZQ43PwgQzPR1gc{vZ`YZlbhk&s5u%-6C<&kUdL$a*FT zr>2t?g~NUN>gL%klF?QdmkkiNTbqqe)?Bmb#b26b>HZp-pjvq;g!4tD*ycO3XfKwb zd8fp6Te>q(MEdhKR7Rw`eWuDRn|>xh^A*O~W(fz8x{dGf{zU3O(g5@!Q78d>n2{99 z?0h%Q$tpK2NJdqqZn)hOl^EVI%DpA{9$3sN`?+v(Y;G0L+>Hos60z_7!{viqj zI*js~-k45lWt(iaV}*hzc5*SSyT0}X9%9G_oE%;`r?QIt{0E8RzEVk5Lww{JeYC}Z zhPoj4ZHq2bmb!o{hfLm_M&HWaPY2ubJ16DEp&T=y(%`<%Uw8#Bbt>!h9^pa5JCfH5 zaK#@Qe=Hl?a@dBB8kno7!^t%Z)nCu{@zW#NqU);$xL^)`@y=2uZifAKjF6y5HxVy1 zoK=Ms>CbUVwd1ByL_20oYlUTRg?V4b^6ZwS3=eEf08^`>VrPKFz2L_JFHH!iSV}fZ zZ?z~*T1IB)gvDef3U%(@j%QZ0#5;ycPKm$_3}`?Ku!F3udjaUph?0h;XzJ_5
    @@ -216,7 +215,6 @@ ms.collection: highpri

    o77FP#v<@mc@Xin*8rbG=a+ zZ1TFhH7*nV@w1c?DK_hKMfWeRmW9)<)7Ve^(?1tvBqney;~4*yETGi0^JpH*N6i5e zVUGS#jbbat2Y5w`nJU|<3U<=aZARy+w>6m3V%G23xFlTO>~UB#CRY|59F|rgnVt4n z$^mh;r;AkGwFPw2U~7Y(0lz_lfAatEcf{v z(HGj$k17mZi9~b_2!|MZ=EXSEBfeTh7lwzcujlUaiIaPr&(tM=FYh;P~$0*`TSB{CIk8zrLIZCdm9X)k6 zGKhdD>ILklZ2DDXu>PSyDkM$IS;ffAj%RMv|M-S;vMYZ_`)6r1Ej`Mm&ZKT85=k=9 z6TIHc=HN6R^JzM&;B}J1mmQI`)WZ1Rc3l_hE9{E; zOoK!p68M6J>zF38I4WzTQtpgn0N%}ZEM`YT74RNKcqfw7(dxd;=6Sos%{7>|S&<(ErU$6x*JQNA&abWLYk24ez8-SSBx5H9J;`p^ z9hy6tL-YETEyGnbYX@wN%$31P{tJ)R*+Ah;I(_hLBW?n3Pq>PPS^13e#SOnE4gThr zUMAQbBhyYJ?Op2LU|#Zt>O)38EEIc64Zcos)BXr7I+}M}b5sM1%-w02-Wq%KTLvyo zpTASypMMxT_v=PQ~%6)HTRPUS$=NYb0?obqI9MkclOqt=U&>SE5_?765ZuE1-$ z>wRer5k3CeO1D;~2x=2{Je+ObyUFw4>3QlZvBBln6}iRUBkF!IgopDJ9m`2GD>FIL zVc~_CQW~rvjx_(!lxnN=WgLs>-X`fP$MDoZPICri7ygR+oK)q^5~=DH;xl>G3Gg=ORbSmpYuK zr%lo+h z=u_2JthPnS&GfgUtOKX?Wc)OT%3a7l3-1D`&#;lX47JMeM;f`3WtiI9p-Jc0@sX5o zluflNd#-9+FsZ_t2irdwNa#Q^yREKroFG-fFOm)Y9=!8uVrF4p!QRO9sNk*gcgU^8 zqC12nH>KhFlbKo6rL{G*hHBfNXh<)N5LVOt&fS;ps!Ex&UKKGYik1o^&4I_Q9Pbyg z&z7$RS5PH%RKC2|y{|tH$geF{F|3(UU3i07&t9XWB}m2Wm{)#a##Zvu!44fa{+D7_ zhV2hpa{}$rdUb@LATr#gqblX(XdL7j3fJedU{=6r_C~K;Fh~jR0SEkKoPVXdxt% zeNk=zVw6xbs{Vn|X$f=jSShBo6Sk#9=ID01V_AnxvxHejMrtrC5mx9^!Ek=M;& z*sRu0uUOn#X@ADEe`G$jqS87N-x_|+X=k+cnfSCYbZSm5(t|W|*F$D)d6=>&u>bp` zkT0(k(wli~Lz9g1bbWW%q{v>?by14+99={azlGh4`-V3w@Dhx%=PNUU2Ey3q-%ZJo zB`aSXv}5g=*@HL25b@X@)<{Ob@Gd2MIHF9v6Op}} z4HJB_=SkD14XG-y!FnOfY;$*68w}Bvz~V(FxYNsKxAo(kTvSox63ZAr#2J&G14Z@o zc}lEJ5*jQn$MktQAxAGRY$~AXli1}}PgEG*=%=EaKdE2(D_~b}L>u-$e!*hf`89{I zY*%XdxjtqjsqV`ZN3uOqIwzLHT3M^ufEQylV^{*JM6Cp(>kqF-J>e4 z_KvMA$LO?N-}#&wie`O-@^^7nipC9$%Q&pu-L7L_vgt03&Y8}A0`Z1}i!FoQ%4at= zYv&z8<*~j+JaX#zSdj`*`c1+dy{$?rCb-Z>)?$!-w!sd%16!H_KU>|R(b-j5Zgs{F zt?O)?rH-htO4O6KGg6SNtzJD_j=X@ap;yv5SYs9C=;(O!6Vh8*)t^YK{kk7*E)eGk z5<9BW=r3-2>|~K#G;#O4xsT1yF~U;tNX8pmXnj?j)%#~B#5gp8-sby6-@OerNmQ=6 z4uXrfkVEcNIEw=McADy!6EigrJD5emObntN#Rn;N#i6X7hbr$0qs8WYUqScbmnh{V z*Wyq$HHXsE{*ZJ_pFB)Soff{FjZd!RQ+BpqIYgPxn6==P>nnooyd8~y@WGe&xr7Mu z=r(gi(c$9)8UpQJpBx zORJd@h@{Gk7W{jAWCe&xZnCr0ZCJQm67(mgM`5{1qInFd4-N-u98_NV)>Wx{tfaI( z+R}kfb)B93InJkF6Y*>r8aGg%S{RCzex@Gj+0`{Jql|7J zTc3!fQB0-!Fu2qL-mO%2WF&reaj;|Kt5`qD%qy+!2s)z~(O0Mf+5?fMQ<=~z;ki=; zf;j0Tfdwis9h$Uz1lheBWcTJa?`hqxc3k$2jWQyB@m`Z2wW|l9qR$q zZPSZ!Gab$*`|0FtY|*b1cRC9*L^<$W>24rP|ubND-n*M>ifwL_&A4wV^Q3V0lWzp35-BH_vcj?aaFwlZ$r7H+yT^TzL z-sn>w-AA@nNDh@?GSq*gkIl0xgf)qk6)8@d zre^#?eB3SuBtOdwWiYJFbxF1;yC(JzqH&n&56Wo}8tIv8S7@Mm$Hj#b-svdMGcDoZ zr*99$zKUTYve%S;X{}EYi$R_?{eFH+S!I&*^IVYC*dhztMtoA|y+pm9yeu%(*F?rj zY|ho!nA+NBB&#+FyB2Dbo=nX}6pD+j8kUeNkTOe8vdU`^?un_2 z2cy`(&bn-RZ3N;^C_4(dJ`kXezIaW@gY*V#s{&9Ru_1Jd$oZj3SPh?AxQcyDl%pCj zCGwIA%zqG&Bovw7P}|As=s-Iadu~4$r&7$L#6jmGL1=NkLrDI1cVZ^Llb<8K+*#=D zO@0IR?|*#)d9A)AkI>`umSy%;wi-AIO4Z4TG9bAz#+#^fBMtlO`GmQ^lRP zRS2@>V#sc=V{Zj94W$)ki;|E7!{4me)Y=r>#=S{t#tc286_psoW@0~;f8X%wAr}_2 zcy67BKyCst0MlF!;82A}o4Rpp^EPimf@8J=n@wAn{HVD2=ayUnPbJS!_Ni)&>l_<- zg*jG#O^Ha^&u+r+cQfUjFXDrkaH~0fZlA-%6uVquSWC|J#`oI7+f?_=ev^>qCkgy= z0*3-%vexcq>M4;nNV{FmmJni;`W53@_yPosA6cP6bYZW^sD+( z;ZG5i%d$Tb$AbSP@*Y0X_hTLcx4K5TbQYHSMoOnju8ZF8R;7&$shr?4v2v_nR31<8sMOTH~i8GLp}nhDOv-Pk)f~mAMtYxdO?<$ktaQ^WiZp6OLO2`mvSo z{Sg#3%Go=%B*kO$rQpn`gH0HBH9Xw44DCfG0BZRR3Z*POpP0Bcl;>Bv+OylYK9r{y^O#!#Nbj!6nq{OK^Y$b^2F`0)U8S zy0NmukuNbqqAowVfl#UsK-n5lP$#_Q`> zT8s^^48~+5HP?eoGfDry?%paYt|e*%Y~0=5-3h^hJHaKmOK^9GV2wKgg1bx5;O_43 z1b6r8dvovo|A(1*nKf(8ntJK#K2lwKpW0eyfBBfPg~<*d^K+AFb%q9aR7;c3nSe_4`EZ#5Yh0T4mOyNX?JR_SaFZ#$kylaZ1qukNG%S z)AcoDbA6ADjP^JUb5r8#__=l^b7-6SWc+2Zkk?K}(AriaZDMJk%h#Gmk4df(u)2+} ztKI5)m9)iF@lpvDlzV<-v6se$)lS6=-F^xGeNHc)yH>iBL2pgT-w1S`G9%wXu*cz4 zPSF+$;_-9&#B{Vz*Tw5lo~ z0Lgl|&2~n(sztsm- z8?AvWBd~i*P96)Yd5OIwi3o`(IKkLTIs(AI!^{1FO{(YHX&9rx5B(E&EKH-r;{CUN zXv9O!(dDf1RKlr#@+f?$qjTxma_9)EC!gbg?P_@-ygc7lC>SY17E zvWKQy5qC5tN2ZfImNVh4^~aGBt2Ob$dOR<(mY2jPnNv8FyjZD2o5|S$t2Fm7A+?WLn5s+hfVM zP=ENo2NR4K6u81Y7+~m|tO5Vw&Ix0{*&#o}eo~h)T*Hqsi2^UX*zl&y)%m`GT(^dF zP`-!CkfEp&Q(1p;ImLiLCusE;uL2g!)zc2a>+EtG)t3w=E+3p%2C1jH>H4b*f0TE* z`EOIvXHxBudgsl!!ub=v#O{e)yL{M39rTc?vM7umJ|+jOJME33G-9&5NVJC8F7hnh z+ys+jMm+lEqtuKZ6dK17ey1wnTT*htas`Gy}W|Bn_ z;jZ*!?}<>ydGJy@I~X=~e0*b0uDilKwKC}}BMk+Wp|}6Ms6VGd8Gi&qx&X?L7iHW+ zwYIj}J3EUN&E&Ml2|HT-L4rgS6ciK@5gGNe`h9aa)7#st>RFli$9*n|EH0+q>JXpF zlZ+9(ePR|6SiiXsp#gJrVl>Azkjbu$EqIRC{BD11>le2ykcSl5T5r9^lAe9-kzzLv zA7p%7P}D|q!W}CeWP#opFEDnC314J#nyNEBN;fC%pWJo#fU|q`TtbMhT0~9v{W=x9 z&fLI6143J5t$dI-Ykc(p99*aV1SfMHZ7Z?3>@sxVx4jm3dImlo9wT9`Z9C_p=^m?( z3VChJexgHWkdvutUp6TN^MJ{Pj2N=?kzFpI-Ijj?t5&t8J~@Hhr>^1tc;RkCLMp-% z+kgfRhgyT%am;q^MBy(iu(Xrr7TD(5em?yC-w>VAT`Y{NQGY6IwVjrna0s%*{m}1x zThxI+DaWHt?`jY5Y=&OiloMb;F8s-s6U#>?>W9L=mJy-h$k);hvWeph5Ok4|Ceg4` zhZ*Cj3nC$YBqvP-GE>7RslCvwLQQsY9GOSk@(h@cYUj14v`YDaqirmel6uTUoM(_Ge_nI-_ zr4=GUCU?RzBvDq=X;4Auo2hd$f@7MG5ISI`xBwSst$Xx#A1wH{XEDFc!QaH?!LgP26&RxHm9JGPoX-Ns#)9rqc8lGYqKFgXguRe+MD#UIT)g+(R-_*) zx6NWZ8$LR%IOb^{%7q~eU45q1G;vVVXTSAnxtBqNxL#t{D!!4sl2VpWeK(ctsvTd+ zPIv{HnXzdj`M#s0x2ij?4*gbfrtC?YMI{uSF_?d;PT*n@waUmCwqA3dqHp137Hgx?EHAunS;R6{*yp6>WNs-R6@MGNRLoLGoU1Ye z7E?6%kMNpdxpI4@#ZStjhYUdZL>p8Kn;;{Z-GnTCYlz%KYT4J}TwstDwcF=v%z;ng zyrrC)cVjs8)EQxSMF^=W-(Gc#a?kImUG0ohRSt^JmTM~>WDdQ}w9_y2T0F{t* zWUN^OpAxub3ytTMsf^)zZcd}tELuJXRZg3SgoI2Xl;wf5KbHEx!o{KI{}+Krwf}#k z-o%%^uPC^?HyxhKl?W%>zs&{r(aQpgVJB2yPnY2UN#DB3(fjQBFaY%3Xc!v_m8k&5 zAv9A;c!g4H&fwA=>U5uv?~q#s`LGINYu_0K^q&hk=I~@Np5-j&*h?J`dN0Gsb(K>= zH{#o3)I}Re0^Pe<-Y?|W>5;2AlX{{G(>AF~t`Jk+ZWH8Gi1SqSaJ1@(9J4e{gBTfs zgFBtLNXQYmUy?ka7`QRF6W=GiFgzPntk7V86+fJqQ^>@yPk8B-0on&4){fWB^W|1M z-Y#uW71;QB)-y3*{Z=JxD3%4k^k^ZmhAF`wYsH%El+Az~CBvx@(Do=&|{P5)ma{{M0rs8}m=WQ81Xt-Hv zmRnFhAD}AB+wv7$s35zXAI>lzDDl1CsXi+|`G&5h#FK>q#5X46mZ4l95P0OjyC!~l zJzN)({TDC$%K=?g`?qTIKi-EQnq?bxCxMU7lJZcuKl;$EaX@HoCQO><&mDVcn6WCo zM5#B+8`y@uiYWEnG|=9GU(|o9KF6>0Wi(I=RnUNODqMm#ZGqI~(3k{~*&b!*spvno zU&(*zz9=vw{#AnsedxW>jpjlrai65q&&%#^^fxu75Fh}s6|bV&3&B!qV^g7S^WLCU zRUka3rs8Fp?FLC#WC!?iRCna>GLLF@5ajm_7^xGJMgfOB)C8O*( zA8?>KZ~f5n$&T~ndi1$nR1DPCND=^leS%sW&1$!}RfDF9imj*P1_gccaI0%T|9fK69NY9?vJAl4?Nx38$uI96MT`n}9=y>yYIc;k9a>qaO{1P>7E$SlllTNLI*p`iR9?xXvI*?-5 zMk4PCAHQw;)%mc~>(YDsBkevVen{i5*L02^68>I{u!Vh`s-o9)_m?Tr%mfp5=#DBV zTQ}{tLhLMV5*s@`WC(NY^BVCp0<3+Za;~N|7)l8A+~~%Vno|#af-MU>bMn92QA4!5 zkdr3*-v+X9&dkwZq;3OS=*=Rl6!dlvN6CE(;CqC?t#yxcg-}) z?ZjKCV^3!LG~(^8cC2m%e@W_E^}=%2a_N=g-G7+ku)g&0#zNc$qirQ{9+v~mHoCP+ zaT>tlz9+v-o8ZOxz|x8w^Xf*G*5d$qm$ZG~s2jYJ<&N{^hq~eT?MDCTxn9)%_fxey z`CfwRtG1%cT038e{R{_cdBJyCotHA0i?c%faT1}w*Zpi1kpns@l^fqUQAJnt7Y3y@ z@~TA18m|Ft4lj25t3zWp3sp3om3adzl@&;zxM8G+;$a|Ia8I0}#qkSC1mvXZ#N zCN}7-7Vr^l{;&nEkH%MxW?KPEwf0N?o_x10UKjV<{FbZ)A|6BFtCtZimztl+Y}>pz z&)To45jm}UI^J)QEx&!H66e#2{(k;Q<$D{t5c}!q^QzB1M3dRP3pbM)3UTwR>&xve zJ0z0CE)qe=!}1vIib~@<4=0NsiB&^+PsqnIrDGNNsU|N5&hsndlf^FJFRtwx{daiK z4vOCUv-H5{v-DsY1(L87;fhr%F-5%&oIaMZ0hx2P&HQWI?sTuSp0N)ShNn9y+iykR zv-N(#lJvFT+HEaxt%t{mdOREwxox+5oplDaeru;ZQJ5wf9&^`{lHr=il zp%Oc=*=G5moV7o`D^?%tuKL|))s(dN4AK0(TykyqfC&JJJcK+NOrz(!iel%+@RVO@ zR_Z?C$=?pSjTNy&qVc0tcd*OX$r`9I7F!I7R`D!ScwGp~kJylzAdS!LSM7V+9)@Dt zgYCS}C7T}CTkOL*fid41#dTp}xz75muCuxd!Ekm0o{4*-)O7;ve2$+}D8R2qaHK2Y(syW>!=U1;-pzfU*}QQ_=NTUB=HqVR{TbQtz`t7nQIw!`W??yxo}U=25% zijzW9wqj|tTcY&K3KA8sgbXkHyORirJ-qbpD{W3Gw$i&DY8o5}!rjp{nXXbkxtY|v< zdA>c&;1?~p`l^DUYEkV}$K*B$3&r*1&%0}WkAcw=BJkuc5-KTz=86ZG~ ze?SX^2uRklelCal!14<-@429)o`aS9*{FN=^591)Hd%CdRKa9nR^&)K50YA-JQIxd z;j6di8Be-H-D&WkQoPLDMeB zhM62_qROY$X1j*=9ljcm8~c~jEh9==nxXE~l$itB0x~#L`P=zy`1JEXpVkDl~DOmMw78OR!<_qp+XMF~T>zh*8!& z5Nuz&u$u19cxacDBC7ei^yvdm%LK*bBH;4i(`mKaz(r)wA`K=A*EZWA z{}8shh(aD5AYpPNh$k*Sr}4`c#`SzT==Mh)x7TMfMrtMw597bh3;Y$Y( zhNnzNW_aDBv-dzXtDrM~^}^7p^2%@_4nkWIr#vJcP5A?q=9X+Vvx90ohP0!=Nef5u zwLoyE3hd-`fk7#1w1|k#g`@7`DP#Y7tD2b=e_ibn)M32HnULtN17EiCl_rFbNcD>~ zpTbp&BE{3j04v!l_5&xO4ikD(k zd<&apH>^hU=2!o#&kYhYk;_kNy}bP^VXXKBX`35@jak^x3CLZFAMx=~n!7V(Nfq@Y zsEdf0%b+|{lvuqHuL!j-riL?U8OlU9aws;3$GQfUL=}IvW44SeiHa=Kg=a^v_6EwTpTcD<%*s^LmY@r^5@$T-hOJ#9d}b4cr*um+55ER ziYOu+V*38Yk1_!m!9`CjK;wI%ejdD%242*IOyN9fsjYNwD?yn%9~ZCWp0;Xkq3kCC zAi!bi9lmOBdcKsroP@Xs)mzq!NKKIFDLil5$w}E7wkKmMf?asO!(-H_-t07e;~Q8Omt~WKl+J&oDv+mR;VGeeBu*Wp<6Cf7w>(->5oHHJRp}L@=HXJ^1 zM(Zjgh)Ka#^J0dV4>y{NFIWU&c#;GXm(UMPqp0UN`Wbab#}z3+dl$GL))$z=`DVhx zemw2+iby6~Zv;U3=xm!>#PK*I$`kMQ<}T=q4@FbUrf9&n^aba_VZ@<5AX3RhDDC0< z`+k1Shi&k=2m`JhjCLl71n>> z@m4s@&ZzT(mcE^iEbZpK&P~QLyudiH9FE;PH*!KYA<){eY3e@X$X2IMJxZsE%Pkv< z#1LLnQ3?W9Mcz51FV|rlz8kprojr4)Af6*FQlOXRCB?fp+AqANt$H&;7rKiFimfOV zBm0D6kOZ{BbMRrj)3_c9Sl0^7^|BR{~Mgnv_`U zVDZK$P%MUsVoF}Ms(t71dnMB&4dqpEZXf{GJU#YHSnr{Wr8um|U7@UQT^$!$k1?BF zlEef3!<0JDp~&X3e!~S#7M=p@ekby)j{Eu-FJ*Syd;6I^Co6sdk{if7SLg2litCl% zbd!rP+vPK%xfW~Wi31@K-&9Hvn7q)!Y zs~t7=TV?J>>(>u;ywN!np}vQ^p}fZM@~`7eDaA`bp2l~`+TW`&W?4Si9q((R4|_yz zTS*hpn^$(35rm;iYoe3Kn-!W-MZ~RGPW!I}RWCLIzSm{i7rii^I?j*vDXfDbnCiss z9(zbqYj@OV8BQp~@B4z)7kvYl+1!F8$xv~%?^mrDG*L$}?$%J5KJLtV9;Rf!*WL;E zZmrq07-95!6vj?rd`{&VJskwrH6HBB*XDsYY&e@CcF_Zpeos)o4hwlH_g4h&dvku9 zQnvH_rw%b}i0si)Jl-yhrr2(X-ld!TR@ewyS39PrXa8l>2H|qwneZ4A$-PXfh zhi39Z4RiUnadoUK8H1xg-I^S&gFbv9;=IP8nXl#kuvv}25)bRiAffL};rqUl)qS^A z=6=%!!@8gKF8nH8v=#D$xohwZnacfpBsQAr#QZ$(xtMdxC;dZ6zwo z#50EPT}DlHnTx6NPJZs?V7+O0ryqx7?VJ!_1we&nx682BAkCe`<`zlHrFrt_y(r&X z(X+z@|NYk7yLHcK%UN%Qxi4!b7(R4_9aA=kXv0D}w?5FovaN@_c^NR-!EW|Z}z3I$56WP&{>zF zFK00wB7*lY?k{dA+v{d}y_M}d4yQzdor_@d4z5%bA({6ot3ET0O7G(;P5S9EZm!~& zQCY8$`!P)ZU-%vHE07@+UIl*Zu%oZ6yW^wqKdF~j+I~~Z3dZ9a@3*siWA0|q@87xd zUcWbcxvsF>9czLt+I3?6mq!J3baYFC(=WFR`UB}aP6myB#Mm-3StY&GR?j7ZM2rEk z3m^zkRmh{mYJ8Mo1~G5*iy(uayqnd|P0dWb{lNdZKsgsH}$gJqm+IZ-J!T>Y#^t7 zo{89JPf;;Q&|SEnXfFy6om!lx|7L)Y&Wx~ZbV->jOv2ZW%2<+GT^!)Zjwd;JE>1ej zsi$8y*K<_eW6d3jd}$PF&P}T4hl*xe-GS|?vSM{)j{za}&5HFnGArk*wdG>;1aH#A z82*OsSZEC6j|!aqND5%g;`Urz7ClCbuSiBS%7bNAHEhB=-XUw_i6lc z+#`Fhpadxi-o#)89D27eKlr^GV5g$>TUFK63i({S7$&<6~y!~Jg&-~iHQBA(6em9L;4glISsp3w&KWzEC4N{oOi1U$U$6eDfV z=Hm-=Kzux~x|>cf;wp`OW(z&QeE_nv%Xzzvr`Jj)b0q007}7s~YDg^TNnmDXi-RC% z3V#!`s)8Sk)B*{+DRF-cbAJUoLxSN><`XICH(A#y37gwx&|D|h-7l~TDB1&IU@>U&h*BV3G4R>#2ku36Jb;J_9qz$fV0L~!x1o&DA-X@v#EeeD5P*x7rA{h)*Q>(u?I5X1X`SH%-3sXuaeo%(M*q&Ub>51wpre^F)NbBq*t zoiVsSu=tquLeTYZvg8^Uv`~RXA7Kr$l<~VgE&u+^UsJ8Bx@~g)!O`Ti@R^ z0ew?q>H7atcgi7ImKrT)pu;(Cr3L)I=;DB;jSW+S?OHgKc7wO!QoGNmR=p~%>jT!m z2?3&obNUx`b>oRl{!krydiu%5#o~EBURm&e=1XMe;o-rWDtn{=EpFC%mkt;ml`U}dS6gw(`Sjm3)`CX%M3j`!B%%q!&?qEG zsi?%)ra%5S$`Q3m9PCk?SjLKO=FjBV;L2Q zUi=DHRt&@*yJ)hh>`))Rjw;G@EN}Nk)Hv>ae$$o)oe*j>6i=m5V+8eeA`_|N?m;({ zg@HkZ7)1(vG)pi`-x3HcR*ww>qyi4C(S?{_8skAkKvrkO4%DkU&y@C0OT%}G0-du@ zz+oQyldw{^#gz`>ugA?SKR@4Kxy}L_TSK}A=Lifjj_~TWe z-J<`;!T-N>(?BSu`OVR}x#WM52ehpHWPo;YT^i_YHRv*cq1O%iL-!dgunOpEy!uI? zLaPy1X3)=wR#!D7CUL z9<#@{N6F&}HuNi;#4!vJz4=1-*)xaPbC!l2_%Xa&J%0uxii?H4Y1^XITilcsB@Hk@ zJUHf{SI;_phyda;qg%B&RxMDnk}Uw~9;p{2@eABKx8ef~Nl_KC_cX`{`O<_Env<!Rl)nmA;V4sd@0eD=J(p!Hxri|mF`JbL>uhPR+=dOEUW|I>@&vV9A;02 zOd1|jH%ch| z5fR(;ShTdYsP&N5{LEoG)}j5wg>Rl1pDDBmP!D z86`Fdq2NS;kB^V6^P&`FOk}3^{TMEYk2t7XDd^75lEqHQ$x3J`rX3p2K@Wq>U2KKJ z)tttTH1f=Ac<=Nv_k!yI4SAp!-$fohOat>$3OBAvL-6Yi0VQfoKPrX|wcuKtq1rzR z03;6K{F^~h=(rzdMx!ZgSu84rhNFS!#%HCL^@Y0_0dKCY{Kv?xZ`0(hx-cKnNJqHB zu0A+iuhlw?w<=SEwiT_&NY6dj*Mr} zauFy*9v<7Qa8Cv?OzVy03)xCW4d4~`UMClT#DL@Ift~e2y@f)XwTSLYdJKAKi=e>A zCUFcz#?NRNfEoHD@RcU0TawhRd+*}iE~`qnSfiRTJJR_HYUlPUe^m9w%tWA7(Dplx zH1uFdlllS&DTr^fEeCiLE43nz;spDPRmOY9ihg(H@2ekGqDitJ39k)Q<+%?@yp(Z6 zVc7j5Qg<^iJC`L2=*r1}rQYGjUI;tHm8OnE^gx|IKxHlLo}LAokizOe^D}q2;_nH( zXyp-W{iEgO4Z=_r?>WOaN(ZhdkOq7@+F{j48O0hFXWzsZ4dez=j`e!?L?t#uh*)y+ zdHpK{T=G66Qx*G}VPjj*ZTVgsr?_;XjxyGjXqQ;2k}WpF*$JeD1_Xb&{7$uCs8xvN zGgqN(Ye?3wYY%oc`t{=Eo^VKv5X_CAL+jHCPtO!hBiQ7l;(|FUi2z!9*=@1aLFKRC zY0tARCT1gop?|ATeOqx;++(Y}CSN1^@_yU5TOE1U#wth|H>*ouN)*9XOT?$8NGT<* zMrjeVx=#IH*g2&})+bJ6(@gj`3UCI;xqCn!L|{?SWmhS0&D0ZaS?D0YE3QC>gdCL42WrlNeFEtjdI zt)sH(ii2m2P;V)=Q^00Vtwm^e#W@beO-(-@9UV<=+KP!vvG}HPRMU%kyqMd-_AHDB~UVU3%CsBl;5W*zuzzXZ3DxZ-*%o z=>Ov8tW($~?bIT`P7VHu22mtaK0?)HW`9@R2!`w?s9GIKCa5m*}BC(|pil*1RThosoX!mZr z?FNO2Sg$ToTHRN)&-)v|p+|| z3tQGal)~#31`8`Gw^Fbb!3#T$1qBacj0JZ3G3xtbmlq=h)%IVKyhV-}(R2pV?sB@* zLyCvOtuHTS3Qar7$!{W;@i|85m!q?|vtZW=YJTw`G^}27zrS2NOo^+o=2Ri4x@aq| zCkly5&3_Ne_MC;TU&N#Bw3r$18%>>Y=;EPJ+FXma7v*=YJK&`RH&L|r;iJnjfMdgzb=p@$Qe!y;Su>9qF9{n=;uJ1+v4GyW4uVNeF z9qjuXGHJ`g(XE6D5HOo;gidu;=177_C;(lQ?gfwDH&Wer^TGNGe2PU7k%%mB2|Qvf zm{%XLKB+GETogR64;znq>bRJ&PWrQ!RacHj@+n(%sWDZ=_HAjn3mri{|D4oidA zBiCdG^(-SQ0APbZjUyN+|3)4>OJD|fB`BwpIB<4dv{p08KSTvmqhX!WhoYJr1omu+ zWwl$_FOIR|Gfp06NI4xEuu^X!(2$nW$q>}U3?T+C4s2hN(&_zBu$C3`f$ak*bO)&Z zAf}U0qBcX}7bf`ekC|3er$t0~$O8nX{48t+Gek2Wh`#fI8eVse}|Mek%BHmM2# zN5u2OFVyEI3cG)gu%WW5wrte@#ZPn%&>gX^q3BBrE4Adp_j!BwiD)Y(SzpdrtiR*u zdtUwEZh5wGxr$(y-Q-BnFw2#rJ?1R6T(eBcoy9IL&%%aUtJNh9-vE6-v9^3>`j3}8|7b)hU55QoH0lm1%;9jApdatMBMI3tj6(#;y}ntAFYa; zv4s1+jDPT%L5V&bITaQduGr#C{F`|>{Jc#N+fSe(;qz)jY|WN)|#jHVkj9l?8>#Niyk>Btclt=17JSCKQYMif;2)LS)f$;^Nm`JwItW4G-JH!fmlLSDH~_Wk8@9-JQ*y9-SV6*=;-fGg>*S!8$Uuo{H%@pVIkzHg*v8f3|lYf@4F~la%jJc zEYuaE9OQP^*Ds26FC`r?|68nMVmN@8#8Ng@O76QT^lYDn?T;kA3i(iB=q-UNbA5`| z=r>$GXV?%Nr$5r67w|S&RlG5ANhaXa&o35do*8|JZ5G3Gl ztZA$G8jKPtyQ8o8nrFcq=aN36xNN4|{nf>1qAGbOk9mP>wtUq%{vw5t&QcCqea47y zg%Wj~5$sWVhZfm#;rh`SO*sC&f4t~h9W97W+~99<*pYZ07$l5ZVOR`;J+>Y)Y^Eg= zx0!MpuUYEVl?_nZ2!#gjrN}D~@nPYYrDG*7Hr zWOEsW4r~xFc5V{8$h>GEEteDKa3Yn!#4?;cn8I!Iqw59ccnl)WQk>oAkd^CIEr`Ve zpC=bL1Bh+`EJO($RTQ=GRi*b^ucAoMtXy}|}}=Vp?02_dX9Io=5? zEf~hv0_unwAwX*`Zw*e4@0+~}zt)S58?!yH*jmtu$E0gdHwM<9z}oE2o_ss;j9)u! zReA@OhWDqhk$8a)MtC27tERhd$+=ftuyF5}eyZMWW*e+)*dW@BunwMKJ@{tj(DI0P zqRoNxeZrGKo8K|S;|Lzwin?E?5znKbWdvEn{H~x<>gZ1SY$~N$eFVc&w>?SHCIl=pI&~HK|-Y2%vwPdocUj$ zQ0E?$c90ox?p>-QNI8*~79*E+87|J^QL0UbJWt?LvPpR00@)GmQ~lj_LYjGU8&E1Q z@G(K#lg^nQVfz@|NZH*9*`aTGNQ;We6VPBJZ}4lXs300lP!9v(n`)m#ccdg6($z^T zoguk%4*zu|A`%q-vWjjx%8L<=eQYon6l8LZprp<3B@kgt1yu9;R^b; zYET<&_YS4-z7j?r?u!VgwK53(FcE>NnE!TyMiKYpdz5vJblF_EajGHqzz7~E8Vwe< z(Gk!(|DbNN3-bj|n8tM|;hzB-4U=ISLsFy0S|mx?1qG}vVNQ_8X~ zS=-+_bTekE;3$yhgpp02h!0};Q`^x_6H@2nC2V^Wb>sj*F+B^GyeW6F(=YlPoN5v( z%E~|A`7yDuO053ksaWXU1w2cp_PONY1T^W)u+rq(8iWkN0-JO= zYj?GAab~4ts3|JP^KuKByx(?^`iQ#;v@&2V?pPrAkCFVgjZ5y1;#ut=&2Qav6)R9k z@{bv;=8}nZcfGoZl26*n0HnyP75Y)(Bv7OJQ5AqlXZ+?@k~NYEP~X2m zL=g zyr~{d?wMX`DqFOBSIAeGnlX*?=HE*}X(x8)F`>Kc09=PB``vKB#(cvTYWd_3M@9E1 zDMZ4QC`P5LxqvEJLXFrobzql@nL&TB3ag>J{w`iTFf2PQTW2zVSU6k=*Y4y{WXntC1I9v<64v?5C5MKyF_?e6(kA zw8N8j8o(cN7OO;hA~8xZeVfW>Z{c)NU`q?zINRp zXit`r0^k#YH~{@rbH`M{`6tuv+t}K^~OFaB_pE(-dk8m&B4XR z5I`LY4MM-BP2>mQ6A(;IPG;A|fPygSV4%P*H2V@o3|5#}q9iqVbIjeQKDFmAIbM{+ zo|6X$2Nf07v-YpzVkzCf^QpXbv9Napfp9Ozfg}M^glQ(=Uv-s#O_%RqY}@8&_9DpT zQ0ibq$e-JF{}s}g)iME+_j1Qzn7OXKte(~!vAk5 zel=RmZct72xvc-m3)Yx`cb>YI3I56Zf&?8%$`J!r8to)aO$)T9fBRE*b`gaANkbm= zlJ5f+TRlF|54&}pTLn+0mD+;+#dT?yj6Y`pJz0@q{#OS5-!7K_JB+8=bi4!s%Qyhk Nq{ZdMDn$&w{U21U=mG!$ literal 0 HcmV?d00001 diff --git a/windows/deployment/update/wufb-wsus.md b/windows/deployment/update/wufb-wsus.md new file mode 100644 index 0000000000..e03715c193 --- /dev/null +++ b/windows/deployment/update/wufb-wsus.md @@ -0,0 +1,78 @@ +--- +title: Use Windows Update for Business (WUfB) and Windows Server Update Services (WSUS) together +description: Learn how to use Windows Update for Business and WSUS together. +ms.prod: w10 +ms.mktglfcycl: manage +author: arcarley +ms.localizationpriority: medium +audience: itpro +ms.author: arcarley +ms.collection: + - m365initiative-coredeploy + - highpri +manager: dougeby +ms.topic: article +--- + +# Use Windows Update for Business and WSUS together + +**Applies to** + +- Windows 10 +- Windows 11 + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +The Windows update scan source policy enables you to choose what types of updates to get from either [WSUS](waas-manage-updates-wsus.md) or Windows Update for Business (WUfB) service. + +We added the scan source policy starting with the [September 1, 2021—KB5005101 (OS Builds 19041.1202, 19042.1202, and 19043.1202) Preview](https://support.microsoft.com/help/5005101) update and it applies to Window 10, version 2004 and above and Windows 11. This policy changes the way devices determine whether to scan against a local WSUS server or Windows Update service. + +> [!IMPORTANT] +> The policy **Do not allow update deferral policies to cause scans against Windows Update**, also known as Dual Scan, is no longer supported on Windows 11 and on Windows 10 it is replaced by the new Windows scan source policy and is not recommended for use. If you configure both on Windows 10, you will not get updates from Windows Update. + +## About the scan source policy + +The specify scan source policy enables you to specify whether your device gets the following Windows update types form WSUS **or** from Windows Update: + +- Feature updates +- Windows quality updates +- Driver and firmware updates +- Updates for other Microsoft products + +We recommend using this policy on your transition from fully on-premises managed environment to a cloud supported one. Whether you move only drivers to the cloud today or drivers and quality updates and then later move your other workloads, taking a step-by-step approach might ease the transition. + +## Default scan behavior + +To help you better understand the scan source policy, see the default scan behavior below and how we can change it: + +- If no policies are configured: All of your updates will come from Windows Update. +- If you configure only the WSUS server policy: + + - On Windows 10: All of your updates will come from WSUS; + - On Windows 11: All of your updates will still come from Windows Update unless you configure the specify scan source policy. + +- If you configure a WSUS server and deferral policies: All of your updates will come from Windows Update unless you specify the scan source policy. +- If you configure a WSUS server and the scan source policy: All of your updates will come from the source chosen in the scan source policy. + +>[!NOTE] +>The only two policies relevant in terms of where your updates come from are the specify scan source policy and whether or not you have configured a WSUS server, this should simplify the configuration options. + +## Configure the scan sources + +The policy can be configured using: + +1. Group Policy: Specify source service for specific classes of Windows Updates + +- Path: Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage updates offered from Windows Server Update Service\ + +:::image type="content" source="media/specify-update-type-sources.png" alt-text="Screenshot of the Group Policy for specifiying sources for update types"::: + +2. Configuration Service Provider (CSP) Policies: **SetPolicyDrivenUpdateSourceFor[]**: + +>[!NOTE] +>You should configure **all** of these if you are using CSPs. + +- [Update/SetPolicyDrivenUpdateSourceForDriverUpdates](../../client-management/mdm/policy-csp-update.md#update-setpolicydrivenupdatesourcefordriverupdates) +- [Update/SetPolicyDrivenUpdateSourceForFeatureUpdates](../../client-management/mdm/policy-csp-update.md#update-setpolicydrivenupdatesourceforfeatureupdates) +- [Update/SetPolicyDrivenUpdateSourceForOtherUpdates](../../client-management/mdm/policy-csp-update.md#update-setpolicydrivenupdatesourceforotherupdates) +- [Update/SetPolicyDrivenUpdateSourceForQualityUpdates](../../client-management/mdm/policy-csp-update.md#update-setpolicydrivenupdatesourceforqualityupdates) From 85785e6d4ff933b1dbc85cdf58faedfeffd300aa Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 9 Dec 2021 09:03:03 -0800 Subject: [PATCH 0121/1077] minor formatting edits --- windows/deployment/update/wufb-wsus.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/deployment/update/wufb-wsus.md b/windows/deployment/update/wufb-wsus.md index e03715c193..7e6b3fd10b 100644 --- a/windows/deployment/update/wufb-wsus.md +++ b/windows/deployment/update/wufb-wsus.md @@ -54,23 +54,23 @@ To help you better understand the scan source policy, see the default scan behav - If you configure a WSUS server and deferral policies: All of your updates will come from Windows Update unless you specify the scan source policy. - If you configure a WSUS server and the scan source policy: All of your updates will come from the source chosen in the scan source policy. ->[!NOTE] ->The only two policies relevant in terms of where your updates come from are the specify scan source policy and whether or not you have configured a WSUS server, this should simplify the configuration options. +> [!TIP] +> The only two relevant policies for where your updates come from are the specify scan source policy and whether or not you have configured a WSUS server. This should simplify the configuration options. ## Configure the scan sources -The policy can be configured using: +The policy can be configured using the following two methods: 1. Group Policy: Specify source service for specific classes of Windows Updates - Path: Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage updates offered from Windows Server Update Service\ -:::image type="content" source="media/specify-update-type-sources.png" alt-text="Screenshot of the Group Policy for specifiying sources for update types"::: + :::image type="content" source="media/specify-update-type-sources.png" alt-text="Screenshot of the Group Policy for specifiying sources for update types"::: -2. Configuration Service Provider (CSP) Policies: **SetPolicyDrivenUpdateSourceFor[]**: +1. Configuration Service Provider (CSP) Policies: **SetPolicyDrivenUpdateSourceFor[]**: ->[!NOTE] ->You should configure **all** of these if you are using CSPs. +> [!NOTE] +> You should configure **all** of these policies if you are using CSPs. - [Update/SetPolicyDrivenUpdateSourceForDriverUpdates](../../client-management/mdm/policy-csp-update.md#update-setpolicydrivenupdatesourcefordriverupdates) - [Update/SetPolicyDrivenUpdateSourceForFeatureUpdates](../../client-management/mdm/policy-csp-update.md#update-setpolicydrivenupdatesourceforfeatureupdates) From 75a028e5dea9f142bdd7a7bd89f583e6813d0aba Mon Sep 17 00:00:00 2001 From: Andrei-George Stoica <5600871+andreiztm@users.noreply.github.com> Date: Thu, 9 Dec 2021 22:36:16 +0200 Subject: [PATCH 0122/1077] Corrected ordered list --- windows/deployment/update/wufb-wsus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/wufb-wsus.md b/windows/deployment/update/wufb-wsus.md index 7e6b3fd10b..0f2676efb4 100644 --- a/windows/deployment/update/wufb-wsus.md +++ b/windows/deployment/update/wufb-wsus.md @@ -1,6 +1,6 @@ --- title: Use Windows Update for Business (WUfB) and Windows Server Update Services (WSUS) together -description: Learn how to use Windows Update for Business and WSUS together. +description: Learn how to use Windows Update for Business and WSUS together using the new scan source policy. ms.prod: w10 ms.mktglfcycl: manage author: arcarley @@ -67,7 +67,7 @@ The policy can be configured using the following two methods: :::image type="content" source="media/specify-update-type-sources.png" alt-text="Screenshot of the Group Policy for specifiying sources for update types"::: -1. Configuration Service Provider (CSP) Policies: **SetPolicyDrivenUpdateSourceFor[]**: +2. Configuration Service Provider (CSP) Policies: **SetPolicyDrivenUpdateSourceFor[]**: > [!NOTE] > You should configure **all** of these policies if you are using CSPs. From f15adac8ab06abaebd516a460283b7d867b88a06 Mon Sep 17 00:00:00 2001 From: Andrei-George Stoica <5600871+andreiztm@users.noreply.github.com> Date: Fri, 10 Dec 2021 00:59:05 +0200 Subject: [PATCH 0123/1077] Updating AllowMUService policy disabled option and a lot of formatting improvements/acrolinx --- .../mdm/policy-csp-update.md | 1016 +++++++++-------- 1 file changed, 538 insertions(+), 478 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index ec5de9aacf..0c612b064a 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -15,7 +15,6 @@ ms.collection: highpri # Policy CSP - Update -

    • -
    @@ -245,10 +243,10 @@ ms.collection: highpri -Allows the IT admin (when used with **Update/ActiveHoursStart**) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12 hour maximum from start time. +Allows the IT admin (when used with **Update/ActiveHoursStart**) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12-hour maximum from start time. > [!NOTE] -> The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See **Update/ActiveHoursMaxRange** below for more information. +> The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. For more information, see **Update/ActiveHoursMaxRange** below. Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. @@ -256,12 +254,13 @@ The default is 17 (5 PM). -ADMX Info: -- GP Friendly name: *Turn off auto-restart for updates during active hours* -- GP name: *ActiveHours* -- GP element: *ActiveHoursEndTime* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Turn off auto-restart for updates during active hours* +* GP name: *ActiveHours* +* GP element: *ActiveHoursEndTime* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* @@ -302,12 +301,13 @@ The default value is 18 (hours). -ADMX Info: -- GP Friendly name: *Specify active hours range for auto-restarts* -- GP name: *ActiveHoursMaxRange* -- GP element: *ActiveHoursMaxRange* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Specify active hours range for auto-restarts* +* GP name: *ActiveHoursMaxRange* +* GP element: *ActiveHoursMaxRange* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* @@ -340,10 +340,10 @@ ADMX Info: -Allows the IT admin (when used with **Update/ActiveHoursEnd**) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12 hour maximum from end time. +Allows the IT admin (when used with **Update/ActiveHoursEnd**) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12-hour maximum from end time. > [!NOTE] -> The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See **Update/ActiveHoursMaxRange** above for more information. +> The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. For more information, see **Update/ActiveHoursMaxRange** above. Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. @@ -351,12 +351,13 @@ The default value is 8 (8 AM). -ADMX Info: -- GP Friendly name: *Turn off auto-restart for updates during active hours* -- GP name: *ActiveHours* -- GP element: *ActiveHoursStartTime* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Turn off auto-restart for updates during active hours* +* GP name: *ActiveHours* +* GP element: *ActiveHoursStartTime* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* @@ -398,28 +399,27 @@ If the policy is not configured, end-users get the default behavior (Auto instal ADMX Info: -- GP Friendly name: *Configure Automatic Updates* -- GP name: *AutoUpdateCfg* -- GP element: *AutoUpdateMode* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* + +* GP Friendly name: *Configure Automatic Updates* +* GP name: *AutoUpdateCfg* +* GP element: *AutoUpdateMode* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 0 – Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end-users to manage data usage. With this option users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel. -- 1 – Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end-user is prompted to schedule the restart time. The end-user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end-user to control the start time reduces the risk of accidental data loss caused by applications that do not shutdown properly on restart. -- 2 (default) – Auto install and restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This is the default behavior for unmanaged devices. Devices are updated quickly, but it increases the risk of accidental data loss caused by an application that does not shutdown properly on restart. -- 3 – Auto install and restart at a specified time. The IT specifies the installation day and time. If no day and time are specified, the default is 3 AM daily. Automatic installation happens at this time and device restart happens after a 15-minute countdown. If the user is logged in when Windows is ready to restart, the user can interrupt the 15-minute countdown to delay the restart. -- 4 – Auto install and restart without end-user control. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This setting option also sets the end-user control panel to read-only. -- 5 – Turn off automatic updates. - +* 0 – Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end users to manage data usage. With these option users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel. +* 1 – Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end user is prompted to schedule the restart time. The end user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end user to control the start time reduces the risk of accidental data loss caused by applications that do not shut down properly on restart. +* 2 (default) – Auto install and restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This is the default behavior for unmanaged devices. Devices are updated quickly, but it increases the risk of accidental data loss caused by an application that does not shut down properly on restart. +* 3 – Auto install and restart at a specified time. The IT specifies the installation day and time. If no day and time are specified, the default is 3 AM daily. Automatic installation happens at this time and device restart happens after a 15-minute countdown. If the user is logged in when Windows is ready to restart, the user can interrupt the 15-minute countdown to delay the restart. +* 4 – Auto install and restart without end-user control. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This setting option also sets the end-user control panel to read-only. +* 5 – Turn off automatic updates. > [!IMPORTANT] > This option should be used only for systems under regulatory compliance, as you will not get security updates as well. - @@ -459,18 +459,19 @@ This policy is accessible through the Update setting in the user interface or Gr -ADMX Info: -- GP Friendly name: *Allow updates to be downloaded automatically over metered connections* -- GP name: *AllowAutoWindowsUpdateDownloadOverMeteredNetwork* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Allow updates to be downloaded automatically over metered connections* +* GP name: *AllowAutoWindowsUpdateDownloadOverMeteredNetwork* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 0 (default) - Not allowed -- 1 - Allowed +* 0 (default) - Not allowed +* 1 - Allowed @@ -508,18 +509,19 @@ Allows the IT admin to manage whether to scan for app updates from Microsoft Upd ADMX Info: -- GP Friendly name: *Configure Automatic Updates* -- GP name: *AutoUpdateCfg* -- GP element: *AllowMUUpdateServiceId* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* + +* GP Friendly name: *Configure Automatic Updates* +* GP name: *AutoUpdateCfg* +* GP element: *AllowMUUpdateServiceId* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 0 – Not allowed or not configured. -- 1 – Allowed. Accepts updates received through Microsoft Update. +* 0 – Not configured. +* 1 – Allowed. Accepts updates received through Microsoft Update. @@ -552,18 +554,18 @@ The following list shows the supported values: -Allows the IT admin to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. This policy supports using WSUS for 3rd party software and patch distribution. +Allows the IT admin to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. This policy supports using WSUS for third-party software and patch distribution. Supported operations are Get and Replace. -This policy is specific to desktop and local publishing via WSUS for 3rd party updates (binaries and updates not hosted on Microsoft Update) and allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. +This policy is specific to desktop and local publishing via WSUS for third-party updates (binaries and updates not hosted on Microsoft Update) and allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. The following list shows the supported values: -- 0 – Not allowed or not configured. Updates from an intranet Microsoft update service location must be signed by Microsoft. -- 1 – Allowed. Accepts updates received through an intranet Microsoft update service location, if they are signed by a certificate found in the "Trusted Publishers" certificate store of the local computer. +* 0 – Not allowed or not configured. Updates from an intranet Microsoft update service location must be signed by Microsoft. +* 1 – Allowed. Accepts updates received through an intranet Microsoft update service location, if they are signed by a certificate found in the "Trusted Publishers" certificate store of the local computer. @@ -603,22 +605,23 @@ Even when Windows Update is configured to receive updates from an intranet updat Enabling this policy will disable that functionality, and may cause connection to public services such as the Microsoft Store to stop working. > [!NOTE] -> This policy applies only when the desktop or device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. +> This policy applies only when the desktop or device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. -ADMX Info: -- GP Friendly name: *Specify intranet Microsoft update service location* -- GP name: *CorpWuURL* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Specify intranet Microsoft update service location* +* GP name: *CorpWuURL* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 0 – Update service is not allowed. -- 1 (default) – Update service is allowed. +* 0 – Update service is not allowed. +* 1 (default) – Update service is allowed. @@ -655,28 +658,30 @@ For Quality Updates, this policy specifies the deadline in days before automatic The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks. -Value type is integer. Default is 7 days. +Value type is integer. Default is seven days. Supported values range: 2-30. -Note that the PC must restart for certain updates to take effect. +The PC must restart for certain updates to take effect. If you enable this policy, a restart will automatically occur the specified number of days after the restart was scheduled. If you disable or do not configure this policy, the PC will restart according to the default schedule. If any of the following two policies are enabled, this policy has no effect: + 1. No auto-restart with logged on users for scheduled automatic updates installations. 2. Always automatically restart at scheduled time. -ADMX Info: -- GP Friendly name: *Specify deadline before auto-restart for update installation* -- GP name: *AutoRestartDeadline* -- GP element: *AutoRestartDeadline* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Specify deadline before auto-restart for update installation* +* GP name: *AutoRestartDeadline* +* GP element: *AutoRestartDeadline* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* @@ -713,28 +718,30 @@ For Feature Updates, this policy specifies the deadline in days before automatic The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks. -Value type is integer. Default is 7 days. +Value type is integer. Default is seven days. Supported values range: 2-30. -Note that the PC must restart for certain updates to take effect. +The PC must restart for certain updates to take effect. If you enable this policy, a restart will automatically occur the specified number of days after the restart was scheduled. If you disable or do not configure this policy, the PC will restart according to the default schedule. If any of the following two policies are enabled, this policy has no effect: + 1. No auto-restart with logged on users for scheduled automatic updates installations. 2. Always automatically restart at scheduled time. -ADMX Info: -- GP Friendly name: *Specify deadline before auto-restart for update installation* -- GP name: *AutoRestartDeadline* -- GP element: *AutoRestartDeadlineForFeatureUpdates* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Specify deadline before auto-restart for update installation* +* GP name: *AutoRestartDeadline* +* GP element: *AutoRestartDeadlineForFeatureUpdates* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* @@ -773,12 +780,13 @@ The default value is 15 (minutes). -ADMX Info: -- GP Friendly name: *Configure auto-restart reminder notifications for updates* -- GP name: *AutoRestartNotificationConfig* -- GP element: *AutoRestartNotificationSchd* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Configure auto-restart reminder notifications for updates* +* GP name: *AutoRestartNotificationConfig* +* GP element: *AutoRestartNotificationSchd* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* @@ -819,19 +827,20 @@ Allows the IT Admin to specify the method by which the auto-restart required not -ADMX Info: -- GP Friendly name: *Configure auto-restart required notification for updates* -- GP name: *AutoRestartRequiredNotificationDismissal* -- GP element: *AutoRestartRequiredNotificationDismissal* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Configure auto-restart required notification for updates* +* GP name: *AutoRestartRequiredNotificationDismissal* +* GP element: *AutoRestartRequiredNotificationDismissal* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 1 (default) – Auto Dismissal. -- 2 – User Dismissal. +* 1 (default) – Auto Dismissal. +* 2 – User Dismissal. @@ -869,22 +878,24 @@ This policy setting allows you to configure if Automatic Maintenance should make > [!Note] > If the OS power wake policy is explicitly disabled, then this setting has no effect. -If you enable this policy setting, Automatic Maintenance attempts to set OS wake policy and make a wake request for the daily scheduled time, if required. +If you enable this policy setting, Automatic Maintenance attempts to set OS wake policy and make a wake request for the daily scheduled time, if necessary. If you disable or do not configure this policy setting, the wake setting as specified in Security and Maintenance/Automatic Maintenance Control Panel applies. -ADMX Info: -- GP Friendly name: *Automatic Maintenance WakeUp Policy* -- GP name: *WakeUpPolicy* -- GP path: *Windows Components/Maintenance Scheduler* -- GP ADMX file name: *msched.admx* +ADMX Info: + +* GP Friendly name: *Automatic Maintenance WakeUp Policy* +* GP name: *WakeUpPolicy* +* GP path: *Windows Components/Maintenance Scheduler* +* GP ADMX file name: *msched.admx* -Supported values: -- 0 - Disable -- 1 - Enable (Default) +Supported values: + +* 0 - Disable +* 1 - Enable (Default) @@ -926,22 +937,23 @@ Allows the IT admin to set which branch a device receives their updates from. As -ADMX Info: -- GP Friendly name: *Select when Preview Builds and Feature Updates are received* -- GP name: *DeferFeatureUpdates* -- GP element: *BranchReadinessLevelId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Select when Preview Builds and Feature Updates are received* +* GP name: *DeferFeatureUpdates* +* GP element: *BranchReadinessLevelId* +* GP path: *Windows Components/Windows Update/Windows Update for Business* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 2 {0x2} - Windows Insider build - Fast (added in Windows 10, version 1709) -- 4 {0x4} - Windows Insider build - Slow (added in Windows 10, version 1709) -- 8 {0x8} - Release Windows Insider build (added in Windows 10, version 1709) -- 16 {0x10} - (default) Semi-annual Channel (Targeted). Device gets all applicable feature updates from Semi-annual Channel (Targeted). -- 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel. (*Only applicable to releases prior to 1903, for all releases 1903 and after the Semi-annual Channel and Semi-annual Channel (Targeted) into a single Semi-annual Channel with a value of 16) +* 2 {0x2} - Windows Insider build - Fast (added in Windows 10, version 1709) +* 4 {0x4} - Windows Insider build - Slow (added in Windows 10, version 1709) +* 8 {0x8} - Release Windows Insider build (added in Windows 10, version 1709) +* 16 {0x10} - (default) Semi-annual Channel (Targeted). Device gets all applicable feature updates from Semi-annual Channel (Targeted). +* 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel. (*Only applicable to releases prior to 1903, for all releases 1903 and after the Semi-annual Channel and Semi-annual Channel (Targeted) into a single Semi-annual Channel with a value of 16) @@ -978,12 +990,13 @@ The following list shows the supported values: Allows IT admins to specify the number of days a user has before feature updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule. -ADMX Info: -- GP Friendly name: *Specify deadlines for automatic updates and restarts* -- GP name: *ConfigureDeadlineForFeatureUpdates* -- GP element: *ConfigureDeadlineForFeatureUpdates* -- GP path: *Administrative Templates\Windows Components\WindowsUpdate* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Specify deadlines for automatic updates and restarts* +* GP name: *ConfigureDeadlineForFeatureUpdates* +* GP element: *ConfigureDeadlineForFeatureUpdates* +* GP path: *Administrative Templates\Windows Components\WindowsUpdate* +* GP ADMX file name: *WindowsUpdate.admx* @@ -1031,12 +1044,13 @@ Default value is 7. Allows IT admins to specify the number of days a user has before quality updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule. -ADMX Info: -- GP Friendly name: *Specify deadlines for automatic updates and restarts* -- GP name: *ConfigureDeadlineForQualityUpdates* -- GP element: *ConfigureDeadlineForQualityUpdates* -- GP path: *Administrative Templates\Windows Components\WindowsUpdate* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Specify deadlines for automatic updates and restarts* +* GP name: *ConfigureDeadlineForQualityUpdates* +* GP element: *ConfigureDeadlineForQualityUpdates* +* GP path: *Administrative Templates\Windows Components\WindowsUpdate* +* GP ADMX file name: *WindowsUpdate.admx* @@ -1085,12 +1099,13 @@ Allows the IT admin (when used with [Update/ConfigureDeadlineForFeatureUpdates]( -ADMX Info: -- GP Friendly name: *Specify deadlines for automatic updates and restarts* -- GP name: *ConfigureDeadlineGracePeriod* -- GP element: *ConfigureDeadlineGracePeriod* -- GP path: *Administrative Templates\Windows Components\WindowsUpdate* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Specify deadlines for automatic updates and restarts* +* GP name: *ConfigureDeadlineGracePeriod* +* GP element: *ConfigureDeadlineGracePeriod* +* GP path: *Administrative Templates\Windows Components\WindowsUpdate* +* GP ADMX file name: *WindowsUpdate.admx* @@ -1140,18 +1155,20 @@ If enabled (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-c When disabled, if the device has installed the required updates and is outside of active hours, it may attempt an automatic restart before the deadline. -ADMX Info: -- GP Friendly name: *Specify deadlines for automatic updates and restarts* -- GP name: *ConfigureDeadlineNoAutoReboot* -- GP element: *ConfigureDeadlineNoAutoReboot* -- GP path: *Administrative Templates\Windows Components\WindowsUpdate* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Specify deadlines for automatic updates and restarts* +* GP name: *ConfigureDeadlineNoAutoReboot* +* GP element: *ConfigureDeadlineNoAutoReboot* +* GP path: *Administrative Templates\Windows Components\WindowsUpdate* +* GP ADMX file name: *WindowsUpdate.admx* -Supported values: -- 1 - Enabled -- 0 (default) - Disabled +Supported values: + +* 1 - Enabled +* 0 (default) - Disabled @@ -1222,23 +1239,24 @@ Enable IT admin to configure feature update uninstall period. Values range 2 - 6 -Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. +Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. Defers Feature Updates for the specified number of days. Supported values are 0-365 days. > [!IMPORTANT] -> The default maximum number of days to defer an update has been increased from 180 (Windows 10, version 1607) to 365 in Windows 10, version 1703. +> The default maximum number of days to defer an update has been increased from 180 (Windows 10, version 1607) to 365 in Windows 10, version 1703. -ADMX Info: -- GP Friendly name: *Select when Preview Builds and Feature Updates are received* -- GP name: *DeferFeatureUpdates* -- GP element: *DeferFeatureUpdatesPeriodId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Select when Preview Builds and Feature Updates are received* +* GP name: *DeferFeatureUpdates* +* GP element: *DeferFeatureUpdatesPeriodId* +* GP path: *Windows Components/Windows Update/Windows Update for Business* +* GP ADMX file name: *WindowsUpdate.admx* @@ -1277,12 +1295,13 @@ Supported values are 0-30. -ADMX Info: -- GP Friendly name: *Select when Quality Updates are received* -- GP name: *DeferQualityUpdates* -- GP element: *DeferQualityUpdatesPeriodId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Select when Quality Updates are received* +* GP name: *DeferQualityUpdates* +* GP element: *DeferQualityUpdatesPeriodId* +* GP path: *Windows Components/Windows Update/Windows Update for Business* +* GP ADMX file name: *WindowsUpdate.admx* @@ -1316,10 +1335,9 @@ ADMX Info: > [!NOTE] -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpdatePeriod for Windows 10, version 1511 devices. +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpdatePeriod for Windows 10, version 1511 devices. - -Allows IT Admins to specify update delays for up to 4 weeks. +Allows IT Admins to specify update delays for up to four weeks. Supported values are 0-4, which refers to the number of weeks to defer updates. @@ -1328,39 +1346,41 @@ If the "Specify intranet Microsoft update service location" policy is enabled, t If the Allow Telemetry policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. OS upgrade: -- Maximum deferral: 8 months -- Deferral increment: 1 month -- Update type/notes: - - Upgrade - 3689BDC8-B205-4AF4-8D4A-A63924C5E9D5 + +* Maximum deferral: Eight months +* Deferral increment: One month +* Update type/notes: + * Upgrade - 3689BDC8-B205-4AF4-8D4A-A63924C5E9D5 Update: -- Maximum deferral: 1 month -- Deferral increment: 1 week -- Update type/notes: If a machine has Microsoft Update enabled, any Microsoft Updates in these categories will also observe Defer / Pause logic: - - - Security Update - 0FA1201D-4330-4FA8-8AE9-B877473B6441 - - Critical Update - E6CF1350-C01B-414D-A61F-263D14D133B4 - - Update Rollup - 28BC880E-0592-4CBF-8F95-C79B17911D5F - - Service Pack - 68C5B0A3-D1A6-4553-AE49-01D3A7827828 - - Tools - B4832BD8-E735-4761-8DAF-37F882276DAB - - Feature Pack - B54E7D24-7ADD-428F-8B75-90A396FA584F - - Update - CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83 - - Driver - EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0 + +* Maximum deferral: One month +* Deferral increment: One week +* Update type/notes: If a machine has Microsoft Update enabled, any Microsoft Updates in these categories will also observe Defer / Pause logic: + * Security Update - 0FA1201D-4330-4FA8-8AE9-B877473B6441 + * Critical Update - E6CF1350-C01B-414D-A61F-263D14D133B4 + * Update Rollup - 28BC880E-0592-4CBF-8F95-C79B17911D5F + * Service Pack - 68C5B0A3-D1A6-4553-AE49-01D3A7827828 + * Tools - B4832BD8-E735-4761-8DAF-37F882276DAB + * Feature Pack - B54E7D24-7ADD-428F-8B75-90A396FA584F + * Update - CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83 + * Driver - EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0 Other/cannot defer: -- Maximum deferral: No deferral -- Deferral increment: No deferral -- Update type/notes: - Any update category not specifically enumerated above falls into this category. +* Maximum deferral: No deferral +* Deferral increment: No deferral +* Update type/notes: + Any update category not enumerated above falls into this category. - Definition Update - E0789628-CE08-4437-BE74-2495B842F43B -ADMX Info: -- GP name: *DeferUpgrade* -- GP element: *DeferUpdatePeriodId* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP name: *DeferUpgrade* +* GP element: *DeferUpdatePeriodId* +* GP ADMX file name: *WindowsUpdate.admx* @@ -1394,12 +1414,11 @@ ADMX Info: > [!NOTE] -> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. +> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. > -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices. +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices. - -Allows IT Admins to specify additional upgrade delays for up to 8 months. +Allows IT Admins to specify more upgrade delays for up to eight months. Supported values are 0-8, which refers to the number of months to defer upgrades. @@ -1409,10 +1428,11 @@ If the "Allow Telemetry" policy is enabled and the Options value is set to 0, th -ADMX Info: -- GP name: *DeferUpgrade* -- GP element: *DeferUpgradePeriodId* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP name: *DeferUpgrade* +* GP element: *DeferUpgradePeriodId* +* GP ADMX file name: *WindowsUpdate.admx* @@ -1445,16 +1465,17 @@ ADMX Info: -Specifies the scan frequency from every 1 - 22 hours with a random variant of 0 - 4 hours. Default is 22 hours. This policy should only be enabled when Update/UpdateServiceUrl is configured to point the device at a WSUS server rather than Microsoft Update. +Specifies the scan frequency from every 1 - 22 hours with a random variant of 0 - 4 hours. Default is 22 hours. This policy should be enabled when Update/UpdateServiceUrl is configured to point the device at a WSUS server rather than Microsoft Update. -ADMX Info: -- GP Friendly name: *Automatic Updates detection frequency* -- GP name: *DetectionFrequency_Title* -- GP element: *DetectionFrequency_Hour2* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Automatic Updates detection frequency* +* GP name: *DetectionFrequency_Title* +* GP element: *DetectionFrequency_Hour2* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* @@ -1497,18 +1518,19 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. -ADMX Info: -- GP Friendly name: *Do not allow update deferral policies to cause scans against Windows Update* -- GP name: *DisableDualScan* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Do not allow update deferral policies to cause scans against Windows Update* +* GP name: *DisableDualScan* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 0 - allow scan against Windows Update -- 1 - do not allow update deferral policies to cause scans against Windows Update +* 0 - allow scan against Windows Update +* 1 - do not allow update deferral policies to cause scans against Windows Update @@ -1552,24 +1574,25 @@ IT admins can, if necessary, opt devices out of safeguard protections using this > [!NOTE] > Opting out of the safeguards can put devices at risk from known performance issues. We recommend opting out only in an IT environment for validation purposes. Further, you can leverage the Windows Insider Program for Business Release Preview Channel in order to validate the upcoming Windows 10 Feature Update version without the safeguards being applied. > -> The disable safeguards policy will revert to “Not Configured” on a device after moving to a new Windows 10 version, even if previously enabled. This ensures the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update. +> The disable safeguards policy will revert to “Not Configured” on a device after moving to a new Windows 10 version, even if previously enabled. This ensures the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update. > > Disabling safeguards does not guarantee your device will be able to successfully update. The update may still fail on the device and will likely result in a bad experience post upgrade as you are bypassing the protection given by Microsoft pertaining to known issues. -ADMX Info: -- GP Friendly name: *Disable safeguards for Feature Updates* -- GP name: *DisableWUfBSafeguards* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Disable safeguards for Feature Updates* +* GP name: *DisableWUfBSafeguards* +* GP path: *Windows Components/Windows Update/Windows Update for Business* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 0 (default) - Safeguards are enabled and devices may be blocked for upgrades until the safeguard is cleared. -- 1 - Safeguards are not enabled and upgrades will be deployed without blocking on safeguards. +* 0 (default) - Safeguards are enabled and devices may be blocked for upgrades until the safeguard is cleared. +* 1 - Safeguards are not enabled and upgrades will be deployed without blocking on safeguards. @@ -1602,7 +1625,7 @@ The following list shows the supported values: -For Quality Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period. +For Quality Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically execute, within the specified period. The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks. @@ -1613,23 +1636,25 @@ Value type is integer. Default is 14. Supported value range: 2 - 30. -If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (e.g. pending user scheduling). +If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (for example, pending user scheduling). If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect: + 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time 3. Specify deadline before auto-restart for update installation -ADMX Info: -- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -- GP name: *EngagedRestartTransitionSchedule* -- GP element: *EngagedRestartDeadline* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* +* GP name: *EngagedRestartTransitionSchedule* +* GP element: *EngagedRestartDeadline* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* @@ -1662,29 +1687,31 @@ ADMX Info: -For Feature Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period. +For Feature Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically execute, within the specified period. Value type is integer. Default is 14. Supported value range: 2 - 30. -If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (e.g. pending user scheduling). +If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (for example, pending user scheduling). If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect: + 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time 3. Specify deadline before auto-restart for update installation -ADMX Info: -- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -- GP name: *EngagedRestartTransitionSchedule* -- GP element: *EngagedRestartDeadlineForFeatureUpdates* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* +* GP name: *EngagedRestartTransitionSchedule* +* GP element: *EngagedRestartDeadlineForFeatureUpdates* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* @@ -1719,25 +1746,27 @@ ADMX Info: For Quality Updates, this policy specifies the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days. -Value type is integer. Default is 3 days. +Value type is integer. Default is three days. -Supported value range: 1 - 3. +Supported value range: 1-3. If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect: + 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time 3. Specify deadline before auto-restart for update installation -ADMX Info: -- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -- GP name: *EngagedRestartTransitionSchedule* -- GP element: *EngagedRestartSnoozeSchedule* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* +* GP name: *EngagedRestartTransitionSchedule* +* GP element: *EngagedRestartSnoozeSchedule* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* @@ -1770,27 +1799,29 @@ ADMX Info: -For Feature Updates, this policy specifies the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days. +For Feature Updates, this policy specifies the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between one and three days. -Value type is integer. Default is 3 days. +Value type is integer. Default is three days. Supported value range: 1 - 3. If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect: + 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time 3. Specify deadline before auto-restart for update installation -ADMX Info: -- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -- GP name: *EngagedRestartTransitionSchedule* -- GP element: *EngagedRestartSnoozeScheduleForFeatureUpdates* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* +* GP name: *EngagedRestartTransitionSchedule* +* GP element: *EngagedRestartSnoozeScheduleForFeatureUpdates* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* @@ -1825,25 +1856,27 @@ ADMX Info: For Quality Updates, this policy specifies the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending. -Value type is integer. Default value is 7 days. +Value type is integer. Default value is seven days. -Supported value range: 2 - 30. +Supported value range: 2 - 30. If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect: + 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time 3. Specify deadline before auto-restart for update installation -ADMX Info: -- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -- GP name: *EngagedRestartTransitionSchedule* -- GP element: *EngagedRestartTransitionSchedule* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* +* GP name: *EngagedRestartTransitionSchedule* +* GP element: *EngagedRestartTransitionSchedule* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* @@ -1878,25 +1911,27 @@ ADMX Info: For Feature Updates, this policy specifies the timing before transitioning from Auto restarts scheduled_outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending. -Value type is integer. Default value is 7 days. +Value type is integer. Default value is seven days. Supported value range: 2 - 30. If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect: + 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time 3. Specify deadline before auto-restart for update installation -ADMX Info: -- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -- GP name: *EngagedRestartTransitionSchedule* -- GP element: *EngagedRestartTransitionScheduleForFeatureUpdates* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* +* GP name: *EngagedRestartTransitionSchedule* +* GP element: *EngagedRestartTransitionScheduleForFeatureUpdates* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* @@ -1930,24 +1965,25 @@ ADMX Info: > [!NOTE] -> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. +> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. Allows IT Admins to exclude Windows Update (WU) drivers during updates. -ADMX Info: -- GP Friendly name: *Do not include drivers with Windows Updates* -- GP name: *ExcludeWUDriversInQualityUpdate* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Do not include drivers with Windows Updates* +* GP name: *ExcludeWUDriversInQualityUpdate* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 0 (default) – Allow Windows Update drivers. -- 1 – Exclude Windows Update drivers. +* 0 (default) – Allow Windows Update drivers. +* 1 – Exclude Windows Update drivers. @@ -1987,19 +2023,20 @@ Allows Windows Update Agent to determine the download URL when it is missing fro -ADMX Info: -- GP Friendly name: *Specify intranet Microsoft update service location* -- GP name: *CorpWuURL* -- GP element: *CorpWUFillEmptyContentUrls* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Specify intranet Microsoft update service location* +* GP name: *CorpWuURL* +* GP element: *CorpWUFillEmptyContentUrls* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 0 (default) – Disabled. -- 1 – Enabled. +* 0 (default) – Disabled. +* 1 – Enabled. @@ -2032,7 +2069,7 @@ The following list shows the supported values: -Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. +Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. > [!WARNING] > Setting this policy might cause devices to incur costs from MO operators. @@ -2041,15 +2078,16 @@ Specifies whether to ignore the MO download limit (allow unlimited downloading) The following list shows the supported values: -- 0 (default) – Do not ignore MO download limit for apps and their updates. -- 1 – Ignore MO download limit (allow unlimited downloading) for apps and their updates. +* 0 (default) – Do not ignore MO download limit for apps and their updates. +* 1 – Ignore MO download limit (allow unlimited downloading) for apps and their updates. To validate this policy: -1. Enable the policy and ensure the device is on a cellular network. -2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: +1. Enable the policy and ensure the device is on a cellular network. +2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: + ```TShell exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' ``` @@ -2085,7 +2123,7 @@ To validate this policy: -Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. +Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. > [!WARNING] > Setting this policy might cause devices to incur costs from MO operators. @@ -2094,15 +2132,16 @@ Specifies whether to ignore the MO download limit (allow unlimited downloading) The following list shows the supported values: -- 0 (default) – Do not ignore MO download limit for OS updates. -- 1 – Ignore MO download limit (allow unlimited downloading) for OS updates. +* 0 (default) – Do not ignore MO download limit for OS updates. +* 1 – Ignore MO download limit (allow unlimited downloading) for OS updates. To validate this policy: -1. Enable the policy and ensure the device is on a cellular network. -2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: +1. Enable the policy and ensure the device is on a cellular network. +2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: + ```TShell exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' ``` @@ -2142,20 +2181,21 @@ Used to manage Windows 10 Insider Preview builds. Value type is integer. -ADMX Info: -- GP Friendly name: *Manage preview builds* -- GP name: *ManagePreviewBuilds* -- GP element: *ManagePreviewBuildsId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Manage preview builds* +* GP name: *ManagePreviewBuilds* +* GP element: *ManagePreviewBuildsId* +* GP path: *Windows Components/Windows Update/Windows Update for Business* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 0 - Disable Preview builds -- 1 - Disable Preview builds once the next release is public -- 2 - Enable Preview builds +* 0 - Disable Preview builds +* 1 - Disable Preview builds once the next release is public +* 2 - Enable Preview builds @@ -2189,11 +2229,9 @@ The following list shows the supported values: > [!NOTE] -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use PauseDeferrals for Windows 10, version 1511 devices. - - -Allows IT Admins to pause updates and upgrades for up to 5 weeks. Paused deferrals will be reset after 5 weeks. +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use PauseDeferrals for Windows 10, version 1511 devices. +Allows IT Admins to pause updates and upgrades for up to five weeks. Paused deferrals will be reset after five weeks. If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. @@ -2201,17 +2239,18 @@ If the "Allow Telemetry" policy is enabled and the Options value is set to 0, th -ADMX Info: -- GP name: *DeferUpgrade* -- GP element: *PauseDeferralsId* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP name: *DeferUpgrade* +* GP element: *PauseDeferralsId* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 0 (default) – Deferrals are not paused. -- 1 – Deferrals are paused. +* 0 (default) – Deferrals are not paused. +* 1 – Deferrals are paused. @@ -2244,26 +2283,26 @@ The following list shows the supported values: -Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. - +Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. Allows IT Admins to pause feature updates for up to 35 days. We recomment that you use the *Update/PauseFeatureUpdatesStartTime* policy if you are running Windows 10, version 1703 or later. -ADMX Info: -- GP Friendly name: *Select when Preview Builds and Feature Updates are received* -- GP name: *DeferFeatureUpdates* -- GP element: *PauseFeatureUpdatesId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Select when Preview Builds and Feature Updates are received* +* GP name: *DeferFeatureUpdates* +* GP element: *PauseFeatureUpdatesId* +* GP path: *Windows Components/Windows Update/Windows Update for Business* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 0 (default) – Feature Updates are not paused. -- 1 – Feature Updates are paused for 35 days or until value set to back to 0, whichever is sooner. +* 0 (default) – Feature Updates are not paused. +* 1 – Feature Updates are paused for 35 days or until value set to back to 0, whichever is sooner. @@ -2296,18 +2335,19 @@ The following list shows the supported values: -Specifies the date and time when the IT admin wants to start pausing the Feature Updates. When this policy is configured, Feature Updates will be paused for 35 days from the specified start date. +Specifies the date and time when the IT admin wants to start pausing the Feature Updates. When this policy is configured, Feature Updates will be paused for 35 days from the specified start date. -Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, Get, Delete, and Replace. +Value type is string (yyyy-mm-dd). Supported operations are Add, Get, Delete, and Replace. -ADMX Info: -- GP Friendly name: *Select when Preview Builds and Feature Updates are received* -- GP name: *DeferFeatureUpdates* -- GP element: *PauseFeatureUpdatesStartId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Select when Preview Builds and Feature Updates are received* +* GP name: *DeferFeatureUpdates* +* GP element: *PauseFeatureUpdatesStartId* +* GP path: *Windows Components/Windows Update/Windows Update for Business* +* GP ADMX file name: *WindowsUpdate.admx* @@ -2344,19 +2384,20 @@ Allows IT Admins to pause quality updates. For those running Windows 10, version -ADMX Info: -- GP Friendly name: *Select when Quality Updates are received* -- GP name: *DeferQualityUpdates* -- GP element: *PauseQualityUpdatesId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Select when Quality Updates are received* +* GP name: *DeferQualityUpdates* +* GP element: *PauseQualityUpdatesId* +* GP path: *Windows Components/Windows Update/Windows Update for Business* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 0 (default) – Quality Updates are not paused. -- 1 – Quality Updates are paused for 35 days or until value set back to 0, whichever is sooner. +* 0 (default) – Quality Updates are not paused. +* 1 – Quality Updates are paused for 35 days or until value set back to 0, whichever is sooner. @@ -2389,18 +2430,19 @@ The following list shows the supported values: -Specifies the date and time when the IT admin wants to start pausing the Quality Updates. When this policy is configured, Quality Updates will be paused for 35 days from the specified start date. +Specifies the date and time when the IT admin wants to start pausing the Quality Updates. When this policy is configured, Quality Updates will be paused for 35 days from the specified start date. -Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, Get, Delete, and Replace. +Value type is string (yyyy-mm-dd). Supported operations are Add, Get, Delete, and Replace. -ADMX Info: -- GP Friendly name: *Select when Quality Updates are received* -- GP name: *DeferQualityUpdates* -- GP element: *PauseQualityUpdatesStartId* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Select when Quality Updates are received* +* GP name: *DeferQualityUpdates* +* GP element: *PauseQualityUpdatesStartId* +* GP path: *Windows Components/Windows Update/Windows Update for Business* +* GP ADMX file name: *WindowsUpdate.admx* @@ -2468,18 +2510,19 @@ This policy is deprecated. Use [Update/RequireUpdateApproval](#update-requireupd -Available in Windows 10, version 2004 and later. Enables IT administrators to specify which product they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy to target a new product. +Available in Windows 10, version 2004 and later. Enables IT administrators to specify which product they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy to target a new product. If no product is specified, the device will continue receiving newer versions of the Windows product it is currently on. For details about different Windows 10 versions, see [release information](/windows/release-health/release-information). -ADMX Info: -- GP Friendly name: *Select the target Feature Update version* -- GP name: *TargetReleaseVersion* -- GP element: *ProductVersion* -- GP path: *Windows Components/Windows Update/Windows Update for Business* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Select the target Feature Update version* +* GP name: *TargetReleaseVersion* +* GP element: *ProductVersion* +* GP path: *Windows Components/Windows Update/Windows Update for Business* +* GP ADMX file name: *WindowsUpdate.admx* @@ -2527,24 +2570,24 @@ By using this Windows Update for Business policy to upgrade devices to a new pro > [!NOTE] -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. - +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. Allows the IT admin to set a device to Semi-Annual Channel train. -ADMX Info: -- GP name: *DeferUpgrade* -- GP element: *DeferUpgradePeriodId* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP name: *DeferUpgrade* +* GP element: *DeferUpgradePeriodId* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 0 (default) – User gets upgrades from Semi-Annual Channel (Targeted). -- 1 – User gets upgrades from Semi-Annual Channel. +* 0 (default) – User gets upgrades from Semi-Annual Channel (Targeted). +* 1 – User gets upgrades from Semi-Annual Channel. @@ -2578,10 +2621,9 @@ The following list shows the supported values: > [!NOTE] -> This policy is *only* recommended for managing mobile devices. If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. +> This policy is *only* recommended for managing mobile devices. If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. - -Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved. +Allows the IT admin to restrict the updates that are installed on a device to only those updates on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end user. EULAs are approved once an update is approved. Supported operations are Get and Replace. @@ -2589,8 +2631,8 @@ Supported operations are Get and Replace. The following list shows the supported values: -- 0 – Not configured. The device installs all applicable updates. -- 1 – The device only installs updates that are both applicable and on the Approved Updates list. Set this policy to 1 if IT wants to control the deployment of updates on devices, such as when testing is required prior to deployment. +* 0 – Not configured. The device installs all applicable updates. +* 1 – The device only installs updates that are both applicable and on the Approved Updates list. Set this policy to 1 if IT wants to control the deployment of updates on devices, such as when testing is required prior to deployment. @@ -2629,12 +2671,13 @@ The default value is 15 (minutes). -ADMX Info: -- GP Friendly name: *Configure auto-restart warning notifications schedule for updates* -- GP name: *RestartWarnRemind* -- GP element: *RestartWarn* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Configure auto-restart warning notifications schedule for updates* +* GP name: *RestartWarnRemind* +* GP element: *RestartWarn* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* @@ -2672,7 +2715,7 @@ Supported values are 15, 30, or 60 (minutes). > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education Allows the IT Admin to specify the period for auto-restart warning reminder notifications. @@ -2681,12 +2724,13 @@ The default value is 4 (hours). -ADMX Info: -- GP Friendly name: *Configure auto-restart warning notifications schedule for updates* -- GP name: *RestartWarnRemind* -- GP element: *RestartWarnRemind* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Configure auto-restart warning notifications schedule for updates* +* GP name: *RestartWarnRemind* +* GP element: *RestartWarnRemind* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* @@ -2731,25 +2775,26 @@ Supported operations are Add, Delete, Get, and Replace. -ADMX Info: -- GP Friendly name: *Configure Automatic Updates* -- GP name: *AutoUpdateCfg* -- GP element: *AutoUpdateSchDay* -- GP path: *Windows Components/Windows Update* -- GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: + +* GP Friendly name: *Configure Automatic Updates* +* GP name: *AutoUpdateCfg* +* GP element: *AutoUpdateSchDay* +* GP path: *Windows Components/Windows Update* +* GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -- 0 (default) – Every day -- 1 – Sunday -- 2 – Monday -- 3 – Tuesday -- 4 – Wednesday -- 5 – Thursday -- 6 – Friday -- 7 – Saturday +* 0 (default) – Every day +* 1 – Sunday +* 2 – Monday +* 3 – Tuesday +* 4 – Wednesday +* 5 – Thursday +* 6 – Friday +* 7 – Saturday @@ -2782,7 +2827,7 @@ The following list shows the supported values: -Enables the IT admin to schedule the update installation on the every week. Value type is integer. Supported values: +Enables the IT admin to schedule the update installation on every week. Value type is integer. Supported values:
    +### EAP policies + +
    +
    + EAP/AllowTLS1_3 +
    +
    + ### Education policies
    diff --git a/windows/client-management/mdm/policy-csp-eap.md b/windows/client-management/mdm/policy-csp-eap.md new file mode 100644 index 0000000000..08c0a773c6 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-eap.md @@ -0,0 +1,83 @@ +--- +title: Policy CSP - EAP +description: Learn how to use the Policy CSP - Education setting to control graphing functionality in the Windows Calculator app. +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: dansimp +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - EAP + + +
    + + +## EAP policies + +
    +
    + EAP/AllowTLS1_3 +
    +
    + + +
    + + +**EAP/AllowTLS1_3<** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting is added in Windows 10, version 21H1. Allow or disallow use of TLS 1.3 during EAP client authentication. + + + +ADMX Info: +- GP Friendly name: *AllowTLS1_3* +- GP name: *AllowTLS1_3* +- GP path: *Windows Components/EAP* +- GP ADMX file name: *EAP.admx* + + + +The following list shows the supported values: +- 0 – Use of TLS version 1.3 is not allowed for authentication. + +- 1 (default) – Use of TLS version 1.3 is allowed for authentication. + + + + +
    + + + + diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 87673ea6e7..e0698232a0 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -701,6 +701,8 @@ items: href: policy-csp-display.md - name: DmaGuard href: policy-csp-dmaguard.md + - name: EAP + href: policy-csp-eap.md - name: Education href: policy-csp-education.md - name: EnterpriseCloudPrint From b55a211f6f61c494201b4dabd9a26dcba4ce79eb Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Tue, 4 Jan 2022 02:11:59 +0530 Subject: [PATCH 0177/1077] Update policy-csp-experience.md --- .../mdm/policy-csp-experience.md | 77 +++++++++++++++++++ 1 file changed, 77 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index e4e0453c5f..cb785576ec 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -40,9 +40,15 @@ manager: dansimp
    Experience/AllowSaveAsOfOfficeFiles
    +
    + Experience/AllowScreenCapture +
    Experience/AllowSharingOfOfficeFiles
    +
    + Experience/AllowSIMErrorDialogPromptWhenNoSIM +
    Experience/AllowSyncMySettings
    @@ -362,6 +368,43 @@ This policy is deprecated.
    + +**Experience/AllowScreenCapture** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + + + + + +Describe what value are supported in by this policy and meaning of each value is default value. + + + + +
    + **Experience/AllowSharingOfOfficeFiles** @@ -371,6 +414,40 @@ This policy is deprecated. + +**Experience/AllowSIMErrorDialogPromptWhenNoSIM** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + + + + +Describes what value are supported in by this policy and meaning of each value is default value. + + + +
    From 3d578d806a94657b00b9934be9824f57b48a34a8 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Tue, 4 Jan 2022 11:41:34 +0530 Subject: [PATCH 0178/1077] Removed Audit/Warn line. --- windows/client-management/mdm/policy-csp-storage.md | 8 -------- 1 file changed, 8 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index da73c643b4..5d43f8f336 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -612,8 +612,6 @@ This policy will do the enforcement over the following protocols which are used If enabled, this policy will block end-user from Read access on any Windows Portal devices, e.g. mobile/iOS/Android. -Audit/Warn – Audit/Warn modes with customer justifications. - >[!NOTE] > WPD policy is not a reliable policy for removable storage - admin can not use WPD policy to block removable storage, e.g. if an end-user is using an USB thumb drive under a WPD policy, the policy may block PTP/MTP/etc, but end-user can still browser the USB via explorer. @@ -674,8 +672,6 @@ This policy will do the enforcement over the following protocols which are used If enabled, this policy will block end-user from Read access on any Windows Portal devices, e.g. mobile/iOS/Android. -Audit/Warn – Audit/Warn modes with customer justifications. - >[!NOTE] > WPD policy is not a reliable policy for removable storage - admin can not use WPD policy to block removable storage, e.g. if an end-user is using an USB thumb drive under a WPD policy, the policy may block PTP/MTP/etc, but end-user can still browser the USB via explorer. @@ -736,8 +732,6 @@ This policy will do the enforcement over the following protocols which are used If enabled, this will block end-user from Write access on any Windows Portal devices, e.g. mobile/iOS/Android. -Audit/Warn – Audit/Warn modes with customer justifications. - >[!NOTE] > WPD policy is not a reliable policy for removable storage - admin can not use WPD policy to block removable storage, e.g. if an end-user is using an USB thumb drive under a WPD policy, the policy may block PTP/MTP/etc, but end-user can still browser the USB via explorer. @@ -798,8 +792,6 @@ This policy will do the enforcement over the following protocols which are used If enabled, this will block end-user from Write access on any Windows Portal devices, e.g. mobile/iOS/Android. -Audit/Warn – Audit/Warn modes with customer justifications. - >[!NOTE] > WPD policy is not a reliable policy for removable storage - admin can not use WPD policy to block removable storage, e.g. if an end-user is using an USB thumb drive under a WPD policy, the policy may block PTP/MTP/etc, but end-user can still browser the USB via explorer. From abe2470a1ffba8b4861bbb66f31ee26cb21cae5e Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Tue, 4 Jan 2022 14:39:49 +0530 Subject: [PATCH 0179/1077] Updated --- .../policy-configuration-service-provider.md | 14 ++ .../mdm/policy-csp-humanpresence.md | 190 ++++++++++++++++++ windows/client-management/mdm/toc.yml | 2 + 3 files changed, 206 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-humanpresence.md diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index f88a7df806..0579418cbd 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -6371,6 +6371,20 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC
    +### HumanPresence policies + +
    +
    + HumanPresence/ForceInstantLock +
    +
    + HumanPresence/ForceInstantWake +
    +
    + HumanPresence/ForceLockTimeout +
    +
    + ### InternetExplorer policies
    diff --git a/windows/client-management/mdm/policy-csp-humanpresence.md b/windows/client-management/mdm/policy-csp-humanpresence.md new file mode 100644 index 0000000000..f9d5c24842 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-humanpresence.md @@ -0,0 +1,190 @@ +--- +title: Policy CSP - HumanPresence +description: Use the Policy CSP - HumanPresence setting allows wake on approach and lock on leave that can be managed from MDM. +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: dansimp +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - HumanPresence + + + +
    + + +## HumanPresence policies + +
    +
    + HumanPresence/ForceInstantLock +
    +
    + HumanPresence/ForceInstantWake +
    +
    + HumanPresence/ForceLockTimeout +
    +
    + + +
    + + +**HumanPresence/ForceInstantLock** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy specifies whether the device can lock when a human presence sensor detects a human. + + + +ADMX Info: +- GP Friendly name: *Implements wake on approach and lock on leave that can be managed from MDM* +- GP name: *ForceInstantLock* +- GP path: *Windows Components/HumanPresence* +- GP ADMX file name: *HumanPresence.admx* + + + +The following list shows the supported values: + +- 2 = ForcedOff +- 1 = ForcedOn +- 0 = DefaultToUserChoice +- Defaults to 0. + + + +
    + + +**HumanPresence/ForceInstantWake** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy specifies whether the device can lock when a human presence sensor detects a human. + + + +ADMX Info: +- GP Friendly name: *Implements wake on approach and lock on leave that can be managed from MDM* +- GP name: *ForceInstantWake* +- GP path: *Windows Components/HumanPresence* +- GP ADMX file name: *HumanPresence.admx* + + + +The following list shows the supported values: + +- 2 = ForcedOff +- 1 = ForcedOn +- 0 = DefaultToUserChoice +- Defaults to 0. + + + +
    + + +**HumanPresence/ForceLockTimeout** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|No|No| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy specifies at what distance the sensor wakes up when it sees a human in seconds. + + + +ADMX Info: +- GP Friendly name: *Implements wake on approach and lock on leave that can be managed from MDM* +- GP name: *ForceLockTimeout* +- GP path: *Windows Components/HumanPresence* +- GP ADMX file name: *HumanPresence.admx* + + + +Integer value that specifies whether the device can lock when a human presence sensor detects a human. + +The following list shows the supported values: + +- 120 = 120 seconds +- 30 = 30 seconds +- 10 = 10 seconds +- 0 = DefaultToUserChoice +- Defaults to 0 + + + +
    + + + diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 87673ea6e7..51ac7ce80f 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -721,6 +721,8 @@ items: href: policy-csp-games.md - name: Handwriting href: policy-csp-handwriting.md + - name: HumanPresence + href: policy-csp-humanpresence.md - name: InternetExplorer href: policy-csp-internetexplorer.md - name: Kerberos From c791533fdeba706af5681f2507e8702b4154d192 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Tue, 4 Jan 2022 15:41:59 +0530 Subject: [PATCH 0180/1077] Update policy-csp-internetexplorer.md --- windows/client-management/mdm/policy-csp-internetexplorer.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index 12fd5be044..37c6285576 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -210,7 +210,7 @@ manager: dansimp InternetExplorer/DoNotBlockOutdatedActiveXControls
    - InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains + InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains
    InternetExplorer/IncludeAllLocalSites From bb2f5d07d97f655797d57e82603ca4caddac1911 Mon Sep 17 00:00:00 2001 From: Meghana Athavale Date: Tue, 4 Jan 2022 17:41:49 +0530 Subject: [PATCH 0181/1077] Updated table --- .../ie11-deploy-guide/new-group-policy-settings-for-ie11.md | 1 + 1 file changed, 1 insertion(+) diff --git a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md index 557d57b34a..e6c30a056e 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md @@ -34,6 +34,7 @@ Internet Explorer 11 gives you some new Group Policy settings to help you manage | Always send Do Not Track header | Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | At least Internet Explorer 10 | This policy setting allows you to configure how IE sends the Do Not Track (DNT) header.

    If you enable this policy setting, IE sends a `DNT:1` header with all HTTP and HTTPS requests. The `DNT:1` header signals to the servers not to track the user.

    **In Internet Explorer 9 and 10:**
    If you disable this policy setting, IE only sends the Do Not Track header if a Tracking Protection List is enabled or inPrivate Browsing mode is used.

    **In at least IE11:**
    If you disable this policy setting, IE only sends the Do Not Track header if inPrivate Browsing mode is used.

    If you don't configure the policy setting, users can select the **Always send Do Not Track header** option on the **Advanced\* tab of the \*\*Internet Options** dialog box. By selecting this option, IE sends a `DNT:1` header with all HTTP and HTTPS requests; unless the user grants a site-specific exception, in which case IE sends a `DNT:0` header. By default, this option is enabled. | | Don't run antimalware programs against ActiveX controls
    (Internet, Restricted Zones) |

    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone
    | IE11 on Windows 10 | This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

    If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

    If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

    If you don't configure this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using the Internet Explorer's **Security** settings. | | Don't run antimalware programs against ActiveX controls
    (Intranet, Trusted, Local Machine Zones) |

    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone
    | IE11 on Windows 10 | This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

    If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

    If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

    If you don't configure this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer's **Security** settings. | +| Hide Internet Explorer 11 Application Retirement Notification | Administrative Templates\Windows Components\Internet Explorer | Internet Explorer 11 on Windows 10 20H2 & newer | This policy setting allows you to prevent the notification bar that informs users of Internet Explorer 11’s retirement from showing up.
    If you disable or don’t configure this setting, the notification will be shown. | | Hide the button (next to the New Tab button) that opens Microsoft Edge | User Configuration\Administrative Templates\Windows Components/Internet Explorer\Internet Settings\Advanced Settings\Browsing\ | IE11 on Windows 10, version 1703 | This policy setting lets you decide whether employees can see the open Microsoft Edge button, which appears next to the New Tab button.

    If you enable this policy setting, the button to open Microsoft Edge from Internet Explorer will be hidden.

    If you disable this policy setting, the button to open Microsoft Edge from Internet Explorer appears.

    If you don't configure this policy setting, the button to open Microsoft Edge from Internet Explorer can be configured by your employees. | | Let users turn on and use Enterprise Mode from the **Tools** menu | Administrative Templates\Windows Components\Internet Explorer | IE11 on Windows 10 | This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the **Tools** menu.

    If you enable this policy setting, users can see and use the **Enterprise Mode** option from the **Tools** menu. If you enable this setting, but don’t specify a report location, Enterprise Mode will still be available to your users, but you won’t get any reports.

    If you disable or don’t configure this policy setting, the menu option won’t appear and users won’t be able to turn on Enterprise Mode locally. | | Limit Site Discovery output by Domain | Administrative Templates\Windows Components\Internet Explorer | At least Internet Explorer 8 | This policy setting allows you to control which domains are included in the discovery function of the Internet Explorer Site Discovery Toolkit.

    If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in your specified domains, configured by adding one domain per line to the included text box.

    If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all domains.

    **Note:**
    You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. | From 94656af0051564618c6705b00962671fee4544e1 Mon Sep 17 00:00:00 2001 From: Thomas Raya Date: Tue, 4 Jan 2022 08:06:18 -0800 Subject: [PATCH 0182/1077] Update policy-csp-notifications.md update sensitive language term --- windows/client-management/mdm/policy-csp-notifications.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index 3be6f32d76..f2a1383e75 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -265,7 +265,7 @@ This policy setting determines which Windows Notification Service endpoint will If you disable or do not configure this setting, the push notifications will connect to the default endpoint of client.wns.windows.com. -Note: Ensure the proper WNS FQDNs, VIPs, IPs and Ports are also whitelisted from your firewall settings. +Note: Ensure the proper WNS FQDNs, VIPs, IPs and Ports are also allowlisted from your firewall settings. @@ -284,4 +284,4 @@ If the policy is not specified, we will default our connection to client.wns.win

    - \ No newline at end of file + From 72febff49b7ea7998c973f3ca47a98c216d7b23e Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Tue, 4 Jan 2022 23:16:28 +0530 Subject: [PATCH 0183/1077] Update policy-csp-start.md --- windows/client-management/mdm/policy-csp-start.md | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index a7bfb4c8ba..3ef4e79b17 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -779,33 +779,27 @@ The following list shows the supported values: - - - - - -
    EditionWindows 10 Windows 11
    Home NoNo
    Pro YesYes
    Business YesYes
    Enterprise YesYes
    Education YesYes
    @@ -823,12 +817,12 @@ The following list shows the supported values: -This policy will allow admins to push a new list of pinned apps to override the default/current list of pinned apps in the SV start menu experience. +This policy will allow admins to push a new list of pinned apps to override the default/current list of pinned apps in the Windows 11 start menu experience. ->[!NOTE] -> TFS information describes feature area owners and policy handling work, but the work to implement the policy itself is being completed by OS\WDX\DASH\Cloud-powered Windows Devices\Project Hailey --> Deliverable 32179178. +It contains details on how to configure the start menu on Windows 11, see https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/customize-the-windows-11-start-menu + This string policy will take a JSON file (expected name LayoutModification.json), which enumerates the items to pin and their relative order. @@ -2322,7 +2316,6 @@ To validate on Desktop, do the following: -This supports a key Enterprise manageability request targeted for Iron. From 9340a272609d566ae577b2fafb2930c83a21732c Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 5 Jan 2022 00:33:08 +0530 Subject: [PATCH 0184/1077] Updated --- .../mdm/policy-csp-admx-taskbar.md | 2 +- .../mdm/policy-csp-admx-terminalserver.md | 34 ++++++++++--------- 2 files changed, 19 insertions(+), 17 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-taskbar.md b/windows/client-management/mdm/policy-csp-admx-taskbar.md index a22e45d37f..2abbb2c51b 100644 --- a/windows/client-management/mdm/policy-csp-admx-taskbar.md +++ b/windows/client-management/mdm/policy-csp-admx-taskbar.md @@ -1115,5 +1115,5 @@ ADMX Info:
    -p + diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index 61b3d28bd5..a2303746fc 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -2766,7 +2766,7 @@ ADMX Info: -This policy determines whether the RPC protocol messagese used by VSS for SMB2 File Shares feature is enabled. VSS for SMB2 File Shares feature enables VSS aware backup applications to perform application consistent backup and restore of VSS aware applications storing data on SMB2 File Shares. By default, the RPC protocol message between File Server VSS provider and File Server VSS Agent is signed but not encrypted. +This policy determines whether the RPC protocol messages used by VSS for SMB2 File Shares feature is enabled. VSS for SMB2 File Shares feature enables VSS aware backup applications to perform application consistent backup and restore of VSS aware applications storing data on SMB2 File Shares. By default, the RPC protocol message between File Server VSS provider and File Server VSS Agent is signed but not encrypted. To make changes to this setting effective, you must restart Volume Shadow Copy (VSS) Service. @@ -2812,7 +2812,7 @@ ADMX Info: -This policy determines whether the RPC protocol messagese used by VSS for SMB2 File Shares feature is enabled. VSS for SMB2 File Shares feature enables VSS aware backup applications to perform application consistent backup and restore of VSS aware applications storing data on SMB2 File Shares. By default, the RPC protocol message between File Server VSS provider and File Server VSS Agent is signed but not encrypted. +This policy determines whether the RPC protocol messages used by VSS for SMB2 File Shares feature is enabled. VSS for SMB2 File Shares feature enables VSS aware backup applications to perform application consistent backup and restore of VSS aware applications storing data on SMB2 File Shares. By default, the RPC protocol message between File Server VSS provider and File Server VSS Agent is signed but not encrypted. To make changes to this setting effective, you must restart Volume Shadow Copy (VSS) Service. @@ -2915,9 +2915,10 @@ Therefore, you must use the same farm name for all RD Session Host servers in th - If you disable or do not configure this policy setting, the farm name is not specified at the Group Policy level. ->[!NOTES] -> 1. This policy setting is not effective unless both the Join RD Connection Broker and the Configure RD Connection Broker server name policy settings are enabled and configured by using Group Policy. -> 2. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. +> [!NOTE] +> This policy setting is not effective unless both the Join RD Connection Broker and the Configure RD Connection Broker server name policy settings are enabled and configured by using Group Policy. + +For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. @@ -2966,7 +2967,7 @@ This policy setting allows you to specify the redirection method to use when a c If you do not configure this policy setting, the Use IP address redirection policy setting is not enforced at the group Group policy Policy level and the default will be used. This setting is enabled by default. ->[!NOTES] +> [!NOTE] > For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. @@ -3014,12 +3015,13 @@ The specified server must be running the Remote Desktop Connection Broker servic - If you enable this policy setting, you must specify the RD Connection Broker server by using its fully qualified domain name (FQDN). In Windows Server 2012, for a high availability setup with multiple RD Connection Broker servers, you must provide a semi-colon separated list of the FQDNs of all the RD Connection Broker servers. - If you disable or do not configure this policy setting, the policy setting is not specified at the Group Policy level. - ->[!NOTES] -> 1. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. -> 2. This policy setting is not effective unless the Join RD Connection Broker policy setting is enabled. -> 3. To be an active member of an RD Session Host server farm, the computer account for each RD Session Host server in the farm must be a member of one of the following local groups on the RD Connection Broker server: Session Directory Computers, Session Broker Computers, or RDS Endpoint Servers. + +> [!NOTE] +> For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard. +> This policy setting is not effective unless the Join RD Connection Broker policy setting is enabled. +> To be an active member of an RD Session Host server farm, the computer account for each RD Session Host server in the farm must be a member of one of the following local groups on the RD Connection Broker server: Session Directory Computers, Session Broker Computers, or RDS Endpoint Servers. + @@ -3067,11 +3069,11 @@ This policy setting specifies whether to require the use of a specific security The following security methods are available: -1. * Negotiate: The Negotiate method enforces the most secure method that is supported by the client. If Transport Layer Security (TLS) version 1.0 is supported, it is used to authenticate the RD Session Host server. If TLS is not supported, native Remote Desktop Protocol (RDP) encryption is used to secure communications, but the RD Session Host server is not authenticated. Native RDP encryption (as opposed to SSL encryption) is not recommended. -2. * RDP: The RDP method uses native RDP encryption to secure communications between the client and RD Session Host server. If you select this setting, the RD Session Host server is not authenticated. Native RDP encryption (as opposed to SSL encryption) is not recommended. -3. * SSL (TLS 1.0): The SSL method requires the use of TLS 1.0 to authenticate the RD Session Host server. If TLS is not supported, the connection fails. This is the recommended setting for this policy. +- **Negotiate**: The Negotiate method enforces the most secure method that is supported by the client. If Transport Layer Security (TLS) version 1.0 is supported, it is used to authenticate the RD Session Host server. If TLS is not supported, native Remote Desktop Protocol (RDP) encryption is used to secure communications, but the RD Session Host server is not authenticated. Native RDP encryption (as opposed to SSL encryption) is not recommended. +- **RDP**: The RDP method uses native RDP encryption to secure communications between the client and RD Session Host server. If you select this setting, the RD Session Host server is not authenticated. Native RDP encryption (as opposed to SSL encryption) is not recommended. +- **SSL (TLS 1.0)**: The SSL method requires the use of TLS 1.0 to authenticate the RD Session Host server. If TLS is not supported, the connection fails. This is the recommended setting for this policy. -- If you disable or do not configure this policy setting, the security method to be used for remote connections to RD Session Host servers is not specified at the Group Policy level. +If you disable or do not configure this policy setting, the security method to be used for remote connections to RD Session Host servers is not specified at the Group Policy level. @@ -3560,7 +3562,7 @@ ADMX Info: -This policy setting allows the administrator to configure the RemoteFX experience for Remote Desktop Session Host or Remote Desktop Virtualization Host servers. By default, the system will choose the best experience based on available nework bandwidth. +This policy setting allows the administrator to configure the RemoteFX experience for Remote Desktop Session Host or Remote Desktop Virtualization Host servers. By default, the system will choose the best experience based on available network bandwidth. If you enable this policy setting, the RemoteFX experience could be set to one of the following options: 1. Let the system choose the experience for the network condition From c159a7b11dbb67cb512bef4d82b3a41086309bfd Mon Sep 17 00:00:00 2001 From: sravanigannavarapu <95500630+sravanigannavarapu@users.noreply.github.com> Date: Tue, 4 Jan 2022 15:34:45 -0800 Subject: [PATCH 0185/1077] Update audit-registry.md --- windows/security/threat-protection/auditing/audit-registry.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/auditing/audit-registry.md b/windows/security/threat-protection/auditing/audit-registry.md index 306872fcbc..38c9f81091 100644 --- a/windows/security/threat-protection/auditing/audit-registry.md +++ b/windows/security/threat-protection/auditing/audit-registry.md @@ -49,5 +49,4 @@ If success auditing is enabled, an audit entry is generated each time any accoun > [!NOTE] > On creating a subkey for a parent (RegCreateKey), the expectation is to see an event for opening a handle for the newly created object (event 4656) issued by the object manager. You will see this event only when "Audit Object Access" is enabled under **Local Policies** > **Audit Policy** in Local Security Policy. This event is not generated while using precisely defined settings for seeing only registry-related events under **Advanced Audit Policy Configurations** > **Object Access** > **Audit Registry** in Local Security Policy. For example, you will not see this event with the setting to just see the registry-related auditing events using "auditpol.exe /set /subcategory:{0CCE921E-69AE-11D9-BED3-505054503030} /success:enable". - -Calls to Registry APIs to access an open key object to perform an operation such as RegSetValue, RegEnumValue, and RegRenameKey would trigger an event to access the object (event 4663). For example, creating a subkey using regedit.exe would not trigger a 4663 event, but renaming it would. +> Calls to Registry APIs to access an open key object to perform an operation such as RegSetValue, RegEnumValue, and RegRenameKey would trigger an event to access the object (event 4663). For example, creating a subkey using regedit.exe would not trigger a 4663 event, but renaming it would. From b184236349483abb3cb694e359836b26d0a413aa Mon Sep 17 00:00:00 2001 From: Matthew Palko Date: Tue, 4 Jan 2022 17:53:34 -0800 Subject: [PATCH 0186/1077] Updating Windows Hello for Business Overview --- .../hello-for-business/hello-overview.md | 59 +++++++++---------- 1 file changed, 28 insertions(+), 31 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index a730b8d478..5426ef1df0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -21,36 +21,39 @@ localizationpriority: medium # Windows Hello for Business Overview **Applies to** + - Windows 10 - Windows 11 In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on devices. This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN. >[!NOTE] -> When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. +> When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. Windows Hello addresses the following problems with passwords: -- Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites. -- Server breaches can expose symmetric network credentials (passwords). -- Passwords are subject to [replay attacks](/previous-versions/dotnet/netframework-4.0/aa738652(v=vs.100)). -- Users can inadvertently expose their passwords due to [phishing attacks](https://go.microsoft.com/fwlink/p/?LinkId=615674). + +- Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites. +- Server breaches can expose symmetric network credentials (passwords). +- Passwords are subject to [replay attacks](/previous-versions/dotnet/netframework-4.0/aa738652(v=vs.100)). +- Users can inadvertently expose their passwords due to [phishing attacks](https://go.microsoft.com/fwlink/p/?LinkId=615674). Windows Hello lets users authenticate to: -- a Microsoft account. -- an Active Directory account. -- a Microsoft Azure Active Directory (Azure AD) account. -- Identity Provider Services or Relying Party Services that support [Fast ID Online (FIDO) v2.0](https://go.microsoft.com/fwlink/p/?LinkId=533889) authentication (in progress) + +- A Microsoft account. +- An Active Directory account. +- A Microsoft Azure Active Directory (Azure AD) account. +- Identity Provider Services or Relying Party Services that support [Fast ID Online (FIDO) v2.0](https://go.microsoft.com/fwlink/p/?LinkId=533889) authentication After an initial two-step verification of the user during enrollment, Windows Hello is set up on the user's device and Windows asks the user to set a gesture, which can be a biometric, such as a fingerprint, or a PIN. The user provides the gesture to verify their identity. Windows then uses Windows Hello to authenticate users. As an administrator in an enterprise or educational organization, you can create policies to manage Windows Hello for Business use on Windows 10-based devices that connect to your organization. ## Biometric sign-in - + Windows Hello provides reliable, fully integrated biometric authentication based on facial recognition or fingerprint matching. Windows Hello uses a combination of special infrared (IR) cameras and software to increase accuracy and guard against spoofing. Major hardware vendors are shipping devices that have integrated Windows Hello-compatible cameras. Fingerprint reader hardware can be used or added to devices that don't currently have it. On devices that support Windows Hello, an easy biometric gesture unlocks users' credentials. - -- **Facial recognition**. This type of biometric recognition uses special cameras that see in IR light, which allows them to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major laptop manufacturers are incorporating it into their devices, as well. -- **Fingerprint recognition**. This type of biometric recognition uses a capacitive fingerprint sensor to scan your fingerprint. Fingerprint readers have been available for Windows computers for years, but the current generation of sensors is significantly more reliable and less error-prone. Most existing fingerprint readers (whether external or integrated into laptops or USB keyboards) work with Windows 10 and Windows 11. + +- **Facial recognition**. This type of biometric recognition uses special cameras that see in IR light, which allows them to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major laptop manufacturers are incorporating it into their devices, as well. +- **Fingerprint recognition**. This type of biometric recognition uses a capacitive fingerprint sensor to scan your fingerprint. Fingerprint readers have been available for Windows computers for years, but the current generation of sensors is significantly more reliable and less error-prone. Most existing fingerprint readers (whether external or integrated into laptops or USB keyboards) work with Windows 10 and Windows 11. Windows stores biometric data that is used to implement Windows Hello securely on the local device only. The biometric data doesn't roam and is never sent to external devices or servers. Because Windows Hello only stores biometric identification data on the device, there's no single collection point an attacker can compromise to steal biometric data. For more information about biometric authentication with Windows Hello for Business, see [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md). @@ -60,17 +63,16 @@ Windows stores biometric data that is used to implement Windows Hello securely o - **Windows Hello for Business**, which is configured by Group Policy or mobile device management (MDM) policy, always uses key-based or certificate-based authentication. This makes it much more secure than **Windows Hello convenience PIN**. - ## Benefits of Windows Hello Reports of identity theft and large-scale hacking are frequent headlines. Nobody wants to be notified that their user name and password have been exposed. You may wonder [how a PIN can help protect a device better than a password](hello-why-pin-is-better-than-password.md). Passwords are shared secrets; they are entered on a device and transmitted over the network to the server. An intercepted account name and password can be used by anyone, anywhere. Because they're stored on the server, a server breach can reveal those stored credentials. -In Windows 10, Windows Hello replaces passwords. When the identity provider supports keys, the Windows Hello provisioning process creates a cryptographic key pair bound to the Trusted Platform Module (TPM), if a device has a TPM 2.0, or in software. Access to these keys and obtaining a signature to validate user possession of the private key is enabled only by the PIN or biometric gesture. The two-step verification that takes place during Windows Hello enrollment creates a trusted relationship between the identity provider and the user when the public portion of the public/private key pair is sent to an identity provider and associated with a user account. When a user enters the gesture on the device, the identity provider knows from the combination of Hello keys and gesture that this is a verified identity and provides an authentication token that allows Windows 10 to access resources and services. +In Windows 10 and later, Windows Hello replaces passwords. When an identity provider supports keys, the Windows Hello provisioning process creates a cryptographic key pair bound to the Trusted Platform Module (TPM), if a device has a TPM 2.0, or in software. Access to these keys and obtaining a signature to validate user possession of the private key is enabled only by the PIN or biometric gesture. The two-step verification that takes place during Windows Hello enrollment creates a trusted relationship between the identity provider and the user when the public portion of the public/private key pair is sent to an identity provider and associated with a user account. When a user enters the gesture on the device, the identity provider knows from the combination of Hello keys and gesture that this is a verified identity and provides an authentication token that allows Windows to access resources and services. >[!NOTE] ->Windows Hello as a convenience sign-in uses regular user name and password authentication, without the user entering the password. +>Windows Hello as a convenience sign-in uses regular username and password authentication, without the user entering the password. :::image type="content" alt-text="How authentication works in Windows Hello." source="images/authflow.png" lightbox="images/authflow.png"::: @@ -78,36 +80,31 @@ Imagine that someone is looking over your shoulder as you get money from an ATM Windows Hello helps protect user identities and user credentials. Because the user doesn't enter a password (except during provisioning), it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Windows Hello credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are protected by TPMs. - -  ## How Windows Hello for Business works: key points -- Windows Hello credentials are based on certificate or asymmetrical key pair. Windows Hello credentials can be bound to the device, and the token that is obtained using the credential is also bound to the device. +- Windows Hello credentials are based on certificate or asymmetrical key pair. Windows Hello credentials can be bound to the device, and the token that is obtained using the credential is also bound to the device. -- Identity provider (such as Active Directory, Azure AD, or a Microsoft account) validates user identity and maps the Windows Hello public key to a user account during the registration step. +- Identity provider (such as Active Directory, Azure AD, or a Microsoft account) validates user identity and maps the Windows Hello public key to a user account during the registration step. -- Keys can be generated in hardware (TPM 1.2 or 2.0 for enterprises, and TPM 2.0 for consumers) or software, based on the policy. +- Keys can be generated in hardware (TPM 1.2 or 2.0 for enterprises, and TPM 2.0 for consumers) or software, based on the policy. To guarantee that keys are generated in hardware, you must set policy. -- Authentication is the two-factor authentication with the combination of a key or certificate tied to a device and something that the person knows (a PIN) or something that the person is (biometrics). The Windows Hello gesture does not roam between devices and is not shared with the server. Biometrics templates are stored locally on a device. The PIN is never stored or shared. +- Authentication is the two-factor authentication with the combination of a key or certificate tied to a device and something that the person knows (a PIN) or something that the person is (biometrics). The Windows Hello gesture does not roam between devices and is not shared with the server. Biometrics templates are stored locally on a device. The PIN is never stored or shared. -- The private key never leaves a device when using TPM. The authenticating server has a public key that is mapped to the user account during the registration process. +- The private key never leaves a device when using TPM. The authenticating server has a public key that is mapped to the user account during the registration process. -- PIN entry and biometric gesture both trigger Windows 10 to use the private key to cryptographically sign data that is sent to the identity provider. The identity provider verifies the user's identity and authenticates the user. +- PIN entry and biometric gesture both trigger Windows 10 and later to use the private key to cryptographically sign data that is sent to the identity provider. The identity provider verifies the user's identity and authenticates the user. -- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. All keys are separated by identity providers' domains to help ensure user privacy. +- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. All keys are separated by identity providers' domains to help ensure user privacy. -- Certificate private keys can be protected by the Windows Hello container and the Windows Hello gesture. +- Certificate private keys can be protected by the Windows Hello container and the Windows Hello gesture. For details, see [How Windows Hello for Business works](hello-how-it-works.md). ## Comparing key-based and certificate-based authentication -Windows Hello for Business can use either keys (hardware or software) or certificates in hardware or software. Enterprises that have a public key infrastructure (PKI) for issuing and managing end user certificates can continue to use PKI in combination with Windows Hello. Enterprises that do not use PKI or want to reduce the effort associated with managing user certificates can rely on key-based credentials for Windows Hello but still use certificates on their domain controllers as a root of trust. +Windows Hello for Business can use either keys (hardware or software) or certificates in hardware or software. Enterprises that have a public key infrastructure (PKI) for issuing and managing end user certificates can continue to use PKI in combination with Windows Hello for Business. Enterprises that do not use PKI or want to reduce the effort associated with managing user certificates can rely on key-based credentials for Windows Hello. This still uses certificates on the domain controllers as a root of trust. Starting with Windows 10 21H2, there is a feature called cloud trust for hybrid deployments which uses Azure AD as the root of trust. Cloud trust uses key-based credentials for Windows Hello but does not require certificates on the domain controller. -Windows Hello for Business with a key does not support supplied credentials for RDP. RDP does not support authentication with a key or a self signed certificate. RDP with Windows Hello for Business is supported with certificate based deployments as a supplied credential. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md). - -> [!NOTE] -> Windows Hello for Business is introducing a new trust model called cloud trust in early 2022. This trust model will enable deployment of Windows Hello for Business using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). More information will be available on Windows Hello for Business cloud trust once it is generally available. +Windows Hello for Business with a key, including cloud trust, does not support supplied credentials for RDP. RDP does not support authentication with a key or a self signed certificate. RDP with Windows Hello for Business is supported with certificate based deployments as a supplied credential. Windows Hello for Business with a key credential can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md). ## Learn more From 8c084b293a401b5c3fc782c145117488258b2b2b Mon Sep 17 00:00:00 2001 From: Matthew Palko Date: Tue, 4 Jan 2022 18:09:07 -0800 Subject: [PATCH 0187/1077] Updating Windows Hello for Business Deployment Overview --- .../hello-for-business/hello-deployment-guide.md | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md index 57e428e8b6..4f06d9b6bd 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md @@ -42,7 +42,7 @@ This guide assumes that baseline infrastructure exists which meets the requireme - Multi-factor Authentication is required during Windows Hello for Business provisioning - Proper name resolution, both internal and external names - Active Directory and an adequate number of domain controllers per site to support authentication -- Active Directory Certificate Services 2012 or later +- Active Directory Certificate Services 2012 or later (Note: certificate services are not needed for cloud trust deployments) - One or more workstation computers running Windows 10, version 1703 or later If you are installing a server role for the first time, ensure the appropriate server operating system is installed, updated with the latest patches, and joined to the domain. This document provides guidance to install and configure the specific roles on that server. @@ -51,24 +51,23 @@ Do not begin your deployment until the hosting servers and infrastructure (not r ## Deployment and trust models -Windows Hello for Business has three deployment models: Azure AD cloud only, hybrid, and on-premises. Hybrid and on-premises deployment models have two trust models: *Key trust* and *certificate trust*. - -> [!NOTE] -> Windows Hello for Business is introducing a new trust model called cloud trust in early 2022. This trust model will enable deployment of Windows Hello for Business using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). More information will be available on Windows Hello for Business cloud trust once it is generally available. +Windows Hello for Business has three deployment models: Azure AD cloud only, hybrid, and on-premises. Hybrid has three trust models: *Key trust*, *certificate trust*, and *cloud trust*. On-premises deployment models only support *Key trust* and *certificate trust*. Hybrid deployments are for enterprises that use Azure Active Directory. On-premises deployments are for enterprises who exclusively use on-premises Active Directory. Remember that the environments that use Azure Active Directory must use the hybrid deployment model for all domains in that forest. The trust model determines how you want users to authenticate to the on-premises Active Directory: -- The key-trust model is for enterprises who do not want to issue end-entity certificates to their users and have an adequate number of 2016 domain controllers in each site to support authentication. +- The key-trust model is for enterprises who do not want to issue end-entity certificates to their users and have an adequate number of 2016 domain controllers in each site to support authentication. This still requires Active Directory Certificate Services for domain controller certificates. +- The cloud-trust model is also for hybrid enterprises who do not want to issue end-entity certificates to their users and have an adequate number of 2016 domain controllers in each site to support authentication. This trust model is simpler to deploy than key trust and does not require Active Directory Certificate Services. We recommend using cloud trust instead of key trust if the clients in your enterprise support it. - The certificate-trust model is for enterprise that *do* want to issue end-entity certificates to their users and have the benefits of certificate expiration and renewal, similar to how smart cards work today. - The certificate trust model also supports enterprises which are not ready to deploy Windows Server 2016 Domain Controllers. > [!NOTE] -> RDP does not support authentication with Windows Hello for Business key trust deployments as a supplied credential. RDP is only supported with certificate trust deployments as a supplied credential at this time. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md). +> RDP does not support authentication with Windows Hello for Business key trust or cloud trust deployments as a supplied credential. RDP is only supported with certificate trust deployments as a supplied credential at this time. Windows Hello for Business key trust and cloud trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md). Following are the various deployment guides and models included in this topic: +- [Hybrid Azure AD Joined Cloud Trust Deployment](hello-hybrid-cloud-trust.md) - [Hybrid Azure AD Joined Key Trust Deployment](hello-hybrid-key-trust.md) - [Hybrid Azure AD Joined Certificate Trust Deployment](hello-hybrid-cert-trust.md) - [Azure AD Join Single Sign-on Deployment Guides](hello-hybrid-aadj-sso.md) From 26b87313a041f55de2fac675b3869577409d27b3 Mon Sep 17 00:00:00 2001 From: Matthew Palko Date: Tue, 4 Jan 2022 18:12:27 -0800 Subject: [PATCH 0188/1077] adding new files --- .../hello-deployment-migration.md | 23 +++++++++++++++++++ .../hello-hybrid-cloud-trust.md | 0 2 files changed, 23 insertions(+) create mode 100644 windows/security/identity-protection/hello-for-business/hello-deployment-migration.md create mode 100644 windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust.md diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-migration.md b/windows/security/identity-protection/hello-for-business/hello-deployment-migration.md new file mode 100644 index 0000000000..3ab14c6a25 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-migration.md @@ -0,0 +1,23 @@ +--- +title: Windows Hello for Business Deployment Known Issues +description: A Troubleshooting Guide for Known Windows Hello for Business Deployment Issues +keywords: identity, PIN, biometric, Hello, passport +params: siblings_only +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 05/03/2021 +ms.reviewer: +--- +# Windows Hello for Business Known Deployment Issues + +TBD + diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust.md new file mode 100644 index 0000000000..e69de29bb2 From e666c74fd8cbe0fa83566a98f6c8b73f67701471 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Wed, 5 Jan 2022 10:39:03 +0530 Subject: [PATCH 0189/1077] Removed the numbers and added bullets --- .../mdm/policy-csp-admx-terminalserver.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index a2303746fc..a1920a3b5e 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -329,7 +329,7 @@ manager: dansimp This policy specifies whether to allow Remote Desktop Connection clients to automatically reconnect to sessions on an RD Session Host server if their network link is temporarily lost. -By default, a maximum of twenty reconnection attempts are made at five second intervals. If the status is set to Enabled, automatic reconnection is attempted for all clients running Remote Desktop Connection whenever their network connection is lost. +By default, a maximum of 20 reconnection attempts are made at five-second intervals. If the status is set to Enabled, automatic reconnection is attempted for all clients running Remote Desktop Connection whenever their network connection is lost. If the status is set to Disabled, automatic reconnection of clients is prohibited. If the status is set to Not Configured, automatic reconnection is not specified at the Group Policy level. However, users can configure automatic reconnection using the "Reconnect if connection is dropped" checkbox on the Experience tab in Remote Desktop Connection. @@ -498,7 +498,7 @@ ADMX Info: -This policy setting allows you to specify whether users can run Remote Desktop Protocol (.rdp) files from a publisher that signed the file with a valid certificate. A valid certificate is one that is issued by an authority recognized by the client, such as the issuers in the client's Third-Party Root Certification Authorities certificate store. +This policy setting allows you to specify whether users can run Remote Desktop Protocol (.rdp) files from a publisher that signed the file with a valid certificate. A valid certificate is one that is issued by an authority recognized by the client, such as the issuers in the client's Third-Party Root Certification Authorities certificate store. This policy setting also controls whether the user can start an RDP session by using default .rdp settings (for example, when a user directly opens the Remote Desktop Connection [RDC] client without specifying an .rdp file). @@ -3268,11 +3268,11 @@ This policy setting allows you to specify whether the client will establish a co - If you enable this policy setting, you must specify one of the following settings: - 1. Always connect, even if authentication fails: The client connects to the RD Session Host server even if the client cannot authenticate the RD Session Host server. + - Always connect, even if authentication fails: The client connects to the RD Session Host server even if the client cannot authenticate the RD Session Host server. - 2. Warn me if authentication fails: The client attempts to authenticate the RD Session Host server. If the RD Session Host server can be authenticated, the client establishes a connection to the RD Session Host server. If the RD Session Host server cannot be authenticated, the user is prompted to choose whether to connect to the RD Session Host server without authenticating the RD Session Host server. + - Warn me if authentication fails: The client attempts to authenticate the RD Session Host server. If the RD Session Host server can be authenticated, the client establishes a connection to the RD Session Host server. If the RD Session Host server cannot be authenticated, the user is prompted to choose whether to connect to the RD Session Host server without authenticating the RD Session Host server. - 3. Do not connect if authentication fails: The client establishes a connection to the RD Session Host server only if the RD Session Host server can be authenticated. + - Do not connect if authentication fails: The client establishes a connection to the RD Session Host server only if the RD Session Host server can be authenticated. - If you disable or do not configure this policy setting, the authentication setting that is specified in Remote Desktop Connection or in the .rdp file determines whether the client establishes a connection to the RD Session Host server when the client cannot authenticate the RD Session Host server. From 3ffebcb7bd541a3e0a222976c1083b6d6116b0be Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Wed, 5 Jan 2022 10:55:23 +0200 Subject: [PATCH 0190/1077] Add info about KB5005010 https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10001 --- .../devices-prevent-users-from-installing-printer-drivers.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md b/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md index 32a0ca45f2..8e293b382a 100644 --- a/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md +++ b/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md @@ -43,6 +43,9 @@ Although it might be appropriate in some organizations to allow users to install - It is advisable to set **Devices: Prevent users from installing printer drivers** to Enabled. Only users in the Administrative, Power User, or Server Operator groups will be able to install printers on servers. If this policy setting is enabled, but the driver for a network printer already exists on the local computer, users can still add the network printer. This policy setting does not affect a user's ability to add a local printer. +> [!NOTE] +> After applying the [July 6, 2021 updates](https://support.microsoft.com/en-us/topic/kb5005010-restricting-installation-of-new-printer-drivers-after-applying-the-july-6-2021-updates-31b91c02-05bc-4ada-a7ea-183b129578a7), non-administrators, including delegated admin groups like printer operators, cannot install signed and unsigned printer drivers to a print server. By default, only administrators can install both signed and unsigned printer drivers to a print server. + ### Location Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options From 483b9e10f8d29ea2c98409b67d4ea73ec2b879da Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Wed, 5 Jan 2022 11:15:52 +0200 Subject: [PATCH 0191/1077] Add info https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10018 --- windows/deployment/upgrade/resolution-procedures.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/upgrade/resolution-procedures.md b/windows/deployment/upgrade/resolution-procedures.md index 608df22ec5..cd1bfa68f2 100644 --- a/windows/deployment/upgrade/resolution-procedures.md +++ b/windows/deployment/upgrade/resolution-procedures.md @@ -45,7 +45,7 @@ See the following general troubleshooting procedures associated with a result co | :--- | :--- | :--- | | 0xC1900101 - 0x20004 | Uninstall antivirus applications.
    Remove all unused SATA devices.
    Remove all unused devices and drivers.
    Update drivers and BIOS. | Windows Setup encountered an error during the SAFE_OS with the INSTALL_RECOVERY_ENVIRONMENT operation.
    This is generally caused by out-of-date drivers. | | 0xC1900101 - 0x2000c | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.
    Contact your hardware vendor to obtain updated device drivers.
    Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. | Windows Setup encountered an unspecified error during Wim apply in the WinPE phase.
    This is generally caused by out-of-date drivers | -| 0xC1900101 - 0x20017 | Ensure that all that drivers are updated.
    Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory, and then locate the problem drivers.
    For more information, see [Windows Vista, Windows 7, Windows Server 2008 R2, Windows 8.1, and Windows 10 setup log file locations](/troubleshoot/windows-client/deployment/windows-setup-log-file-locations).
    Update or uninstall the problem drivers. | A driver has caused an illegal operation.
    Windows was not able to migrate the driver, resulting in a rollback of the operating system.
    This is a SafeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software. | +| 0xC1900101 - 0x20017 | Ensure that all that drivers are updated.
    Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory, and then locate the problem drivers.
    For more information, see [Windows Vista, Windows 7, Windows Server 2008 R2, Windows 8.1, and Windows 10 setup log file locations](/troubleshoot/windows-client/deployment/windows-setup-log-file-locations).
    Update or uninstall the problem drivers. | A driver has caused an illegal operation.
    Windows was not able to migrate the driver, resulting in a rollback of the operating system.
    This is a SafeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software.
    This can also be caused by a hardware failure. | | 0xC1900101 - 0x30018 | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.
    Contact your hardware vendor to obtain updated device drivers.
    Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. | A device driver has stopped responding to setup.exe during the upgrade process. | | 0xC1900101 - 0x3000D | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.
    Update or uninstall the display driver. | Installation failed during the FIRST_BOOT phase while attempting the MIGRATE_DATA operation.
    This can occur due to a problem with a display driver. | | 0xC1900101 - 0x4000D | Check supplemental rollback logs for a setupmem.dmp file, or event logs for any unexpected reboots or errors.
    Review the rollback log and determine the stop code.
    The rollback log is located in the $Windows.~BT\Sources\Rollback folder. An example analysis is shown below. This example is not representative of all cases:
     
    Info SP Crash 0x0000007E detected
    Info SP Module name :
    Info SP Bugcheck parameter 1 : 0xFFFFFFFFC0000005
    Info SP Bugcheck parameter 2 : 0xFFFFF8015BC0036A
    Info SP Bugcheck parameter 3 : 0xFFFFD000E5D23728
    Info SP Bugcheck parameter 4 : 0xFFFFD000E5D22F40
    Info SP Cannot recover the system.
    Info SP Rollback: Showing splash window with restoring text: Restoring your previous version of Windows.
     
    Typically, there is a dump file for the crash to analyze. If you are not equipped to debug the dump, then attempt the following basic troubleshooting procedures:
     
    1. Make sure you have enough disk space.
    2. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.
    3. Try changing video adapters.
    4. Check with your hardware vendor for any BIOS updates.
    5. Disable BIOS memory options such as caching or shadowing. | A rollback occurred due to a driver configuration issue.
    Installation failed during the second boot phase while attempting the MIGRATE_DATA operation.
    This can occur because of incompatible drivers. | From 55aff11d116cf0e7a345a3fcd83ee57ca50e528a Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Wed, 5 Jan 2022 11:31:03 +0200 Subject: [PATCH 0192/1077] Update info https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10021 --- .../identity-protection/hello-for-business/hello-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 66e88ee1a6..b033cf57b3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -100,7 +100,7 @@ sections: [Windows Hello for Business forgotten PIN user experience](hello-videos.md#windows-hello-for-business-forgotten-pin-user-experience) - For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. + For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs. Non-destructive PIN reset works without access to corporate network. Destructive PIN reset requires access to corporate network. More details about destructive and non-destructive PIN reset can be found [here](https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset). - question: What URLs do I need to allow for a hybrid deployment? answer: | From 0d604646a85dc74575cb1609e0e7622c84ba23db Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 5 Jan 2022 15:30:41 +0530 Subject: [PATCH 0193/1077] Update policy-csp-humanpresence.md --- windows/client-management/mdm/policy-csp-humanpresence.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-humanpresence.md b/windows/client-management/mdm/policy-csp-humanpresence.md index f9d5c24842..98fafc4e6d 100644 --- a/windows/client-management/mdm/policy-csp-humanpresence.md +++ b/windows/client-management/mdm/policy-csp-humanpresence.md @@ -46,8 +46,8 @@ manager: dansimp |Home|No|No| |Pro|No|No| |Business|No|No| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| +|Enterprise|No|Yes| +|Education|No|Yes|
    From e669287ba0f3a44ab5bc3c5c11b3d51b319b13ee Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 5 Jan 2022 15:34:18 +0530 Subject: [PATCH 0194/1077] Update policy-csp-humanpresence.md --- windows/client-management/mdm/policy-csp-humanpresence.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-humanpresence.md b/windows/client-management/mdm/policy-csp-humanpresence.md index 98fafc4e6d..9ce283864c 100644 --- a/windows/client-management/mdm/policy-csp-humanpresence.md +++ b/windows/client-management/mdm/policy-csp-humanpresence.md @@ -95,8 +95,8 @@ The following list shows the supported values: |Home|No|No| |Pro|No|No| |Business|No|No| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| +|Enterprise|No|Yes| +|Education|No|Yes|
    @@ -144,8 +144,8 @@ The following list shows the supported values: |Home|No|No| |Pro|No|No| |Business|No|No| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| +|Enterprise|No|Yes| +|Education|No|Yes|
    From 138fd479d992a3dae186013f3df28b880db1c1fc Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 5 Jan 2022 15:41:22 +0530 Subject: [PATCH 0195/1077] Update policy-csp-humanpresence.md --- windows/client-management/mdm/policy-csp-humanpresence.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-humanpresence.md b/windows/client-management/mdm/policy-csp-humanpresence.md index 9ce283864c..4a902246b7 100644 --- a/windows/client-management/mdm/policy-csp-humanpresence.md +++ b/windows/client-management/mdm/policy-csp-humanpresence.md @@ -95,8 +95,8 @@ The following list shows the supported values: |Home|No|No| |Pro|No|No| |Business|No|No| -|Enterprise|No|Yes| -|Education|No|Yes| +|Enterprise|No|No| +|Education|No|No|
    @@ -144,8 +144,8 @@ The following list shows the supported values: |Home|No|No| |Pro|No|No| |Business|No|No| -|Enterprise|No|Yes| -|Education|No|Yes| +|Enterprise|No|No| +|Education|No|No|
    From 0b923c92302e773bd31594ee428f8e579940ea1e Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 5 Jan 2022 15:46:17 +0530 Subject: [PATCH 0196/1077] Update policy-csp-humanpresence.md --- windows/client-management/mdm/policy-csp-humanpresence.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-humanpresence.md b/windows/client-management/mdm/policy-csp-humanpresence.md index 4a902246b7..9ce283864c 100644 --- a/windows/client-management/mdm/policy-csp-humanpresence.md +++ b/windows/client-management/mdm/policy-csp-humanpresence.md @@ -95,8 +95,8 @@ The following list shows the supported values: |Home|No|No| |Pro|No|No| |Business|No|No| -|Enterprise|No|No| -|Education|No|No| +|Enterprise|No|Yes| +|Education|No|Yes|
    @@ -144,8 +144,8 @@ The following list shows the supported values: |Home|No|No| |Pro|No|No| |Business|No|No| -|Enterprise|No|No| -|Education|No|No| +|Enterprise|No|Yes| +|Education|No|Yes|
    From c9766eefa956eaeeaa14ccc4ce920e47d13af587 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Wed, 5 Jan 2022 13:02:03 +0200 Subject: [PATCH 0197/1077] Add info about next version https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10051 --- ...e-guard-signing-portal-in-microsoft-store-for-business.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md index 7311563492..cc73221cbc 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md @@ -26,6 +26,9 @@ ms.technology: windows-sec - Windows 11 - Windows Server 2016 and above +> [!IMPORTANT] +> The existing web-based mechanism for the Device Guard Signing service v1 will be retired on June 9, 2021. Please transition to the PowerShell based version of the service [(DGSS v2)](https://docs.microsoft.com/en-us/microsoft-store/device-guard-signing-portal). More details can be found [here](https://docs.microsoft.com/en-us/windows/msix/package/signing-package-device-guard-signing) and [here](https://docs.microsoft.com/en-us/microsoft-store/device-guard-signing-portal). + > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md). @@ -47,4 +50,4 @@ Before you get started, be sure to review these best practices: 4. After the files are uploaded, click **Sign** to sign the code integrity policy. 5. Click **Download** to download the signed code integrity policy. - When you sign a code integrity policy with the Device Guard signing portal, the signing certificate is added to the policy. This means you can't modify this policy. If you need to make changes, make them to an unsigned version of the policy, and then sign the policy again. \ No newline at end of file + When you sign a code integrity policy with the Device Guard signing portal, the signing certificate is added to the policy. This means you can't modify this policy. If you need to make changes, make them to an unsigned version of the policy, and then sign the policy again. From 25d4a0950f71c2e502a375619ff982e6ea4613a0 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Wed, 5 Jan 2022 13:31:25 +0200 Subject: [PATCH 0198/1077] add info https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10070 --- .../hello-hybrid-cert-new-install.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md index 893bb67c67..7fc2f3cb26 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md @@ -55,15 +55,17 @@ Windows Hello for Business must have a public key infrastructure regardless of t This guide assumes most enterprises have an existing public key infrastructure. Windows Hello for Business depends on a Windows enterprise public key infrastructure running the Active Directory Certificate Services role from Windows Server 2012 or later. +More details about configuring a Windows enterprise public key infrastructure and installing Active Directory Certificate Services can be found [here](https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki#follow-the-windows-hello-for-business-hybrid-key-trust-deployment-guide) and [here](https://docs.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/install-the-certification-authority). + +>[!NOTE] +>Never install a certificate authority on a domain controller in a production environment. + ### Lab-based public key infrastructure The following instructions may be used to deploy simple public key infrastructure that is suitable for a lab environment. Sign-in using _Enterprise Admin_ equivalent credentials on Windows Server 2012 or later server where you want the certificate authority installed. ->[!NOTE] ->Never install a certificate authority on a domain controller in a production environment. - 1. Open an elevated Windows PowerShell prompt. 2. Use the following command to install the Active Directory Certificate Services role. ```PowerShell @@ -148,4 +150,4 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation 3. New Installation Baseline (*You are here*) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) From dc2d02c4b0558776ab1ca484eb869f7eabd4e524 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 5 Jan 2022 17:51:09 +0530 Subject: [PATCH 0199/1077] Update policy-csp-eap.md --- windows/client-management/mdm/policy-csp-eap.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-eap.md b/windows/client-management/mdm/policy-csp-eap.md index 08c0a773c6..4a50535a07 100644 --- a/windows/client-management/mdm/policy-csp-eap.md +++ b/windows/client-management/mdm/policy-csp-eap.md @@ -30,7 +30,7 @@ manager: dansimp
    -**EAP/AllowTLS1_3<** +**EAP/AllowTLS1_3** From 2cee54dd4a417f4358dd836c4e09dc6025fd67de Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 5 Jan 2022 17:53:59 +0530 Subject: [PATCH 0200/1077] Update policy-csp-devicelock.md --- windows/client-management/mdm/policy-csp-devicelock.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index d32b7868bc..ebd5365b45 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -152,15 +152,14 @@ Specifies whether PINs or passwords such as "1111" or "1234" are allowed. For th > This policy must be wrapped in an Atomic command. - For additional information about this policy, see [Exchange ActiveSync Policy Engine Overview](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn282287(v=ws.11)). The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 (default) – Blocked +- 1 – Allowed From 007b329f4833bfed68f2a503095f43efb07ee4be Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 5 Jan 2022 19:49:03 +0530 Subject: [PATCH 0201/1077] Update policy-csp-defender.md --- windows/client-management/mdm/policy-csp-defender.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index f39d034b33..4e05320c00 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -2100,16 +2100,17 @@ This policy setting allows you to define the security intelligence location for ADMX Info: -- GP Friendly name: *Signature (Security intelligence) delivery optimization for Defender in Virtual Environments* +- GP Friendly name: *Define security intelligence location for VDI clients* - GP name: *SecurityIntelligenceLocation* - GP element: *SecurityIntelligenceLocation* -- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Security Intelligence Updates* - GP ADMX file name: *WindowsDefender.admx* -Empty string - no policy is set -Non-empty string - the policy is set and security intelligence is gathered from the location + +- Empty string - no policy is set +- Non-empty string - the policy is set and security intelligence is gathered from the location From df09430ff830a7ed40fc6697f4d031da6a43e6d7 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 5 Jan 2022 19:56:16 +0530 Subject: [PATCH 0202/1077] Update policy-csp-power.md --- windows/client-management/mdm/policy-csp-power.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index e8b4361743..f42ef230e5 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -120,22 +120,22 @@ manager: dansimp Pro - Yes + No Yes Business - Yes + No Yes Enterprise - Yes + No Yes Education - Yes + No Yes From dc66f44917d8b44b680ec3d1ca3f2bdfc9b25d06 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 5 Jan 2022 20:01:47 +0530 Subject: [PATCH 0203/1077] Update policy-csp-power.md --- windows/client-management/mdm/policy-csp-power.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index f42ef230e5..7ff6dc2585 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -14,11 +14,10 @@ manager: dansimp # Policy CSP - Power - -
    + ## Power policies
    From b37498d8e28cb552079306229bc99e7374f18cbf Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 5 Jan 2022 20:04:40 +0530 Subject: [PATCH 0204/1077] Update policy-csp-power.md --- windows/client-management/mdm/policy-csp-power.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 7ff6dc2585..535d207080 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -103,7 +103,7 @@ manager: dansimp
    -**Power/AllowHibernate** +**Power/AllowHibernate** From b06079f3acef6f0ff5fb392769236597645c0dda Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Wed, 5 Jan 2022 20:19:52 +0530 Subject: [PATCH 0205/1077] Update policy-csp-printers.md --- windows/client-management/mdm/policy-csp-printers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index d6f2240333..52f26fbc86 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -55,7 +55,7 @@ manager: dansimp
    -**Printers/ApprovedUsbPrintDevices** +**Printers/ApprovedUsbPrintDevices**
    From 23c5629f952b3593652e10dc7a0ec4496e2675f6 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 5 Jan 2022 09:30:18 -0800 Subject: [PATCH 0206/1077] Update devices-prevent-users-from-installing-printer-drivers.md --- .../devices-prevent-users-from-installing-printer-drivers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md b/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md index 8e293b382a..93bd2ad466 100644 --- a/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md +++ b/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md @@ -14,7 +14,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/19/2017 +ms.date: 01/05/2022 ms.technology: windows-sec --- From cf7dad1d318d8216ce76ccfe6a27cf2f9ba07db8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 5 Jan 2022 09:31:51 -0800 Subject: [PATCH 0207/1077] Update audit-registry.md --- windows/security/threat-protection/auditing/audit-registry.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/audit-registry.md b/windows/security/threat-protection/auditing/audit-registry.md index 38c9f81091..4004a503f4 100644 --- a/windows/security/threat-protection/auditing/audit-registry.md +++ b/windows/security/threat-protection/auditing/audit-registry.md @@ -11,7 +11,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp -ms.date: 12/16/2021 +ms.date: 01/05/2021 ms.technology: windows-sec --- From dfbc2a2cdf522005479ca7d70264d3337e3da7cf Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 5 Jan 2022 09:32:05 -0800 Subject: [PATCH 0208/1077] Update windows/security/threat-protection/auditing/audit-registry.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/security/threat-protection/auditing/audit-registry.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/auditing/audit-registry.md b/windows/security/threat-protection/auditing/audit-registry.md index 4004a503f4..ace2bfd284 100644 --- a/windows/security/threat-protection/auditing/audit-registry.md +++ b/windows/security/threat-protection/auditing/audit-registry.md @@ -49,4 +49,5 @@ If success auditing is enabled, an audit entry is generated each time any accoun > [!NOTE] > On creating a subkey for a parent (RegCreateKey), the expectation is to see an event for opening a handle for the newly created object (event 4656) issued by the object manager. You will see this event only when "Audit Object Access" is enabled under **Local Policies** > **Audit Policy** in Local Security Policy. This event is not generated while using precisely defined settings for seeing only registry-related events under **Advanced Audit Policy Configurations** > **Object Access** > **Audit Registry** in Local Security Policy. For example, you will not see this event with the setting to just see the registry-related auditing events using "auditpol.exe /set /subcategory:{0CCE921E-69AE-11D9-BED3-505054503030} /success:enable". +> > Calls to Registry APIs to access an open key object to perform an operation such as RegSetValue, RegEnumValue, and RegRenameKey would trigger an event to access the object (event 4663). For example, creating a subkey using regedit.exe would not trigger a 4663 event, but renaming it would. From 7ea140075427fdd0009ecba20c3d9d1b41fd0fc3 Mon Sep 17 00:00:00 2001 From: Matthew Palko Date: Wed, 5 Jan 2022 10:03:05 -0800 Subject: [PATCH 0209/1077] fixing warnings --- .../hello-deployment-migration.md | 6 +++--- .../hello-hybrid-cloud-trust.md | 19 +++++++++++++++++++ 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-migration.md b/windows/security/identity-protection/hello-for-business/hello-deployment-migration.md index 3ab14c6a25..26602d5af6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-migration.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-migration.md @@ -1,6 +1,6 @@ --- -title: Windows Hello for Business Deployment Known Issues -description: A Troubleshooting Guide for Known Windows Hello for Business Deployment Issues +title: Migrating Between Windows Hello For Business Deployment Types +description: A guide outlining the different Windows Hello deployment types, which migrations are supported, and how to migrate keywords: identity, PIN, biometric, Hello, passport params: siblings_only ms.prod: m365-security @@ -17,7 +17,7 @@ localizationpriority: medium ms.date: 05/03/2021 ms.reviewer: --- -# Windows Hello for Business Known Deployment Issues +# TBD TBD diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust.md index e69de29bb2..28e9e95cd7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust.md @@ -0,0 +1,19 @@ +--- +title: Hybrid Cloud Trust Deployment (Windows Hello for Business) +description: Learn the information you need to successfully deploy Windows Hello for Business in a hybrid cloud trust scenario. +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 1/05/2022 +ms.reviewer: +--- +# Hybrid Azure AD joined Certificate Trust Deployment From a1ef229ccc4ca43d3f5517b526dce0f188dedf0f Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Wed, 5 Jan 2022 17:57:15 -0500 Subject: [PATCH 0210/1077] Removing Win10 Mobile --- .../ltsc/whats-new-windows-10-2015.md | 50 +++++++-------- .../ltsc/whats-new-windows-10-2016.md | 13 ++-- ...ts-new-windows-10-version-1507-and-1511.md | 62 +++++++++---------- .../whats-new-windows-10-version-1607.md | 7 +-- 4 files changed, 64 insertions(+), 68 deletions(-) diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2015.md b/windows/whats-new/ltsc/whats-new-windows-10-2015.md index d02ab43956..9aa921ea74 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2015.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2015.md @@ -17,12 +17,12 @@ ms.topic: article # What's new in Windows 10 Enterprise LTSC 2015 **Applies to** -- Windows 10 Enterprise LTSC 2015 +- Windows 10 Enterprise LTSC 2015 -This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md). +This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md). ->[!NOTE] ->Features in Windows 10 Enterprise LTSC 2015 are equivalent to [Windows 10, version 1507](../whats-new-windows-10-version-1507-and-1511.md). +> [!NOTE] +> Features in Windows 10 Enterprise LTSC 2015 are equivalent to [Windows 10, version 1507](../whats-new-windows-10-version-1507-and-1511.md). ## Deployment @@ -42,7 +42,6 @@ Enhancements to AppLocker in Windows 10 include: - A new parameter was added to the [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy) Windows PowerShell cmdlet that lets you choose whether executable and DLL rule collections apply to non-interactive processes. To enable this, set the **ServiceEnforcement** to **Enabled**. - A new [AppLocker](/windows/client-management/mdm/applocker-csp) configuration service provider was add to allow you to enable AppLocker rules by using an MDM server. -- You can manage Windows 10 Mobile devices by using the new [AppLocker CSP](/windows/client-management/mdm/applocker-csp). [Learn how to manage AppLocker within your organization](/windows/device-security/applocker/applocker-overview). @@ -58,7 +57,7 @@ Enhancements to AppLocker in Windows 10 include: ### Certificate management -For Windows 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You'll be able to use MDM to enroll, renew, and delete certificates. As in Windows Phone 8.1, you can use the [Certificates app](https://go.microsoft.com/fwlink/p/?LinkId=615824) to review the details of certificates on your device. [Learn how to install digital certificates on Windows 10 Mobile.](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile) +For Windows 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You'll be able to use MDM to enroll, renew, and delete certificates. ### Microsoft Passport @@ -68,13 +67,13 @@ Microsoft Passport lets users authenticate to a Microsoft account, an Active Dir ### Security auditing -In Windows 10, security auditing has added some improvements: +In Windows 10, security auditing has added some improvements: - [New audit subcategories](#bkmk-auditsubcat) - [More info added to existing audit events](#bkmk-moreinfo) #### New audit subcategories -In Windows 10, two new audit subcategories were added to the Advanced Audit Policy Configuration to provide greater granularity in audit events: +In Windows 10, two new audit subcategories were added to the Advanced Audit Policy Configuration to provide greater granularity in audit events: - [Audit Group Membership](/windows/device-security/auditing/audit-group-membership) Found in the Logon/Logoff audit category, the Audit Group Membership subcategory allows you to audit the group membership information in a user's logon token. Events in this subcategory are generated when group memberships are enumerated or queried on the PC where the logon session was created. For an interactive logon, the security audit event is generated on the PC that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the PC hosting the resource. When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the **Audit Logon** setting under **Advanced Audit Policy Configuration\\System Audit Policies\\Logon/Logoff**. Multiple events are generated if the group membership information cannot fit in a single security audit event. - [Audit PNP Activity](/windows/device-security/auditing/audit-pnp-activity) Found in the Detailed Tracking category, the Audit PNP Activity subcategory allows you to audit when plug and play detects an external device. @@ -83,7 +82,7 @@ In Windows 10, two new audit subcategories were added to the Advanced Audit Pol #### More info added to existing audit events -With Windows 10, version 1507, we've added more info to existing audit events to make it easier for you to put together a full audit trail and come away with the information you need to protect your enterprise. Improvements were made to the following audit events: +With Windows 10, version 1507, we've added more info to existing audit events to make it easier for you to put together a full audit trail and come away with the information you need to protect your enterprise. Improvements were made to the following audit events: - [Changed the kernel default audit policy](#bkmk-kdal) - [Added a default process SACL to LSASS.exe](#bkmk-lsass) - [Added new fields in the logon event](#bkmk-logon) @@ -94,11 +93,11 @@ With Windows 10, version 1507, we've added more info to existing audit events t #### Changed the kernel default audit policy -In previous releases, the kernel depended on the Local Security Authority (LSA) to retrieve info in some of its events. In Windows 10, the process creation events audit policy is automatically enabled until an actual audit policy is received from LSA. This results in better auditing of services that may start before LSA starts. +In previous releases, the kernel depended on the Local Security Authority (LSA) to retrieve info in some of its events. In Windows 10, the process creation events audit policy is automatically enabled until an actual audit policy is received from LSA. This results in better auditing of services that may start before LSA starts. #### Added a default process SACL to LSASS.exe -In Windows 10, a default process SACL was added to LSASS.exe to log processes attempting to access LSASS.exe. The SACL is L"S:(AU;SAFA;0x0010;;;WD)". You can enable this under **Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object**. +In Windows 10, a default process SACL was added to LSASS.exe to log processes attempting to access LSASS.exe. The SACL is L"S:(AU;SAFA;0x0010;;;WD)". You can enable this under **Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object**. This can help identify attacks that steal credentials from the memory of a process. #### New fields in the logon event @@ -137,7 +136,7 @@ The logon event ID 4688 has been updated to include more verbose information to #### New Security Account Manager events -In Windows 10, new SAM events were added to cover SAM APIs that perform read/query operations. In previous versions of Windows, only write operations were audited. The new events are event ID 4798 and event ID 4799. The following APIs are now audited: +In Windows 10, new SAM events were added to cover SAM APIs that perform read/query operations. In previous versions of Windows, only write operations were audited. The new events are event ID 4798 and event ID 4799. The following APIs are now audited: - SamrEnumerateGroupsInDomain - SamrEnumerateUsersInDomain - SamrEnumerateAliasesInDomain @@ -170,9 +169,9 @@ Event ID 6416 has been added to track when an external device is detected throug ### Trusted Platform Module -#### New TPM features in Windows 10 +#### New TPM features in Windows 10 -The following sections describe the new and changed functionality in the TPM for Windows 10: +The following sections describe the new and changed functionality in the TPM for Windows 10: - [Device health attestation](#bkmk-dha) - [Microsoft Passport](/windows/access-protection/hello-for-business/hello-identity-verification) support - [Device Guard](/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies) support @@ -186,7 +185,8 @@ Some things that you can check on the device are: - Is BitLocker Drive Encryption supported and enabled? - Is SecureBoot supported and enabled? -> **Note**  The device must be running Windows 10 and it must support at least TPM 2.0. +> [!NOTE] +> The device must be running Windows 10 and it must support at least TPM 2.0. [Learn how to deploy and manage TPM within your organization](/windows/device-security/tpm//trusted-platform-module-overview). @@ -198,7 +198,7 @@ You should not turn off UAC because this is not a supported scenario for devices For more info about how manage UAC, see [UAC Group Policy Settings and Registry Key Settings](/windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings). -In Windows 10, User Account Control has added some improvements: +In Windows 10, User Account Control has added some improvements: - **Integration with the Antimalware Scan Interface (AMSI)**. The [AMSI](/windows/win32/amsi/antimalware-scan-interface-portal) scans all UAC elevation requests for malware. If malware is detected, the admin privilege is blocked. @@ -219,13 +219,13 @@ Windows 10 provides a set of VPN features that both increase enterprise security ## Management -Windows 10 provides mobile device management (MDM) capabilities for PCs, laptops, tablets, and phones that enable enterprise-level management of corporate-owned and personal devices. +Windows 10 provides mobile device management (MDM) capabilities for PCs, laptops, tablets, and phones that enable enterprise-level management of corporate-owned and personal devices. ### MDM support -MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Microsoft Store, VPN configuration, and more. +MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Microsoft Store, VPN configuration, and more. -MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](https://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification. +MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](https://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification. Corporate-owned devices can be enrolled automatically for enterprises using Azure AD. [Reference for Mobile device management for Windows 10](/windows/client-management/mdm/) @@ -245,8 +245,8 @@ Enterprises have the following identity and management choices. | Grouping | Domain join; Workgroup; Azure AD join | | Device management | Group Policy; Microsoft Endpoint Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) | - > **Note**   -With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](/lifecycle/). +> [!NOTE] +> With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](/lifecycle/). ### Device lockdown @@ -272,9 +272,9 @@ Administrators can also use mobile device management (MDM) or Group Policy to di ## Updates -Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service. +Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service. -By using [Group Policy Objects](/previous-versions/cc498727(v=msdn.10)), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: +By using [Group Policy Objects](/previous-versions/cc498727(v=msdn.10)), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: - **Deployment and validation groups**; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met). @@ -287,7 +287,7 @@ Together, these Windows Update for Business features help reduce device manageme Learn more about [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb). -For more information about updating Windows 10, see [Windows 10 servicing options for updates and upgrades](/windows/deployment/update/waas-servicing-strategy-windows-10-updates). +For more information about updating Windows 10, see [Windows 10 servicing options for updates and upgrades](/windows/deployment/update/waas-servicing-strategy-windows-10-updates). ## Microsoft Edge @@ -295,4 +295,4 @@ The new chromium-based Microsoft Edge is not included in the LTSC release of Win ## See Also -[Windows 10 Enterprise LTSC](index.md): A description of the LTSC servicing channel with links to information about each release. \ No newline at end of file +[Windows 10 Enterprise LTSC](index.md): A description of the LTSC servicing channel with links to information about each release. diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2016.md b/windows/whats-new/ltsc/whats-new-windows-10-2016.md index b563c7b398..1a98ceb952 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2016.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2016.md @@ -17,9 +17,9 @@ ms.topic: article # What's new in Windows 10 Enterprise LTSC 2016 **Applies to** -- Windows 10 Enterprise LTSC 2016 +- Windows 10 Enterprise LTSC 2016 -This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2016 (LTSB), compared to Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md). +This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2016 (LTSB), compared to Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md). >[!NOTE] >Features in Windows 10 Enterprise LTSC 2016 are equivalent to Windows 10, version 1607. @@ -76,7 +76,6 @@ Additional changes for Windows Hello in Windows 10 Enterprise LTSC 2016: - Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. - Group Policy settings for managing Windows Hello for Business are now available for both **User Configuration** and **Computer Configuration**. - Beginning in this version of Windows 10, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN, enable the Group Policy setting **Turn on convenience PIN sign-in**. - [Learn more about Windows Hello for Business.](/windows/access-protection/hello-for-business/hello-identity-verification) @@ -88,7 +87,9 @@ Additional changes for Windows Hello in Windows 10 Enterprise LTSC 2016: It provides the following benefits: - The algorithm is FIPS-compliant. - Easy to administer. You can use the BitLocker Wizard, manage-bde, Group Policy, MDM policy, Windows PowerShell, or WMI to manage it on devices in your organization. - >**Note:** Drives encrypted with XTS-AES will not be accessible on older version of Windows. This is only recommended for fixed and operating system drives. Removable drives should continue to use the AES-CBC 128-bit or AES-CBC 256-bit algorithms. + + > [!NOTE] + > Drives encrypted with XTS-AES will not be accessible on older version of Windows. This is only recommended for fixed and operating system drives. Removable drives should continue to use the AES-CBC 128-bit or AES-CBC 256-bit algorithms. ### Security auditing @@ -135,7 +136,7 @@ With the growing threat from more sophisticated targeted attacks, a new security - The VPN client can integrate with the Conditional Access Framework, a cloud-based policy engine built into Azure Active Directory, to provide a device compliance option for remote clients. - The VPN client can integrate with Windows Information Protection (WIP) policy to provide additional security. [Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip), previously known as Enterprise Data Protection. - New VPNv2 configuration service provider (CSP) adds configuration settings. For details, see [What's new in MDM enrollment and management](/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew_1607) -- Microsoft Intune: *VPN Profile (Windows 10 Desktop and Mobile and later)* policy template includes support for native VPN plug-ins. +- Microsoft Intune: *VPN* profile template includes support for native VPN plug-ins. For more information, see [Create VPN profiles to connect to VPN servers in Intune](/mem/intune/configuration/vpn-settings-configure). ## Management @@ -179,4 +180,4 @@ The new chromium-based Microsoft Edge is not included in the LTSC release of Win ## See Also -[Windows 10 Enterprise LTSC](index.md): A description of the LTSC servicing channel with links to information about each release. \ No newline at end of file +[Windows 10 Enterprise LTSC](index.md): A description of the LTSC servicing channel with links to information about each release. diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index 373252080c..efdd81bde2 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -1,6 +1,6 @@ --- title: What's new in Windows 10, versions 1507 and 1511 (Windows 10) -description: What's new in Windows 10 for Windows 10 (versions 1507 and 1511) and Windows 10 Mobile. +description: What's new in Windows 10 for Windows 10 (versions 1507 and 1511). ms.assetid: 75F285B0-09BE-4821-9B42-37B9BE54CEC6 ms.reviewer: ms.prod: w10 @@ -34,11 +34,10 @@ With Windows 10, you can create provisioning packages that let you quickly and e ### AppLocker -#### New AppLocker features in Windows 10, version 1507 +#### New AppLocker features in Windows 10, version 1507 - A new parameter was added to the [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy) Windows PowerShell cmdlet that lets you choose whether executable and DLL rule collections apply to non-interactive processes. To enable this, set the **ServiceEnforcement** to **Enabled**. - A new [AppLocker](/windows/client-management/mdm/applocker-csp) configuration service provider was add to allow you to enable AppLocker rules by using an MDM server. -- You can manage Windows 10 Mobile devices by using the new [AppLocker CSP](/windows/client-management/mdm/applocker-csp). [Learn how to manage AppLocker within your organization](/windows/device-security/applocker/applocker-overview). @@ -51,10 +50,10 @@ With Windows 10, you can create provisioning packages that let you quickly and e - The algorithm is FIPS-compliant. - Easy to administer. You can use the BitLocker Wizard, manage-bde, Group Policy, MDM policy, Windows PowerShell, or WMI to manage it on devices in your organization. ->[!NOTE] ->Drives encrypted with XTS-AES will not be accessible on older version of Windows. This is only recommended for fixed and operating system drives. Removable drives should continue to use the AES-CBC 128-bit or AES-CBC 256-bit algorithms. +> [!NOTE] +> Drives encrypted with XTS-AES will not be accessible on older version of Windows. This is only recommended for fixed and operating system drives. Removable drives should continue to use the AES-CBC 128-bit or AES-CBC 256-bit algorithms. -#### New BitLocker features in Windows 10, version 1507 +#### New BitLocker features in Windows 10, version 1507 @@ -80,7 +79,7 @@ With Windows 10, you can create provisioning packages that let you quickly and e ### Easier certificate management -For Windows 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You'll be able to use MDM to enroll, renew, and delete certificates. As in Windows Phone 8.1, you can use the [Certificates app](https://go.microsoft.com/fwlink/p/?LinkId=615824) to review the details of certificates on your device. [Learn how to install digital certificates on Windows 10 Mobile.](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile) +For Windows 10-based devices, you can use your MDM server to directly deploy client authentication certificates using Personal Information Exchange (PFX), in addition to enrolling using Simple Certificate Enrollment Protocol (SCEP), including certificates to enable Windows Hello for Business in your enterprise. You'll be able to use MDM to enroll, renew, and delete certificates. ### Microsoft Passport @@ -94,15 +93,15 @@ Microsoft Passport lets users authenticate to a Microsoft account, an Active Dir - The [WindowsSecurityAuditing](/windows/client-management/mdm/windowssecurityauditing-csp) and [Reporting](/windows/client-management/mdm/reporting-csp) configuration service providers allow you to add security audit policies to mobile devices. -#### New features in Windows 10, version 1507 +#### New features in Windows 10, version 1507 -In Windows 10, security auditing has added some improvements: +In Windows 10, security auditing has added some improvements: - [New audit subcategories](#bkmk-auditsubcat) - [More info added to existing audit events](#bkmk-moreinfo) ##### New audit subcategories -In Windows 10, two new audit subcategories were added to the Advanced Audit Policy Configuration to provide greater granularity in audit events: +In Windows 10, two new audit subcategories were added to the Advanced Audit Policy Configuration to provide greater granularity in audit events: - [Audit Group Membership](/windows/device-security/auditing/audit-group-membership) Found in the Logon/Logoff audit category, the Audit Group Membership subcategory allows you to audit the group membership information in a user's logon token. Events in this subcategory are generated when group memberships are enumerated or queried on the PC where the logon session was created. For an interactive logon, the security audit event is generated on the PC that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the PC hosting the resource. When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the **Audit Logon** setting under **Advanced Audit Policy Configuration\\System Audit Policies\\Logon/Logoff**. Multiple events are generated if the group membership information cannot fit in a single security audit event. - [Audit PNP Activity](/windows/device-security/auditing/audit-pnp-activity) Found in the Detailed Tracking category, the Audit PNP Activity subcategory allows you to audit when plug and play detects an external device. @@ -111,7 +110,7 @@ In Windows 10, two new audit subcategories were added to the Advanced Audit Pol ##### More info added to existing audit events -With Windows 10, version 1507, we've added more info to existing audit events to make it easier for you to put together a full audit trail and come away with the information you need to protect your enterprise. Improvements were made to the following audit events: +With Windows 10, version 1507, we've added more info to existing audit events to make it easier for you to put together a full audit trail and come away with the information you need to protect your enterprise. Improvements were made to the following audit events: - [Changed the kernel default audit policy](#bkmk-kdal) - [Added a default process SACL to LSASS.exe](#bkmk-lsass) - [Added new fields in the logon event](#bkmk-logon) @@ -122,11 +121,11 @@ With Windows 10, version 1507, we've added more info to existing audit events t ##### Changed the kernel default audit policy -In previous releases, the kernel depended on the Local Security Authority (LSA) to retrieve info in some of its events. In Windows 10, the process creation events audit policy is automatically enabled until an actual audit policy is received from LSA. This results in better auditing of services that may start before LSA starts. +In previous releases, the kernel depended on the Local Security Authority (LSA) to retrieve info in some of its events. In Windows 10, the process creation events audit policy is automatically enabled until an actual audit policy is received from LSA. This results in better auditing of services that may start before LSA starts. ##### Added a default process SACL to LSASS.exe -In Windows 10, a default process SACL was added to LSASS.exe to log processes attempting to access LSASS.exe. The SACL is L"S:(AU;SAFA;0x0010;;;WD)". You can enable this under **Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object**. +In Windows 10, a default process SACL was added to LSASS.exe to log processes attempting to access LSASS.exe. The SACL is L"S:(AU;SAFA;0x0010;;;WD)". You can enable this under **Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object**. This can help identify attacks that steal credentials from the memory of a process. ##### New fields in the logon event @@ -165,7 +164,7 @@ The logon event ID 4688 has been updated to include more verbose information to ##### New Security Account Manager events -In Windows 10, new SAM events were added to cover SAM APIs that perform read/query operations. In previous versions of Windows, only write operations were audited. The new events are event ID 4798 and event ID 4799. The following APIs are now audited: +In Windows 10, new SAM events were added to cover SAM APIs that perform read/query operations. In previous versions of Windows, only write operations were audited. The new events are event ID 4798 and event ID 4799. The following APIs are now audited: - SamrEnumerateGroupsInDomain - SamrEnumerateUsersInDomain - SamrEnumerateAliasesInDomain @@ -198,13 +197,13 @@ Event ID 6416 has been added to track when an external device is detected throug ### Trusted Platform Module -#### New TPM features in Windows 10, version 1511 +#### New TPM features in Windows 10, version 1511 - Key Storage Providers (KSPs) and srvcrypt support elliptical curve cryptography (ECC). -#### New TPM features in Windows 10, version 1507 +#### New TPM features in Windows 10, version 1507 -The following sections describe the new and changed functionality in the TPM for Windows 10: +The following sections describe the new and changed functionality in the TPM for Windows 10: - [Device health attestation](#bkmk-dha) - [Microsoft Passport](/windows/access-protection/hello-for-business/hello-identity-verification) support - [Device Guard](/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies) support @@ -219,7 +218,7 @@ Some things that you can check on the device are: - Is SecureBoot supported and enabled? >[!NOTE] ->The device must be running Windows 10 and it must support at least TPM 2.0. +>The device must be running Windows 10 and it must support at least TPM 2.0. [Learn how to deploy and manage TPM within your organization](/windows/device-security/tpm//trusted-platform-module-overview). @@ -231,9 +230,9 @@ You should not turn off UAC because this is not a supported scenario for devices For more info about how manage UAC, see [UAC Group Policy Settings and Registry Key Settings](/windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings). -In Windows 10, User Account Control has added some improvements. +In Windows 10, User Account Control has added some improvements. -#### New User Account Control features in Windows 10, version 1507 +#### New User Account Control features in Windows 10, version 1507 - **Integration with the Antimalware Scan Interface (AMSI)**. The [AMSI](/windows/win32/amsi/antimalware-scan-interface-portal) scans all UAC elevation requests for malware. If malware is detected, the admin privilege is blocked. @@ -254,13 +253,13 @@ Windows 10 provides a set of VPN features that both increase enterprise security ## Management -Windows 10 provides mobile device management (MDM) capabilities for PCs, laptops, tablets, and phones that enable enterprise-level management of corporate-owned and personal devices. +Windows 10 provides mobile device management (MDM) capabilities for PCs, laptops, tablets, and phones that enable enterprise-level management of corporate-owned and personal devices. ### MDM support -MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Microsoft Store, VPN configuration, and more. +MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Microsoft Store, VPN configuration, and more. -MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](https://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification. +MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](https://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification. Corporate-owned devices can be enrolled automatically for enterprises using Azure AD. [Reference for Mobile device management for Windows 10](/windows/client-management/mdm/) @@ -282,7 +281,8 @@ Enterprises have the following identity and management choices. | Grouping | Domain join; Workgroup; Azure AD join | | Device management | Group Policy; Microsoft Endpoint Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) | -**Note:** With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](/lifecycle/). +> [!NOTE] +> With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](/lifecycle/). ### Device lockdown @@ -318,9 +318,9 @@ For more information, see [Microsoft Store for Business overview](/microsoft-sto ## Updates -Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service. +Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service. -By using [Group Policy Objects](/previous-versions/cc498727(v=msdn.10)), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: +By using [Group Policy Objects](/previous-versions/cc498727(v=msdn.10)), Windows Update for Business is an easily established and implemented system which enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: - **Deployment and validation groups**; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met). @@ -333,7 +333,7 @@ Together, these Windows Update for Business features help reduce device manageme Learn more about [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb). -For more information about updating Windows 10, see [Windows 10 servicing options for updates and upgrades](/windows/deployment/update/waas-servicing-strategy-windows-10-updates). +For more information about updating Windows 10, see [Windows 10 servicing options for updates and upgrades](/windows/deployment/update/waas-servicing-strategy-windows-10-updates). ## Microsoft Edge Microsoft Edge takes you beyond just browsing to actively engaging with the web through features like Web Note, Reading View, and Cortana. @@ -344,9 +344,9 @@ Microsoft Edge takes you beyond just browsing to actively engaging with the web - **Compatibility and security.** Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or that are included on your Enterprise Mode Site List. You must use IE11 to run older, less secure technology, such as ActiveX controls. ### Enterprise guidance -Microsoft Edge is the default browser experience for Windows 10 and Windows 10 Mobile. However, if you're running web apps that need ActiveX controls, we recommend that you continue to use Internet Explorer 11 for them. If you don't have IE11 installed anymore, you can download it from the Microsoft Store or from the [Internet Explorer 11 download page](https://go.microsoft.com/fwlink/p/?linkid=290956). +Microsoft Edge is the default browser experience for Windows 10. However, if you're running web apps that need ActiveX controls, we recommend that you continue to use Internet Explorer 11 for them. If you don't have IE11 installed anymore, you can download it from the Microsoft Store or from the [Internet Explorer 11 download page](https://go.microsoft.com/fwlink/p/?linkid=290956). -We also recommend that you upgrade to IE11 if you're running any earlier versions of Internet Explorer. IE11 is supported on Windows 7, Windows 8.1, and Windows 10. So any legacy apps that work with IE11 will continue to work even as you migrate to Windows 10. +We also recommend that you upgrade to IE11 if you're running any earlier versions of Internet Explorer. IE11 is supported on Windows 7, Windows 8.1, and Windows 10. So any legacy apps that work with IE11 will continue to work even as you migrate to Windows 10. [Learn more about using Microsoft Edge in the enterprise](/microsoft-edge/deploy/emie-to-improve-compatibility) @@ -354,7 +354,3 @@ We also recommend that you upgrade to IE11 if you're running any earlier version ## Learn more - [Windows 10 release information](https://technet.microsoft.com/windows/release-info) - - - - diff --git a/windows/whats-new/whats-new-windows-10-version-1607.md b/windows/whats-new/whats-new-windows-10-version-1607.md index e211ea26c2..ccf2f1132f 100644 --- a/windows/whats-new/whats-new-windows-10-version-1607.md +++ b/windows/whats-new/whats-new-windows-10-version-1607.md @@ -1,6 +1,6 @@ --- title: What's new in Windows 10, version 1607 (Windows 10) -description: What's new in Windows 10 for Windows 10 (version 1607) and Windows 10 Mobile. +description: What's new in Windows 10 for Windows 10 (version 1607). keywords: ["What's new in Windows 10", "Windows 10", "anniversary update"] ms.prod: w10 ms.mktglfcycl: deploy @@ -19,7 +19,7 @@ Below is a list of some of the new and updated features in Windows 10, version 1 >[!NOTE] >For release dates and servicing options for each version, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info). -   + ## Deployment ### Windows Imaging and Configuration Designer (ICD) @@ -78,7 +78,6 @@ Additional changes for Windows Hello in Windows 10, version 1607: - Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. - Group Policy settings for managing Windows Hello for Business are now available for both **User Configuration** and **Computer Configuration**. - Beginning in version 1607, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN for Windows 10, version 1607, enable the Group Policy setting **Turn on convenience PIN sign-in**. - [Learn more about Windows Hello for Business.](/windows/access-protection/hello-for-business/hello-identity-verification) @@ -87,7 +86,7 @@ Additional changes for Windows Hello in Windows 10, version 1607: - The VPN client can integrate with the Conditional Access Framework, a cloud-based policy engine built into Azure Active Directory, to provide a device compliance option for remote clients. - The VPN client can integrate with Windows Information Protection (WIP) policy to provide additional security. [Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip), previously known as Enterprise Data Protection. - New VPNv2 configuration service provider (CSP) adds configuration settings. For details, see [What's new in MDM enrollment and management](/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew_1607) -- Microsoft Intune: *VPN Profile (Windows 10 Desktop and Mobile and later)* policy template includes support for native VPN plug-ins. +- Microsoft Intune: *VPN* profile template includes support for native VPN plug-ins. For more information, see [Create VPN profiles to connect to VPN servers in Intune](/mem/intune/configuration/vpn-settings-configure). ### Windows Information Protection (WIP), formerly known as enterprise data protection (EDP) From 5c669bde762a84a0779e938a257c1e568a497a28 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Thu, 6 Jan 2022 10:22:46 +0200 Subject: [PATCH 0211/1077] Update windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-cert-new-install.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md index 7fc2f3cb26..c93d1abad1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md @@ -55,7 +55,7 @@ Windows Hello for Business must have a public key infrastructure regardless of t This guide assumes most enterprises have an existing public key infrastructure. Windows Hello for Business depends on a Windows enterprise public key infrastructure running the Active Directory Certificate Services role from Windows Server 2012 or later. -More details about configuring a Windows enterprise public key infrastructure and installing Active Directory Certificate Services can be found [here](https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki#follow-the-windows-hello-for-business-hybrid-key-trust-deployment-guide) and [here](https://docs.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/install-the-certification-authority). +For more details about configuring a Windows enterprise public key infrastructure and installing Active Directory Certificate Services, see [Follow the Windows Hello for Business hybrid key trust deployment guide](/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki#follow-the-windows-hello-for-business-hybrid-key-trust-deployment-guide) and [Install the Certification Authority](/windows-server/networking/core-network-guide/cncg/server-certs/install-the-certification-authority). >[!NOTE] >Never install a certificate authority on a domain controller in a production environment. From 618bad0a8532ac48d1b91b27b900844a7fe67dd7 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Thu, 6 Jan 2022 10:30:52 +0200 Subject: [PATCH 0212/1077] Update windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-cert-new-install.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md index c93d1abad1..05d4a7b317 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md @@ -57,8 +57,8 @@ This guide assumes most enterprises have an existing public key infrastructure. For more details about configuring a Windows enterprise public key infrastructure and installing Active Directory Certificate Services, see [Follow the Windows Hello for Business hybrid key trust deployment guide](/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki#follow-the-windows-hello-for-business-hybrid-key-trust-deployment-guide) and [Install the Certification Authority](/windows-server/networking/core-network-guide/cncg/server-certs/install-the-certification-authority). ->[!NOTE] ->Never install a certificate authority on a domain controller in a production environment. +> [!NOTE] +> Never install a certificate authority on a domain controller in a production environment. ### Lab-based public key infrastructure From d5815d8d148ba556dd906e8a2800b4899c4512f2 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Thu, 6 Jan 2022 11:34:51 +0200 Subject: [PATCH 0213/1077] Update windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../devices-prevent-users-from-installing-printer-drivers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md b/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md index 93bd2ad466..5b2bfdf5aa 100644 --- a/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md +++ b/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md @@ -44,7 +44,7 @@ Although it might be appropriate in some organizations to allow users to install - It is advisable to set **Devices: Prevent users from installing printer drivers** to Enabled. Only users in the Administrative, Power User, or Server Operator groups will be able to install printers on servers. If this policy setting is enabled, but the driver for a network printer already exists on the local computer, users can still add the network printer. This policy setting does not affect a user's ability to add a local printer. > [!NOTE] -> After applying the [July 6, 2021 updates](https://support.microsoft.com/en-us/topic/kb5005010-restricting-installation-of-new-printer-drivers-after-applying-the-july-6-2021-updates-31b91c02-05bc-4ada-a7ea-183b129578a7), non-administrators, including delegated admin groups like printer operators, cannot install signed and unsigned printer drivers to a print server. By default, only administrators can install both signed and unsigned printer drivers to a print server. +> After applying the [July 6, 2021 updates](https://support.microsoft.com/topic/kb5005010-restricting-installation-of-new-printer-drivers-after-applying-the-july-6-2021-updates-31b91c02-05bc-4ada-a7ea-183b129578a7), non-administrators, including delegated admin groups like printer operators, cannot install signed and unsigned printer drivers to a print server. By default, only administrators can install both signed and unsigned printer drivers to a print server. ### Location From 6b861b7d7dc6855f8b2d91d185d1685760207799 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Thu, 6 Jan 2022 11:35:22 +0200 Subject: [PATCH 0214/1077] Update windows/security/identity-protection/hello-for-business/hello-faq.yml Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../identity-protection/hello-for-business/hello-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index b033cf57b3..b4dc152193 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -100,7 +100,7 @@ sections: [Windows Hello for Business forgotten PIN user experience](hello-videos.md#windows-hello-for-business-forgotten-pin-user-experience) - For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs. Non-destructive PIN reset works without access to corporate network. Destructive PIN reset requires access to corporate network. More details about destructive and non-destructive PIN reset can be found [here](https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset). + For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can onboard their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs. Non-destructive PIN reset works without access to the corporate network. Destructive PIN reset requires access to the corporate network. For more details about destructive and non-destructive PIN reset, see [PIN reset](/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset). - question: What URLs do I need to allow for a hybrid deployment? answer: | From 03c95d0f0909232244c48b4ccd5e0204a03ed74f Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Thu, 6 Jan 2022 11:35:47 +0200 Subject: [PATCH 0215/1077] Update windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...vice-guard-signing-portal-in-microsoft-store-for-business.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md index cc73221cbc..5956abbc56 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md @@ -27,7 +27,7 @@ ms.technology: windows-sec - Windows Server 2016 and above > [!IMPORTANT] -> The existing web-based mechanism for the Device Guard Signing service v1 will be retired on June 9, 2021. Please transition to the PowerShell based version of the service [(DGSS v2)](https://docs.microsoft.com/en-us/microsoft-store/device-guard-signing-portal). More details can be found [here](https://docs.microsoft.com/en-us/windows/msix/package/signing-package-device-guard-signing) and [here](https://docs.microsoft.com/en-us/microsoft-store/device-guard-signing-portal). +> The existing web-based mechanism for the Device Guard Signing Service v1 will be retired on June 9, 2021. Please transition to the PowerShell based version of the service [(DGSS v2)](/microsoft-store/device-guard-signing-portal). For more details, see [Sign an MSIX package with Device Guard signing](/windows/msix/package/signing-package-device-guard-signing) and [Device Guard signing](/microsoft-store/device-guard-signing-portal). > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md). From da207de45741eed0d937f53f001f9757ac27704f Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Thu, 6 Jan 2022 16:10:30 +0530 Subject: [PATCH 0216/1077] Updated --- .../mdm/policy-csp-remotedesktop.md | 264 ++++++++++++++++++ .../mdm/policy-csp-search.md | 49 +--- 2 files changed, 266 insertions(+), 47 deletions(-) create mode 100644 windows/client-management/mdm/policy-csp-remotedesktop.md diff --git a/windows/client-management/mdm/policy-csp-remotedesktop.md b/windows/client-management/mdm/policy-csp-remotedesktop.md new file mode 100644 index 0000000000..e30c9f6ceb --- /dev/null +++ b/windows/client-management/mdm/policy-csp-remotedesktop.md @@ -0,0 +1,264 @@ +--- +title: Policy CSP - RemoteDesktop +description: Learn how the Policy CSP - RemoteDesktop setting allows you to specify a custom message to display. +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: dansimp +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - RemoteDesktop + +
    + + +## RemoteDesktop policies + +
    +
    + RemoteDesktop/AutoSubscription +
    +
    + RemoteDesktop/LoadAadCredKeyFromProfile +
    +
    + +> [!TIP] +> These are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + +
    + + +**RemoteDesktop/AutoSubscription<** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + + + + + + +ADMX Info: +- GP Friendly name: *Customize warning messages* +- GP name: *AutoSubscription* +- GP path: *System/Remote Desktop* +- GP ADMX file name: *remotedesktop.admx* + + + + +
    + + +**RemoteAssistance/SessionLogging** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting allows you to turn logging on or off. Log files are located in the user's Documents folder under Remote Assistance. + +If you enable this policy setting, log files are generated. + +If you disable this policy setting, log files are not generated. + +If you do not configure this setting, application-based settings are used. + + + + +ADMX Info: +- GP Friendly name: *Turn on session logging* +- GP name: *RA_Logging* +- GP path: *System/Remote Assistance* +- GP ADMX file name: *remoteassistance.admx* + + + + +
    + + +**RemoteAssistance/SolicitedRemoteAssistance** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer. + +If you enable this policy setting, users on this computer can use email or file transfer to ask someone for help. Also, users can use instant messaging programs to allow connections to this computer, and you can configure additional Remote Assistance settings. + +If you disable this policy setting, users on this computer cannot use email or file transfer to ask someone for help. Also, users cannot use instant messaging programs to allow connections to this computer. + +If you do not configure this policy setting, users can turn on or turn off Solicited (Ask for) Remote Assistance themselves in System Properties in Control Panel. Users can also configure Remote Assistance settings. + +If you enable this policy setting, you have two ways to allow helpers to provide Remote Assistance: "Allow helpers to only view the computer" or "Allow helpers to remotely control the computer." + +The "Maximum ticket time" policy setting sets a limit on the amount of time that a Remote Assistance invitation created by using email or file transfer can remain open. + +The "Select the method for sending email invitations" setting specifies which email standard to use to send Remote Assistance invitations. Depending on your email program, you can use either the Mailto standard (the invitation recipient connects through an Internet link) or the SMAPI (Simple MAPI) standard (the invitation is attached to your email message). This policy setting is not available in Windows Vista since SMAPI is the only method supported. + +If you enable this policy setting you should also enable appropriate firewall exceptions to allow Remote Assistance communications. + + + + +ADMX Info: +- GP Friendly name: *Configure Solicited Remote Assistance* +- GP name: *RA_Solicit* +- GP path: *System/Remote Assistance* +- GP ADMX file name: *remoteassistance.admx* + + + + +
    + + +**RemoteAssistance/UnsolicitedRemoteAssistance** + + + +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes| + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting allows you to turn on or turn off Offer (Unsolicited) Remote Assistance on this computer. + +If you enable this policy setting, users on this computer can get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance. + +If you disable this policy setting, users on this computer cannot get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance. + +If you do not configure this policy setting, users on this computer cannot get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance. + +If you enable this policy setting, you have two ways to allow helpers to provide Remote Assistance: "Allow helpers to only view the computer" or "Allow helpers to remotely control the computer." When you configure this policy setting, you also specify the list of users or user groups that are allowed to offer remote assistance. + +To configure the list of helpers, click "Show." In the window that opens, you can enter the names of the helpers. Add each user or group one by one. When you enter the name of the helper user or user groups, use the following format: + +`\` or + +`\` + +If you enable this policy setting, you should also enable firewall exceptions to allow Remote Assistance communications. The firewall exceptions required for Offer (Unsolicited) Remote Assistance depend on the version of Windows you are running. + +Windows Vista and later + +Enable the Remote Assistance exception for the domain profile. The exception must contain: +Port 135:TCP +%WINDIR%\System32\msra.exe +%WINDIR%\System32\raserver.exe + +Windows XP with Service Pack 2 (SP2) and Windows XP Professional x64 Edition with Service Pack 1 (SP1) + +Port 135:TCP +%WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe +%WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe +%WINDIR%\System32\Sessmgr.exe + +For computers running Windows Server 2003 with Service Pack 1 (SP1) + +Port 135:TCP +%WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe +%WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe +Allow Remote Desktop Exception + + + + +ADMX Info: +- GP Friendly name: *Configure Offer Remote Assistance* +- GP name: *RA_Unsolicit* +- GP path: *System/Remote Assistance* +- GP ADMX file name: *remoteassistance.admx* + + + +
    + + diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 667994f6ca..426be9aa21 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -191,6 +191,7 @@ The following list shows the supported values: +This policy allows the cortana opt-in page during windows setup out of the box experience. @@ -207,57 +208,11 @@ ADMX Info: This is a simple boolean value, default false, that can be set by MDM policy to allow the Cortana Page in OOBE when logged in with an AAD account. +
    - - - -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    EditionWindows 10Windows 11
    HomeNoNo
    ProYesYes
    BusinessYesYes
    EnterpriseYesYes
    EducationYesYes
    - - -
    - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - **Search/AllowFindMyFiles** From b53ee7ceeec4a4c1378b09145cfabe36fbb70ee4 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Thu, 6 Jan 2022 16:15:26 +0530 Subject: [PATCH 0217/1077] Update policy-csp-remotedesktop.md --- windows/client-management/mdm/policy-csp-remotedesktop.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-remotedesktop.md b/windows/client-management/mdm/policy-csp-remotedesktop.md index e30c9f6ceb..19de9949ac 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktop.md +++ b/windows/client-management/mdm/policy-csp-remotedesktop.md @@ -80,7 +80,7 @@ ADMX Info:
    -**RemoteAssistance/SessionLogging** +**RemoteDesktop/LoadAadCredKeyFromProfile** From 1745de75336e0ecc27c59d86e1e56f2e5fc500a9 Mon Sep 17 00:00:00 2001 From: Kaushik Ainapure Date: Thu, 6 Jan 2022 20:14:46 +0530 Subject: [PATCH 0218/1077] Updates to include activation delay experience --- windows/deployment/deploy-enterprise-licenses.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md index 719e822d59..307d30d1f1 100644 --- a/windows/deployment/deploy-enterprise-licenses.md +++ b/windows/deployment/deploy-enterprise-licenses.md @@ -255,3 +255,10 @@ At a command prompt, type: **winver** A popup window will display the Windows 10 version number and detailed OS build information. If a device is running a version of Windows 10 Pro prior to version 1703 (for example, version 1511), it will not be upgraded to Windows 10 Enterprise when a user signs in, even if the user has been assigned a subscription in the CSP portal. + +### Delay in the activation of Enterprise License of Windows 10 + +This is by design. Windows 10 has a built-in cache to help with the volume of calls coming to determine the upgrades of Windows 10 devices. + +This cache stores three-day values, including responses that indicate that the device is not eligible for an upgrade. When a device makes the call to check for upgrade eligibility on behalf of the signed user with a qualifying license, it can take three days + the delay for the subscription purchase to go through OMS into the system that masters Windows10 licenses. + From d97f31e1db9874778571498511cadac54024d967 Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Thu, 6 Jan 2022 18:27:19 -0500 Subject: [PATCH 0219/1077] removing references to Windows Phone --- .openpublishing.redirection.json | 5 + .../mdm/browserfavorite-csp.md | 94 ------------------- .../mdm/clientcertificateinstall-csp.md | 12 +-- .../mdm/clientcertificateinstall-ddf-file.md | 9 +- ...onfiguration-service-provider-reference.md | 14 +-- .../mdm/dmprocessconfigxmlfiltered.md | 34 +++---- ...erated-authentication-device-enrollment.md | 34 +++---- .../mdm/nodecache-ddf-file.md | 4 +- .../mdm/policy-csp-devicelock.md | 2 +- windows/client-management/mdm/toc.yml | 2 - .../mdm/w4-application-csp.md | 22 ++--- .../new-policies-for-windows-10.md | 25 ++--- .../manage-wifi-sense-in-enterprise.md | 40 ++++---- .../windows-10-enterprise-faq-itpro.yml | 4 +- ...ndows-diagnostic-events-and-fields-1703.md | 4 +- .../bitlocker-group-policy-settings.md | 2 +- .../create-wip-policy-using-intune-azure.md | 11 ++- .../ltsc/whats-new-windows-10-2019.md | 18 ++-- .../whats-new-windows-10-version-1703.md | 21 ++--- 19 files changed, 116 insertions(+), 241 deletions(-) delete mode 100644 windows/client-management/mdm/browserfavorite-csp.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index fa2dc0a8d0..f505c1d9de 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -1,5 +1,10 @@ { "redirections": [ + { + "source_path": "windows/client-management/mdm/browserfavorite-csp.md", + "redirect_url": "https://support.microsoft.com/windows/windows-phone-8-1-end-of-support-faq-7f1ef0aa-0aaf-0747-3724-5c44456778a3", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/windows-10-mobile-security-guide.md", "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5", diff --git a/windows/client-management/mdm/browserfavorite-csp.md b/windows/client-management/mdm/browserfavorite-csp.md deleted file mode 100644 index fa29e87d8d..0000000000 --- a/windows/client-management/mdm/browserfavorite-csp.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: BrowserFavorite CSP -description: Learn how the BrowserFavorite configuration service provider is used to add and remove URLs from the favorites list on a device. -ms.assetid: 5d2351ff-2d6a-4273-9b09-224623723cbf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: dansimp -ms.date: 10/25/2021 ---- - -# BrowserFavorite CSP - - -The BrowserFavorite configuration service provider is used to add and remove URLs from the favorites list on a device. - -> [!Note] -> BrowserFavorite CSP is only supported in Windows Phone 8.1. - - - -The BrowserFavorite configuration service provider manages only the favorites at the root favorite folder level. It does not manage subfolders under the root favorite folder nor does it manage favorites under a subfolder. - -> [!Note] -> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_INTERNET\_EXPLORER\_FAVORITES capabilities to be accessed from a network configuration application. - - - -The following shows the BrowserFavorite configuration service provider in tree format as used by Open Mobile Alliance Device (OMA) Client Provisioning. The OMA Device Management protocol is not supported with this configuration service provider. - -```console -BrowserFavorite -favorite name -----URL -``` - -***favorite name*** -Required. Specifies the user-friendly name of the favorite URL that is displayed in the Favorites list of Internet Explorer. - -> [!Note] -> The *favorite name* should contain only characters that are valid in the Windows file system. The invalid characters are: \\ / : \* ? " < > | - - - -Adding the same favorite twice adds only one occurrence to the Favorites list. If a favorite is added when another favorite with the same name but a different URL is already in the Favorites list, the existing favorite is replaced with the new favorite. - -**URL** -Optional. Specifies the complete URL for the favorite. - -## OMA client provisioning examples - - -Adding a new browser favorite. - -```xml - - - - - - - - -``` - -## Microsoft Custom Elements - - -The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning. - -|Elements|Available| -|--- |--- | -|Parm-query|Yes| -|Noparm|Yes| -|Nocharacteristic|Yes| -|Characteristic-query|Yes

    Recursive query: Yes

    Top-level query: Yes| - -## Related topics - - -[Configuration service provider reference](configuration-service-provider-reference.md) - - - - - - - - - - diff --git a/windows/client-management/mdm/clientcertificateinstall-csp.md b/windows/client-management/mdm/clientcertificateinstall-csp.md index ba1e38a584..1a39403fad 100644 --- a/windows/client-management/mdm/clientcertificateinstall-csp.md +++ b/windows/client-management/mdm/clientcertificateinstall-csp.md @@ -227,11 +227,11 @@ Optional. Specifies where to keep the private key. The data type is an integer corresponding to one of the following values: -| Value | Description | -|-------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 1 | Private key protected by TPM. | -| 2 | Private key protected by phone TPM if the device supports TPM. All Windows Phone 8.1 devices support TPM and will treat value 2 as 1. | -| 3 | (Default) Private key saved in software KSP. | +| Value | Description | +|---|---| +| 1 | Private key protected by TPM. | +| 2 | Private key protected by phone TPM if the device supports TPM. | +| 3 | (Default) Private key saved in software KSP. | | 4 | Private key protected by Windows Hello for Business (formerly known as Microsoft Passport for Work). If this option is specified, the ContainerName must be specified, otherwise enrollment will fail. | Supported operations are Add, Get, Delete, and Replace. @@ -361,7 +361,7 @@ The date type format is Null, meaning this node doesn’t contain a value. The only supported operation is Execute. **ClientCertificateInstall/SCEP/*UniqueID*/Install/AADKeyIdentifierList** -Optional. Specify the AAD Key Identifier List as a list of semicolon separated values. On Enroll, the values in this list are validated against the AAD Key present on the device. If no match is found, enrollment will fail. +Optional. Specify the Azure AD Key Identifier List as a list of semicolon separated values. On Enroll, the values in this list are validated against the Azure AD Key present on the device. If no match is found, enrollment will fail. Data type is string. diff --git a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md index ad299e4113..46bb00affa 100644 --- a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md +++ b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md @@ -556,21 +556,22 @@ Supported operations are Get, Add, Delete, Replace. 3 Optional. Specify where to keep the private key. Note that even it is protected by TPM, it is not guarded with TPM PIN. -SCEP enrolled cert doesn’t support TPM PIN protection. -Supported values: + +SCEP enrolled cert doesn’t support TPM PIN protection. Supported values: + 1 – private key protected by TPM, 2 – private key protected by phone TPM if the device supports TPM. -All Windows Phone 8.1 devices support TPM and will treat value 2 as 1 3 (default) – private key saved in software KSP -4 – private key protected by NGC. If this option is specified, container name should be specifed, if not enrollment will fail +4 – private key protected by NGC. If this option is specified, container name should be specified, if not enrollment will fail. Format is int. Supported operations are Get, Add, Delete, Replace + diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index 930d7f0b3b..8f140c8f43 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -15,7 +15,7 @@ ms.collection: highpri # Configuration service provider reference -A configuration service provider (CSP) is an interface to read, set, modify, or delete configuration settings on the device. These settings map to registry keys or files. Some configuration service providers support the WAP format, some support SyncML, and some support both. SyncML is only used over–the–air for Open Mobile Alliance Device Management (OMA DM), whereas WAP can be used over–the–air for OMA Client Provisioning, or it can be included in the phone image as a .provxml file that is installed during boot. +A configuration service provider (CSP) is an interface to read, set, modify, or delete configuration settings on the device. These settings map to registry keys or files. Some configuration service providers support the WAP format, some support SyncML, and some support both. SyncML is only used over–the–air for Open Mobile Alliance Device Management (OMA DM), whereas WAP can be used over–the–air for OMA Client Provisioning, or it can be included in the device image as a `.provxml` file that is installed during boot. For information about the bridge WMI provider classes that map to these CSPs, see [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal). For CSP DDF files, see [CSP DDF files download](#csp-ddf-files-download). @@ -150,18 +150,6 @@ Additional lists: - -[BrowserFavorite CSP](browserfavorite-csp.md) - - - -|Home|Pro|Business|Enterprise|Education| -|--- |--- |--- |--- |--- | -|No|No|No|No|No| - - - - [CMPolicy CSP](cmpolicy-csp.md) diff --git a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md index a13b3a0c7d..67d29f0ce3 100644 --- a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md +++ b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md @@ -25,7 +25,7 @@ ms.date: 06/26/2017 # DMProcessConfigXMLFiltered function > [!Important] -> The use of this function for automatic data configuration (ADC) is deprecated in Windows Phone 8.1. For more information about the new process for provisioning connectivity configuration, see [Connectivity configuration](/previous-versions//dn757424(v=vs.85)). However, this function is still supported for other OEM uses. +> The use of this function for automatic data configuration (ADC) is deprecated in Windows Phone 8.1. For more information about the new process for provisioning connectivity configuration, see [Connectivity configuration](/previous-versions//dn757424(v=vs.85)). However, this function is still supported for other OEM uses. Configures phone settings by using OMA Client Provisioning XML. Use of this function is strictly limited to the following scenarios. @@ -45,7 +45,7 @@ Microsoft recommends that this function isn't used to configure the following ty - Email settings > [!Note] -> The **DMProcessConfigXMLFiltered** function has full functionality in Windows Phone 8.1, but it has a read-only functionality in Windows 10. +> The **DMProcessConfigXMLFiltered** function has full functionality in Windows Phone 8.1, but it has a read-only functionality in Windows 10. @@ -54,37 +54,29 @@ Microsoft recommends that this function isn't used to configure the following ty ```C++ HRESULT STDAPICALLTYPE DMProcessConfigXMLFiltered( LPCWSTR pszXmlIn, - const WCHAR   **rgszAllowedCspNode, - const DWORD   dwNumAllowedCspNodes, - BSTR    *pbstrXmlOut + const WCHAR **rgszAllowedCspNode, + const DWORD dwNumAllowedCspNodes, + BSTR *pbstrXmlOut ); ``` ## Parameters *pszXmlIn* -
      -
    • [in] The null–terminated input XML buffer containing the configuration data. The parameter holds the XML that will be used to configure the phone. DMProcessConfigXMLFiltered accepts only OMA Client Provisioning XML (also known as WAP provisioning). It doesn't accept OMA DM SyncML XML (also known as SyncML).
      • -
    -
    + +- [in] The null–terminated input XML buffer containing the configuration data. The parameter holds the XML that will be used to configure the phone. **DMProcessConfigXMLFiltered** accepts only OMA Client Provisioning XML (also known as WAP provisioning). It doesn't accept OMA DM SyncML XML (also known as SyncML). *rgszAllowedCspNode* -
      -
    • [in] Array of WCHAR\* that specify which configuration service provider nodes can be invoked.
      • -
    -
    + +- [in] Array of `WCHAR` that specify which configuration service provider nodes can be invoked. *dwNumAllowedCspNodes* -
      -
    • [in] Number of elements passed in rgszAllowedCspNode.
      • -
    -
    + +- [in] Number of elements passed in rgszAllowedCspNode. *pbstrXmlOut* -
      -
    • [out] The resulting null–terminated XML from configuration. The caller of DMProcessConfigXMLFiltered is responsible for cleanup of the output buffer that the pbstrXmlOut parameter references. Use SysFreeString to free the memory.
      • -
    -
    + +- [out] The resulting null–terminated XML from configuration. The caller of **DMProcessConfigXMLFiltered** is responsible for cleanup of the output buffer that the pbstrXmlOut parameter references. Use **SysFreeString** to free the memory. If **DMProcessConfigXMLFiltered** retrieves a document, the *pbstrXmlOut* holds the XML output (in string form) of the provisioning operations. If **DMProcessConfigXMLFiltered** returns a failure, the XML output often contains "error nodes" that indicate which elements of the original XML failed. If the input document doesn't contain queries and is successfully processed, the output document should resemble the input document. In some error cases, no output is returned. diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md index f55e50ff03..254ba46424 100644 --- a/windows/client-management/mdm/federated-authentication-device-enrollment.md +++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md @@ -16,9 +16,9 @@ ms.date: 07/28/2017 This section provides an example of the mobile device enrollment protocol using federated authentication policy. When the authentication policy is set to Federated, the web authentication broker is leveraged by the enrollment client to get a security token. The enrollment client calls the web authentication broker API within the response message to start the process. The server should build the web authentication broker pages to fit the device screen and should be consistent with the existing enrollment UI. The opaque security token that is returned from the broker as an end page is used by the enrollment client as the device security secret during the client certificate request call. -The <AuthenticationServiceURL> element the discovery response message specifies web authentication broker page start URL. +The `` element the discovery response message specifies web authentication broker page start URL. -For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692). +For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692). ## In this topic @@ -26,7 +26,7 @@ For details about the Microsoft mobile device enrollment protocol for Windows 1 [Enrollment policy web service](#enrollment-policy-web-service) [Enrollment web service](#enrollment-web-service) -For the list of enrollment scenarios not supported in Windows 10, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). +For the list of enrollment scenarios not supported in Windows 10, see [Enrollment scenarios not supported](mobile-device-enrollment.md#enrollment-scenarios-not-supported). ## Discovery service @@ -35,7 +35,7 @@ The discovery web service provides the configuration information necessary for a > [!NOTE] > The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. -The automatic discovery flow of the device uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain “enterpriseenrollment” to the domain of the email address, and by appending the path “/EnrollmentServer/Discovery.svc”. For example, if the email address is “sample@contoso.com”, the resulting URI for first Get request would be: http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc +The automatic discovery flow of the device uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain “enterpriseenrollment” to the domain of the email address, and by appending the path “/EnrollmentServer/Discovery.svc”. For example, if the email address is “sample@contoso.com”, the resulting URI for first Get request would be: `http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc`. The first request is a standard HTTP GET request. @@ -146,7 +146,7 @@ A new XML tag, AuthenticationServiceUrl, is introduced in the DiscoveryResponse The following are the explicit requirements for the server. -- The <DiscoveryResponse><AuthenticationServiceUrl> element must support HTTPS. +- The ```` element must support HTTPS. - The authentication server must use a device trusted root certificate. Otherwise, the WAP call will fail. - WP doesn’t support Windows Integrated Authentication (WIA) for ADFS during WAB authentication. ADFS 2012 R2 if used needs to be configured to not attempt WIA for Windows device. @@ -156,8 +156,8 @@ The enrollment client issues an HTTPS request as follows: AuthenticationServiceUrl?appru=&login_hint= ``` -- <appid> is of the form ms-app://string -- <User Principal Name> is the name of the enrolling user, for example, user@constoso.com as input by the user in an enrollment sign in page. The value of this attribute serves as a hint that can be used by the authentication server as part of the authentication. +- `` is of the form ms-app://string +- `` is the name of the enrolling user, for example, user@constoso.com as input by the user in an enrollment sign in page. The value of this attribute serves as a hint that can be used by the authentication server as part of the authentication. After authentication is complete, the auth server should return an HTML form document with a POST method action of appid identified in the query string parameter. @@ -191,7 +191,7 @@ Content-Length: 556 ``` -The server has to send a POST to a redirect URL of the form ms-app://string (the URL scheme is ms-app) as indicated in the POST method action. The security token value is the base64-encoded string "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\#base64binary" contained in the <wsse:BinarySecurityToken> EncodingType attribute. Windows does the binary encode when it sends it back to enrollment server, in the form it is just HTML encoded. This string is opaque to the enrollment client; the client does not interpret the string. +The server has to send a POST to a redirect URL of the form ms-app://string (the URL scheme is ms-app) as indicated in the POST method action. The security token value is the base64-encoded string `http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\#base64binary` contained in the `` EncodingType attribute. Windows does the binary encode when it sends it back to enrollment server, in the form it is just HTML encoded. This string is opaque to the enrollment client; the client does not interpret the string. The following example shows a response received from the discovery web service which requires authentication via WAB. @@ -235,18 +235,18 @@ Policy service is optional. By default, if no policies are specified, the minimu This web service implements the X.509 Certificate Enrollment Policy Protocol (MS-XCEP) specification that allows customizing certificate enrollment to match different security needs of enterprises at different times (cryptographic agility). The service processes the GetPolicies message from the client, authenticates the client, and returns matching enrollment policies in the GetPoliciesResponse message. -For Federated authentication policy, the security token credential is provided in a request message using the <wsse:BinarySecurityToken> element \[WSS\]. The security token is retrieved as described in the discovery response section. The authentication information is as follows: +For Federated authentication policy, the security token credential is provided in a request message using the `` element \[WSS\]. The security token is retrieved as described in the discovery response section. The authentication information is as follows: -- wsse:Security: The enrollment client implements the <wsse:Security> element defined in \[WSS\] section 5. The <wsse:Security> element must be a child of the <s:Header> element. -- wsse:BinarySecurityToken: The enrollment client implements the <wsse:BinarySecurityToken> element defined in \[WSS\] section 6.3. The <wsse:BinarySecurityToken> element must be included as a child of the <wsse:Security> element in the SOAP header. +- wsse:Security: The enrollment client implements the `` element defined in \[WSS\] section 5. The `` element must be a child of the `` element. +- wsse:BinarySecurityToken: The enrollment client implements the `` element defined in \[WSS\] section 6.3. The `` element must be included as a child of the `` element in the SOAP header. -As was described in the discovery response section, the inclusion of the <wsse:BinarySecurityToken> element is opaque to the enrollment client, and the client does not interpret the string, and the inclusion of the element is agreed upon by the security token authentication server (as identified in the <AuthenticationServiceUrl> element of <DiscoveryResponse> and the enterprise server. +As was described in the discovery response section, the inclusion of the `` element is opaque to the enrollment client, and the client does not interpret the string, and the inclusion of the element is agreed upon by the security token authentication server (as identified in the `` element of `` and the enterprise server. -The <wsse:BinarySecurityToken> element contains a base64-encoded string. The enrollment client uses the security token received from the authentication server and base64-encodes the token to populate the <wsse:BinarySecurityToken> element. +The `` element contains a base64-encoded string. The enrollment client uses the security token received from the authentication server and base64-encodes the token to populate the `` element. -- wsse:BinarySecurityToken/attributes/ValueType: The `` ValueType attribute must be "http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentUserToken". +- wsse:BinarySecurityToken/attributes/ValueType: The `` ValueType attribute must be `http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentUserToken`. -- wsse:BinarySecurityToken/attributes/EncodingType: The `` EncodingType attribute must be "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\#base64binary". +- wsse:BinarySecurityToken/attributes/EncodingType: The `` EncodingType attribute must be `http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\#base64binary`. The following is an enrollment policy request example with a received security token as client credential. @@ -478,7 +478,7 @@ After validating the request, the web service looks up the assigned certificate > [!Note] > The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. -Similar to the TokenType in the RST, the RSTR will use a custom ValueType in the BinarySecurityToken (http://schemas.microsoft.com/ConfigurationManager/Enrollment/DeviceEnrollmentProvisionDoc), because the token is more than an X.509 v3 certificate. +Similar to the TokenType in the RST, the RSTR will use a custom ValueType in the BinarySecurityToken (`http://schemas.microsoft.com/ConfigurationManager/Enrollment/DeviceEnrollmentProvisionDoc`), because the token is more than an X.509 v3 certificate. The provisioning XML contains: @@ -616,7 +616,7 @@ The following code shows sample provisioning XML (presented in the preceding pac > [!NOTE] > -> - <Parm name> and <characteristic type=> elements in the w7 APPLICATION CSP XML are case sensitive and must be all uppercase. +> - `` and `` elements in the w7 APPLICATION CSP XML are case sensitive and must be all uppercase. > > - In w7 APPLICATION characteristic, both CLIENT and APPSRV credentials should be provided in XML. > diff --git a/windows/client-management/mdm/nodecache-ddf-file.md b/windows/client-management/mdm/nodecache-ddf-file.md index 0e15800f30..a344d5d843 100644 --- a/windows/client-management/mdm/nodecache-ddf-file.md +++ b/windows/client-management/mdm/nodecache-ddf-file.md @@ -57,7 +57,7 @@ The XML below is the current version for this CSP. - Group settings per DM server. Each group of settings is distinguished by the server's Provider ID. It should be the same DM server PROVIDER-ID value that was supplied through the w7 APPLICATION configuration service provider XML during the enrollment process. In Windows Phone 8, only one enterprise management server is supported. That is, there should be only one ProviderID node under NodeCache. + Group settings per DM server. Each group of settings is distinguished by the server's Provider ID. It should be the same DM server PROVIDER-ID value that was supplied through the w7 APPLICATION configuration service provider XML during the enrollment process. @@ -282,7 +282,7 @@ The XML below is the current version for this CSP. - Group settings per DM server. Each group of settings is distinguished by the server's Provider ID. It should be the same DM server PROVIDER-ID value that was supplied through the w7 APPLICATION configuration service provider XML during the enrollment process. In Windows Phone 8, only one enterprise management server is supported. That is, there should be only one ProviderID node under NodeCache. + Group settings per DM server. Each group of settings is distinguished by the server's Provider ID. It should be the same DM server PROVIDER-ID value that was supplied through the w7 APPLICATION configuration service provider XML during the enrollment process. diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 64a8ef9104..758e8a4502 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -537,7 +537,7 @@ For additional information about this policy, see [Exchange ActiveSync Policy En The following list shows the supported values: - An integer X where 0 <= X <= 999. -- 0 (default) - No timeout is defined. The default of "0" is Windows Phone 7.5 parity and is interpreted by as "No timeout is defined." +- 0 (default) - No timeout is defined. diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 87673ea6e7..e81cb17f06 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -149,8 +149,6 @@ items: items: - name: BitLocker DDF file href: bitlocker-ddf-file.md - - name: BrowserFavorite CSP - href: browserfavorite-csp.md - name: CellularSettings CSP href: cellularsettings-csp.md - name: CertificateStore CSP diff --git a/windows/client-management/mdm/w4-application-csp.md b/windows/client-management/mdm/w4-application-csp.md index 643381e5ac..026dcfb003 100644 --- a/windows/client-management/mdm/w4-application-csp.md +++ b/windows/client-management/mdm/w4-application-csp.md @@ -19,11 +19,12 @@ Use an **APPLICATION** configuration service provider that has an APPID of w4 to The default security roles are defined in the root characteristic, and map to each subnode unless specific permission is granted to the subnode. The default security roles are Manager, Operator, and Operator – TPS. -> **Note**   This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_CSP\_W4\_APPLICATION capabilities to be accessed from a network configuration application. +> [!NOTE] +> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_CSP\_W4\_APPLICATION capabilities to be accessed from a network configuration application. The following shows the configuration service provider in tree format as used by OMA Client Provisioning. -```console +```cmd APPLICATION ----APPID ----NAME @@ -45,11 +46,10 @@ This parameter takes a string value. The possible values to configure the NAME p - no value specified -> **Note**  MDM servers should resend APPLICATION/NAME to DMAcc after an upgrade because this value is displayed in the UI but not saved in Windows Phone 8.1 and cannot be migrated to Windows 10. +> [!NOTE] +> The APPLICATION/NAME value is displayed in the UI. The APPLICATION/NAME value might not be saved on the device. So after an upgrade, the MDM servers should resend APPLICATION/NAME to DMAcc. -  - -If no value is specified, the registry location will default to <unnamed>. +If no value is specified, the registry location will default to ``. If `Name` is greater than 40 characters, it will be truncated to 40 characters. @@ -77,13 +77,3 @@ Optional. The maximum authorized size, in KB, for multimedia content. This param [Configuration service provider reference](configuration-service-provider-reference.md) - -  - -  - - - - - - diff --git a/windows/client-management/new-policies-for-windows-10.md b/windows/client-management/new-policies-for-windows-10.md index 9d8d9e35c6..35613face4 100644 --- a/windows/client-management/new-policies-for-windows-10.md +++ b/windows/client-management/new-policies-for-windows-10.md @@ -1,6 +1,6 @@ --- title: New policies for Windows 10 (Windows 10) -description: Learn how Windows 10 includes new policies for management, like Group Policy settings for the Windows system and components. +description: Learn how Windows 10 includes new policies for management, like Group Policy settings for the Windows system and components. ms.assetid: 1F24ABD8-A57A-45EA-BA54-2DA2238C573D ms.reviewer: manager: dansimp @@ -20,8 +20,8 @@ ms.topic: reference **Applies to** -- Windows 10 -- Windows 11 +- Windows 10 +- Windows 11 As of September 2020 This page will no longer be updated. To find the Group Polices that ship in each version of Windows, refer to the Group Policy Settings Reference Spreadsheet. You can always locate the most recent version of the Spreadsheet by searching the Internet for "Windows Version + Group Policy Settings Reference". @@ -57,7 +57,7 @@ The following Group Policy settings were added in Windows 10, version 1903: - Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Use WDDM graphics display driver for Remote Desktop Connections - Windows Components\Windows Logon Options\Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot -## New Group Policy settings in Windows 10, version 1809 +## New Group Policy settings in Windows 10, version 1809 The following Group Policy settings were added in Windows 10, version 1809: @@ -242,7 +242,7 @@ The following Group Policy settings were added in Windows 10, version 1809: - Network\Windows Connection Manager\Enable Windows to soft-disconnect a computer from a network -## New Group Policy settings in Windows 10, version 1803 +## New Group Policy settings in Windows 10, version 1803 The following Group Policy settings were added in Windows 10, version 1803: @@ -282,7 +282,7 @@ The following Group Policy settings were added in Windows 10, version 1803: - Windows Components\Windows Defender Security Center\Virus and threat protection\Hide the Ransomware data recovery area -## New Group Policy settings in Windows 10, version 1709 +## New Group Policy settings in Windows 10, version 1709 The following Group Policy settings were added in Windows 10, version 1709: @@ -351,7 +351,7 @@ The following Group Policy settings were added in Windows 10, version 1709: - Windows Components\Windows Update\Do not allow update deferral policies to cause scans against Windows Update -## New Group Policy settings in Windows 10, version 1703 +## New Group Policy settings in Windows 10, version 1703 The following Group Policy settings were added in Windows 10, version 1703: @@ -481,10 +481,9 @@ For a spreadsheet of Group Policy settings included in Windows 10 and Windows Se ## New MDM policies +Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education include previous Windows Phone settings, and new or enhanced settings for Windows 10, such as: -Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education includes settings from Windows Phone 8.1, plus new or enhanced settings for Windows 10, such as: - -- Defender (Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education only) +- Defender (Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education only) - Enhanced Bluetooth policies @@ -508,7 +507,7 @@ Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, and Windows 10, version 1703, adds a number of [ADMX-backed policies to MDM](./mdm/policy-configuration-service-provider.md). -If you use Microsoft Intune for MDM, you can [configure custom policies](https://go.microsoft.com/fwlink/p/?LinkId=616316) to deploy Open Mobile Alliance Uniform Resource Identifier (OMA-URI) settings that can be used to control features on Windows 10. For a list of OMA-URI settings, see [Custom URI settings for Windows 10 devices](https://go.microsoft.com/fwlink/p/?LinkId=616317). +If you use Microsoft Intune for MDM, you can [configure custom policies](https://go.microsoft.com/fwlink/p/?LinkId=616316) to deploy Open Mobile Alliance Uniform Resource Identifier (OMA-URI) settings that can be used to control features on Windows 10. For a list of OMA-URI settings, see [Custom URI settings for Windows 10 devices](https://go.microsoft.com/fwlink/p/?LinkId=616317). No new [Exchange ActiveSync policies](/exchange/mobile-device-mailbox-policies-exchange-2013-help). For more information, see the [ActiveSync configuration service provider](./mdm/activesync-csp.md) technical reference. @@ -519,7 +518,3 @@ No new [Exchange ActiveSync policies](/exchange/mobile-device-mailbox-policies-e [Manage corporate devices](manage-corporate-devices.md) [Changes to Group Policy settings for Start in Windows 10](/windows/configuration/changes-to-start-policies-in-windows-10) - - - -  \ No newline at end of file diff --git a/windows/configuration/manage-wifi-sense-in-enterprise.md b/windows/configuration/manage-wifi-sense-in-enterprise.md index bbdaae9711..3ed542c5c9 100644 --- a/windows/configuration/manage-wifi-sense-in-enterprise.md +++ b/windows/configuration/manage-wifi-sense-in-enterprise.md @@ -19,26 +19,28 @@ ms.topic: article **Applies to** -- Windows 10 version 1709 and older +- Windows 10 version 1709 and older ->[!IMPORTANT] ->Beginning with Windows 10, version 1803, Wifi-Sense is no longer available. The following information only applies to Windows 10, version 1709 and prior. Please see [Connecting to open Wi-Fi hotspots in Windows 10](https://privacy.microsoft.com/windows-10-open-wi-fi-hotspots) for more details. +> [!IMPORTANT] +> Beginning with Windows 10, version 1803, Wifi-Sense is no longer available. The following information only applies to Windows 10, version 1709 and prior. Please see [Connecting to open Wi-Fi hotspots in Windows 10](https://privacy.microsoft.com/windows-10-open-wi-fi-hotspots) for more details. -Wi-Fi Sense learns about open Wi-Fi hotspots your Windows PC or Windows phone connects to by collecting information about the network, like whether the open Wi-Fi network has a high-quality connection to the Internet. By using that information from your device and from other Wi-Fi Sense customers' devices too, Wi-Fi Sense builds a database of these high-quality networks. When you’re in range of one of these Wi-Fi hotspots, you automatically get connected to it. +Wi-Fi Sense learns about open Wi-Fi hotspots your Windows device by collecting information about the network, like whether the open Wi-Fi network has a high-quality connection to the Internet. By using that information from your device and from other Wi-Fi Sense customers' devices too, Wi-Fi Sense builds a database of these high-quality networks. When you’re in range of one of these Wi-Fi hotspots, you automatically get connected to it. -The initial settings for Wi-Fi Sense are determined by the options you chose when you first set up your PC with Windows 10. +The initial settings for Wi-Fi Sense are determined by the options you chose when you first set up your device with Windows 10. -**Note**
    Wi-Fi Sense isn’t available in all countries or regions. +> [!NOTE] +> >Wi-Fi Sense isn’t available in all countries or regions. ## How does Wi-Fi Sense work? Wi-Fi Sense connects your employees to open Wi-Fi networks. Typically, these are the open (no password required) Wi-Fi hotspots you see when you’re out and about. ## How to manage Wi-Fi Sense in your company -In a company environment, you will most likely deploy Windows 10 to your employees' PCs using your preferred deployment method and then manage their settings globally. With that in mind, you have a few options for managing how your employees will use Wi-Fi Sense. +In a company environment, you will most likely deploy Windows 10 to your employees devices using your preferred deployment method and then manage their settings globally. With that in mind, you have a few options for managing how your employees will use Wi-Fi Sense. -**Important**
    Turning off Wi-Fi Sense stops employees from connecting automatically to open hotspots. +> [!IMPORTANT] +> Turning off Wi-Fi Sense stops employees from connecting automatically to open hotspots. -### Using Group Policy (available starting with Windows 10, version 1511) +### Using Group Policy (available starting with Windows 10, version 1511) You can manage your Wi-Fi Sense settings by using Group Policy and your Group Policy editor. **To set up Wi-Fi Sense using Group Policy** @@ -57,7 +59,8 @@ You can manage your Wi-Fi Sense settings by using registry keys and the Registry 1. Open your Registry Editor and go to `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config\` 2. Create and set a new **DWORD (32-bit) Value** named, **AutoConnectAllowedOEM**, with a **Value data** of **0 (zero)**. -

    Setting this value to 0 turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see How to configure Wi-Fi Sense on Windows 10 in an enterprise. + + Setting this value to `0` turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see [How to configure Wi-Fi Sense on Windows 10 in an enterprise](/troubleshoot/windows-client/networking/configure-wifi-sense-and-paid-wifi-service). ![Registry Editor, showing the creation of a new DWORD value.](images/wifisense-registry.png) @@ -67,7 +70,8 @@ You can manage your Wi-Fi Sense settings by changing the Windows provisioning se **To set up Wi-Fi Sense using WiFISenseAllowed** - Change the Windows Provisioning setting, **WiFISenseAllowed**, to **0**. -

    Setting this value to 0 turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Windows Provisioning settings reference topic, WiFiSenseAllowed. + + Setting this value to `0` turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Windows Provisioning settings reference topic, [WiFiSenseAllowed](./wcd/wcd-connectivityprofiles.md#wifisense). ### Using Unattended Windows Setup settings If your company still uses Unattend, you can manage your Wi-Fi Sense settings by changing the Unattended Windows Setup setting, **WiFiSenseAllowed**. @@ -75,24 +79,24 @@ If your company still uses Unattend, you can manage your Wi-Fi Sense settings by **To set up Wi-Fi Sense using WiFISenseAllowed** - Change the Unattended Windows Setup setting, **WiFISenseAllowed**, to **0**. -

    Setting this value to 0 turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Unattended Windows Setup Reference topic, WiFiSenseAllowed. + + Setting this value to `0` turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Unattended Windows Setup Reference topic, [WiFiSenseAllowed](/previous-versions//mt186511(v=vs.85)). ### How employees can change their own Wi-Fi Sense settings -If you don’t turn off the ability for your employees to use Wi-Fi Sense, they can turn it on locally by selecting **Settings > Network & Internet > Wi-Fi > Manage Wi-Fi settings**, and then turning on **Connect to suggested open hotspots**. +If you don’t turn off the ability for your employees to use Wi-Fi Sense, they can turn it on locally by selecting **Settings > Network & Internet > Wi-Fi > Manage Wi-Fi settings**, and then turning on **Connect to suggested open hotspots**. ![Wi-Fi Sense options shown to employees if it's not turned off.](images/wifisense-settingscreens.png) -**Important**
    The service that was used to share networks with Facebook friends, Outlook.com contacts, or Skype contacts is no longer available. This means: +> [!IMPORTANT] +> The service that was used to share networks with Facebook friends, Outlook.com contacts, or Skype contacts is no longer available. This means: -The **Connect to networks shared by my contacts** setting will still appear in **Settings > Network & Internet > Wi-Fi > Manage Wi-Fi settings** on your PC and in **Settings > Network & wireless > Wi‑Fi > Wi‑Fi Sense** on your phone. However, this setting will have no effect now. Regardless of what it’s set to, networks won’t be shared with your contacts. Your contacts won’t be connected to networks you’ve shared with them, and you won’t be connected to networks they’ve shared with you. +The **Connect to networks shared by my contacts** setting will still appear in **Settings > Network & Internet > Wi-Fi > Manage Wi-Fi settings** on your device. However, this setting will have no effect now. Regardless of what it’s set to, networks won’t be shared with your contacts. Your contacts won’t be connected to networks you’ve shared with them, and you won’t be connected to networks they’ve shared with you. Even if you selected **Automatically connect to networks shared by your contacts** when you first set up your Windows 10 device, you still won’t be connected to networks your contacts have shared with you. If you select the **Share network with my contacts** check box the first time you connect to a new network, the network won’t be shared. ## Related topics + - [Wi-Fi Sense and Privacy](https://go.microsoft.com/fwlink/p/?LinkId=620911) - [How to configure Wi-Fi Sense on Windows 10 in an enterprise](/troubleshoot/windows-client/networking/configure-wifi-sense-and-paid-wifi-service) - - - diff --git a/windows/deployment/planning/windows-10-enterprise-faq-itpro.yml b/windows/deployment/planning/windows-10-enterprise-faq-itpro.yml index a8e1aa8c67..c35f6f3570 100644 --- a/windows/deployment/planning/windows-10-enterprise-faq-itpro.yml +++ b/windows/deployment/planning/windows-10-enterprise-faq-itpro.yml @@ -149,5 +149,5 @@ sections: Use the following resources for additional information about Windows 10. - If you are an IT professional or if you have a question about administering, managing, or deploying Windows 10 in your organization or business, visit the [Windows 10 IT Professional forums](https://social.technet.microsoft.com/forums/home?category=windows10itpro) on TechNet. - If you are an end user or if you have a question about using Windows 10, visit the [Windows 10 forums on Microsoft Community](https://answers.microsoft.com/windows/forum/windows_10). - - If you are a developer or if you have a question about making apps for Windows 10, visit the [Windows Desktop Development forums](https://social.msdn.microsoft.com/forums/en-us/home?category=windowsdesktopdev) or [Windows and Windows phone apps forums](https://social.msdn.microsoft.com/forums/en-us/home?category=windowsapps) on MSDN. - - If you have a question about Internet Explorer, visit the [Internet Explorer forums](https://social.technet.microsoft.com/forums/ie/en-us/home) on TechNet. + - If you are a developer or if you have a question about making apps for Windows 10, visit the [Windows Desktop Development forums](https://social.msdn.microsoft.com/forums/en-us/home?category=windowsdesktopdev). + - If you have a question about Internet Explorer, visit the [Internet Explorer forums](https://social.technet.microsoft.com/forums/ie/en-us/home). diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index 43752ab87d..62ba908c10 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -5076,7 +5076,7 @@ The following fields are available: - **TargetAppId** The target app ID. - **TargetAppVer** The target app version. - + ## Windows Store events diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index aa7bdd87b0..15aca0d717 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -614,7 +614,7 @@ This policy setting is used to control the encryption method and cipher strength |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| |**Conflicts**|None| |**When enabled**|You can choose an encryption algorithm and key cipher strength for BitLocker to use to encrypt drives.| -|**When disabled or not configured**|Beginning with Windows 10, version 1511, or Windows 11, BitLocker uses the default encryption method of XTS-AES 128-bit or the encryption method that is specified by the setup script. Windows Phone does not support XTS; it uses AES-CBC 128-bit by default and supports AES-CBC 256-bit by policy.| +|**When disabled or not configured**|Beginning with Windows 10, version 1511, or Windows 11, BitLocker uses the default encryption method of XTS-AES 128-bit or the encryption method that is specified by the setup script. **Reference** diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index 3fb7d9b80d..1a019df8fe 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -19,7 +19,7 @@ ms.reviewer: **Applies to:** -- Windows 10, version 1607 and later +- Windows 10, version 1607 and later Microsoft Intune has an easy way to create and deploy a Windows Information Protection (WIP) policy. You can choose which apps to protect, the level of protection, and how to find enterprise data on the network. The devices can be fully managed by Mobile Device Management (MDM), or managed by Mobile Application Management (MAM), where Intune manages only the apps on a user's personal device. @@ -100,15 +100,15 @@ Select **Store apps**, type the app product name and publisher, and click **OK** ![Add Store app.](images/add-a-protected-store-app.png) -To add multiple Store apps, click the ellipsis **…**. +To add multiple Store apps, click the ellipsis `…`. If you don't know the Store app publisher or product name, you can find them by following these steps. 1. Go to the [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Power BI Mobile App*. -2. Copy the ID value from the app URL. For example, the Power BI Mobile App ID URL is https://www.microsoft.com/store/p/microsoft-power-bi/9nblgggzlxn1, and you'd copy the ID value, `9nblgggzlxn1`. +2. Copy the ID value from the app URL. For example, the Power BI Mobile App ID URL is `https://www.microsoft.com/store/p/microsoft-power-bi/9nblgggzlxn1`, and you'd copy the ID value, `9nblgggzlxn1`. -3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblgggzlxn1/applockerdata, where `9nblgggzlxn1` is replaced with your ID value. +3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run `https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblgggzlxn1/applockerdata`, where `9nblgggzlxn1` is replaced with your ID value. The API runs and opens a text editor with the app details. @@ -131,6 +131,7 @@ If you don't know the Store app publisher or product name, you can find them by > "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", > } + + ### Add Desktop apps To add **Desktop apps**, complete the following fields, based on what results you want returned. diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index 20366cd3bd..fd9c51a888 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -16,9 +16,9 @@ ms.topic: article # What's new in Windows 10 Enterprise LTSC 2019 **Applies to** -- Windows 10 Enterprise LTSC 2019 +- Windows 10 Enterprise LTSC 2019 -This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2019, compared to Windows 10 Enterprise LTSC 2016 (LTSB). For a brief description of the LTSC servicing channel and associated support, see [Windows 10 Enterprise LTSC](index.md). +This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2019, compared to Windows 10 Enterprise LTSC 2016 (LTSB). For a brief description of the LTSC servicing channel and associated support, see [Windows 10 Enterprise LTSC](index.md). >[!NOTE] >Features in Windows 10 Enterprise LTSC 2019 are equivalent to Windows 10, version 1809. @@ -200,8 +200,6 @@ New features in [Windows Hello for Business](/windows/security/identity-protecti - You can now reset a forgotten PIN without deleting company managed data or apps on devices managed by [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune). -- For Windows Phone devices, an administrator is able to initiate a remote PIN reset through the Intune portal. - - For Windows desktops, users are able to reset a forgotten PIN through **Settings > Accounts > Sign-in options**. For more details, check out [What if I forget my PIN?](/windows/security/identity-protection/hello-for-business/hello-features#pin-reset). [Windows Hello](/windows/security/identity-protection/hello-for-business/hello-features) now supports FIDO 2.0 authentication for Azure AD Joined Windows 10 devices and has enhanced support for shared devices, as described in [Kiosk configuration](#kiosk-configuration). @@ -210,13 +208,13 @@ New features in [Windows Hello for Business](/windows/security/identity-protecti - Support for S/MIME with Windows Hello for Business and APIs for non-Microsoft identity lifecycle management solutions. -- Windows Hello is part of the account protection pillar in Windows Defender Security Center. Account Protection will encourage password users to set up Windows Hello Face, Fingerprint or PIN for faster sign in, and will notify Dynamic lock users if Dynamic lock has stopped working because their phone or device Bluetooth is off. +- Windows Hello is part of the account protection pillar in Windows Defender Security Center. Account Protection will encourage password users to set up Windows Hello Face, Fingerprint or PIN for faster sign in, and will notify Dynamic lock users if Dynamic lock has stopped working because their device Bluetooth is off. - You can set up Windows Hello from lock screen for MSA accounts. We’ve made it easier for Microsoft account users to set up Windows Hello on their devices for faster and more secure sign-in. Previously, you had to navigate deep into Settings to find Windows Hello. Now, you can set up Windows Hello Face, Fingerprint or PIN straight from your lock screen by clicking the Windows Hello tile under Sign-in options. - New [public API](/uwp/api/windows.security.authentication.web.core.webauthenticationcoremanager.findallaccountsasync#Windows_Security_Authentication_Web_Core_WebAuthenticationCoreManager_FindAllAccountsAsync_Windows_Security_Credentials_WebAccountProvider_) for secondary account SSO for a particular identity provider. -- It is easier to set up Dynamic lock, and WD SC actionable alerts have been added when Dynamic lock stops working (ex: phone Bluetooth is off). +- It is easier to set up Dynamic lock, and WD SC actionable alerts have been added when Dynamic lock stops working (ex: device Bluetooth is off). For more information, see: [Windows Hello and FIDO2 Security Keys enable secure and easy authentication for shared devices](https://blogs.windows.com/business/2018/04/17/windows-hello-fido2-security-keys/#OdKBg3pwJQcEKCbJ.97) @@ -348,7 +346,7 @@ If you have shared devices deployed in your work place, **Fast sign-in** enables **To enable fast sign-in:** -1. Set up a shared or guest device with Windows 10, version 1809 or Windows 10 Enterprise LTSC 2019. +1. Set up a shared or guest device with Windows 10, version 1809 or Windows 10 Enterprise LTSC 2019. 2. Set the Policy CSP, and the **Authentication** and **EnableFastFirstSignIn** policies to enable fast sign-in. @@ -586,11 +584,11 @@ Users attempt to connect to a Miracast receiver as they did previously. When the If you have a device that has been updated to Windows 10 Enterprise LTSC 2019, then you automatically have this new feature. To take advantage of it in your environment, you need to ensure the following is true within your deployment: -- The device (PC, phone, or Surface Hub) needs to be running Windows 10, version 1703, Windows 10 Enterprise LTSC 2019, or a later OS. +- The device (PC or Surface Hub) needs to be running Windows 10, version 1703, Windows 10 Enterprise LTSC 2019, or a later OS. -- A Windows PC or Surface Hub can act as a Miracast over Infrastructure *receiver*. A Windows PC or phone can act as a Miracast over Infrastructure *source*. +- A Windows PC or Surface Hub can act as a Miracast over Infrastructure *receiver*. A Windows device can act as a Miracast over Infrastructure *source*. - As a Miracast receiver, the PC or Surface Hub must be connected to your enterprise network via either Ethernet or a secure Wi-Fi connection (e.g. using either WPA2-PSK or WPA2-Enterprise security). If the Hub is connected to an open Wi-Fi connection, Miracast over Infrastructure will disable itself. - - As a Miracast source, the PC or phone must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. + - As a Miracast source, the device must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. - The DNS Hostname (device name) of the device needs to be resolvable via your DNS servers. You can achieve this by either allowing your device to register automatically via Dynamic DNS, or by manually creating an A or AAAA record for the device's hostname. diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 9afb045cb7..102af90453 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -18,7 +18,7 @@ ms.topic: article Below is a list of some of what's new in Information Technology (IT) pro features in Windows 10, version 1703 (also known as the Creators Update). -For more general info about Windows 10 features, see [Features available only on Windows 10](https://www.microsoft.com/windows/features). For info about previous versions of Windows 10, see [What's New in Windows 10](./index.yml). Also see this blog post: [What’s new for IT pros in the Windows 10 Creators Update](https://blogs.technet.microsoft.com/windowsitpro/2017/04/05/whats-new-for-it-pros-in-the-windows-10-creators-update/). +For more general info about Windows 10 features, see [Features available only on Windows 10](https://www.microsoft.com/windows/features). For info about previous versions of Windows 10, see [What's New in Windows 10](./index.yml). Also see this blog post: [What’s new for IT pros in the Windows 10 Creators Update](https://blogs.technet.microsoft.com/windowsitpro/2017/04/05/whats-new-for-it-pros-in-the-windows-10-creators-update/). >[!NOTE] >Windows 10, version 1703 contains all fixes included in previous cumulative updates to Windows 10, version 1607. For info about each version, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info). For a list of removed features, see [Features that are removed or deprecated in Windows 10 Creators Update](/windows/deployment/planning/windows-10-removed-features). @@ -99,23 +99,20 @@ For details, see [MBR2GPT.EXE](/windows/deployment/mbr-to-gpt). ### Microsoft Defender for Endpoint New features in Microsoft Defender for Endpoint for Windows 10, version 1703 include: -- **Detection**
    - Enhancements to the detection capabilities include: +- **Detection**: Enhancements to the detection capabilities include: - [Use the threat intelligence API to create custom alerts](/windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection) - Understand threat intelligence concepts, enable the threat intel application, and create custom threat intelligence alerts for your organization. - Improvements on OS memory and kernel sensors to enable detection of attackers who are using in-memory and kernel-level attacks - Upgraded detections of ransomware and other advanced attacks - Historical detection capability ensures new detection rules apply to up to six months of stored data to detect previous attacks that might not have been noticed -- **Investigation**
    - Enterprise customers can now take advantage of the entire Windows security stack with Microsoft Defender Antivirus detections and Device Guard blocks being surfaced in the Microsoft Defender for Endpoint portal. Other capabilities have been added to help you gain a holistic view on investigations. +- **Investigation**: Enterprise customers can now take advantage of the entire Windows security stack with Microsoft Defender Antivirus detections and Device Guard blocks being surfaced in the Microsoft Defender for Endpoint portal. Other capabilities have been added to help you gain a holistic view on investigations. Other investigation enhancements include: - [Investigate a user account](/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection) - Identify user accounts with the most active alerts and investigate cases of potential compromised credentials. - [Alert process tree](/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection#alert-process-tree) - Aggregates multiple detections and related events into a single view to reduce case resolution time. - [Pull alerts using REST API](/windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection) - Use REST API to pull alerts from Microsoft Defender for Endpoint. -- **Response**
    - When detecting an attack, security response teams can now take immediate action to contain a breach: +- **Response**: When detecting an attack, security response teams can now take immediate action to contain a breach: - [Take response actions on a machine](/windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection) - Quickly respond to detected attacks by isolating machines or collecting an investigation package. - [Take response actions on a file](/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection) - Quickly respond to detected attacks by stopping and quarantining files or blocking a file. @@ -168,8 +165,6 @@ A new security policy setting You can now reset a forgotten PIN without deleting company managed data or apps on devices managed by [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune). -For Windows Phone devices, an administrator is able to initiate a remote PIN reset through the Intune portal. - For Windows desktops, users are able to reset a forgotten PIN through **Settings > Accounts > Sign-in options**. For more details, check out [What if I forget my PIN?](/windows/security/identity-protection/hello-for-business/hello-features#pin-reset). @@ -295,10 +290,10 @@ Users attempt to connect to a Miracast receiver as they did previously. When the If you have a device that has been updated to Windows 10, version 1703, then you automatically have this new feature. To take advantage of it in your environment, you need to ensure the following is true within your deployment: -- The device (PC, phone, or Surface Hub) needs to be running Windows 10, version 1703. -- A Windows PC or Surface Hub can act as a Miracast over Infrastructure *receiver*. A Windows PC or phone can act as a Miracast over Infrastructure *source*. +- The device (PC or Surface Hub) needs to be running Windows 10, version 1703. +- A Windows PC or Surface Hub can act as a Miracast over Infrastructure *receiver*. A Windows device can act as a Miracast over Infrastructure *source*. - As a Miracast receiver, the PC or Surface Hub must be connected to your enterprise network via either Ethernet or a secure Wi-Fi connection (e.g. using either WPA2-PSK or WPA2-Enterprise security). If the Hub is connected to an open Wi-Fi connection, Miracast over Infrastructure will disable itself. - - As a Miracast source, the PC or phone must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. + - As a Miracast source, the device must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. - The DNS Hostname (device name) of the device needs to be resolvable via your DNS servers. You can achieve this by either allowing your device to register automatically via Dynamic DNS, or by manually creating an A or AAAA record for the device's hostname. - Windows 10 PCs must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. @@ -325,4 +320,4 @@ Update Compliance helps you to keep Windows 10 devices in your organization secu Update Compliance is a solution built using OMS Log Analytics that provides information about installation status of monthly quality and feature updates. Details are provided about the deployment progress of existing updates and the status of future updates. Information is also provided about devices that might need attention to resolve issues. -For more information about Update Compliance, see [Monitor Windows Updates with Update Compliance](/windows/deployment/update/update-compliance-monitor). \ No newline at end of file +For more information about Update Compliance, see [Monitor Windows Updates with Update Compliance](/windows/deployment/update/update-compliance-monitor). From daf2c4494093d1c1af551f23e4bbb0c9bcc26739 Mon Sep 17 00:00:00 2001 From: Angela Fleischmann Date: Thu, 6 Jan 2022 18:51:17 -0700 Subject: [PATCH 0220/1077] Added apostrophe Added apostrophe: "to your employees' devices" line 38. --- windows/configuration/manage-wifi-sense-in-enterprise.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/manage-wifi-sense-in-enterprise.md b/windows/configuration/manage-wifi-sense-in-enterprise.md index 3ed542c5c9..5d3cc333a4 100644 --- a/windows/configuration/manage-wifi-sense-in-enterprise.md +++ b/windows/configuration/manage-wifi-sense-in-enterprise.md @@ -35,7 +35,7 @@ The initial settings for Wi-Fi Sense are determined by the options you chose whe Wi-Fi Sense connects your employees to open Wi-Fi networks. Typically, these are the open (no password required) Wi-Fi hotspots you see when you’re out and about. ## How to manage Wi-Fi Sense in your company -In a company environment, you will most likely deploy Windows 10 to your employees devices using your preferred deployment method and then manage their settings globally. With that in mind, you have a few options for managing how your employees will use Wi-Fi Sense. +In a company environment, you will most likely deploy Windows 10 to your employees' devices using your preferred deployment method and then manage their settings globally. With that in mind, you have a few options for managing how your employees will use Wi-Fi Sense. > [!IMPORTANT] > Turning off Wi-Fi Sense stops employees from connecting automatically to open hotspots. From be94903092daa8b58162b79a7784865d3d23dbe4 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Fri, 7 Jan 2022 12:29:23 +0530 Subject: [PATCH 0221/1077] Updated with windows version as per feedback --- windows/client-management/mdm/policy-csp-storage.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 5d43f8f336..31bf31a9f9 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -610,6 +610,8 @@ This policy will do the enforcement over the following protocols which are used - Media Transfer Protocol (MTP) over USB, IP, and Bluetooth - Mass Storage Class (MSC) over USB +To enable this policy, the minimum OS requirement is Windows 10, version 1809 and [KB5003217 (OS Build 17763.1971)](https://support.microsoft.com/en-us/topic/may-20-2021-kb5003217-os-build-17763-1971-preview-08687c95-0740-421b-a205-54aa2c716b46). + If enabled, this policy will block end-user from Read access on any Windows Portal devices, e.g. mobile/iOS/Android. >[!NOTE] @@ -670,6 +672,8 @@ This policy will do the enforcement over the following protocols which are used - Media Transfer Protocol (MTP) over USB, IP, and Bluetooth - Mass Storage Class (MSC) over USB +To enable this policy, the minimum OS requirement is Windows 10, version 1809 and [KB5003217 (OS Build 17763.1971)](https://support.microsoft.com/en-us/topic/may-20-2021-kb5003217-os-build-17763-1971-preview-08687c95-0740-421b-a205-54aa2c716b46). + If enabled, this policy will block end-user from Read access on any Windows Portal devices, e.g. mobile/iOS/Android. >[!NOTE] @@ -730,6 +734,8 @@ This policy will do the enforcement over the following protocols which are used - Media Transfer Protocol (MTP) over USB, IP, and Bluetooth - Mass Storage Class (MSC) over USB +To enable this policy, the minimum OS requirement is Windows 10, version 1809 and [KB5003217 (OS Build 17763.1971)](https://support.microsoft.com/en-us/topic/may-20-2021-kb5003217-os-build-17763-1971-preview-08687c95-0740-421b-a205-54aa2c716b46). + If enabled, this will block end-user from Write access on any Windows Portal devices, e.g. mobile/iOS/Android. >[!NOTE] @@ -790,6 +796,8 @@ This policy will do the enforcement over the following protocols which are used - Media Transfer Protocol (MTP) over USB, IP, and Bluetooth - Mass Storage Class (MSC) over USB +To enable this policy, the minimum OS requirement is Windows 10, version 1809 and [KB5003217 (OS Build 17763.1971)](https://support.microsoft.com/en-us/topic/may-20-2021-kb5003217-os-build-17763-1971-preview-08687c95-0740-421b-a205-54aa2c716b46). + If enabled, this will block end-user from Write access on any Windows Portal devices, e.g. mobile/iOS/Android. >[!NOTE] From 5fc5424cef3a960886434520cec8debf683ebedf Mon Sep 17 00:00:00 2001 From: Benny Shilpa Date: Fri, 7 Jan 2022 14:59:50 +0530 Subject: [PATCH 0222/1077] Update event-4673.md --- windows/security/threat-protection/auditing/event-4673.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4673.md b/windows/security/threat-protection/auditing/event-4673.md index f815be18a8..4ee65904e9 100644 --- a/windows/security/threat-protection/auditing/event-4673.md +++ b/windows/security/threat-protection/auditing/event-4673.md @@ -173,7 +173,7 @@ For 4673(S, F): A privileged service was called. > **Important**  For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). -- Monitor for this event where “**Subject\\Security ID**” is *not* one of these well-known security principals: LOCAL SYSTEM, NETWORK SERVICE, LOCAL SERVICE, and where “**Subject\\Security ID**” is not an administrative account that is expected to have the listed **Privileges**. Especially monitor Failure events. +- Monitor for this event where “**Subject\\Security ID**” is *not* one of these well-known security principals: LOCAL SYSTEM, NETWORK SERVICE, LOCAL SERVICE, and where “**Subject\\Security ID**” is not an administrative account that is expected to have the listed **Privileges**. See subcategories [Audit Sensitive Privilege Use](/windows/security/threat-protection/auditing/audit-sensitive-privilege-use) and [Audit Non Sensitive Privilege Use](/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use) for more details. - If you need to monitor events related to specific Windows subsystems (“**Service\\Server**”), for example **NT Local Security Authority / Authentication Service** or **Security Account Manager**, monitor this event for the corresponding “**Service\\Server**.” @@ -193,4 +193,4 @@ For 4673(S, F): A privileged service was called. - If you have a list of specific user rights which should never be used, or used only by a few accounts (for example, SeDebugPrivilege), trigger an alert for those “**Privileges**.” -- If you have a list of specific user rights for which every use must be reported or monitored (for example, SeRemoteShutdownPrivilege), trigger an alert for those “**Privileges**.” \ No newline at end of file +- If you have a list of specific user rights for which every use must be reported or monitored (for example, SeRemoteShutdownPrivilege), trigger an alert for those “**Privileges**.” From 864049b0d8b2b1469fdea8b90f57a81b2798898d Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Fri, 7 Jan 2022 17:42:56 +0530 Subject: [PATCH 0223/1077] Update policy-csp-browser.md --- windows/client-management/mdm/policy-csp-browser.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index ba8ac722c2..7bab2b690f 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -15,7 +15,7 @@ ms.localizationpriority: medium # Policy CSP - Browser > [!NOTE] -> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](/DeployEdge/). +> These settings are for the previous version of Microsoft Edge and are deprecated. These settings will be removed in a future Windows release. Microsoft recommends updating your version of Microsoft Edge and use the appropriate CSPs for the Chromium version of the Microsoft Edge browser. Learn more about how to [Configure Microsoft Edge using Mobile Device Management](https://docs.microsoft.com/deployedge/configure-edge-with-mdm). ## Browser policies From e04e0b5048948ef4ec7f8f1bb3fd39ea183a8efd Mon Sep 17 00:00:00 2001 From: Jacob Scott <49541449+mrjacobascott@users.noreply.github.com> Date: Fri, 7 Jan 2022 07:56:06 -0600 Subject: [PATCH 0224/1077] Removing duplicated text within a sentence The same sentence looked to be copied/pasted within itself by accident --- windows/client-management/mdm/policy-csp-update.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 18b041249a..c58336a73f 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -427,7 +427,7 @@ ADMX Info: The following list shows the supported values: - 0 – Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end users to manage data usage. With these option users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel. -- 1 – Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end user is prompted to schedule the restart time. The end user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end Enabling the end user to control the start time reduces the risk of accidental data loss caused by applications that do not shut down properly on restart.user to control the start time reduces the risk of accidental data loss caused by applications that do not shutdown properly on restart. +- 1 – Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end user is prompted to schedule the restart time. The end user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end user to control the start time reduces the risk of accidental data loss caused by applications that do not shutdown properly on restart. - 2 (default) – Auto install and restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This is the default behavior for unmanaged devices. Devices are updated quickly, but it increases the risk of accidental data loss caused by an application that does not shutdown properly on restart. - 3 – Auto install and restart at a specified time. The IT specifies the installation day and time. If no day and time are specified, the default is 3 AM daily. Automatic installation happens at this time and device restart happens after a 15-minute countdown. If the user is logged in when Windows is ready to restart, the user can interrupt the 15-minute countdown to delay the restart. - 4 – Auto install and restart without end-user control. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This setting option also sets the end-user control panel to read-only. From f4e2c4ee26ae295581d2e6b3052363f3d4f02242 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Sat, 8 Jan 2022 00:36:02 +0530 Subject: [PATCH 0225/1077] Update policy-csp-browser.md --- windows/client-management/mdm/policy-csp-browser.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 7bab2b690f..7b3f0a6fb4 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -15,7 +15,8 @@ ms.localizationpriority: medium # Policy CSP - Browser > [!NOTE] -> These settings are for the previous version of Microsoft Edge and are deprecated. These settings will be removed in a future Windows release. Microsoft recommends updating your version of Microsoft Edge and use the appropriate CSPs for the Chromium version of the Microsoft Edge browser. Learn more about how to [Configure Microsoft Edge using Mobile Device Management](https://docs.microsoft.com/deployedge/configure-edge-with-mdm). +> These settings are for the previous version of Microsoft Edge (version 45 and earlier) and are deprecated. These settings will be removed in a future Windows release. Microsoft recommends updating your version of Microsoft Edge to version 77 or later and use the ADMX Ingestion function for management. Learn more about how to [Configure Microsoft Edge using Mobile Device Management](https://docs.microsoft.com/deployedge/configure-edge-with-mdm). + ## Browser policies From 8c6c0790d2c9caa886ac3d8a3fd7eaa83f2e36cb Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Sat, 8 Jan 2022 00:42:50 +0530 Subject: [PATCH 0226/1077] Update policy-csp-browser.md --- windows/client-management/mdm/policy-csp-browser.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 7b3f0a6fb4..3ab4a15f8d 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -15,7 +15,7 @@ ms.localizationpriority: medium # Policy CSP - Browser > [!NOTE] -> These settings are for the previous version of Microsoft Edge (version 45 and earlier) and are deprecated. These settings will be removed in a future Windows release. Microsoft recommends updating your version of Microsoft Edge to version 77 or later and use the ADMX Ingestion function for management. Learn more about how to [Configure Microsoft Edge using Mobile Device Management](https://docs.microsoft.com/deployedge/configure-edge-with-mdm). +> These settings are for the previous version of Microsoft Edge (version 45 and earlier) and are deprecated. These settings will be removed in a future Windows release. Microsoft recommends updating your version of Microsoft Edge to version 77 or later and use the ADMX Ingestion function for management. Learn more about how to [Configure Microsoft Edge using Mobile Device Management](deployedge/configure-edge-with-mdm). From da7399f346a57f55461383014aa39a5632ede6d0 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Mon, 10 Jan 2022 15:28:32 +0530 Subject: [PATCH 0227/1077] Update policy-csp-browser.md --- windows/client-management/mdm/policy-csp-browser.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 3ab4a15f8d..7b3f0a6fb4 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -15,7 +15,7 @@ ms.localizationpriority: medium # Policy CSP - Browser > [!NOTE] -> These settings are for the previous version of Microsoft Edge (version 45 and earlier) and are deprecated. These settings will be removed in a future Windows release. Microsoft recommends updating your version of Microsoft Edge to version 77 or later and use the ADMX Ingestion function for management. Learn more about how to [Configure Microsoft Edge using Mobile Device Management](deployedge/configure-edge-with-mdm). +> These settings are for the previous version of Microsoft Edge (version 45 and earlier) and are deprecated. These settings will be removed in a future Windows release. Microsoft recommends updating your version of Microsoft Edge to version 77 or later and use the ADMX Ingestion function for management. Learn more about how to [Configure Microsoft Edge using Mobile Device Management](https://docs.microsoft.com/deployedge/configure-edge-with-mdm). From 02af56b64a72a8ac99155346a85ffd126a2df8b7 Mon Sep 17 00:00:00 2001 From: Nimisha Satapathy Date: Mon, 10 Jan 2022 15:35:47 +0530 Subject: [PATCH 0228/1077] Update policy-csp-browser.md --- windows/client-management/mdm/policy-csp-browser.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 7b3f0a6fb4..cbf9ef190b 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -15,7 +15,7 @@ ms.localizationpriority: medium # Policy CSP - Browser > [!NOTE] -> These settings are for the previous version of Microsoft Edge (version 45 and earlier) and are deprecated. These settings will be removed in a future Windows release. Microsoft recommends updating your version of Microsoft Edge to version 77 or later and use the ADMX Ingestion function for management. Learn more about how to [Configure Microsoft Edge using Mobile Device Management](https://docs.microsoft.com/deployedge/configure-edge-with-mdm). +> These settings are for the previous version of Microsoft Edge (version 45 and earlier) and are deprecated. These settings will be removed in a future Windows release. Microsoft recommends updating your version of Microsoft Edge to version 77 or later and use the ADMX Ingestion function for management. Learn more about how to [Configure Microsoft Edge using Mobile Device Management](/deployedge/configure-edge-with-mdm). From c127f6bdb4e9cc54411eb7c3cd2b0601c6c3d677 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Mon, 10 Jan 2022 08:04:57 -0800 Subject: [PATCH 0229/1077] Update deploy-enterprise-licenses.md --- windows/deployment/deploy-enterprise-licenses.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md index 307d30d1f1..1d57c81037 100644 --- a/windows/deployment/deploy-enterprise-licenses.md +++ b/windows/deployment/deploy-enterprise-licenses.md @@ -260,5 +260,5 @@ If a device is running a version of Windows 10 Pro prior to version 1703 (for ex This is by design. Windows 10 has a built-in cache to help with the volume of calls coming to determine the upgrades of Windows 10 devices. -This cache stores three-day values, including responses that indicate that the device is not eligible for an upgrade. When a device makes the call to check for upgrade eligibility on behalf of the signed user with a qualifying license, it can take three days + the delay for the subscription purchase to go through OMS into the system that masters Windows10 licenses. +This cache stores three-day values, including responses that indicate that the device is not eligible for an upgrade. When a device makes the call to check for upgrade eligibility on behalf of the signed user with a qualifying license, it can take three days and the delay for the subscription purchase to go through OMS into the system that masters Windows 10 licenses. From 0b98840be99b915a5076310a8daff7af7fcbb338 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 10 Jan 2022 10:50:23 -0800 Subject: [PATCH 0230/1077] Update policy-csp-update.md --- windows/client-management/mdm/policy-csp-update.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index c58336a73f..36e1d8215a 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.technology: windows author: dansimp ms.localizationpriority: medium -ms.date: 11/29/2021 +ms.date: 01/10/2022 ms.reviewer: manager: dansimp ms.collection: highpri From 5bce39ea1811650839de0e837588d34a7c1aa4e7 Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Tue, 11 Jan 2022 15:57:04 +0530 Subject: [PATCH 0231/1077] fixed Acrolinx scores --- ...te-a-package-accelerator-with-powershell.md | 8 ++++---- .../appv-release-notes-for-appv-for-windows.md | 14 +++++++------- .../app-v/appv-technical-reference.md | 18 +++++++++--------- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md b/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md index 79b713f591..13e617e6bf 100644 --- a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md +++ b/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md @@ -22,17 +22,17 @@ App-V Package Accelerators automatically sequence large, complex applications. A 1. Install the App-V sequencer. For more information about installing the sequencer, see [How to install the sequencer](appv-install-the-sequencer.md). 2. To open a Windows PowerShell console, select **Start** and enter **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. -3. Make sure that you have the .appv package to create an accelerator from the installation media or installation files. You can also optionally use a readme file for the accelerator's users to reference. +3. Ensure you have the .apps package to create an accelerator from the installation media or installation files. You can also optionally use a readme file for the accelerator's users to reference. 4. Enter the **New-AppvPackageAccelerator** cmdlet. The following parameters are required to use the package accelerator cmdlet: - *InstalledFilesPath* specifies the application installation path. - *Installer* specifies the path to the application installer media. - - *InputPackagePath* specifies the path to the .appv package. + - *InputPackagePath* specifies the path to the.appv package. - *Path* specifies the output directory for the package. - The following example cmdlet shows how you can create a package accelerator with an .appv package and the installation media: + The following example cmdlet shows how you can create a package accelerator with .app package and the installation media: ```PowerShell New-AppvPackageAccelerator -InputPackagePath -Installer -Path @@ -46,6 +46,6 @@ App-V Package Accelerators automatically sequence large, complex applications. A -## Related topics +## Related articles - [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md) diff --git a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md index bfabcf0c97..908f5748b5 100644 --- a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md +++ b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md @@ -20,13 +20,13 @@ ms.author: greglin The following are known issues and workarounds for Application Virtualization (App-V) running on Windows 10, version 1607. ## Windows Installer packages (.msi files) generated by the App-V sequencer (version 5.1 and earlier) fail to install on computers with the in-box App-V client -MSI packages that were generated using an App-V sequencer from previous versions of App-V (App-V versions 5.1 and earlier) include a check to validate that the App-V client is installed on client devices before allowing the MSI package to install. Now that the App-V client is installed automatically when you upgrade user devices to Windows 10, version 1607, the pre-requisite check fails and causes the MSI to fail. +There are MSI packages generated by an App-V sequencer from previous versions of App-V (Versions 5.1 and earlier). These packages include a check to validate whether the App-V client is installed on client devices, before allowing the MSI package to be installed. As the App-V client gets installed automatically when you upgrade user devices to Windows 10, version 1607, the pre-requisite check fails and causes the MSI to fail. **Workaround**: 1. Install the latest App-V sequencer, which you can get from the Windows Assessment and Deployment Kit (ADK) for Windows 10, version 1607. See [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). For more information, see [Install the App-V Sequencer](appv-install-the-sequencer.md). -2. Ensure that you have installed the **MSI Tools** included in the Windows 10 SDK, available as follows: +2. Ensure that you've installed the **MSI Tools** included in the Windows 10 SDK, available as follows: - For the **Visual Studio Community 2015 with Update 3** client, which includes the latest Windows 10 SDK and developer tools, see [Downloads and tools for Windows 10](https://developer.microsoft.com/en-us/windows/downloads). @@ -44,21 +44,21 @@ MSI packages that were generated using an App-V sequencer from previous versions `Update-AppvPackageMsi -MsiPackage "" -MsSdkPath ""` - where the path is to the new directory (**C:\MyMsiTools\ for this example**). + where the path is to the new directory (**C:\MyMsiTools\ for this example**). ## Error occurs during publishing refresh between App-V 5.0 SP3 Management Server and App-V Client on Windows 10 -An error is generated during publishing refresh when synchronizing packages from the App-V 5.0 SP3 management server to an App-V client on Windows 10. This error occurs because the App-V 5.0 SP3 server does not understand the Windows 10 operating system that is specified in the publishing URL. The issue is fixed for App-V publishing server, but is not backported to versions of App-V 5.0 SP3 or earlier. +An error is generated during publishing refresh when synchronizing packages from the App-V 5.0 SP3 management server to an App-V client on Windows 10. This error occurs because the App-V 5.0 SP3 server doesn't understand the Windows 10-operating system that is specified in the publishing URL. The issue is fixed for App-V publishing server, but isn't backported to versions of App-V 5.0 SP3 or earlier. **Workaround**: Upgrade the App-V 5.0 Management server to the App-V Management server for Windows 10 Clients. ## Custom configurations do not get applied for packages that will be published globally if they are set using the App-V Server If you assign a package to an AD group that contains machine accounts and apply a custom configuration to that group using the App-V Server, the custom configuration will not be applied to those machines. The App-V Client will publish packages assigned to a machine account globally. However, it stores custom configuration files per user in each user’s profile. Globally published packages will not have access to this custom configuration. -**Workaround**: Do one of the following: +**Workaround**: Implement one of the following tasks: -- Assign the package to groups containing only user accounts. This will ensure that the package’s custom configuration will be stored in each user’s profile and will be applied correctly. +- Assign the package to groups containing only user accounts. This assignation ensures that the package’s custom configuration will be stored in each user’s profile and will be applied correctly. -- Create a custom deployment configuration file and apply it to the package on the client using the Add-AppvClientPackage cmdlet with the –DynamicDeploymentConfiguration parameter. See [About App-V Dynamic Configuration](appv-dynamic-configuration.md) for more information. +- Create a custom deployment configuration file and apply it to the package on the client, using the Add-AppvClientPackage cmdlet with the –DynamicDeploymentConfiguration parameter. See [About App-V Dynamic Configuration](appv-dynamic-configuration.md) for more information. - Create a new package with the custom configuration using the App-V Sequencer. diff --git a/windows/application-management/app-v/appv-technical-reference.md b/windows/application-management/app-v/appv-technical-reference.md index 378c6cf052..4eeb5962c1 100644 --- a/windows/application-management/app-v/appv-technical-reference.md +++ b/windows/application-management/app-v/appv-technical-reference.md @@ -24,21 +24,21 @@ This section provides reference information related to managing App-V. - [Performance Guidance for Application Virtualization](appv-performance-guidance.md) - Provides strategy and context for many performance optimizations. Not all practices will be applicable. However, these are tested and supported. Using all suggested practices that are applicable to your organization will provide the optimal end-user experience. + Provides strategy and context for many performance optimizations. Not all practices will be applicable. However, these practices are tested and supported. Using all suggested practices that are applicable to your organization will provide the optimal end-user experience. - [Application Publishing and Client Interaction](appv-application-publishing-and-client-interaction.md) Describes how the following App-V client operations affect the local operating system: - App-V files and data storage locations -- package registry -- package store behavior -- roaming registry and data -- client application lifecycle management -- integration of App-V packages -- dynamic configuration -- side-by-side assemblies -- client logging +- Package registry +- Package store behavior +- Roaming registry and data +- Client application lifecycle management +- Integration of App-V packages +- Dynamic configuration +- Side-by-side assemblies +- Client logging - [Viewing App-V Server Publishing Metadata](appv-viewing-appv-server-publishing-metadata.md) From 441a66e050ebad0da1089e8b66b16fa1239e4904 Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Tue, 11 Jan 2022 16:16:04 +0530 Subject: [PATCH 0232/1077] Update appv-release-notes-for-appv-for-windows.md --- .../app-v/appv-release-notes-for-appv-for-windows.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md index 908f5748b5..af731fd9e0 100644 --- a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md +++ b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md @@ -109,9 +109,9 @@ In environments that are running the RDS Client or that have multiple concurrent **Workaround**: Have users log out and then log back in. ## Error message is erroneously displayed when the connection group is published only to the user -When you run Repair-AppvClientConnectionGroup, the following error is displayed, even when the connection group is published only to the user: “Internal App-V Integration error: Package not integrated for the user. Please ensure that the package is added to the machine and published to the user.” +When you run Repair-AppvClientConnectionGroup, the following error is displayed, even when the connection group is published only to the user: “Internal App-V Integration error: Package not integrated for the user. Ensure that the package is added to the machine and published to the user.” -**Workaround**: Do one of the following: +**Workaround**: Execute one of the following tasks: - Publish all packages in a connection group. @@ -119,7 +119,7 @@ When you run Repair-AppvClientConnectionGroup, the following error is displayed, - Repair packages individually using the Repair-AppvClientPackage command rather than the Repair-AppvClientConnectionGroup command. - Determine which packages are available to users and then run the **Repair-AppvClientPackage** command once for each package. Use Windows PowerShell cmdlets to do the following: + Determine which packages are available to users and then run the **Repair-AppvClientPackage** command once for each package. Use Windows PowerShell cmdlets to execute the following tasks: 1. Get all the packages in a connection group. @@ -128,7 +128,7 @@ When you run Repair-AppvClientConnectionGroup, the following error is displayed, 3. If the package is currently published, run **Repair-AppvClientPackage** on that package. ## Icons not displayed properly in Sequencer -Icons in the Shortcuts and File Type Associations tab are not displayed correctly when modifying a package in the App-V Sequencer. This problem occurs when the size of the icons are not 16x16 or 32x32. +Icons in the Shortcuts and File Type Associations tab are not displayed correctly when modifying a package in the App-V Sequencer. This problem occurs when the size of the icons is not 16x16 or 32x32. **Workaround**: Only use icons that are 16x16 or 32x32. From 1f1f5d55e6f1ec173d545eaca92763aa55beba38 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 11 Jan 2022 09:18:03 -0800 Subject: [PATCH 0233/1077] updating mbam supported versions --- .../bitlocker/bitlocker-deployment-comparison.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md index c9cf5ba6f5..0e57c625ae 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md @@ -30,7 +30,7 @@ This article depicts the BitLocker deployment comparison chart. | Requirements |Microsoft Intune |Microsoft Endpoint Configuration Manager |Microsoft BitLocker Administration and Monitoring (MBAM) | |---------|---------|---------|---------| -|Minimum client operating system version |Windows 11 and Windows 10 | Windows 11, Windows 10, and Windows 8.1 | Windows 7 and later | +|Minimum client operating system version |Windows 11 and Windows 10 | Windows 11, Windows 10, and Windows 8.1 | Windows 7, Windows 8, Windows 8.1, Windows 10, and Windows 10 IoT | |Supported Windows SKUs | Enterprise, Pro, Education | Enterprise, Pro, Education | Enterprise | |Minimum Windows version |1909 | None | None | |Supported domain-joined status | Microsoft Azure Active Directory (Azure AD) joined, hybrid Azure AD joined | Active Directory joined, hybrid Azure AD joined | Active Directory joined | From 2a82e81d21b545af10a56d57e7dcbdd5a05c0acb Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Tue, 11 Jan 2022 12:45:39 -0500 Subject: [PATCH 0234/1077] fixed blocking issues --- ...ndows-diagnostic-events-and-fields-1703.md | 84 +++--- .../bitlocker-group-policy-settings.md | 248 +++++++++--------- .../create-wip-policy-using-intune-azure.md | 136 +++++----- 3 files changed, 234 insertions(+), 234 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index 62ba908c10..e127c49bd5 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -1289,10 +1289,10 @@ This event sends type and capacity data about the battery on the device, as well The following fields are available: - **InternalBatteryCapablities** Represents information about what the battery is capable of doing. -- **InternalBatteryCapacityCurrent** Represents the battery's current fully charged capacity in mWh (or relative). Compare this value to DesignedCapacity  to estimate the battery's wear. +- **InternalBatteryCapacityCurrent** Represents the battery's current fully charged capacity in mWh (or relative). Compare this value to DesignedCapacity to estimate the battery's wear. - **InternalBatteryCapacityDesign** Represents the theoretical capacity of the battery when new, in mWh. - **InternalBatteryNumberOfCharges** Provides the number of battery charges. This is used when creating new products and validating that existing products meets targeted functionality performance. -- **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. +- **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected. Boolean value. ### Census.Enterprise @@ -1304,10 +1304,10 @@ The following fields are available: - **AzureOSIDPresent** Represents the field used to identify an Azure machine. - **AzureVMType** Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs. - **CDJType** Represents the type of cloud domain joined for the machine. -- **CommercialId** Represents the GUID for the commercial entity which the device is a member of.  Will be used to reflect insights back to customers. +- **CommercialId** Represents the GUID for the commercial entity which the device is a member of. Will be used to reflect insights back to customers. - **ContainerType** The type of container, such as process or virtual machine hosted. - **HashedDomain** The hashed representation of the user domain used for login. -- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (AAD) tenant? true/false +- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (Azure AD) tenant? true/false - **IsDERequirementMet** Represents if the device can do device encryption. - **IsDeviceProtected** Represents if Device protected by BitLocker/Device Encryption - **IsDomainJoined** Indicates whether a machine is joined to a domain. @@ -1315,7 +1315,7 @@ The following fields are available: - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID - **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise System Center Configuration Manager (SCCM) environment. -- **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. +- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. - **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier. @@ -1437,7 +1437,7 @@ The following fields are available: - **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine. - **OSEdition** Retrieves the version of the current OS. - **OSInstallDateTime** Retrieves the date the OS was installed using ISO 8601 (Date part) == yyyy-mm-dd -- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc +- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc. - **OSOOBEDateTime** Retrieves Out of Box Experience (OOBE) Date in Coordinated Universal Time (UTC). - **OSSKU** Retrieves the Friendly Name of OS Edition. - **OSSubscriptionStatus** Represents the existing status for enterprise subscription feature for PRO machines. @@ -1491,7 +1491,7 @@ The following fields are available: - **HolographicSpeechInputDisabledRemote** Indicates if a remote policy has disabled speech functionalities for the HMD devices. - **KWSEnabled** Cortana setting that represents if a user has enabled the "Hey Cortana" keyword spotter (KWS). - **MDMAllowInputPersonalization** Indicates if an MDM policy has enabled speech functionalities. -- **RemotelyManaged** Indicates if the device is being controlled by a remote admininistrator (MDM or Group Policy) in the context of speech functionalities. +- **RemotelyManaged** Indicates if the device is being controlled by a remote administrator (MDM or Group Policy) in the context of speech functionalities. - **SpeakerIdEnabled** Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice. - **SpeechServicesEnabled** Windows setting that represents whether a user is opted-in for speech services on the device. @@ -1823,7 +1823,7 @@ The following fields are available: - **creativeId** A serialized string containing the ID of the offer being rendered, the ID of the current rotation period, the ID of the surface/ring/market combination, the offer index in the current branch, the ID of the batch, the rotation period length, and the expiration timestamp. - **eventToken** In there are multiple item offers, such as Start tiles, this indicates which tile the event corresponds to. -- **eventType** A code that indicates the type of creative event, such a impression, click, positive feedback, negative feedback, etc.. +- **eventType** A code that indicates the type of creative event, such a impression, click, positive feedback, negative feedback, etc. - **placementId** Name of surface, such as LockScreen or Start. @@ -2139,7 +2139,7 @@ This event sends data about hangs for both native and managed applications, to h The following fields are available: - **AppName** The name of the app that has hung. -- **AppSessionGuid** GUID made up of process id used as a correlation vector for process instances in the telemetry backend. +- **AppSessionGuid** GUID made up of process ID used as a correlation vector for process instances in the telemetry backend. - **AppVersion** The version of the app that has hung. - **PackageFullName** Store application identity. - **PackageRelativeAppId** Store application identity. @@ -2154,7 +2154,7 @@ The following fields are available: - **WaitingOnAppName** If this is a cross process hang waiting for an application, this has the name of the application. - **WaitingOnAppVersion** If this is a cross process hang, this has the version of the application for which it is waiting. - **WaitingOnPackageFullName** If this is a cross process hang waiting for a package, this has the full name of the package for which it is waiting. -- **WaitingOnPackageRelativeAppId** If this is a cross process hang waiting for a package, this has the relative application id of the package. +- **WaitingOnPackageRelativeAppId** If this is a cross process hang waiting for a package, this has the relative applicationIDof the package. ## Inventory events @@ -2845,8 +2845,8 @@ The following fields are available: - **BatteryCapacity** Maximum battery capacity in mWh - **BatteryCharge** Current battery charge as a percentage of total capacity - **BatteryDischarging** Flag indicating whether the battery is discharging or charging -- **BootId** Monotonically increasing boot id, reset on upgrades. -- **BootTimeUTC** Boot time in UTC  file time. +- **BootId** Monotonically increasing boot ID, reset on upgrades. +- **BootTimeUTC** Boot time in UTC file time. - **EventSequence** Monotonically increasing event number for OsStateChange events logged during this boot. - **LastStateTransition** The previous state transition on the device. - **LastStateTransitionSub** The previous state subtransition on the device. @@ -3238,7 +3238,7 @@ The following fields are available: - **RemediationWindowsTotalSystemDiskSize** The total storage capacity of the System Disk Drive, measured in Megabytes. - **Result** The HRESULT for Detection or Perform Action phases of the plug-in. - **RunResult** The HRESULT for Detection or Perform Action phases of the plug-in. -- **ServiceHealthPlugin** The nae of the Service Health plug-in. +- **ServiceHealthPlugin** The name of the Service Health plug-in. - **StartComponentCleanupTask** TRUE if the Component Cleanup task started successfully. - **TotalSizeofOrphanedInstallerFilesInMegabytes** The size of any orphaned Windows Installer files, measured in Megabytes. - **TotalSizeofStoreCacheAfterCleanupInMegabytes** The size of the Microsoft Store cache after cleanup, measured in Megabytes. @@ -3882,7 +3882,7 @@ This event sends basic metadata about the SetupPlatform update installation proc The following fields are available: -- **ActivityId** Provides a unique Id to correlate events that occur between a activity start event, and a stop event +- **ActivityId** Provides a uniqueIDto correlate events that occur between a activity start event, and a stop event - **ActivityName** Provides a friendly name of the package type that belongs to the ActivityId (Setup, LanguagePack, GDR, Driver, etc.) - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. @@ -3924,7 +3924,7 @@ Activity for deletion of a user account for devices set up for Shared PC mode as The following fields are available: -- **accountType** The type of account that was deleted. Example: AD, AAD, or Local +- **accountType** The type of account that was deleted. Example: AD, Azure AD, or Local - **userSid** The security identifier of the account. - **wilActivity** Windows Error Reporting data collected when there is a failure in deleting a user account with the Transient Account Manager. See [wilActivity](#wilactivity). @@ -4114,7 +4114,7 @@ The following fields are available: - **EventInstanceID** A globally unique identifier for event instance. - **EventScenario** State of call - **EventType** Possible values are "Child", "Bundle", or "Driver". -- **FlightId** The specific id of the flight the device is getting +- **FlightId** The specificIDof the flight the device is getting - **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.) - **RevisionNumber** Unique revision number of Update - **ServerId** Identifier for the service to which the software distribution client is connecting, such as Windows Update and Microsoft Store. @@ -4166,7 +4166,7 @@ The following fields are available: - **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device. - **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds). - **FlightBuildNumber** If this download was for a flight (pre-release build), this indicates the build number of that flight. -- **FlightId** The specific id of the flight (pre-release build) the device is getting. +- **FlightId** The specificIDof the flight (pre-release build) the device is getting. - **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds). - **HandlerType** Indicates what kind of content is being downloaded (app, driver, windows patch, etc.). - **HardwareId** If this download was for a driver targeted to a particular device model, this ID indicates the model of the device. @@ -4188,7 +4188,7 @@ The following fields are available: - **RelatedCV** The Correlation Vector that was used before the most recent change to a new Correlation Vector. - **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to download. - **RevisionNumber** The revision number of the specified piece of content. -- **ServiceGuid** A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc). +- **ServiceGuid** A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc.). - **Setup360Phase** Identifies the active phase of the upgrade download if the current download is for an Operating System upgrade. - **ShippingMobileOperator** The mobile operator linked to the device when the device shipped. - **StatusCode** Indicates the result of a Download event (success, cancellation, failure code HResult). @@ -4218,7 +4218,7 @@ The following fields are available: - **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client - **ClientVersion** The version number of the software distribution client - **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed -- **EventType** Possible values are "Child", "Bundle", "Relase" or "Driver" +- **EventType** Possible values are "Child", "Bundle", "Release" or "Driver" - **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough - **FileId** A hash that uniquely identifies a file - **FileName** Name of the downloaded file @@ -4247,10 +4247,10 @@ The following fields are available: - **IsNetworkMetered** Indicates whether Windows considered the current network to be ?metered" - **MOAppDownloadLimit** Mobile operator cap on size of application downloads, if any - **MOUpdateDownloadLimit** Mobile operator cap on size of operating system update downloads, if any -- **PowerState** Indicates the power state of the device at the time of heartbeart (DC, AC, Battery Saver, or Connected Standby) +- **PowerState** Indicates the power state of the device at the time of heartbeat (DC, AC, Battery Saver, or Connected Standby) - **RelatedCV** The previous correlation vector that was used by the client, before swapping with a new one - **ResumeCount** Number of times this active download has resumed from a suspended state -- **ServiceID** Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc) +- **ServiceID** Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc.) - **SuspendCount** Number of times this active download has entered a suspended state - **SuspendReason** Last reason for why this active download entered a suspended state @@ -4903,7 +4903,7 @@ The following fields are available: - **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. - **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. - **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). -- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled. +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. - **TestId** ID that uniquely identifies a group of events. - **WuId** This is the Windows Update Client ID. Using Windows Update, this is the same as the clientId. @@ -5035,7 +5035,7 @@ The following fields are available: ### Microsoft.Windows.WERVertical.OSCrash -This event sends binary data from the collected dump file wheneveer a bug check occurs, to help keep Windows up to date. The is the OneCore version of this event. +This event sends binary data from the collected dump file whenever a bug check occurs, to help keep Windows up to date. The is the OneCore version of this event. The following fields are available: @@ -5048,7 +5048,7 @@ The following fields are available: - **DumpFileAttributes** Codes that identify the type of data contained in the dump file - **DumpFileSize** Size of the dump file - **IsValidDumpFile** True if the dump file is valid for the debugger, false otherwise -- **ReportId** WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson). +- **ReportId** WER Report ID associated with this bug check (used for finding the corresponding report archive in Watson). ### WerTraceloggingProvider.AppCrashEvent @@ -5111,12 +5111,12 @@ The following fields are available: ### Microsoft.Windows.StoreAgent.Telemetry.AbortedInstallation -This event is sent when an installation or update is canceled by a user or the system and is used to help keep Windows Apps up to date and secure. +This event is sent when an installation or update is cancelled by a user or the system and is used to help keep Windows Apps up to date and secure. The following fields are available: - **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. -- **AttemptNumber** Number of retry attempts before it was canceled. +- **AttemptNumber** Number of retry attempts before it was cancelled. - **BundleId** The Item Bundle ID. - **CategoryId** The Item Category ID. - **ClientAppId** The identity of the app that initiated this operation. @@ -5131,9 +5131,9 @@ The following fields are available: - **ParentBundleId** The product ID of the parent (if this product is part of a bundle). - **PFN** The product family name of the product being installed. - **ProductId** The identity of the package or packages being installed. -- **SystemAttemptNumber** The total number of automatic attempts at installation before it was canceled. +- **SystemAttemptNumber** The total number of automatic attempts at installation before it was cancelled. - **UpdateId** Update ID (if this is an update) -- **UserAttemptNumber** The total number of user attempts at installation before it was canceled. +- **UserAttemptNumber** The total number of user attempts at installation before it was cancelled. - **WUContentId** The Windows Update content ID. @@ -5151,7 +5151,7 @@ This event is sent when the Store Agent cache is refreshed with any available pa ### Microsoft.Windows.StoreAgent.Telemetry.CancelInstallation -This event is sent when an app update or installation is canceled while in interactive mode. This can be canceled by the user or the system. It's used to help keep Windows up-to-date and secure. +This event is sent when an app update or installation is cancelled while in interactive mode. This can be cancelled by the user or the system. It's used to help keep Windows up-to-date and secure. The following fields are available: @@ -5170,11 +5170,11 @@ The following fields are available: - **ParentBundleId** The product ID of the parent (if this product is part of a bundle). - **PFN** The name of all packages to be downloaded and installed. - **PreviousHResult** The previous HResult code. -- **PreviousInstallState** Previous installation state before it was canceled. +- **PreviousInstallState** Previous installation state before it was cancelled. - **ProductId** The name of the package or packages requested for installation. - **RelatedCV** Correlation Vector of a previous performed action on this product. -- **SystemAttemptNumber** Total number of automatic attempts to install before it was canceled. -- **UserAttemptNumber** Total number of user attempts to install before it was canceled. +- **SystemAttemptNumber** Total number of automatic attempts to install before it was cancelled. +- **UserAttemptNumber** Total number of user attempts to install before it was cancelled. - **WUContentId** The Windows Update content ID. @@ -5229,7 +5229,7 @@ This event is sent after an app is downloaded to help keep Windows up-to-date an The following fields are available: - **AggregatedPackageFullNames** The name of all packages to be downloaded and installed. -- **AttemptNumber** Number of retry attempts before it was canceled. +- **AttemptNumber** Number of retry attempts before it was cancelled. - **BundleId** The identity of the Windows Insider build associated with this product. - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. @@ -5278,7 +5278,7 @@ This event is sent after a product has been installed to help keep Windows up-to The following fields are available: - **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. -- **AttemptNumber** The number of retry attempts before it was canceled. +- **AttemptNumber** The number of retry attempts before it was cancelled. - **BundleId** The identity of the build associated with this product. - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. @@ -5321,7 +5321,7 @@ This event is sent after searching for update packages to install. It is used to The following fields are available: - **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. -- **AttemptNumber** The total number of retry attempts before it was canceled. +- **AttemptNumber** The total number of retry attempts before it was cancelled. - **BundleId** The identity of the build associated with this product. - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. @@ -5350,7 +5350,7 @@ This event is sent after restoring user data (if any) that needs to be restored The following fields are available: - **AggregatedPackageFullNames** The name of all packages to be downloaded and installed. -- **AttemptNumber** The total number of retry attempts before it was canceled. +- **AttemptNumber** The total number of retry attempts before it was cancelled. - **BundleId** The identity of the build associated with this product. - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. @@ -5421,7 +5421,7 @@ This event is sent when a product install or update is paused (either by a user The following fields are available: - **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. -- **AttemptNumber** The total number of retry attempts before it was canceled. +- **AttemptNumber** The total number of retry attempts before it was cancelled. - **BundleId** The identity of the build associated with this product. - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. @@ -5450,7 +5450,7 @@ This event is sent when a product install or update is resumed (either by a user The following fields are available: - **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. -- **AttemptNumber** The number of retry attempts before it was canceled. +- **AttemptNumber** The number of retry attempts before it was cancelled. - **BundleId** The identity of the build associated with this product. - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. @@ -5491,7 +5491,7 @@ The following fields are available: - **CatalogId** The Store Catalog ID for the product being installed. - **ProductId** The Store Product ID for the product being installed. -- **SkuId** Specfic edition of the app being updated. +- **SkuId** Specific edition of the app being updated. ### Microsoft.Windows.StoreAgent.Telemetry.UpdateAppOperationRequest @@ -5505,9 +5505,9 @@ The following fields are available: ## Windows Update Delivery Optimization events -### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled +### Microsoft.OSG.DU.DeliveryOptClient.Downloadcancelled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. +This event describes when a download was cancelled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5938,7 +5938,7 @@ The following fields are available: - **batteryLevel** Current battery capacity in mWh or percentage left. - **deferReason** Reason for install not completing. -- **errorCode** The error code reppresented by a hexadecimal value. +- **errorCode** The error code represented by a hexadecimal value. - **eventScenario** End-to-end update session ID. - **flightID** The ID of the Windows Insider build the device is getting. - **flightUpdate** Indicates whether the update is a Windows Insider build. diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index 15aca0d717..bbb2f13bcd 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -1,6 +1,6 @@ --- title: BitLocker Group Policy settings (Windows 10) -description: This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. +description: This article for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. ms.assetid: 4904e336-29fe-4cef-bb6c-3950541864af ms.reviewer: ms.prod: m365-security @@ -26,17 +26,17 @@ ms.custom: bitlocker - Windows 10, Windows 11, Windows Server 2019, Windows Server 2016, Windows 8.1, and Windows Server 2012 R2 -This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. +This article for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. -To control what drive encryption tasks the user can perform from the Windows Control Panel or to modify other configuration options, you can use Group Policy administrative templates or local computer policy settings. How you configure these policy settings depends on how you implement BitLocker and what level of user interaction will be allowed. +To control the drive encryption tasks the user can perform from the Windows Control Panel or to modify other configuration options, you can use Group Policy administrative templates or local computer policy settings. How you configure these policy settings depends on how you implement BitLocker and what level of user interaction will be allowed. > [!NOTE] > A separate set of Group Policy settings supports the use of the Trusted Platform Module (TPM). For details about those settings, see [Trusted Platform Module Group Policy settings](../tpm/trusted-platform-module-services-group-policy-settings.md). BitLocker Group Policy settings can be accessed using the Local Group Policy Editor and the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**. -Most of the BitLocker Group Policy settings are applied when BitLocker is initially turned on for a drive. If a computer is not compliant with existing Group Policy settings, BitLocker may not be turned on or modified until the computer is in a compliant state. When a drive is out of compliance with Group Policy settings (for example, if a Group Policy setting was changed after the initial BitLocker deployment in your organization, and then the setting was applied to previously encrypted drives), no change can be made to the BitLocker configuration of that drive except a change that will bring it into compliance. +Most of the BitLocker Group Policy settings are applied when BitLocker is initially turned on for a drive. If a computer isn't compliant with existing Group Policy settings, BitLocker may not be turned on or modified until the computer is in a compliant state. When a drive is out of compliance with Group Policy settings (for example, if a Group Policy setting was changed after the initial BitLocker deployment in your organization, and then the setting was applied to previously encrypted drives), no change can be made to the BitLocker configuration of that drive except a change that will bring it into compliance. -If multiple changes are necessary to bring the drive into compliance, you must suspend BitLocker protection, make the necessary changes, and then resume protection. This situation could occur, for example, if a removable drive was initially configured to be unlocked with a password and then Group +If multiple changes are necessary to bring the drive into compliance, you must suspend BitLocker protection, make the necessary changes, and then resume protection. This situation could occur, for example, if a removable drive is initially configured to be unlocked with a password and then Group Policy settings are changed to disallow passwords and require smart cards. In this situation, you need to suspend BitLocker protection by using the [Manage-bde](/windows-server/administration/windows-commands/manage-bde) command-line tool, delete the password unlock method, and add the smart card method. After this is complete, BitLocker is compliant with the Group Policy setting and BitLocker protection on the drive can be resumed. > [!NOTE] @@ -119,14 +119,14 @@ This policy setting allows users on devices that are compliant with Modern Stand **Reference** -The preboot authentication option **Require startup PIN with TPM** of the [Require additional authentication at startup](#bkmk-unlockpol1) policy is often enabled to help ensure security for older devices that do not support Modern Standby. But visually impaired users have no audible way to know when to enter a PIN. +The preboot authentication option **Require startup PIN with TPM** of the [Require additional authentication at startup](#bkmk-unlockpol1) policy is often enabled to help ensure security for older devices that don't support Modern Standby. But visually impaired users have no audible way to know when to enter a PIN. This setting enables an exception to the PIN-required policy on secure hardware. ### Allow network unlock at startup This policy controls a portion of the behavior of the Network Unlock feature in BitLocker. This policy is required to enable BitLocker Network Unlock on a network because it allows clients running BitLocker to create the necessary network key protector during encryption. -This policy is used in addition to the BitLocker Drive Encryption Network Unlock Certificate security policy (located in the **Public Key Policies** folder of Local Computer Policy) to allow systems that are connected to a trusted network to properly utilize the Network Unlock feature. +This policy is used with the BitLocker Drive Encryption Network Unlock Certificate security policy (located in the **Public Key Policies** folder of Local Computer Policy) to allow systems that are connected to a trusted network to properly utilize the Network Unlock feature. | |   | |:---|:---| @@ -136,14 +136,14 @@ This policy is used in addition to the BitLocker Drive Encryption Network Unlock |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| |**Conflicts**|None| |**When enabled**|Clients configured with a BitLocker Network Unlock certificate can create and use Network Key Protectors.| -|**When disabled or not configured**|Clients cannot create and use Network Key Protectors| +|**When disabled or not configured**|Clients can't create and use Network Key Protectors| **Reference** -To use a network key protector to unlock the computer, the computer and the server that hosts BitLocker Drive Encryption Network Unlock must be provisioned with a Network Unlock certificate. The Network Unlock certificate is used to create a network key protector and to protect the information exchange with the server to unlock the computer. You can use the Group Policy setting **Computer Configuration\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate** on the domain controller to distribute this certificate to computers in your organization. This unlock method uses the TPM on the computer, so computers that do not have a TPM cannot create network key protectors to automatically unlock by using Network Unlock. +To use a network key protector to unlock the computer, the computer and the server that hosts BitLocker Drive Encryption Network Unlock must be provisioned with a Network Unlock certificate. The Network Unlock certificate is used to create a network key protector and to protect the information exchange with the server to unlock the computer. You can use the Group Policy setting **Computer Configuration\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate** on the domain controller to distribute this certificate to computers in your organization. This unlock method uses the TPM on the computer, so computers that don't have a TPM can't create network key protectors to automatically unlock by using Network Unlock. > [!NOTE] -> For reliability and security, computers should also have a TPM startup PIN that can be used when the computer is disconnected from the wired network or cannot connect to the domain controller at startup. +> For reliability and security, computers should also have a TPM startup PIN that can be used when the computer is disconnected from the wired network or can't connect to the domain controller at startup. For more information about Network Unlock, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). @@ -157,7 +157,7 @@ This policy setting is used to control which unlock options are available for op |**Introduced**|Windows Server 2008 R2 and Windows 7| |**Drive type**|Operating system drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|**Conflicts**|If one authentication method is required, the other methods cannot be allowed. Use of BitLocker with a TPM startup key or with a TPM startup key and a PIN must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.| +|**Conflicts**|If one authentication method is required, the other methods can't be allowed. Use of BitLocker with a TPM startup key or with a TPM startup key and a PIN must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.| |**When enabled**|Users can configure advanced startup options in the BitLocker Setup Wizard.| |**When disabled or not configured**|Users can configure only basic options on computers with a TPM.

    Only one of the additional authentication options can be required at startup; otherwise, a policy error occurs.| @@ -167,10 +167,10 @@ If you want to use BitLocker on a computer without a TPM, select **Allow BitLock On a computer with a compatible TPM, additional authentication methods can be used at startup to improve protection for encrypted data. When the computer starts, it can use: -- only the TPM -- insertion of a USB flash drive containing the startup key -- the entry of a 4-digit to 20-digit personal identification number (PIN) -- a combination of the PIN and the USB flash drive +- Only the TPM +- Insertion of a USB flash drive containing the startup key +- The entry of a 4-digit to 20-digit personal identification number (PIN) +- A combination of the PIN and the USB flash drive There are four options for TPM-enabled computers or devices: @@ -206,7 +206,7 @@ This policy setting permits the use of enhanced PINs when you use an unlock meth |**Drive type**|Operating system drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| |**Conflicts**|None| -|**When enabled**|All new BitLocker startup PINs that are set will be enhanced PINs. Existing drives that were protected by using standard startup PINs are not affected.| +|**When enabled**|All new BitLocker startup PINs that are set will be enhanced PINs. Existing drives that were protected by using standard startup PINs aren't affected.| |**When disabled or not configured**|Enhanced PINs will not be used.| **Reference** @@ -214,7 +214,7 @@ This policy setting permits the use of enhanced PINs when you use an unlock meth Enhanced startup PINs permit the use of characters (including uppercase and lowercase letters, symbols, numbers, and spaces). This policy setting is applied when you turn on BitLocker. > [!IMPORTANT] -> Not all computers support enhanced PIN characters in the preboot environment. It is strongly recommended that users perform a system check during the BitLocker setup to verify that enhanced PIN characters can be used. +> Not all computers support enhanced PIN characters in the preboot environment. It's strongly recommended that users perform a system check during the BitLocker setup to verify that enhanced PIN characters can be used. ### Configure minimum PIN length for startup @@ -222,7 +222,7 @@ This policy setting is used to set a minimum PIN length when you use an unlock m | |   | |:---|:---| -|**Policy description**|With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits, and it can have a maximum length of 20 digits. By default, the minimum PIN length is 6.| +|**Policy description**|With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of four digits, and it can have a maximum length of 20 digits. By default, the minimum PIN length is 6.| |**Introduced**|Windows Server 2008 R2 and Windows 7| |**Drive type**|Operating system drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| @@ -232,7 +232,7 @@ This policy setting is used to set a minimum PIN length when you use an unlock m **Reference** -This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits. +This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of four digits and can have a maximum length of 20 digits. Originally, BitLocker allowed from 4 to 20 characters for a PIN. Windows Hello has its own PIN for logon, which can be 4 to 127 characters. @@ -244,13 +244,13 @@ The Dictionary Attack Prevention Parameters provide a way to balance security ne For example, when BitLocker is used with a TPM + PIN configuration, the number of PIN guesses is limited over time. A TPM 2.0 in this example could be configured to allow only 32 PIN guesses immediately, and then only one more guess every two hours. This totals a maximum of about 4415 guesses per year. -If the PIN is 4 digits, all 9999 possible PIN combinations could be attempted in a little over two years. +If the PIN is four digits, all 9999 possible PIN combinations could be attempted in a little over two years. Increasing the PIN length requires a greater number of guesses for an attacker. In that case, the lockout duration between each guess can be shortened to allow legitimate users to retry a failed attempt sooner, while maintaining a similar level of protection. -Beginning with Windows 10, version 1703, or Windows 11, the minimum length for the BitLocker PIN was increased to 6 characters to better align with other Windows features that leverage TPM 2.0, including Windows Hello. -To help organizations with the transition, beginning with Windows 10, version 1709 and Windows 10, version 1703 with the October 2017, or Windows 11 [cumulative update](https://support.microsoft.com/help/4018124) installed, the BitLocker PIN length is 6 characters by default, but it can be reduced to 4 characters. +Beginning with Windows 10, version 1703, or Windows 11, the minimum length for the BitLocker PIN was increased to six characters to better align with other Windows features that use TPM 2.0, including Windows Hello. +To help organizations with the transition, beginning with Windows 10, version 1709 and Windows 10, version 1703 with the October 2017, or Windows 11 [cumulative update](https://support.microsoft.com/help/4018124) installed, the BitLocker PIN length is six characters by default, but it can be reduced to four characters. If the minimum PIN length is reduced from the default of six characters, then the TPM 2.0 lockout period will be extended. ### Disable new DMA devices when this computer is locked @@ -282,7 +282,7 @@ This policy setting allows you to configure whether standard users are allowed t |**Drive type**|Operating system drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| |**Conflicts**|None| -|**When enabled**|Standard users are not allowed to change BitLocker PINs or passwords.| +|**When enabled**|Standard users aren't allowed to change BitLocker PINs or passwords.| |**When disabled or not configured**|Standard users are permitted to change BitLocker PINs or passwords.| **Reference** @@ -291,7 +291,7 @@ To change the PIN or password, the user must be able to provide the current PIN ### Configure use of passwords for operating system drives -This policy controls how non-TPM based systems utilize the password protector. Used in conjunction with the **Password must meet complexity requirements** policy, this policy allows administrators to require password length and complexity for using the password protector. By default, passwords must be eight characters in length. Complexity configuration options determine how important domain connectivity is for the client. For the strongest password security, administrators should choose **Require password complexity** because it requires domain connectivity, and it requires that the BitLocker password meets the same password complexity requirements as domain sign-in passwords. +This policy controls how non-TPM based systems utilize the password protector. Used with the **Password must meet complexity requirements** policy, this policy allows administrators to require password length and complexity for using the password protector. By default, passwords must be eight characters in length. Complexity configuration options determine how important domain connectivity is for the client. For the strongest password security, administrators should choose **Require password complexity** because it requires domain connectivity, and it requires that the BitLocker password meets the same password complexity requirements as domain sign-in passwords. | |   | |:---|:---| @@ -299,9 +299,9 @@ This policy controls how non-TPM based systems utilize the password protector. U |**Introduced**|Windows Server 2012 and Windows 8| |**Drive type**|Operating system drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|**Conflicts**|Passwords cannot be used if FIPS-compliance is enabled.


    **NOTE:** The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options** specifies whether FIPS-compliance is enabled.| +|**Conflicts**|Passwords can't be used if FIPS-compliance is enabled.


    **NOTE:** The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options** specifies whether FIPS-compliance is enabled.| |**When enabled**|Users can configure a password that meets the requirements you define. To enforce complexity requirements for the password, select **Require complexity**.| -|**When disabled or not configured**|The default length constraint of 8 characters will apply to operating system drive passwords and no complexity checks will occur.| +|**When disabled or not configured**|The default length constraint of eight characters will apply to operating system drive passwords and no complexity checks will occur.| **Reference** @@ -311,7 +311,7 @@ If non-TPM protectors are allowed on operating system drives, you can provision > These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. When set to **Require complexity**, a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. When set to **Allow complexity**, a connection to a domain controller is attempted to validate that the complexity adheres to the rules set by the policy. If no domain controllers are found, the password will be accepted regardless of actual password complexity, and the drive will be encrypted by using that password as a protector. When set to **Do not allow complexity**, there is no password complexity validation. -Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. +Passwords must be at least eight characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. When this policy setting is enabled, you can set the option **Configure password complexity for operating system drives** to: @@ -329,7 +329,7 @@ This policy setting is used to control what unlock options are available for com |**Introduced**|Windows Server 2008 and Windows Vista| |**Drive type**|Operating system drives (Windows Server 2008 and Windows Vista)| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|**Conflicts**|If you choose to require an additional authentication method, other authentication methods cannot be allowed.| +|**Conflicts**|If you choose to require an additional authentication method, other authentication methods can't be allowed.| |**When enabled**|The BitLocker Setup Wizard displays the page that allows the user to configure advanced startup options for BitLocker. You can further configure setting options for computers with or without a TPM.| |**When disabled or not configured**|The BitLocker Setup Wizard displays basic steps that allow users to enable BitLocker on computers with a TPM. In this basic wizard, no additional startup key or startup PIN can be configured.| @@ -368,7 +368,7 @@ This policy setting is used to require, allow, or deny the use of smart cards wi |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| |**Conflicts**|To use smart cards with BitLocker, you may also need to modify the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting to match the object identifier of your smart card certificates.| |**When enabled**|Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the **Require use of smart cards on fixed data drives** check box.| -|**When disabled**|Users cannot use smart cards to authenticate their access to BitLocker-protected fixed data drives.| +|**When disabled**|Users can't use smart cards to authenticate their access to BitLocker-protected fixed data drives.| |**When not configured**|Smart cards can be used to authenticate user access to a BitLocker-protected drive.| **Reference** @@ -388,8 +388,8 @@ This policy setting is used to require, allow, or deny the use of passwords with |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| |**Conflicts**|To use password complexity, the **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements** policy setting must also be enabled.| |**When enabled**|Users can configure a password that meets the requirements you define. To require the use of a password, select **Require password for fixed data drive**. To enforce complexity requirements on the password, select **Require complexity**.| -|**When disabled**|The user is not allowed to use a password.| -|**When not configured**|Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.| +|**When disabled**|The user isn't allowed to use a password.| +|**When not configured**|Passwords are supported with the default settings, which don't include password complexity requirements and require only eight characters.| **Reference** @@ -399,18 +399,18 @@ When set to **Allow complexity**, a connection to a domain controller is attempt When set to **Do not allow complexity**, no password complexity validation is performed. -Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. +Passwords must be at least eight characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. > [!NOTE] > These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. For the complexity requirement setting to be effective, the Group Policy setting **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\Password must meet complexity requirements** must also be enabled. -This policy setting is configured on a per-computer basis. This means that it applies to local user accounts and domain user accounts. Because the password filter that is used to validate password complexity is located on the domain controllers, local user accounts cannot access the password filter because they are not authenticated for domain access. When this policy setting is enabled, if you sign in with a local user account, and you attempt to encrypt a drive or change a password on an existing BitLocker-protected drive, an "Access denied" error message is displayed. In this situation, the password key protector cannot be added to the drive. +This policy setting is configured on a per-computer basis. This means that it applies to local user accounts and domain user accounts. Because the password filter that's used to validate password complexity is located on the domain controllers, local user accounts can't access the password filter because they're not authenticated for domain access. When this policy setting is enabled, if you sign in with a local user account, and you attempt to encrypt a drive or change a password on an existing BitLocker-protected drive, an "Access denied" error message is displayed. In this situation, the password key protector can't be added to the drive. -Enabling this policy setting requires that connectivity to a domain be established before adding a password key protector to a BitLocker-protected drive. Users who work remotely and have periods of time in which they cannot connect to the domain should be made aware of this requirement so that they can schedule a time when they will be connected to the domain to turn on BitLocker or to change a password on a BitLocker-protected data drive. +Enabling this policy setting requires that connectivity to a domain be established before adding a password key protector to a BitLocker-protected drive. Users who work remotely and have periods of time in which they can't connect to the domain should be made aware of this requirement so that they can schedule a time when they will be connected to the domain to turn on BitLocker or to change a password on a BitLocker-protected data drive. > [!IMPORTANT] -> Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. +> Passwords can't be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. ### Configure use of smart cards on removable data drives @@ -424,7 +424,7 @@ This policy setting is used to require, allow, or deny the use of smart cards wi |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| |**Conflicts**|To use smart cards with BitLocker, you may also need to modify the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting to match the object identifier of your smart card certificates.| |**When enabled**|Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the **Require use of smart cards on removable data drives** check box.| -|**When disabled or not configured**|Users are not allowed to use smart cards to authenticate their access to BitLocker-protected removable data drives.| +|**When disabled or not configured**|Users aren't allowed to use smart cards to authenticate their access to BitLocker-protected removable data drives.| |**When not configured**|Smart cards are available to authenticate user access to a BitLocker-protected removable data drive.| **Reference** @@ -444,8 +444,8 @@ This policy setting is used to require, allow, or deny the use of passwords with |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| |**Conflicts**|To use password complexity, the **Password must meet complexity requirements** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy** must also be enabled.| |**When enabled**|Users can configure a password that meets the requirements you define. To require the use of a password, select **Require password for removable data drive**. To enforce complexity requirements on the password, select **Require complexity**.| -|**When disabled**|The user is not allowed to use a password.| -|**When not configured**|Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.| +|**When disabled**|The user isn't allowed to use a password.| +|**When not configured**|Passwords are supported with the default settings, which don't include password complexity requirements and require only eight characters.| **Reference** @@ -455,7 +455,7 @@ If you choose to allow the use of a password, you can require a password to be u > [!NOTE] > These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. -Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. +Passwords must be at least eight characters. To configure a greater minimum length for the password, enter the wanted number of characters in the **Minimum password length** box. When set to **Require complexity**, a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. @@ -464,7 +464,7 @@ When set to **Allow complexity**, a connection to a domain controller will be at When set to **Do not allow complexity**, no password complexity validation will be done. > [!NOTE] -> Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. +> Passwords can't be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. For information about this setting, see [System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing](../../threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md). @@ -491,7 +491,7 @@ The object identifier is specified in the enhanced key usage (EKU) of a certific The default object identifier is 1.3.6.1.4.1.311.67.1.1. > [!NOTE] -> BitLocker does not require that a certificate have an EKU attribute; however, if one is configured for the certificate, it must be set to an object identifier that matches the object identifier configured for BitLocker. +> BitLocker doesn't require that a certificate have an EKU attribute; however, if one is configured for the certificate, it must be set to an object identifier that matches the object identifier configured for BitLocker. ### Enable use of BitLocker authentication requiring preboot keyboard input on slates @@ -509,13 +509,13 @@ This policy setting allows users to enable authentication options that require u **Reference** -The Windows touch keyboard (such as used by tablets) is not available in the preboot environment where BitLocker requires additional information, such as a PIN or password. +The Windows touch keyboard (such as used by tablets) isn't available in the preboot environment where BitLocker requires additional information, such as a PIN or password. -It is recommended that administrators enable this policy only for devices that are verified to have an alternative means of preboot input, such as attaching a USB keyboard. +It's recommended that administrators enable this policy only for devices that are verified to have an alternative means of preboot input, such as attaching a USB keyboard. -When the Windows Recovery Environment is not enabled and this policy is not enabled, you cannot turn on BitLocker on a device that uses the Windows touch keyboard. +When the Windows Recovery Environment isn't enabled and this policy isn't enabled, you can't turn on BitLocker on a device that uses the Windows touch keyboard. -If you do not enable this policy setting, the following options in the **Require additional authentication at startup** policy might not be available: +If you don't enable this policy setting, the following options in the **Require additional authentication at startup** policy might not be available: - Configure TPM startup PIN: Required and Allowed - Configure TPM startup key and PIN: Required and Allowed @@ -532,7 +532,7 @@ This policy setting is used to require encryption of fixed drives prior to grant |**Drive type**|Fixed data drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| |**Conflicts**|See the Reference section for a description of conflicts.| -|**When enabled**|All fixed data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.| +|**When enabled**|All fixed data drives that aren't BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it's mounted with Read and Write access.| |**When disabled or not configured**|All fixed data drives on the computer are mounted with Read and Write access.| **Reference** @@ -544,10 +544,10 @@ Conflict considerations include: 1. When this policy setting is enabled, users receive "Access denied" error messages when they try to save data to unencrypted fixed data drives. See the Reference section for additional conflicts. 2. If BdeHdCfg.exe is run on a computer when this policy setting is enabled, you could encounter the following issues: - - If you attempted to shrink the drive and create the system drive, the drive size is successfully reduced and a raw partition is created. However, the raw partition is not formatted. The following error message is displayed: "The new active drive cannot be formatted. You may need to manually prepare your drive for BitLocker." + - If you attempted to shrink the drive and create the system drive, the drive size is successfully reduced and a raw partition is created. However, the raw partition isn't formatted. The following error message is displayed: "The new active drive cannot be formatted. You may need to manually prepare your drive for BitLocker." - If you attempt to use unallocated space to create the system drive, a raw partition will be created. However, the raw partition will not be formatted. The following error message is displayed: "The new active drive cannot be formatted. You may need to manually prepare your drive for BitLocker." - If you attempt to merge an existing drive into the system drive, the tool fails to copy the required boot file onto the target drive to create the system drive. The following error message is displayed: "BitLocker setup failed to copy boot files. You may need to manually prepare your drive for BitLocker." -3. If this policy setting is enforced, a hard drive cannot be repartitioned because the drive is protected. If you are upgrading computers in your organization from a previous version of Windows, and those computers were configured with a single partition, you should create the required BitLocker system partition before you apply this policy setting to the computers. +3. If this policy setting is enforced, a hard drive can't be repartitioned because the drive is protected. If you are upgrading computers in your organization from a previous version of Windows, and those computers were configured with a single partition, you should create the required BitLocker system partition before you apply this policy setting to the computers. ### Deny write access to removable drives not protected by BitLocker @@ -560,12 +560,12 @@ This policy setting is used to require that removable drives are encrypted prior |**Drive type**|Removable data drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| |**Conflicts**|See the Reference section for a description of conflicts.| -|**When enabled**|All removable data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.| +|**When enabled**|All removable data drives that aren't BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it's mounted with Read and Write access.| |**When disabled or not configured**|All removable data drives on the computer are mounted with Read and Write access.| **Reference** -If the **Deny write access to devices configured in another organization** option is selected, only drives with identification fields that match the computer's identification fields are given Write access. When a removable data drive is accessed, it is checked for a valid identification field and allowed identification fields. These fields are defined by the **Provide the unique identifiers for your organization** policy setting. +If the **Deny write access to devices configured in another organization** option is selected, only drives with identification fields that match the computer's identification fields are given Write access. When a removable data drive is accessed, it's checked for a valid identification field and allowed identification fields. These fields are defined by the **Provide the unique identifiers for your organization** policy setting. > [!NOTE] > You can override this policy setting with the policy settings under **User Configuration\\Administrative Templates\\System\\Removable Storage Access**. If the **Removable Disks: Deny write access** policy setting is enabled, this policy setting will be ignored. @@ -588,7 +588,7 @@ This policy setting is used to prevent users from turning BitLocker on or off on |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| |**Conflicts**|None| |**When enabled**|You can select property settings that control how users can configure BitLocker.| -|**When disabled**|Users cannot use BitLocker on removable data drives.| +|**When disabled**|Users can't use BitLocker on removable data drives.| |**When not configured**|Users can use BitLocker on removable data drives.| **Reference** @@ -621,20 +621,20 @@ This policy setting is used to control the encryption method and cipher strength The values of this policy determine the strength of the cipher that BitLocker uses for encryption. Enterprises may want to control the encryption level for increased security (AES-256 is stronger than AES-128). -If you enable this setting, you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. +If you enable this setting, you can configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. -For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10, version 1511 or later, or Windows 11. +For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that aren't running Windows 10, version 1511 or later, or Windows 11. Changing the encryption method has no effect if the drive is already encrypted or if encryption is in progress. In these cases, this policy setting is ignored. > [!WARNING] -> This policy does not apply to encrypted drives. Encrypted drives utilize their own algorithm, which is set by the drive during partitioning. +> This policy doesn't apply to encrypted drives. Encrypted drives utilize their own algorithm, which is set by the drive during partitioning. When this policy setting is disabled or not configured, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method that is specified in the setup script. ### Configure use of hardware-based encryption for fixed data drives -This policy controls how BitLocker reacts to systems that are equipped with encrypted drives when they are used as fixed data volumes. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. +This policy controls how BitLocker reacts to systems that are equipped with encrypted drives when they're used as fixed data volumes. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. | |   | |:---|:---| @@ -643,16 +643,16 @@ This policy controls how BitLocker reacts to systems that are equipped with encr |**Drive type**|Fixed data drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| |**Conflicts**|None| -|**When enabled**|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| -|**When disabled**|BitLocker cannot use hardware-based encryption with fixed data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| +|**When enabled**|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that don't support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| +|**When disabled**|BitLocker can't use hardware-based encryption with fixed data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| |**When not configured**|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.| **Reference** > [!NOTE] -> The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. +> The **Choose drive encryption method and cipher strength** policy setting doesn't apply to hardware-based encryption. -The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: +The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive isn't available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: - Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2 - AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42 @@ -668,25 +668,25 @@ This policy controls how BitLocker reacts when encrypted drives are used as oper |**Drive type**|Operating system drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| |**Conflicts**|None| -|**When enabled**|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| -|**When disabled**|BitLocker cannot use hardware-based encryption with operating system drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| +|**When enabled**|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that don't support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| +|**When disabled**|BitLocker can't use hardware-based encryption with operating system drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| |**When not configured**|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.| **Reference** -If hardware-based encryption is not available, BitLocker software-based encryption is used instead. +If hardware-based encryption isn't available, BitLocker software-based encryption is used instead. > [!NOTE] -> The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. +> The **Choose drive encryption method and cipher strength** policy setting doesn't apply to hardware-based encryption. -The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: +The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive isn't available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: - Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2 - AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42 ### Configure use of hardware-based encryption for removable data drives -This policy controls how BitLocker reacts to encrypted drives when they are used as removable data drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. +This policy controls how BitLocker reacts to encrypted drives when they're used as removable data drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. | |   | |:---|:---| @@ -695,18 +695,18 @@ This policy controls how BitLocker reacts to encrypted drives when they are used |**Drive type**|Removable data drive| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| |**Conflicts**|None| -|**When enabled**|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| -|**When disabled**|BitLocker cannot use hardware-based encryption with removable data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| +|**When enabled**|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that don't support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| +|**When disabled**|BitLocker can't use hardware-based encryption with removable data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| |**When not configured**|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.| **Reference** -If hardware-based encryption is not available, BitLocker software-based encryption is used instead. +If hardware-based encryption isn't available, BitLocker software-based encryption is used instead. > [!NOTE] -> The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. +> The **Choose drive encryption method and cipher strength** policy setting doesn't apply to hardware-based encryption. -The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: +The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive isn't available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: - Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2 - AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42 @@ -722,7 +722,7 @@ This policy controls whether fixed data drives utilize Used Space Only encryptio |**Drive type**|Fixed data drive| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| |**Conflicts**|None| -|**When enabled**|This policy defines the encryption type that BitLocker uses to encrypt drives, and the encryption type option is not presented in the BitLocker Setup Wizard.| +|**When enabled**|This policy defines the encryption type that BitLocker uses to encrypt drives, and the encryption type option isn't presented in the BitLocker Setup Wizard.| |**When disabled or not configured**|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.| **Reference** @@ -730,7 +730,7 @@ This policy controls whether fixed data drives utilize Used Space Only encryptio This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. > [!NOTE] -> This policy is ignored when you are shrinking or expanding a volume and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. +> This policy is ignored when you are shrinking or expanding a volume and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space isn't wiped as it would be for a drive that is using Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: `manage-bde -w`. If the volume is shrunk, no action is taken for the new free space. For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde). @@ -745,7 +745,7 @@ This policy controls whether operating system drives utilize Full encryption or |**Drive type**|Operating system drive| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| |**Conflicts**|None| -|**When enabled**|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.| +|**When enabled**|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option isn't presented in the BitLocker Setup Wizard.| |**When disabled or not configured**|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.| **Reference** @@ -753,7 +753,7 @@ This policy controls whether operating system drives utilize Full encryption or This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. > [!NOTE] -> This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that uses Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. +> This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space isn't wiped as it would be for a drive that uses Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: `manage-bde -w`. If the volume is shrunk, no action is taken for the new free space. For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde). @@ -768,7 +768,7 @@ This policy controls whether fixed data drives utilize Full encryption or Used S |**Drive type**|Removable data drive| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| |**Conflicts**|None| -|**When enabled**|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.| +|**When enabled**|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option isn't presented in the BitLocker Setup Wizard.| |**When disabled or not configured**|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.| **Reference** @@ -776,7 +776,7 @@ This policy controls whether fixed data drives utilize Full encryption or Used S This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. > [!NOTE] -> This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full Encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. +> This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space isn't wiped as it would be for a drive that is using Full Encryption. The user could wipe the free space on a Used Space Only drive by using the following command: `manage-bde -w`. If the volume is shrunk, no action is taken for the new free space. For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde). @@ -792,7 +792,7 @@ This policy setting is used to configure recovery methods for operating system d |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| |**Conflicts**|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.

    When using data recovery agents, you must enable the **Provide the unique identifiers for your organization** policy setting.| |**When enabled**|You can control the methods that are available to users to recover data from BitLocker-protected operating system drives.| -|**When disabled or not configured**|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| +|**When disabled or not configured**|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information isn't backed up to AD DS.| **Reference** @@ -804,7 +804,7 @@ For more information about adding data recovery agents, see [BitLocker basic dep In **Configure user storage of BitLocker recovery information**, select whether users are allowed, required, or not allowed to generate a 48-digit recovery password. -Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for +Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you can't specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for the drive are determined by the policy setting. In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS) for operating system drives. If you select **Store recovery password and key packages**, the BitLocker recovery password and the key package are stored in AD DS. Storing the key package supports recovering data from a drive that is physically corrupted. If you select **Store recovery password only**, only the recovery password is stored in AD DS. @@ -825,7 +825,7 @@ This policy setting is used to configure recovery methods for BitLocker-protecte |**Drive type**|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| |**Conflicts**|This policy setting provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. If you choose the **Do not allow** option for both user recovery options, you must enable the **Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)** policy setting to prevent a policy error.| -|**When enabled**|You can configure the options that the Bitlocker Setup Wizard displays to users for recovering BitLocker encrypted data.| +|**When enabled**|You can configure the options that the BitLocker Setup Wizard displays to users for recovering BitLocker encrypted data.| |**When disabled or not configured**|The BitLocker Setup Wizard presents users with ways to store recovery options.| **Reference** @@ -838,10 +838,10 @@ Saving the recovery password to a USB drive stores the 48-digit recovery passwor > [!IMPORTANT] > If TPM initialization is performed during the BitLocker setup, TPM owner information is saved or printed with the BitLocker recovery information. -> The 48-digit recovery password is not available in FIPS-compliance mode. +> The 48-digit recovery password isn't available in FIPS-compliance mode. > [!IMPORTANT] -> To prevent data loss, you must have a way to recover BitLocker encryption keys. If you do not allow both recovery options, you must enable the backup of BitLocker recovery information to AD DS. Otherwise, a policy error occurs. +> To prevent data loss, you must have a way to recover BitLocker encryption keys. If you don't allow both recovery options, you must enable the backup of BitLocker recovery information to AD DS. Otherwise, a policy error occurs. ### Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista) @@ -855,7 +855,7 @@ This policy setting is used to configure the storage of BitLocker recovery infor |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| |**Conflicts**|None| |**When enabled**|BitLocker recovery information is automatically and silently backed up to AD DS when BitLocker is turned on for a computer.| -|**When disabled or not configured**|BitLocker recovery information is not backed up to AD DS.| +|**When disabled or not configured**|BitLocker recovery information isn't backed up to AD DS.| **Reference** @@ -865,11 +865,11 @@ This policy setting is applied when you turn on BitLocker. BitLocker recovery information includes the recovery password and unique identifier data. You can also include a package that contains an encryption key for a BitLocker-protected drive. This key package is secured by one or more recovery passwords, and it can help perform specialized recovery when the disk is damaged or corrupted. -If you select **Require BitLocker backup to AD DS**, BitLocker cannot be turned on unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. This option is selected by default to help ensure that BitLocker recovery is possible. +If you select **Require BitLocker backup to AD DS**, BitLocker can't be turned on unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. This option is selected by default to help ensure that BitLocker recovery is possible. A recovery password is a 48-digit number that unlocks access to a BitLocker-protected drive. A key package contains a drive’s BitLocker encryption key, which is secured by one or more recovery passwords. Key packages may help perform specialized recovery when the disk is damaged or corrupted. -If the **Require BitLocker backup to AD DS** option is not selected, AD DS backup is attempted, but network or other backup failures do not prevent the BitLocker setup. The Backup process is not automatically retried, and the recovery password might not be stored in AD DS during BitLocker setup. +If the **Require BitLocker backup to AD DS** option isn't selected, AD DS backup is attempted, but network or other backup failures don't prevent the BitLocker setup. The Backup process isn't automatically retried, and the recovery password might not be stored in AD DS during BitLocker setup. TPM initialization might be needed during the BitLocker setup. Enable the **Turn on TPM backup to Active Directory Domain Services** policy setting in **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services** to ensure that TPM information is also backed up. For more information about this setting, see [TPM Group Policy settings](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings). @@ -885,7 +885,7 @@ This policy setting is used to configure the default folder for recovery passwor |**Drive type**|All drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| |**Conflicts**|None| -|**When enabled**|You can specify the path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder. You can specify a fully qualified path or include the target computer's environment variables in the path. If the path is not valid, the BitLocker Setup Wizard displays the computer's top-level folder view.| +|**When enabled**|You can specify the path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder. You can specify a fully qualified path or include the target computer's environment variables in the path. If the path isn't valid, the BitLocker Setup Wizard displays the computer's top-level folder view.| |**When disabled or not configured**|The BitLocker Setup Wizard displays the computer's top-level folder view when the user chooses the option to save the recovery password in a folder.| **Reference** @@ -893,7 +893,7 @@ This policy setting is used to configure the default folder for recovery passwor This policy setting is applied when you turn on BitLocker. > [!NOTE] -> This policy setting does not prevent the user from saving the recovery password in another folder. +> This policy setting doesn't prevent the user from saving the recovery password in another folder. ### Choose how BitLocker-protected fixed drives can be recovered @@ -907,7 +907,7 @@ This policy setting is used to configure recovery methods for fixed data drives. |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| |**Conflicts**|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.

    When using data recovery agents, you must enable and configure the **Provide the unique identifiers for your organization** policy setting.| |**When enabled**|You can control the methods that are available to users to recover data from BitLocker-protected fixed data drives.| -|**When disabled or not configured**|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| +|**When disabled or not configured**|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information isn't backed up to AD DS.| **Reference** @@ -917,10 +917,10 @@ The **Allow data recovery agent** check box is used to specify whether a data re In **Configure user storage of BitLocker recovery information**, select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. -Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you cannot specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for the drive are determined by the policy setting. +Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you can't specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for the drive are determined by the policy setting. In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select **Backup recovery password and key package**, the BitLocker recovery password and the key package are stored in AD DS. -Storing the key package supports recovering data from a drive that has been physically corrupted. To recover this data, you can use the **Repair-bde** command-line tool. If you select **Backup recovery password only**, only the recovery password is stored in AD DS. +Storing the key package supports recovering data from a drive that has been physically corrupted. To recover this data, you can use the `Repair-bde` command-line tool. If you select **Backup recovery password only**, only the recovery password is stored in AD DS. For more information about the BitLocker repair tool, see [Repair-bde](/windows-server/administration/windows-commands/repair-bde). @@ -941,7 +941,7 @@ This policy setting is used to configure recovery methods for removable data dri |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| |**Conflicts**|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.

    When using data recovery agents, you must enable and configure the **Provide the unique identifiers for your organization** policy setting.| |**When enabled**|You can control the methods that are available to users to recover data from BitLocker-protected removable data drives.| -|**When disabled or not configured**|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| +|**When disabled or not configured**|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information isn't backed up to AD DS.| **Reference** @@ -951,7 +951,7 @@ The **Allow data recovery agent** check box is used to specify whether a data re In **Configure user storage of BitLocker recovery information**, select whether users are allowed, required, or not allowed to generate a 48-digit recovery password. -Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you cannot specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for the drive are determined by the policy setting. +Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you can't specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for the drive are determined by the policy setting. In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in AD DS for removable data drives. If you select **Backup recovery password and key package**, the BitLocker recovery password and the key package are stored in AD DS. If you select **Backup recovery password only**, only the recovery password is stored in AD DS. @@ -972,13 +972,13 @@ This policy setting is used to configure the entire recovery message and to repl |**Policy path**|Computer Configuration \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Operating System Drives \ Configure pre-boot recovery message and URL| |**Conflicts**|None| |**When enabled**|The customized message and URL are displayed on the pre-boot recovery screen. If you have previously enabled a custom recovery message and URL and want to revert to the default message and URL, you must keep the policy setting enabled and select the **Use default recovery message and URL** option.| -|**When disabled or not configured**|If the setting has not been previously enabled the default pre-boot recovery screen is displayed for BitLocker recovery. If the setting previously was enabled and is subsequently disabled the last message in Boot Configuration Data (BCD) is displayed whether it was the default recovery message or the custom message.| +|**When disabled or not configured**|If the setting hasn't been previously enabled, then the default pre-boot recovery screen is displayed for BitLocker recovery. If the setting previously was enabled and is later disabled, then the last message in Boot Configuration Data (BCD) is displayed whether it was the default recovery message or the custom message.| **Reference** Enabling the **Configure the pre-boot recovery message and URL** policy setting allows you to customize the default recovery screen message and URL to assist customers in recovering their key. -Once you enable the setting you have three options: +Once you enable the setting, you have three options: - If you select the **Use default recovery message and URL** option, the default BitLocker recovery message and URL will be displayed on the pre-boot recovery screen. - If you select the **Use custom recovery message** option, type the custom message in the **Custom recovery message option** text box. The message that you type in the **Custom recovery message option** text box will be displayed on the pre-boot recovery screen. If a recovery URL is available, include it in the message. @@ -988,11 +988,11 @@ Once you enable the setting you have three options: > Not all characters and languages are supported in the pre-boot environment. We strongly recommended that you verify the correct appearance of the characters that you use for the custom message and URL on the pre-boot recovery screen. > [!IMPORTANT] -> Because you can alter the BCDEdit commands manually before you have set Group Policy settings, you cannot return the policy setting to the default setting by selecting the **Not Configured** option after you have configured this policy setting. To return to the default pre-boot recovery screen leave the policy setting enabled and select the **Use default message** options from the **Choose an option for the pre-boot recovery message** drop-down list box. +> Because you can alter the BCDEdit commands manually before you have set Group Policy settings, you can't return the policy setting to the default setting by selecting the **Not Configured** option after you have configured this policy setting. To return to the default pre-boot recovery screen leave the policy setting enabled and select the **Use default message** options from the **Choose an option for the pre-boot recovery message** drop-down list box. ### Allow Secure Boot for integrity validation -This policy controls how BitLocker-enabled system volumes are handled in conjunction with the Secure Boot feature. Enabling this feature forces Secure Boot validation during the boot process and verifies Boot Configuration Data (BCD) settings according to the Secure Boot policy. +This policy controls how BitLocker-enabled system volumes are handled with the Secure Boot feature. Enabling this feature forces Secure Boot validation during the boot process and verifies Boot Configuration Data (BCD) settings according to the Secure Boot policy. | |   | |:---|:---| @@ -1000,7 +1000,7 @@ This policy controls how BitLocker-enabled system volumes are handled in conjunc |**Introduced**|Windows Server 2012 and Windows 8| |**Drive type**|All drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|**Conflicts**|If you enable **Allow Secure Boot for integrity validation**, make sure the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting is not enabled or include PCR 7 to allow BitLocker to use Secure Boot for platform or BCD integrity validation.

    For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.| +|**Conflicts**|If you enable **Allow Secure Boot for integrity validation**, make sure the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting isn't enabled or include PCR 7 to allow BitLocker to use Secure Boot for platform or BCD integrity validation.

    For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this cc.| |**When enabled or not configured**|BitLocker uses Secure Boot for platform integrity if the platform is capable of Secure Boot-based integrity validation.| |**When disabled**|BitLocker uses legacy platform integrity validation, even on systems that are capable of Secure Boot-based integrity validation.| @@ -1022,9 +1022,9 @@ This policy setting is used to establish an identifier that is applied to all dr |**Introduced**|Windows Server 2008 R2 and Windows 7| |**Drive type**|All drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| -|**Conflicts**|Identification fields are required to manage certificate-based data recovery agents on BitLocker-protected drives. BitLocker manages and updates certificate-based data recovery agents only when the identification field is present on a drive and it is identical to the value that is configured on the computer.| +|**Conflicts**|Identification fields are required to manage certificate-based data recovery agents on BitLocker-protected drives. BitLocker manages and updates certificate-based data recovery agents only when the identification field is present on a drive and it's identical to the value that is configured on the computer.| |**When enabled**|You can configure the identification field on the BitLocker-protected drive and any allowed identification field that is used by your organization.| -|**When disabled or not configured**|The identification field is not required.| +|**When disabled or not configured**|The identification field isn't required.| **Reference** @@ -1034,7 +1034,7 @@ An identification field is required to manage certificate-based data recovery ag For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde). -The allowed identification field is used in combination with the **Deny write access to removable drives not protected by BitLocker** policy setting to help control the use of removable drives in your organization. It is a comma-separated list of identification fields from your organization or external organizations. +The allowed identification field is used in combination with the **Deny write access to removable drives not protected by BitLocker** policy setting to help control the use of removable drives in your organization. It's a comma-separated list of identification fields from your organization or external organizations. You can configure the identification fields on existing drives by using the [Manage-bde](/windows-server/administration/windows-commands/manage-bde) command-line tool. @@ -1071,12 +1071,12 @@ This policy setting determines what values the TPM measures when it validates ea |**Drive type**|Operating system drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| |**Conflicts**|None| -|**When enabled**|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| +|**When enabled**|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, then the TPM doesn't release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| |**When disabled or not configured**|The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.| **Reference** -This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection. +This policy setting doesn't apply if the computer doesn't have a compatible TPM or if BitLocker has already been turned on with TPM protection. > [!IMPORTANT] > This Group Policy setting only applies to computers with BIOS configurations or to computers with UEFI firmware with the CSM enabled. Computers that use a native UEFI firmware configuration store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting to configure the TPM PCR profile for computers that use native UEFI firmware. @@ -1121,12 +1121,12 @@ This policy setting determines what values the TPM measures when it validates ea |**Drive type**|Operating system drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| |**Conflicts**|None| -|**When enabled**|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| +|**When enabled**|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM doesn't release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| |**When disabled or not configured**|The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.| **Reference** -This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker is already turned on with TPM protection. +This policy setting doesn't apply if the computer doesn't have a compatible TPM or if BitLocker is already turned on with TPM protection. A platform validation profile consists of a set of PCR indices that range from 0 to 23. The default platform validation profile secures the encryption key against changes to the following: @@ -1170,13 +1170,13 @@ This policy setting determines what values the TPM measures when it validates ea |**Introduced**|Windows Server 2012 and Windows 8| |**Drive type**|Operating system drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|**Conflicts**|Setting this policy with PCR 7 omitted, overrides the **Allow Secure Boot for integrity validation** Group Policy setting, and it prevents BitLocker from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation.

    If your environments use TPM and Secure Boot for platform integrity checks, this policy should not be configured.

    For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.| -|**When enabled**|Before you turn on BitLocker, you can configure the boot components that the TPM validates before it unlocks access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| +|**Conflicts**|Setting this policy with PCR 7 omitted, overrides the **Allow Secure Boot for integrity validation** Group Policy setting, and it prevents BitLocker from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation.

    If your environments use TPM and Secure Boot for platform integrity checks, this policy is configured.

    For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this article.| +|**When enabled**|Before you turn on BitLocker, you can configure the boot components that the TPM validates before it unlocks access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM doesn't release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| |**When disabled or not configured**|BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script.| **Reference** -This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker is already turned on with TPM protection. +This policy setting doesn't apply if the computer doesn't have a compatible TPM or if BitLocker is already turned on with TPM protection. > [!IMPORTANT] > This Group Policy setting only applies to computers with a native UEFI firmware configuration. Computers with BIOS or UEFI firmware with a Compatibility Support Module (CSM) enabled store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for BIOS-based firmware configurations** Group Policy setting to configure the TPM PCR profile for computers with BIOS configurations or for computers with UEFI firmware with a CSM enabled. @@ -1194,7 +1194,7 @@ The following list identifies all of the PCRs available: - PCR 6: Resume from S4 and S5 Power State Events - PCR 7: Secure Boot State - For more information about this PCR, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic. + For more information about this PCR, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this article. - PCR 8: Initialized to 0 with no Extends (reserved for future use) - PCR 9: Initialized to 0 with no Extends (reserved for future use) @@ -1220,7 +1220,7 @@ This policy setting determines if you want platform validation data to refresh w |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| |**Conflicts**|None| |**When enabled**|Platform validation data is refreshed when Windows is started following a BitLocker recovery.| -|**When disabled**|Platform validation data is not refreshed when Windows is started following a BitLocker recovery.| +|**When disabled**|Platform validation data isn't refreshed when Windows is started following a BitLocker recovery.| |**When not configured**|Platform validation data is refreshed when Windows is started following a BitLocker recovery.| **Reference** @@ -1245,7 +1245,7 @@ This policy setting determines specific Boot Configuration Data (BCD) settings t **Reference** > [!NOTE] -> The setting that controls boot debugging (0x16000010) is always validated, and it has no effect if it is included in the inclusion or the exclusion list. +> The setting that controls boot debugging (0x16000010) is always validated, and it has no effect if it's included in the inclusion or the exclusion list. ### Allow access to BitLocker-protected fixed data drives from earlier versions of Windows @@ -1259,14 +1259,14 @@ This policy setting is used to control whether access to drives is allowed by us |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| |**Conflicts**|None| |**When enabled and When not configured**|Fixed data drives that are formatted with the FAT file system can be unlocked on computers running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.| -|**When disabled**|Fixed data drives that are formatted with the FAT file system and are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.| +|**When disabled**|Fixed data drives that are formatted with the FAT file system and are BitLocker-protected can't be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) isn't installed.| **Reference** > [!NOTE] -> This policy setting does not apply to drives that are formatted with the NTFS file system. +> This policy setting doesn't apply to drives that are formatted with the NTFS file system. -When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted fixed drives** check box to help prevent users from running BitLocker To Go Reader from their fixed drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user is prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the fixed drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box is not selected, BitLocker To Go Reader will be installed on the fixed drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. +When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted fixed drives** check box to help prevent users from running BitLocker To Go Reader from their fixed drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that doesn't have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user is prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the fixed drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box isn't selected, then BitLocker To Go Reader will be installed on the fixed drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. ### Allow access to BitLocker-protected removable data drives from earlier versions of Windows @@ -1280,18 +1280,18 @@ This policy setting controls access to removable data drives that are using the |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| |**Conflicts**|None| |**When enabled and When not configured**|Removable data drives that are formatted with the FAT file system can be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.| -|**When disabled**|Removable data drives that are formatted with the FAT file system that are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.| +|**When disabled**|Removable data drives that are formatted with the FAT file system that are BitLocker-protected can't be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) isn't installed.| **Reference** > [!NOTE] -> This policy setting does not apply to drives that are formatted with the NTFS file system. +> This policy setting doesn't apply to drives that are formatted with the NTFS file system. -When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted removable drives** check box to help prevent users from running BitLocker To Go Reader from their removable drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user will be prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the removable drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box is not selected, BitLocker To Go Reader will be installed on the removable drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2 that do not have BitLocker To Go Reader installed. +When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted removable drives** check box to help prevent users from running BitLocker To Go Reader from their removable drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that doesn't have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user will be prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the removable drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box isn't selected, then BitLocker To Go Reader will be installed on the removable drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2 that don't have BitLocker To Go Reader installed. ## FIPS setting -You can configure the Federal Information Processing Standard (FIPS) setting for FIPS compliance. As an effect of FIPS compliance, users cannot create or save a BitLocker password for recovery or as a key protector. The use of a recovery key is permitted. +You can configure the Federal Information Processing Standard (FIPS) setting for FIPS compliance. As an effect of FIPS compliance, users can't create or save a BitLocker password for recovery or as a key protector. The use of a recovery key is permitted. | |   | |:---|:---| @@ -1299,15 +1299,15 @@ You can configure the Federal Information Processing Standard (FIPS) setting for |**Introduced**|Windows Server 2003 with SP1| |**Drive type**|System-wide| |**Policy path**|Local Policies\Security Options\System cryptography: **Use FIPS compliant algorithms for encryption, hashing, and signing**| -|**Conflicts**|Some applications, such as Terminal Services, do not support FIPS-140 on all operating systems.| -|**When enabled**|Users will be unable to save a recovery password to any location. This includes AD DS and network folders. In addition, you cannot use WMI or the BitLocker Drive Encryption Setup wizard to create a recovery password.| +|**Conflicts**|Some applications, such as Terminal Services, don't support FIPS-140 on all operating systems.| +|**When enabled**|Users will be unable to save a recovery password to any location. This includes AD DS and network folders. Also, you can't use WMI or the BitLocker Drive Encryption Setup wizard to create a recovery password.| |**When disabled or not configured**|No BitLocker encryption key is generated| **Reference** -This policy needs to be enabled before any encryption key is generated for BitLocker. Note that when this policy is enabled, BitLocker prevents creating or using recovery passwords, so recovery keys should be used instead. +This policy must be enabled before any encryption key is generated for BitLocker. When this policy is enabled, BitLocker prevents creating or using recovery passwords, so recovery keys should be used instead. -You can save the optional recovery key to a USB drive. Because recovery passwords cannot be saved to AD DS when FIPS is enabled, an error is caused if AD DS backup is required by Group Policy. +You can save the optional recovery key to a USB drive. Because recovery passwords can't be saved to AD DS when FIPS is enabled, an error is caused if AD DS backup is required by Group Policy. You can edit the FIPS setting by using the Security Policy Editor (Secpol.msc) or by editing the Windows registry. You must be an administrator to perform these procedures. @@ -1315,11 +1315,11 @@ For more information about setting this policy, see [System cryptography: Use FI ## Power management Group Policy settings: Sleep and Hibernate -PCs default power settings for a computer will cause the computer to enter Sleep mode frequently to conserve power when idle and to help extend the system’s battery life. When a computer transitions to Sleep, open programs and documents are persisted in memory. When a computer resumes from Sleep, users are not required to re-authenticate with a PIN or USB startup key to access encrypted data. This might lead to conditions where data security is compromised. +PCs default power settings for a computer will cause the computer to enter Sleep mode frequently to conserve power when idle and to help extend the system’s battery life. When a computer transitions to Sleep, open programs and documents are persisted in memory. When a computer resumes from Sleep, users aren't required to reauthenticate with a PIN or USB startup key to access encrypted data. This might lead to conditions where data security is compromised. -However, when a computer hibernates the drive is locked, and when it resumes from hibernation the drive is unlocked, which means that users will need to provide a PIN or a startup key if using multifactor authentication with BitLocker. Therefore, organizations that use BitLocker may want to use Hibernate instead of Sleep for improved security. This setting does not have an impact on TPM-only mode, because it provides a transparent user experience at startup and when resuming from the Hibernate states. +However, when a computer hibernates the drive is locked, and when it resumes from hibernation the drive is unlocked, which means that users will need to provide a PIN or a startup key if using multifactor authentication with BitLocker. Therefore, organizations that use BitLocker may want to use Hibernate instead of Sleep for improved security. This setting doesn't have an impact on TPM-only mode, because it provides a transparent user experience at startup and when resuming from the Hibernate states. -You can use disable the following Group Policy settings, which are located in **Computer Configuration\\Administrative Templates\\System\\Power Management** to disable all available sleep states: +You can disable the following Group Policy settings, which are located in **Computer Configuration\\Administrative Templates\\System\\Power Management** to disable all available sleep states: - Allow Standby States (S1-S3) When Sleeping (Plugged In) - Allow Standby States (S1-S3) When Sleeping (Battery) @@ -1332,7 +1332,7 @@ Changing from the default platform validation profile affects the security and m **About PCR 7** -PCR 7 measures the state of Secure Boot. With PCR 7, BitLocker can leverage Secure Boot for integrity validation. Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. PCR 7 measurements indicate whether Secure Boot is on and which keys are trusted on the platform. If Secure Boot is on and the firmware measures PCR 7 correctly per the UEFI specification, BitLocker can bind to this information rather than to PCRs 0, 2, and 4 which have the measurements of the exact firmware and Bootmgr images loaded. This +PCR 7 measures the state of Secure Boot. With PCR 7, BitLocker can use Secure Boot for integrity validation. Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. PCR 7 measurements indicate whether Secure Boot is on and which keys are trusted on the platform. If Secure Boot is on and the firmware measures PCR 7 correctly per the UEFI specification, BitLocker can bind to this information rather than to PCRs 0, 2, and 4, which have the measurements of the exact firmware and Bootmgr images loaded. This reduces the likelihood of BitLocker starting in recovery mode as a result of firmware and image updates, and it provides you with greater flexibility to manage the preboot configuration. PCR 7 measurements must follow the guidance that is described in [Appendix A Trusted Execution Environment EFI Protocol](/windows-hardware/test/hlk/testref/trusted-execution-environment-efi-protocol). diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index 1a019df8fe..f8388b1544 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -27,10 +27,10 @@ Microsoft Intune has an easy way to create and deploy a Windows Information Prot You can create an app protection policy in Intune either with device enrollment for MDM or without device enrollment for MAM. The process to create either policy is similar, but there are important differences: -- MAM has additional **Access** settings for Windows Hello for Business. +- MAM has more **Access** settings for Windows Hello for Business. - MAM can [selectively wipe company data](/intune/apps-selective-wipe) from a user's personal device. - MAM requires an [Azure Active Directory (Azure AD) Premium license](/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses). -- An Azure AD Premium license is also required for WIP auto-recovery, where a device can re-enroll and re-gain access to protected data. WIP auto-recovery depends on Azure AD registration to back up the encryption keys, which requires device auto-enrollment with MDM. +- An Azure AD Premium license is also required for WIP auto-recovery, where a device can re-enroll and regain access to protected data. WIP auto-recovery depends on Azure AD registration to back up the encryption keys, which requires device auto-enrollment with MDM. - MAM supports only one user per device. - MAM can only manage [enlightened apps](enlightened-microsoft-apps-and-wip.md). - Only MDM can use [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp) policies. @@ -39,15 +39,15 @@ You can create an app protection policy in Intune either with device enrollment ## Prerequisites -Before you can create a WIP policy using Intune, you need to configure an MDM or MAM provider in Azure Active Directory (Azure AD). MAM requires an [Azure Active Directory (Azure AD) Premium license](/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses). An Azure AD Premium license is also required for WIP auto-recovery, where a device can re-enroll and re-gain access to protected data. WIP auto-recovery relies on Azure AD registration to back up the encryption keys, which requires device auto-enrollment with MDM. +Before you can create a WIP policy using Intune, you need to configure an MDM or MAM provider in Azure Active Directory (Azure AD). MAM requires an [Azure Active Directory (Azure AD) Premium license](/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses). An Azure AD Premium license is also required for WIP auto-recovery, where a device can re-enroll and regain access to protected data. WIP auto-recovery relies on Azure AD registration to back up the encryption keys, which requires device auto-enrollment with MDM. ## Configure the MDM or MAM provider 1. Sign in to the Azure portal. -2. Click **Azure Active Directory** > **Mobility (MDM and MAM)** > **Microsoft Intune**. +2. Select **Azure Active Directory** > **Mobility (MDM and MAM)** > **Microsoft Intune**. -3. Click **Restore Default URLs** or enter the settings for MDM or MAM user scope and click **Save**: +3. Select **Restore Default URLs** or enter the settings for MDM or MAM user scope and select **Save**: ![Configure MDM or MAM provider.](images/mobility-provider.png) @@ -55,11 +55,11 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or 1. Sign in to the [Microsoft Endpoint Manager](https://endpoint.microsoft.com/). -2. Open Microsoft Intune and click **Apps** > **App protection policies** > **Create policy**. +2. Open Microsoft Intune and select **Apps** > **App protection policies** > **Create policy**. ![Open Client apps.](images/create-app-protection-policy.png) -3. In the **App policy** screen, click **Add a policy**, and then fill out the fields: +3. In the **App policy** screen, select **Add a policy**, and then fill out the fields: - **Name.** Type a name (required) for your new policy. @@ -71,7 +71,7 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or ![Add a mobile app policy.](images/add-a-mobile-app-policy.png) -4. Click **Protected apps** and then click **Add apps**. +4. Select **Protected apps** and then select **Add apps**. ![Add protected apps.](images/add-protected-apps.png) @@ -86,13 +86,13 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or ### Add recommended apps -Select **Recommended apps** and select each app you want to access your enterprise data or select them all, and click **OK**. +Select **Recommended apps** and select each app you want to access your enterprise data or select them all, and select **OK**. ![Microsoft Intune management console: Recommended apps.](images/recommended-apps.png) ### Add Store apps -Select **Store apps**, type the app product name and publisher, and click **OK**. For example, to add the Power BI Mobile App from the Store, type the following: +Select **Store apps**, type the app product name and publisher, and select **OK**. For example, to add the Power BI Mobile App from the Store, type the following: - **Name**: Microsoft Power BI - **Publisher**: `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` @@ -100,7 +100,7 @@ Select **Store apps**, type the app product name and publisher, and click **OK** ![Add Store app.](images/add-a-protected-store-app.png) -To add multiple Store apps, click the ellipsis `…`. +To add multiple Store apps, select the ellipsis `…`. If you don't know the Store app publisher or product name, you can find them by following these steps. @@ -169,14 +169,14 @@ To add **Desktop apps**, complete the following fields, based on what results yo |Field|Manages| |--- |--- | |All fields marked as “*”|All files signed by any publisher. (Not recommended and may not work)| -|Publisher only|If you only fill out this field, you’ll get all files signed by the named publisher.This might be useful if your company is the publisher and signer of internal line-of-business apps.| +|Publisher only|If you only fill out this field, you’ll get all files signed by the named publisher. This might be useful if your company is the publisher and signer of internal line-of-business apps.| |Publisher and Name only|If you only fill out these fields, you’ll get all files for the specified product, signed by the named publisher.| |Publisher, Name, and File only|If you only fill out these fields, you’ll get any version of the named file or package for the specified product, signed by the named publisher.| -|Publisher, Name, File, and Min version only|If you only fill out these fields, you’ll get the specified version or newer releases of the named file or package for the specified product, signed by the named publisher.This option is recommended for enlightened apps that weren't previously enlightened.| +|Publisher, Name, File, and Min version only|If you only fill out these fields, you’ll get the specified version or newer releases of the named file or package for the specified product, signed by the named publisher. This option is recommended for enlightened apps that weren't previously enlightened.| |Publisher, Name, File, and Max version only|If you only fill out these fields, you’ll get the specified version or older releases of the named file or package for the specified product, signed by the named publisher.| |All fields completed|If you fill out all fields, you’ll get the specified version of the named file or package for the specified product, signed by the named publisher.| -To add another Desktop app, click the ellipsis **…**. After you’ve entered the info into the fields, click **OK**. +To add another Desktop app, select the ellipsis **…**. After you’ve entered the info into the fields, select **OK**. ![Microsoft Intune management console: Adding Desktop app info.](images/wip-azure-add-desktop-apps.png) @@ -202,7 +202,7 @@ Path Publisher Where `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the **Publisher** name and `WORDPAD.EXE` is the **File** name. -Regarding to how to get the Product Name for the Apps you wish to Add, please reach out to our Windows Support Team to request the guidelines +Regarding to how to get the Product Name for the Apps you wish to Add, contact the Windows Support Team to request the guidelines ### Import a list of apps @@ -217,35 +217,35 @@ For more info about AppLocker, see the [AppLocker](../../threat-protection/windo 1. Open the Local Security Policy snap-in (SecPol.msc). -2. In the left blade, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. +2. Expand **Application Control Policies**, expand **AppLocker**, and then select **Packaged App Rules**. ![Local security snap-in, showing the Packaged app Rules.](images/wip-applocker-secpol-1.png) -3. Right-click in the right-hand blade, and then click **Create New Rule**. +3. Right-click in the right side, and then select **Create New Rule**. The **Create Packaged app Rules** wizard appears. -4. On the **Before You Begin** page, click **Next**. +4. On the **Before You Begin** page, select **Next**. ![Screenshot of the Before You Begin tab.](images/wip-applocker-secpol-wizard-1.png) -5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**. +5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then select **Next**. ![Screenshot of the Permissions tab with "Allow" and "Everyone" selected](images/wip-applocker-secpol-wizard-2.png) -6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. +6. On the **Publisher** page, choose **Select** from the **Use an installed packaged app as a reference** area. ![Screenshot of the "Use an installed package app as a reference" radio button selected and the Select button highlighted](images/wip-applocker-secpol-wizard-3.png) -7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Dynamics 365. +7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then select **OK**. For this example, we’re using Microsoft Dynamics 365. ![Screenshot of the Select applications list.](images/wip-applocker-secpol-wizard-4.png) -8. On the updated **Publisher** page, click **Create**. +8. On the updated **Publisher** page, select **Create**. ![Screenshot of the Publisher tab.](images/wip-applocker-secpol-wizard-5.png) -9. Click **No** in the dialog box that appears, asking if you want to create the default rules. You must not create default rules for your WIP policy. +9. Select **No** in the dialog box that appears, asking if you want to create the default rules. Don't create default rules for your WIP policy. ![Screenshot of AppLocker warning.](images/wip-applocker-default-rule-warning.png) @@ -253,15 +253,15 @@ For more info about AppLocker, see the [AppLocker](../../threat-protection/windo ![Local security snap-in, showing the new rule.](images/wip-applocker-secpol-create.png) -10. In the left blade, right-click on **AppLocker**, and then click **Export policy**. +10. On the left, right-click on **AppLocker**, and then select **Export policy**. The **Export policy** box opens, letting you export and save your new policy as XML. ![Local security snap-in, showing the Export Policy option.](images/wip-applocker-secpol-export.png) -11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. +11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then select **Save**. - The policy is saved and you’ll see a message that says 1 rule was exported from the policy. + The policy is saved and you’ll see a message that says one rule was exported from the policy. **Example XML file**
    This is the XML file that AppLocker creates for Microsoft Dynamics 365. @@ -293,40 +293,40 @@ The executable rule helps to create an AppLocker rule to sign any unsigned apps. 1. Open the Local Security Policy snap-in (SecPol.msc). -2. In the left pane, click **Application Control Policies** > **AppLocker** > **Executable Rules**. +2. In the left pane, select **Application Control Policies** > **AppLocker** > **Executable Rules**. 3. Right-click **Executable Rules** > **Create New Rule**. ![Local security snap-in, showing the Executable Rules.](images/create-new-path-rule.png) -4. On the **Before You Begin** page, click **Next**. +4. On the **Before You Begin** page, select **Next**. -5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**. +5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then select **Next**. -6. On the **Conditions** page, click **Path** and then click **Next**. +6. On the **Conditions** page, select **Path** and then select **Next**. ![Screenshot with Path conditions selected in the Create Executable Rules wizard.](images/path-condition.png) -7. Click **Browse Folders...** and select the path for the unsigned apps. For this example, we’re using "C:\Program Files". +7. Select **Browse Folders...** and select the path for the unsigned apps. For this example, we’re using "C:\Program Files". ![Screenshot of the Path field of the Create Executable Rules wizard.](images/select-path.png) -8. On the **Exceptions** page, add any exceptions and then click **Next**. +8. On the **Exceptions** page, add any exceptions and then select **Next**. -9. On the **Name** page, type a name and description for the rule and then click **Create**. +9. On the **Name** page, type a name and description for the rule and then select **Create**. 10. In the left pane, right-click **AppLocker** > **Export policy**. -11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. +11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then select **Save**. - The policy is saved and you’ll see a message that says 1 rule was exported from the policy. + The policy is saved and you’ll see a message that says one rule was exported from the policy. 12. After you’ve created your XML file, you need to import it by using Microsoft Intune. **To import a list of protected apps using Microsoft Intune** -1. In **Protected apps**, click **Import apps**. +1. In **Protected apps**, select **Import apps**. ![Import protected apps.](images/import-protected-apps.png) @@ -334,20 +334,20 @@ The executable rule helps to create an AppLocker rule to sign any unsigned apps. ![Microsoft Intune, Importing your AppLocker policy file using Intune.](images/wip-azure-import-apps.png) -2. Browse to your exported AppLocker policy file, and then click **Open**. +2. Browse to your exported AppLocker policy file, and then select **Open**. The file imports and the apps are added to your **Protected apps** list. ### Exempt apps from a WIP policy -If your app is incompatible with WIP, but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak. +If your app is incompatible with WIP, but still needs to be used with enterprise data, then you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak. -1. In **Client apps - App protection policies**, click **Exempt apps**. +1. In **Client apps - App protection policies**, select **Exempt apps**. ![Exempt apps.](images/exempt-apps.png) -2. In **Exempt apps**, click **Add apps**. +2. In **Exempt apps**, select **Add apps**. - Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. + When you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. 3. Fill out the rest of the app info, based on the type of app you’re adding: @@ -359,40 +359,40 @@ If your app is incompatible with WIP, but still needs to be used with enterprise - [Import apps](#import-a-list-of-apps) -4. Click **OK**. +4. Select **OK**. ## Manage the WIP protection mode for your enterprise data After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode. We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, **Block**. -1. From the **App protection policy** blade, click the name of your policy, and then click **Required settings**. +1. From **App protection policy**, select the name of your policy, and then select **Required settings**. - ![Microsoft Intune, Required settings blade showing Windows Information Protection mode.](images/wip-azure-required-settings-protection-mode.png) + ![Microsoft Intune, Required settings shows Windows Information Protection mode.](images/wip-azure-required-settings-protection-mode.png) |Mode |Description | |-----|------------| |Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| |Allow Overrides |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).| - |Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Allow Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.| - |Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.

    After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.| + |Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would have been prompted for employee interaction while in Allow Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.| + |Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.

    After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.| -2. Click **Save**. +2. Select **Save**. ## Define your enterprise-managed corporate identity -Corporate identity, usually expressed as your primary Internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies. +Corporate identity, typically expressed as your primary Internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies. Starting with Windows 10, version 1703, Intune automatically determines your corporate identity and adds it to the **Corporate identity** field. **To change your corporate identity** -1. From the **App policy** blade, click the name of your policy, and then click **Required settings**. +1. From **App policy**, select the name of your policy, and then select **Required settings**. 2. If the auto-defined identity isn’t correct, you can change the info in the **Corporate identity** field. ![Microsoft Intune, Set your corporate identity for your organization.](images/wip-azure-required-settings-corp-identity.png) -3. To add domains, such your email domain names, click **Configure Advanced settings** > **Add network boundary** and select **Protected domains**. +3. To add domains, such your email domain names, select **Configure Advanced settings** > **Add network boundary** and select **Protected domains**. ![Add protected domains.](images/add-protected-domains.png) @@ -401,17 +401,17 @@ After you've added a protection mode to your apps, you'll need to decide where t There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT). -To define the network boundaries, click **App policy** > the name of your policy > **Advanced settings** > **Add network boundary**. +To define the network boundaries, select **App policy** > the name of your policy > **Advanced settings** > **Add network boundary**. ![Microsoft Intune, Set where your apps can access enterprise data on your network.](images/wip-azure-advanced-settings-network.png) -Select the type of network boundary to add from the **Boundary type** box. Type a name for your boundary into the **Name** box, add your values to the **Value** box, based on the options covered in the following subsections, and then click **OK**. +Select the type of network boundary to add from the **Boundary type** box. Type a name for your boundary into the **Name** box, add your values to the **Value** box, based on the options covered in the following subsections, and then select **OK**. ### Cloud resources Specify the cloud resources to be treated as corporate and protected by WIP. For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. -Be aware that all traffic routed through your Internal proxy servers is considered enterprise. +All traffic routed through your Internal proxy servers is considered enterprise. Separate multiple resources with the "|" delimiter. For example: @@ -420,7 +420,7 @@ For example: URL <,proxy>|URL <,proxy> ``` -Personal applications will be able to access a cloud resource that has a blank space or an invalid character, such as a trailing dot in the URL. +Personal applications can access a cloud resource that has a blank space or an invalid character, such as a trailing dot in the URL. To add a subdomain for a cloud resource, use a period (.) instead of an asterisk (*). For example, to add all subdomains within Office.com, use ".office.com" (without the quotation marks). @@ -450,7 +450,7 @@ contoso.sharepoint.com|contoso.visualstudio.com|contoso.onedrive.com, ### Protected domains Specify the domains used for identities in your environment. -All traffic to the fully-qualified domains appearing in this list will be protected. +All traffic to the fully qualified domains appearing in this list will be protected. Separate multiple domains with the "|" delimiter. ```console @@ -460,7 +460,7 @@ exchange.contoso.com|contoso.com|region.contoso.com ### Network domains Specify the DNS suffixes used in your environment. -All traffic to the fully-qualified domains appearing in this list will be protected. +All traffic to the fully qualified domains appearing in this list will be protected. Separate multiple resources with the "," delimiter. ```console @@ -529,13 +529,13 @@ Separate multiple resources with the "," delimiter. sts.contoso.com,sts.contoso2.com ``` -Decide if you want Windows to look for additional network settings: +Decide if you want Windows to look for more network settings: -- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Turn on if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you turn this off, Windows will search for additional proxy servers in your immediate network. +- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Turn on if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you turn this off, Windows will search for more proxy servers in your immediate network. -- **Enterprise IP Ranges list is authoritative (do not auto-detect).** Turn on if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you turn this off, Windows will search for additional IP ranges on any domain-joined devices connected to your network. +- **Enterprise IP Ranges list is authoritative (do not auto-detect).** Turn on if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you turn this off, Windows will search for more IP ranges on any domain-joined devices connected to your network. -![Microsoft Intune, Choose if you want Windows to search for additional proxy servers or IP ranges in your enterprise.](images/wip-azure-advanced-settings-network-autodetect.png) +![Microsoft Intune, Choose if you want Windows to search for more proxy servers or IP ranges in your enterprise.](images/wip-azure-advanced-settings-network-autodetect.png) ## Upload your Data Recovery Agent (DRA) certificate After you create and deploy your WIP policy to your employees, Windows begins to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data while you maintain the private key that can unencrypt the data. @@ -544,11 +544,11 @@ After you create and deploy your WIP policy to your employees, Windows begins to >Using a DRA certificate isn’t mandatory. However, we strongly recommend it. For more info about how to find and export your data recovery certificate, see [Data Recovery and Encrypting File System (EFS)](/previous-versions/tn-archive/cc512680(v=technet.10)). For more info about creating and verifying your EFS DRA certificate, see [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate). **To upload your DRA certificate** -1. From the **App policy** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears. +1. From **App policy**, select the name of your policy, and then select **Advanced settings** from the menu that appears. - The **Advanced settings** blade appears. + **Advanced settings** shows. -2. In the **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. +2. In the **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, select **Browse** to add a data recovery certificate for your policy. ![Microsoft Intune, Upload your Data Recovery Agent (DRA) certificate.](images/wip-azure-advanced-settings-efsdra.png) @@ -561,15 +561,15 @@ After you've decided where your protected apps can access enterprise data on you - **On, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment. -- **Off.** Stop local encryption keys from being revoked from a device during unenrollment. For example if you’re migrating between Mobile Device Management (MDM) solutions. +- **Off.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you’re migrating between Mobile Device Management (MDM) solutions. **Show the enterprise data protection icon.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explorer views. The options are: -- **On.** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but protected apps, the icon overlay also appears on the app tile and with Managed text on the app name in the **Start** menu. +- **On.** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Also, for unenlightened but protected apps, the icon overlay also appears on the app tile and with Managed text on the app name in the **Start** menu. - **Off, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but protected apps. Not configured is the default option. -**Use Azure RMS for WIP.** Determines whether WIP uses [Microsoft Azure Rights Management](https://products.office.com/business/microsoft-azure-rights-management) to apply EFS encryption to files that are copied from Windows 10 to USB or other removable drives so they can be securely shared amongst employees. In other words, WIP uses Azure Rights Management "machinery" to apply EFS encryption to files when they are copied to removable drives. You must already have Azure Rights Management set up. The EFS file encryption key is protected by the RMS template’s license. Only users with permission to that template will be able to read it from the removable drive. WIP can also integrate with Azure RMS by using the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings in the [EnterpriseDataProtection CSP](/windows/client-management/mdm/enterprisedataprotection-csp). +**Use Azure RMS for WIP.** Determines whether WIP uses [Microsoft Azure Rights Management](https://products.office.com/business/microsoft-azure-rights-management) to apply EFS encryption to files that are copied from Windows 10 to USB or other removable drives so they can be securely shared with employees. In other words, WIP uses Azure Rights Management "machinery" to apply EFS encryption to files when they're copied to removable drives. You must already have Azure Rights Management set up. The EFS file encryption key is protected by the RMS template’s license. Only users with permission to that template can read it from the removable drive. WIP can also integrate with Azure RMS by using the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings in the [EnterpriseDataProtection CSP](/windows/client-management/mdm/enterprisedataprotection-csp). - **On.** Protects files that are copied to a removable drive. You can enter a TemplateID GUID to specify who can access the Azure Rights Management protected files, and for how long. The RMS template is only applied to the files on removable media, and is only used for access control—it doesn’t actually apply Azure Information Protection to the files. @@ -588,11 +588,11 @@ After you've decided where your protected apps can access enterprise data on you ## Encrypted file extensions -You can restrict which files are protected by WIP when they are downloaded from an SMB share within your enterprise network locations. If this setting is configured, only files with the extensions in the list will be encrypted. If this setting is not specified, the existing auto-encryption behavior is applied. +You can restrict which files are protected by WIP when they're downloaded from an SMB share within your enterprise network locations. If this setting is configured, only files with the extensions in the list will be encrypted. If this setting is not specified, the existing auto-encryption behavior is applied. ![WIP encrypted file extensions.](images/wip-encrypted-file-extensions.png) -## Related topics +## Related articles - [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md) From d376314dda7eb0bfa8f2ca6a165a9e197bb81467 Mon Sep 17 00:00:00 2001 From: Kaushik Ainapure Date: Wed, 12 Jan 2022 00:00:24 +0530 Subject: [PATCH 0235/1077] Updating the text --- windows/deployment/deploy-enterprise-licenses.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md index 1d57c81037..5a764b36a4 100644 --- a/windows/deployment/deploy-enterprise-licenses.md +++ b/windows/deployment/deploy-enterprise-licenses.md @@ -258,7 +258,5 @@ If a device is running a version of Windows 10 Pro prior to version 1703 (for ex ### Delay in the activation of Enterprise License of Windows 10 -This is by design. Windows 10 has a built-in cache to help with the volume of calls coming to determine the upgrades of Windows 10 devices. - -This cache stores three-day values, including responses that indicate that the device is not eligible for an upgrade. When a device makes the call to check for upgrade eligibility on behalf of the signed user with a qualifying license, it can take three days and the delay for the subscription purchase to go through OMS into the system that masters Windows 10 licenses. +This is by design. Windows 10 and Windows 11 has a built-in cache that is used when determining upgrade eligibility, including responses that indicate that the device is not eligible for an upgrade. It can take up to four days after a qualifying purchase before the upgrade eligibility is enabled and the cache expires. From 92532931bd4e5eba8eca363424ba15d36cf7b72a Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 11 Jan 2022 10:58:16 -0800 Subject: [PATCH 0236/1077] Update deploy-enterprise-licenses.md --- windows/deployment/deploy-enterprise-licenses.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md index 5a764b36a4..9c9fe641ba 100644 --- a/windows/deployment/deploy-enterprise-licenses.md +++ b/windows/deployment/deploy-enterprise-licenses.md @@ -258,5 +258,5 @@ If a device is running a version of Windows 10 Pro prior to version 1703 (for ex ### Delay in the activation of Enterprise License of Windows 10 -This is by design. Windows 10 and Windows 11 has a built-in cache that is used when determining upgrade eligibility, including responses that indicate that the device is not eligible for an upgrade. It can take up to four days after a qualifying purchase before the upgrade eligibility is enabled and the cache expires. +This is by design. Windows 10 and Windows 11 include a built-in cache that is used when determining upgrade eligibility, including responses that indicate that the device is not eligible for an upgrade. It can take up to four days after a qualifying purchase before the upgrade eligibility is enabled and the cache expires. From 784d4bc173e712c47baf5b86884f18f75806f80d Mon Sep 17 00:00:00 2001 From: Andrei-George Stoica <5600871+andreiztm@users.noreply.github.com> Date: Tue, 11 Jan 2022 21:20:54 +0200 Subject: [PATCH 0237/1077] Revert "Updating AllowMUService policy disabled option and a lot of formatting improvements/acrolinx" This reverts commit f15adac8ab06abaebd516a460283b7d867b88a06. --- .../mdm/policy-csp-update.md | 1016 ++++++++--------- 1 file changed, 478 insertions(+), 538 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 0c612b064a..ec5de9aacf 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -15,6 +15,7 @@ ms.collection: highpri # Policy CSP - Update +

    @@ -215,6 +216,7 @@ ms.collection: highpri
    +
    @@ -243,10 +245,10 @@ ms.collection: highpri -Allows the IT admin (when used with **Update/ActiveHoursStart**) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12-hour maximum from start time. +Allows the IT admin (when used with **Update/ActiveHoursStart**) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12 hour maximum from start time. > [!NOTE] -> The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. For more information, see **Update/ActiveHoursMaxRange** below. +> The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See **Update/ActiveHoursMaxRange** below for more information. Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. @@ -254,13 +256,12 @@ The default is 17 (5 PM). -ADMX Info: - -* GP Friendly name: *Turn off auto-restart for updates during active hours* -* GP name: *ActiveHours* -* GP element: *ActiveHoursEndTime* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Turn off auto-restart for updates during active hours* +- GP name: *ActiveHours* +- GP element: *ActiveHoursEndTime* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* @@ -301,13 +302,12 @@ The default value is 18 (hours). -ADMX Info: - -* GP Friendly name: *Specify active hours range for auto-restarts* -* GP name: *ActiveHoursMaxRange* -* GP element: *ActiveHoursMaxRange* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Specify active hours range for auto-restarts* +- GP name: *ActiveHoursMaxRange* +- GP element: *ActiveHoursMaxRange* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* @@ -340,10 +340,10 @@ ADMX Info: -Allows the IT admin (when used with **Update/ActiveHoursEnd**) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12-hour maximum from end time. +Allows the IT admin (when used with **Update/ActiveHoursEnd**) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12 hour maximum from end time. > [!NOTE] -> The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. For more information, see **Update/ActiveHoursMaxRange** above. +> The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See **Update/ActiveHoursMaxRange** above for more information. Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. @@ -351,13 +351,12 @@ The default value is 8 (8 AM). -ADMX Info: - -* GP Friendly name: *Turn off auto-restart for updates during active hours* -* GP name: *ActiveHours* -* GP element: *ActiveHoursStartTime* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Turn off auto-restart for updates during active hours* +- GP name: *ActiveHours* +- GP element: *ActiveHoursStartTime* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* @@ -399,27 +398,28 @@ If the policy is not configured, end-users get the default behavior (Auto instal ADMX Info: - -* GP Friendly name: *Configure Automatic Updates* -* GP name: *AutoUpdateCfg* -* GP element: *AutoUpdateMode* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +- GP Friendly name: *Configure Automatic Updates* +- GP name: *AutoUpdateCfg* +- GP element: *AutoUpdateMode* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 0 – Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end users to manage data usage. With these option users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel. -* 1 – Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end user is prompted to schedule the restart time. The end user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end user to control the start time reduces the risk of accidental data loss caused by applications that do not shut down properly on restart. -* 2 (default) – Auto install and restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This is the default behavior for unmanaged devices. Devices are updated quickly, but it increases the risk of accidental data loss caused by an application that does not shut down properly on restart. -* 3 – Auto install and restart at a specified time. The IT specifies the installation day and time. If no day and time are specified, the default is 3 AM daily. Automatic installation happens at this time and device restart happens after a 15-minute countdown. If the user is logged in when Windows is ready to restart, the user can interrupt the 15-minute countdown to delay the restart. -* 4 – Auto install and restart without end-user control. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This setting option also sets the end-user control panel to read-only. -* 5 – Turn off automatic updates. +- 0 – Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end-users to manage data usage. With this option users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel. +- 1 – Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end-user is prompted to schedule the restart time. The end-user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end-user to control the start time reduces the risk of accidental data loss caused by applications that do not shutdown properly on restart. +- 2 (default) – Auto install and restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This is the default behavior for unmanaged devices. Devices are updated quickly, but it increases the risk of accidental data loss caused by an application that does not shutdown properly on restart. +- 3 – Auto install and restart at a specified time. The IT specifies the installation day and time. If no day and time are specified, the default is 3 AM daily. Automatic installation happens at this time and device restart happens after a 15-minute countdown. If the user is logged in when Windows is ready to restart, the user can interrupt the 15-minute countdown to delay the restart. +- 4 – Auto install and restart without end-user control. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This setting option also sets the end-user control panel to read-only. +- 5 – Turn off automatic updates. + > [!IMPORTANT] > This option should be used only for systems under regulatory compliance, as you will not get security updates as well. + @@ -459,19 +459,18 @@ This policy is accessible through the Update setting in the user interface or Gr -ADMX Info: - -* GP Friendly name: *Allow updates to be downloaded automatically over metered connections* -* GP name: *AllowAutoWindowsUpdateDownloadOverMeteredNetwork* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Allow updates to be downloaded automatically over metered connections* +- GP name: *AllowAutoWindowsUpdateDownloadOverMeteredNetwork* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 0 (default) - Not allowed -* 1 - Allowed +- 0 (default) - Not allowed +- 1 - Allowed @@ -509,19 +508,18 @@ Allows the IT admin to manage whether to scan for app updates from Microsoft Upd ADMX Info: - -* GP Friendly name: *Configure Automatic Updates* -* GP name: *AutoUpdateCfg* -* GP element: *AllowMUUpdateServiceId* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +- GP Friendly name: *Configure Automatic Updates* +- GP name: *AutoUpdateCfg* +- GP element: *AllowMUUpdateServiceId* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 0 – Not configured. -* 1 – Allowed. Accepts updates received through Microsoft Update. +- 0 – Not allowed or not configured. +- 1 – Allowed. Accepts updates received through Microsoft Update. @@ -554,18 +552,18 @@ The following list shows the supported values: -Allows the IT admin to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. This policy supports using WSUS for third-party software and patch distribution. +Allows the IT admin to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. This policy supports using WSUS for 3rd party software and patch distribution. Supported operations are Get and Replace. -This policy is specific to desktop and local publishing via WSUS for third-party updates (binaries and updates not hosted on Microsoft Update) and allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. +This policy is specific to desktop and local publishing via WSUS for 3rd party updates (binaries and updates not hosted on Microsoft Update) and allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. The following list shows the supported values: -* 0 – Not allowed or not configured. Updates from an intranet Microsoft update service location must be signed by Microsoft. -* 1 – Allowed. Accepts updates received through an intranet Microsoft update service location, if they are signed by a certificate found in the "Trusted Publishers" certificate store of the local computer. +- 0 – Not allowed or not configured. Updates from an intranet Microsoft update service location must be signed by Microsoft. +- 1 – Allowed. Accepts updates received through an intranet Microsoft update service location, if they are signed by a certificate found in the "Trusted Publishers" certificate store of the local computer. @@ -605,23 +603,22 @@ Even when Windows Update is configured to receive updates from an intranet updat Enabling this policy will disable that functionality, and may cause connection to public services such as the Microsoft Store to stop working. > [!NOTE] -> This policy applies only when the desktop or device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. +> This policy applies only when the desktop or device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. -ADMX Info: - -* GP Friendly name: *Specify intranet Microsoft update service location* -* GP name: *CorpWuURL* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Specify intranet Microsoft update service location* +- GP name: *CorpWuURL* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 0 – Update service is not allowed. -* 1 (default) – Update service is allowed. +- 0 – Update service is not allowed. +- 1 (default) – Update service is allowed. @@ -658,30 +655,28 @@ For Quality Updates, this policy specifies the deadline in days before automatic The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks. -Value type is integer. Default is seven days. +Value type is integer. Default is 7 days. Supported values range: 2-30. -The PC must restart for certain updates to take effect. +Note that the PC must restart for certain updates to take effect. If you enable this policy, a restart will automatically occur the specified number of days after the restart was scheduled. If you disable or do not configure this policy, the PC will restart according to the default schedule. If any of the following two policies are enabled, this policy has no effect: - 1. No auto-restart with logged on users for scheduled automatic updates installations. 2. Always automatically restart at scheduled time. -ADMX Info: - -* GP Friendly name: *Specify deadline before auto-restart for update installation* -* GP name: *AutoRestartDeadline* -* GP element: *AutoRestartDeadline* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Specify deadline before auto-restart for update installation* +- GP name: *AutoRestartDeadline* +- GP element: *AutoRestartDeadline* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* @@ -718,30 +713,28 @@ For Feature Updates, this policy specifies the deadline in days before automatic The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks. -Value type is integer. Default is seven days. +Value type is integer. Default is 7 days. Supported values range: 2-30. -The PC must restart for certain updates to take effect. +Note that the PC must restart for certain updates to take effect. If you enable this policy, a restart will automatically occur the specified number of days after the restart was scheduled. If you disable or do not configure this policy, the PC will restart according to the default schedule. If any of the following two policies are enabled, this policy has no effect: - 1. No auto-restart with logged on users for scheduled automatic updates installations. 2. Always automatically restart at scheduled time. -ADMX Info: - -* GP Friendly name: *Specify deadline before auto-restart for update installation* -* GP name: *AutoRestartDeadline* -* GP element: *AutoRestartDeadlineForFeatureUpdates* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Specify deadline before auto-restart for update installation* +- GP name: *AutoRestartDeadline* +- GP element: *AutoRestartDeadlineForFeatureUpdates* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* @@ -780,13 +773,12 @@ The default value is 15 (minutes). -ADMX Info: - -* GP Friendly name: *Configure auto-restart reminder notifications for updates* -* GP name: *AutoRestartNotificationConfig* -* GP element: *AutoRestartNotificationSchd* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Configure auto-restart reminder notifications for updates* +- GP name: *AutoRestartNotificationConfig* +- GP element: *AutoRestartNotificationSchd* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* @@ -827,20 +819,19 @@ Allows the IT Admin to specify the method by which the auto-restart required not -ADMX Info: - -* GP Friendly name: *Configure auto-restart required notification for updates* -* GP name: *AutoRestartRequiredNotificationDismissal* -* GP element: *AutoRestartRequiredNotificationDismissal* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Configure auto-restart required notification for updates* +- GP name: *AutoRestartRequiredNotificationDismissal* +- GP element: *AutoRestartRequiredNotificationDismissal* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 1 (default) – Auto Dismissal. -* 2 – User Dismissal. +- 1 (default) – Auto Dismissal. +- 2 – User Dismissal. @@ -878,24 +869,22 @@ This policy setting allows you to configure if Automatic Maintenance should make > [!Note] > If the OS power wake policy is explicitly disabled, then this setting has no effect. -If you enable this policy setting, Automatic Maintenance attempts to set OS wake policy and make a wake request for the daily scheduled time, if necessary. +If you enable this policy setting, Automatic Maintenance attempts to set OS wake policy and make a wake request for the daily scheduled time, if required. If you disable or do not configure this policy setting, the wake setting as specified in Security and Maintenance/Automatic Maintenance Control Panel applies. -ADMX Info: - -* GP Friendly name: *Automatic Maintenance WakeUp Policy* -* GP name: *WakeUpPolicy* -* GP path: *Windows Components/Maintenance Scheduler* -* GP ADMX file name: *msched.admx* +ADMX Info: +- GP Friendly name: *Automatic Maintenance WakeUp Policy* +- GP name: *WakeUpPolicy* +- GP path: *Windows Components/Maintenance Scheduler* +- GP ADMX file name: *msched.admx* -Supported values: - -* 0 - Disable -* 1 - Enable (Default) +Supported values: +- 0 - Disable +- 1 - Enable (Default) @@ -937,23 +926,22 @@ Allows the IT admin to set which branch a device receives their updates from. As -ADMX Info: - -* GP Friendly name: *Select when Preview Builds and Feature Updates are received* -* GP name: *DeferFeatureUpdates* -* GP element: *BranchReadinessLevelId* -* GP path: *Windows Components/Windows Update/Windows Update for Business* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Select when Preview Builds and Feature Updates are received* +- GP name: *DeferFeatureUpdates* +- GP element: *BranchReadinessLevelId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 2 {0x2} - Windows Insider build - Fast (added in Windows 10, version 1709) -* 4 {0x4} - Windows Insider build - Slow (added in Windows 10, version 1709) -* 8 {0x8} - Release Windows Insider build (added in Windows 10, version 1709) -* 16 {0x10} - (default) Semi-annual Channel (Targeted). Device gets all applicable feature updates from Semi-annual Channel (Targeted). -* 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel. (*Only applicable to releases prior to 1903, for all releases 1903 and after the Semi-annual Channel and Semi-annual Channel (Targeted) into a single Semi-annual Channel with a value of 16) +- 2 {0x2} - Windows Insider build - Fast (added in Windows 10, version 1709) +- 4 {0x4} - Windows Insider build - Slow (added in Windows 10, version 1709) +- 8 {0x8} - Release Windows Insider build (added in Windows 10, version 1709) +- 16 {0x10} - (default) Semi-annual Channel (Targeted). Device gets all applicable feature updates from Semi-annual Channel (Targeted). +- 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel. (*Only applicable to releases prior to 1903, for all releases 1903 and after the Semi-annual Channel and Semi-annual Channel (Targeted) into a single Semi-annual Channel with a value of 16) @@ -990,13 +978,12 @@ The following list shows the supported values: Allows IT admins to specify the number of days a user has before feature updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule. -ADMX Info: - -* GP Friendly name: *Specify deadlines for automatic updates and restarts* -* GP name: *ConfigureDeadlineForFeatureUpdates* -* GP element: *ConfigureDeadlineForFeatureUpdates* -* GP path: *Administrative Templates\Windows Components\WindowsUpdate* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Specify deadlines for automatic updates and restarts* +- GP name: *ConfigureDeadlineForFeatureUpdates* +- GP element: *ConfigureDeadlineForFeatureUpdates* +- GP path: *Administrative Templates\Windows Components\WindowsUpdate* +- GP ADMX file name: *WindowsUpdate.admx* @@ -1044,13 +1031,12 @@ Default value is 7. Allows IT admins to specify the number of days a user has before quality updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule. -ADMX Info: - -* GP Friendly name: *Specify deadlines for automatic updates and restarts* -* GP name: *ConfigureDeadlineForQualityUpdates* -* GP element: *ConfigureDeadlineForQualityUpdates* -* GP path: *Administrative Templates\Windows Components\WindowsUpdate* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Specify deadlines for automatic updates and restarts* +- GP name: *ConfigureDeadlineForQualityUpdates* +- GP element: *ConfigureDeadlineForQualityUpdates* +- GP path: *Administrative Templates\Windows Components\WindowsUpdate* +- GP ADMX file name: *WindowsUpdate.admx* @@ -1099,13 +1085,12 @@ Allows the IT admin (when used with [Update/ConfigureDeadlineForFeatureUpdates]( -ADMX Info: - -* GP Friendly name: *Specify deadlines for automatic updates and restarts* -* GP name: *ConfigureDeadlineGracePeriod* -* GP element: *ConfigureDeadlineGracePeriod* -* GP path: *Administrative Templates\Windows Components\WindowsUpdate* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Specify deadlines for automatic updates and restarts* +- GP name: *ConfigureDeadlineGracePeriod* +- GP element: *ConfigureDeadlineGracePeriod* +- GP path: *Administrative Templates\Windows Components\WindowsUpdate* +- GP ADMX file name: *WindowsUpdate.admx* @@ -1155,20 +1140,18 @@ If enabled (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-c When disabled, if the device has installed the required updates and is outside of active hours, it may attempt an automatic restart before the deadline. -ADMX Info: - -* GP Friendly name: *Specify deadlines for automatic updates and restarts* -* GP name: *ConfigureDeadlineNoAutoReboot* -* GP element: *ConfigureDeadlineNoAutoReboot* -* GP path: *Administrative Templates\Windows Components\WindowsUpdate* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Specify deadlines for automatic updates and restarts* +- GP name: *ConfigureDeadlineNoAutoReboot* +- GP element: *ConfigureDeadlineNoAutoReboot* +- GP path: *Administrative Templates\Windows Components\WindowsUpdate* +- GP ADMX file name: *WindowsUpdate.admx* -Supported values: - -* 1 - Enabled -* 0 (default) - Disabled +Supported values: +- 1 - Enabled +- 0 (default) - Disabled @@ -1239,24 +1222,23 @@ Enable IT admin to configure feature update uninstall period. Values range 2 - 6 -Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. +Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. Defers Feature Updates for the specified number of days. Supported values are 0-365 days. > [!IMPORTANT] -> The default maximum number of days to defer an update has been increased from 180 (Windows 10, version 1607) to 365 in Windows 10, version 1703. +> The default maximum number of days to defer an update has been increased from 180 (Windows 10, version 1607) to 365 in Windows 10, version 1703. -ADMX Info: - -* GP Friendly name: *Select when Preview Builds and Feature Updates are received* -* GP name: *DeferFeatureUpdates* -* GP element: *DeferFeatureUpdatesPeriodId* -* GP path: *Windows Components/Windows Update/Windows Update for Business* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Select when Preview Builds and Feature Updates are received* +- GP name: *DeferFeatureUpdates* +- GP element: *DeferFeatureUpdatesPeriodId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* @@ -1295,13 +1277,12 @@ Supported values are 0-30. -ADMX Info: - -* GP Friendly name: *Select when Quality Updates are received* -* GP name: *DeferQualityUpdates* -* GP element: *DeferQualityUpdatesPeriodId* -* GP path: *Windows Components/Windows Update/Windows Update for Business* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Select when Quality Updates are received* +- GP name: *DeferQualityUpdates* +- GP element: *DeferQualityUpdatesPeriodId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* @@ -1335,9 +1316,10 @@ ADMX Info: > [!NOTE] -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpdatePeriod for Windows 10, version 1511 devices. +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpdatePeriod for Windows 10, version 1511 devices. -Allows IT Admins to specify update delays for up to four weeks. + +Allows IT Admins to specify update delays for up to 4 weeks. Supported values are 0-4, which refers to the number of weeks to defer updates. @@ -1346,41 +1328,39 @@ If the "Specify intranet Microsoft update service location" policy is enabled, t If the Allow Telemetry policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. OS upgrade: - -* Maximum deferral: Eight months -* Deferral increment: One month -* Update type/notes: - * Upgrade - 3689BDC8-B205-4AF4-8D4A-A63924C5E9D5 +- Maximum deferral: 8 months +- Deferral increment: 1 month +- Update type/notes: + - Upgrade - 3689BDC8-B205-4AF4-8D4A-A63924C5E9D5 Update: - -* Maximum deferral: One month -* Deferral increment: One week -* Update type/notes: If a machine has Microsoft Update enabled, any Microsoft Updates in these categories will also observe Defer / Pause logic: - * Security Update - 0FA1201D-4330-4FA8-8AE9-B877473B6441 - * Critical Update - E6CF1350-C01B-414D-A61F-263D14D133B4 - * Update Rollup - 28BC880E-0592-4CBF-8F95-C79B17911D5F - * Service Pack - 68C5B0A3-D1A6-4553-AE49-01D3A7827828 - * Tools - B4832BD8-E735-4761-8DAF-37F882276DAB - * Feature Pack - B54E7D24-7ADD-428F-8B75-90A396FA584F - * Update - CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83 - * Driver - EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0 +- Maximum deferral: 1 month +- Deferral increment: 1 week +- Update type/notes: If a machine has Microsoft Update enabled, any Microsoft Updates in these categories will also observe Defer / Pause logic: + + - Security Update - 0FA1201D-4330-4FA8-8AE9-B877473B6441 + - Critical Update - E6CF1350-C01B-414D-A61F-263D14D133B4 + - Update Rollup - 28BC880E-0592-4CBF-8F95-C79B17911D5F + - Service Pack - 68C5B0A3-D1A6-4553-AE49-01D3A7827828 + - Tools - B4832BD8-E735-4761-8DAF-37F882276DAB + - Feature Pack - B54E7D24-7ADD-428F-8B75-90A396FA584F + - Update - CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83 + - Driver - EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0 Other/cannot defer: -* Maximum deferral: No deferral -* Deferral increment: No deferral -* Update type/notes: - Any update category not enumerated above falls into this category. +- Maximum deferral: No deferral +- Deferral increment: No deferral +- Update type/notes: + Any update category not specifically enumerated above falls into this category. - Definition Update - E0789628-CE08-4437-BE74-2495B842F43B -ADMX Info: - -* GP name: *DeferUpgrade* -* GP element: *DeferUpdatePeriodId* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP name: *DeferUpgrade* +- GP element: *DeferUpdatePeriodId* +- GP ADMX file name: *WindowsUpdate.admx* @@ -1414,11 +1394,12 @@ ADMX Info: > [!NOTE] -> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. +> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. > -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices. +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices. -Allows IT Admins to specify more upgrade delays for up to eight months. + +Allows IT Admins to specify additional upgrade delays for up to 8 months. Supported values are 0-8, which refers to the number of months to defer upgrades. @@ -1428,11 +1409,10 @@ If the "Allow Telemetry" policy is enabled and the Options value is set to 0, th -ADMX Info: - -* GP name: *DeferUpgrade* -* GP element: *DeferUpgradePeriodId* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP name: *DeferUpgrade* +- GP element: *DeferUpgradePeriodId* +- GP ADMX file name: *WindowsUpdate.admx* @@ -1465,17 +1445,16 @@ ADMX Info: -Specifies the scan frequency from every 1 - 22 hours with a random variant of 0 - 4 hours. Default is 22 hours. This policy should be enabled when Update/UpdateServiceUrl is configured to point the device at a WSUS server rather than Microsoft Update. +Specifies the scan frequency from every 1 - 22 hours with a random variant of 0 - 4 hours. Default is 22 hours. This policy should only be enabled when Update/UpdateServiceUrl is configured to point the device at a WSUS server rather than Microsoft Update. -ADMX Info: - -* GP Friendly name: *Automatic Updates detection frequency* -* GP name: *DetectionFrequency_Title* -* GP element: *DetectionFrequency_Hour2* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Automatic Updates detection frequency* +- GP name: *DetectionFrequency_Title* +- GP element: *DetectionFrequency_Hour2* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* @@ -1518,19 +1497,18 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. -ADMX Info: - -* GP Friendly name: *Do not allow update deferral policies to cause scans against Windows Update* -* GP name: *DisableDualScan* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Do not allow update deferral policies to cause scans against Windows Update* +- GP name: *DisableDualScan* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 0 - allow scan against Windows Update -* 1 - do not allow update deferral policies to cause scans against Windows Update +- 0 - allow scan against Windows Update +- 1 - do not allow update deferral policies to cause scans against Windows Update @@ -1574,25 +1552,24 @@ IT admins can, if necessary, opt devices out of safeguard protections using this > [!NOTE] > Opting out of the safeguards can put devices at risk from known performance issues. We recommend opting out only in an IT environment for validation purposes. Further, you can leverage the Windows Insider Program for Business Release Preview Channel in order to validate the upcoming Windows 10 Feature Update version without the safeguards being applied. > -> The disable safeguards policy will revert to “Not Configured” on a device after moving to a new Windows 10 version, even if previously enabled. This ensures the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update. +> The disable safeguards policy will revert to “Not Configured” on a device after moving to a new Windows 10 version, even if previously enabled. This ensures the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update. > > Disabling safeguards does not guarantee your device will be able to successfully update. The update may still fail on the device and will likely result in a bad experience post upgrade as you are bypassing the protection given by Microsoft pertaining to known issues. -ADMX Info: - -* GP Friendly name: *Disable safeguards for Feature Updates* -* GP name: *DisableWUfBSafeguards* -* GP path: *Windows Components/Windows Update/Windows Update for Business* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Disable safeguards for Feature Updates* +- GP name: *DisableWUfBSafeguards* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 0 (default) - Safeguards are enabled and devices may be blocked for upgrades until the safeguard is cleared. -* 1 - Safeguards are not enabled and upgrades will be deployed without blocking on safeguards. +- 0 (default) - Safeguards are enabled and devices may be blocked for upgrades until the safeguard is cleared. +- 1 - Safeguards are not enabled and upgrades will be deployed without blocking on safeguards. @@ -1625,7 +1602,7 @@ The following list shows the supported values: -For Quality Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically execute, within the specified period. +For Quality Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period. The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks. @@ -1636,25 +1613,23 @@ Value type is integer. Default is 14. Supported value range: 2 - 30. -If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (for example, pending user scheduling). +If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (e.g. pending user scheduling). If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect: - 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time 3. Specify deadline before auto-restart for update installation -ADMX Info: - -* GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -* GP name: *EngagedRestartTransitionSchedule* -* GP element: *EngagedRestartDeadline* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* +- GP name: *EngagedRestartTransitionSchedule* +- GP element: *EngagedRestartDeadline* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* @@ -1687,31 +1662,29 @@ ADMX Info: -For Feature Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically execute, within the specified period. +For Feature Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period. Value type is integer. Default is 14. Supported value range: 2 - 30. -If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (for example, pending user scheduling). +If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (e.g. pending user scheduling). If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect: - 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time 3. Specify deadline before auto-restart for update installation -ADMX Info: - -* GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -* GP name: *EngagedRestartTransitionSchedule* -* GP element: *EngagedRestartDeadlineForFeatureUpdates* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* +- GP name: *EngagedRestartTransitionSchedule* +- GP element: *EngagedRestartDeadlineForFeatureUpdates* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* @@ -1746,27 +1719,25 @@ ADMX Info: For Quality Updates, this policy specifies the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days. -Value type is integer. Default is three days. +Value type is integer. Default is 3 days. -Supported value range: 1-3. +Supported value range: 1 - 3. If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect: - 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time 3. Specify deadline before auto-restart for update installation -ADMX Info: - -* GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -* GP name: *EngagedRestartTransitionSchedule* -* GP element: *EngagedRestartSnoozeSchedule* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* +- GP name: *EngagedRestartTransitionSchedule* +- GP element: *EngagedRestartSnoozeSchedule* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* @@ -1799,29 +1770,27 @@ ADMX Info: -For Feature Updates, this policy specifies the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between one and three days. +For Feature Updates, this policy specifies the number of days a user can snooze Engaged restart reminder notifications. The snooze period can be set between 1 and 3 days. -Value type is integer. Default is three days. +Value type is integer. Default is 3 days. Supported value range: 1 - 3. If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect: - 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time 3. Specify deadline before auto-restart for update installation -ADMX Info: - -* GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -* GP name: *EngagedRestartTransitionSchedule* -* GP element: *EngagedRestartSnoozeScheduleForFeatureUpdates* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* +- GP name: *EngagedRestartTransitionSchedule* +- GP element: *EngagedRestartSnoozeScheduleForFeatureUpdates* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* @@ -1856,27 +1825,25 @@ ADMX Info: For Quality Updates, this policy specifies the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending. -Value type is integer. Default value is seven days. +Value type is integer. Default value is 7 days. -Supported value range: 2 - 30. +Supported value range: 2 - 30. If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect: - 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time 3. Specify deadline before auto-restart for update installation -ADMX Info: - -* GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -* GP name: *EngagedRestartTransitionSchedule* -* GP element: *EngagedRestartTransitionSchedule* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* +- GP name: *EngagedRestartTransitionSchedule* +- GP element: *EngagedRestartTransitionSchedule* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* @@ -1911,27 +1878,25 @@ ADMX Info: For Feature Updates, this policy specifies the timing before transitioning from Auto restarts scheduled_outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending. -Value type is integer. Default value is seven days. +Value type is integer. Default value is 7 days. Supported value range: 2 - 30. If you disable or do not configure this policy, the default behaviors will be used. If any of the following policies are configured, this policy has no effect: - 1. No auto-restart with logged on users for scheduled automatic updates installations 2. Always automatically restart at scheduled time 3. Specify deadline before auto-restart for update installation -ADMX Info: - -* GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* -* GP name: *EngagedRestartTransitionSchedule* -* GP element: *EngagedRestartTransitionScheduleForFeatureUpdates* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* +- GP name: *EngagedRestartTransitionSchedule* +- GP element: *EngagedRestartTransitionScheduleForFeatureUpdates* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* @@ -1965,25 +1930,24 @@ ADMX Info: > [!NOTE] -> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. +> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. Allows IT Admins to exclude Windows Update (WU) drivers during updates. -ADMX Info: - -* GP Friendly name: *Do not include drivers with Windows Updates* -* GP name: *ExcludeWUDriversInQualityUpdate* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Do not include drivers with Windows Updates* +- GP name: *ExcludeWUDriversInQualityUpdate* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 0 (default) – Allow Windows Update drivers. -* 1 – Exclude Windows Update drivers. +- 0 (default) – Allow Windows Update drivers. +- 1 – Exclude Windows Update drivers. @@ -2023,20 +1987,19 @@ Allows Windows Update Agent to determine the download URL when it is missing fro -ADMX Info: - -* GP Friendly name: *Specify intranet Microsoft update service location* -* GP name: *CorpWuURL* -* GP element: *CorpWUFillEmptyContentUrls* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Specify intranet Microsoft update service location* +- GP name: *CorpWuURL* +- GP element: *CorpWUFillEmptyContentUrls* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 0 (default) – Disabled. -* 1 – Enabled. +- 0 (default) – Disabled. +- 1 – Enabled. @@ -2069,7 +2032,7 @@ The following list shows the supported values: -Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. +Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. > [!WARNING] > Setting this policy might cause devices to incur costs from MO operators. @@ -2078,16 +2041,15 @@ Specifies whether to ignore the MO download limit (allow unlimited downloading) The following list shows the supported values: -* 0 (default) – Do not ignore MO download limit for apps and their updates. -* 1 – Ignore MO download limit (allow unlimited downloading) for apps and their updates. +- 0 (default) – Do not ignore MO download limit for apps and their updates. +- 1 – Ignore MO download limit (allow unlimited downloading) for apps and their updates. To validate this policy: -1. Enable the policy and ensure the device is on a cellular network. -2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: - +1. Enable the policy and ensure the device is on a cellular network. +2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: ```TShell exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' ``` @@ -2123,7 +2085,7 @@ To validate this policy: -Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. +Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. > [!WARNING] > Setting this policy might cause devices to incur costs from MO operators. @@ -2132,16 +2094,15 @@ Specifies whether to ignore the MO download limit (allow unlimited downloading) The following list shows the supported values: -* 0 (default) – Do not ignore MO download limit for OS updates. -* 1 – Ignore MO download limit (allow unlimited downloading) for OS updates. +- 0 (default) – Do not ignore MO download limit for OS updates. +- 1 – Ignore MO download limit (allow unlimited downloading) for OS updates. To validate this policy: -1. Enable the policy and ensure the device is on a cellular network. -2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: - +1. Enable the policy and ensure the device is on a cellular network. +2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: ```TShell exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' ``` @@ -2181,21 +2142,20 @@ Used to manage Windows 10 Insider Preview builds. Value type is integer. -ADMX Info: - -* GP Friendly name: *Manage preview builds* -* GP name: *ManagePreviewBuilds* -* GP element: *ManagePreviewBuildsId* -* GP path: *Windows Components/Windows Update/Windows Update for Business* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Manage preview builds* +- GP name: *ManagePreviewBuilds* +- GP element: *ManagePreviewBuildsId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 0 - Disable Preview builds -* 1 - Disable Preview builds once the next release is public -* 2 - Enable Preview builds +- 0 - Disable Preview builds +- 1 - Disable Preview builds once the next release is public +- 2 - Enable Preview builds @@ -2229,9 +2189,11 @@ The following list shows the supported values: > [!NOTE] -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use PauseDeferrals for Windows 10, version 1511 devices. +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use PauseDeferrals for Windows 10, version 1511 devices. + + +Allows IT Admins to pause updates and upgrades for up to 5 weeks. Paused deferrals will be reset after 5 weeks. -Allows IT Admins to pause updates and upgrades for up to five weeks. Paused deferrals will be reset after five weeks. If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. @@ -2239,18 +2201,17 @@ If the "Allow Telemetry" policy is enabled and the Options value is set to 0, th -ADMX Info: - -* GP name: *DeferUpgrade* -* GP element: *PauseDeferralsId* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP name: *DeferUpgrade* +- GP element: *PauseDeferralsId* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 0 (default) – Deferrals are not paused. -* 1 – Deferrals are paused. +- 0 (default) – Deferrals are not paused. +- 1 – Deferrals are paused. @@ -2283,26 +2244,26 @@ The following list shows the supported values: -Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. +Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. + Allows IT Admins to pause feature updates for up to 35 days. We recomment that you use the *Update/PauseFeatureUpdatesStartTime* policy if you are running Windows 10, version 1703 or later. -ADMX Info: - -* GP Friendly name: *Select when Preview Builds and Feature Updates are received* -* GP name: *DeferFeatureUpdates* -* GP element: *PauseFeatureUpdatesId* -* GP path: *Windows Components/Windows Update/Windows Update for Business* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Select when Preview Builds and Feature Updates are received* +- GP name: *DeferFeatureUpdates* +- GP element: *PauseFeatureUpdatesId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 0 (default) – Feature Updates are not paused. -* 1 – Feature Updates are paused for 35 days or until value set to back to 0, whichever is sooner. +- 0 (default) – Feature Updates are not paused. +- 1 – Feature Updates are paused for 35 days or until value set to back to 0, whichever is sooner. @@ -2335,19 +2296,18 @@ The following list shows the supported values: -Specifies the date and time when the IT admin wants to start pausing the Feature Updates. When this policy is configured, Feature Updates will be paused for 35 days from the specified start date. +Specifies the date and time when the IT admin wants to start pausing the Feature Updates. When this policy is configured, Feature Updates will be paused for 35 days from the specified start date. -Value type is string (yyyy-mm-dd). Supported operations are Add, Get, Delete, and Replace. +Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, Get, Delete, and Replace. -ADMX Info: - -* GP Friendly name: *Select when Preview Builds and Feature Updates are received* -* GP name: *DeferFeatureUpdates* -* GP element: *PauseFeatureUpdatesStartId* -* GP path: *Windows Components/Windows Update/Windows Update for Business* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Select when Preview Builds and Feature Updates are received* +- GP name: *DeferFeatureUpdates* +- GP element: *PauseFeatureUpdatesStartId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* @@ -2384,20 +2344,19 @@ Allows IT Admins to pause quality updates. For those running Windows 10, version -ADMX Info: - -* GP Friendly name: *Select when Quality Updates are received* -* GP name: *DeferQualityUpdates* -* GP element: *PauseQualityUpdatesId* -* GP path: *Windows Components/Windows Update/Windows Update for Business* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Select when Quality Updates are received* +- GP name: *DeferQualityUpdates* +- GP element: *PauseQualityUpdatesId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 0 (default) – Quality Updates are not paused. -* 1 – Quality Updates are paused for 35 days or until value set back to 0, whichever is sooner. +- 0 (default) – Quality Updates are not paused. +- 1 – Quality Updates are paused for 35 days or until value set back to 0, whichever is sooner. @@ -2430,19 +2389,18 @@ The following list shows the supported values: -Specifies the date and time when the IT admin wants to start pausing the Quality Updates. When this policy is configured, Quality Updates will be paused for 35 days from the specified start date. +Specifies the date and time when the IT admin wants to start pausing the Quality Updates. When this policy is configured, Quality Updates will be paused for 35 days from the specified start date. -Value type is string (yyyy-mm-dd). Supported operations are Add, Get, Delete, and Replace. +Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, Get, Delete, and Replace. -ADMX Info: - -* GP Friendly name: *Select when Quality Updates are received* -* GP name: *DeferQualityUpdates* -* GP element: *PauseQualityUpdatesStartId* -* GP path: *Windows Components/Windows Update/Windows Update for Business* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Select when Quality Updates are received* +- GP name: *DeferQualityUpdates* +- GP element: *PauseQualityUpdatesStartId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* @@ -2510,19 +2468,18 @@ This policy is deprecated. Use [Update/RequireUpdateApproval](#update-requireupd -Available in Windows 10, version 2004 and later. Enables IT administrators to specify which product they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy to target a new product. +Available in Windows 10, version 2004 and later. Enables IT administrators to specify which product they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy to target a new product. If no product is specified, the device will continue receiving newer versions of the Windows product it is currently on. For details about different Windows 10 versions, see [release information](/windows/release-health/release-information). -ADMX Info: - -* GP Friendly name: *Select the target Feature Update version* -* GP name: *TargetReleaseVersion* -* GP element: *ProductVersion* -* GP path: *Windows Components/Windows Update/Windows Update for Business* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Select the target Feature Update version* +- GP name: *TargetReleaseVersion* +- GP element: *ProductVersion* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* @@ -2570,24 +2527,24 @@ By using this Windows Update for Business policy to upgrade devices to a new pro > [!NOTE] -> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. +> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. + Allows the IT admin to set a device to Semi-Annual Channel train. -ADMX Info: - -* GP name: *DeferUpgrade* -* GP element: *DeferUpgradePeriodId* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP name: *DeferUpgrade* +- GP element: *DeferUpgradePeriodId* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 0 (default) – User gets upgrades from Semi-Annual Channel (Targeted). -* 1 – User gets upgrades from Semi-Annual Channel. +- 0 (default) – User gets upgrades from Semi-Annual Channel (Targeted). +- 1 – User gets upgrades from Semi-Annual Channel. @@ -2621,9 +2578,10 @@ The following list shows the supported values: > [!NOTE] -> This policy is *only* recommended for managing mobile devices. If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. +> This policy is *only* recommended for managing mobile devices. If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. -Allows the IT admin to restrict the updates that are installed on a device to only those updates on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end user. EULAs are approved once an update is approved. + +Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved. Supported operations are Get and Replace. @@ -2631,8 +2589,8 @@ Supported operations are Get and Replace. The following list shows the supported values: -* 0 – Not configured. The device installs all applicable updates. -* 1 – The device only installs updates that are both applicable and on the Approved Updates list. Set this policy to 1 if IT wants to control the deployment of updates on devices, such as when testing is required prior to deployment. +- 0 – Not configured. The device installs all applicable updates. +- 1 – The device only installs updates that are both applicable and on the Approved Updates list. Set this policy to 1 if IT wants to control the deployment of updates on devices, such as when testing is required prior to deployment. @@ -2671,13 +2629,12 @@ The default value is 15 (minutes). -ADMX Info: - -* GP Friendly name: *Configure auto-restart warning notifications schedule for updates* -* GP name: *RestartWarnRemind* -* GP element: *RestartWarn* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Configure auto-restart warning notifications schedule for updates* +- GP name: *RestartWarnRemind* +- GP element: *RestartWarn* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* @@ -2715,7 +2672,7 @@ Supported values are 15, 30, or 60 (minutes). > [!NOTE] -> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education +> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education Allows the IT Admin to specify the period for auto-restart warning reminder notifications. @@ -2724,13 +2681,12 @@ The default value is 4 (hours). -ADMX Info: - -* GP Friendly name: *Configure auto-restart warning notifications schedule for updates* -* GP name: *RestartWarnRemind* -* GP element: *RestartWarnRemind* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Configure auto-restart warning notifications schedule for updates* +- GP name: *RestartWarnRemind* +- GP element: *RestartWarnRemind* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* @@ -2775,26 +2731,25 @@ Supported operations are Add, Delete, Get, and Replace. -ADMX Info: - -* GP Friendly name: *Configure Automatic Updates* -* GP name: *AutoUpdateCfg* -* GP element: *AutoUpdateSchDay* -* GP path: *Windows Components/Windows Update* -* GP ADMX file name: *WindowsUpdate.admx* +ADMX Info: +- GP Friendly name: *Configure Automatic Updates* +- GP name: *AutoUpdateCfg* +- GP element: *AutoUpdateSchDay* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* The following list shows the supported values: -* 0 (default) – Every day -* 1 – Sunday -* 2 – Monday -* 3 – Tuesday -* 4 – Wednesday -* 5 – Thursday -* 6 – Friday -* 7 – Saturday +- 0 (default) – Every day +- 1 – Sunday +- 2 – Monday +- 3 – Tuesday +- 4 – Wednesday +- 5 – Thursday +- 6 – Friday +- 7 – Saturday @@ -2827,7 +2782,7 @@ The following list shows the supported values: -Enables the IT admin to schedule the update installation on every week. Value type is integer. Supported values: +Enables the IT admin to schedule the update installation on the every week. Value type is integer. Supported values: