diff --git a/.openpublishing.build.ps1 b/.openpublishing.build.ps1 deleted file mode 100644 index dd60c684ef..0000000000 --- a/.openpublishing.build.ps1 +++ /dev/null @@ -1,18 +0,0 @@ -param( - [string]$buildCorePowershellUrl = "https://opbuildstoragesandbox2.blob.core.windows.net/opps1container/.openpublishing.buildcore.ps1", - [string]$parameters -) -# Main -$errorActionPreference = 'Stop' - -# Step-1 Download buildcore script to local -echo "download build core script to local with source url: $buildCorePowershellUrl" -$repositoryRoot = Split-Path -Parent $MyInvocation.MyCommand.Definition -$buildCorePowershellDestination = "$repositoryRoot\.openpublishing.buildcore.ps1" -Invoke-WebRequest $buildCorePowershellUrl -OutFile $buildCorePowershellDestination - -# Step-2: Run build core -echo "run build core script with parameters: $parameters" -$arguments = "-parameters:'$parameters'" -Invoke-Expression "$buildCorePowershellDestination $arguments" -exit $LASTEXITCODE \ No newline at end of file diff --git a/.openpublishing.redirection.windows-deployment.json b/.openpublishing.redirection.windows-deployment.json index 09479f4eca..5d117ed99e 100644 --- a/.openpublishing.redirection.windows-deployment.json +++ b/.openpublishing.redirection.windows-deployment.json @@ -1660,6 +1660,26 @@ "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/planning/windows-10-enterprise-faq-itpro", "redirect_document_id": false }, + { + "source_path": "windows/deployment/do/mcc-enterprise-appendix.md", + "redirect_url": "/windows/deployment/do/mcc-ent-early-preview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/do/mcc-enterprise-deploy.md", + "redirect_url": "/windows/deployment/do/mcc-ent-early-preview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/do/mcc-enterprise-prerequisites.md", + "redirect_url": "/windows/deployment/do/mcc-ent-early-preview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/do/mcc-enterprise-update-uninstall.md", + "redirect_url": "/windows/deployment/do/mcc-ent-early-preview", + "redirect_document_id": false + }, { "source_path": "windows/deployment/planning/windows-10-deployment-considerations.md", "redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/planning/windows-10-deployment-considerations", diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 25701bb0a1..04839ec4dd 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -9982,7 +9982,47 @@ }, { "source_path": "windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md", - "redirect_url": "/windows/security/application-security/application-control/introduction-to-virtualization-based-security-and-appcontrol.md", + "redirect_url": "/windows/security/application-security/application-control/introduction-to-virtualization-based-security-and-appcontrol", + "redirect_document_id": false + }, + { + "source_path": "windows/security/application-security/index.md", + "redirect_url": "/windows/security/book/application-security", + "redirect_document_id": false + }, + { + "source_path": "windows/security/hardware-security/index.md", + "redirect_url": "/windows/security/book/hardware-security", + "redirect_document_id": false + }, + { + "source_path": "windows/security/cloud-services/index.md", + "redirect_url": "/windows/security/book/cloud-services", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/index.md", + "redirect_url": "/windows/security/book/identity-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/index.md", + "redirect_url": "/windows/security/book/operating-system-security", + "redirect_document_id": false + }, + { + "source_path": "windows/security/security-foundations/index.md", + "redirect_url": "/windows/security/book/security-foundation", + "redirect_document_id": false + }, + { + "source_path": "windows/security/introduction.md", + "redirect_url": "/windows/security/book", + "redirect_document_id": false + }, + { + "source_path": "windows/security/security-foundations/zero-trust-windows-device-health.md", + "redirect_url": "/windows/security/book/security-foundation", "redirect_document_id": false } ] diff --git a/education/windows/suspcs/reference.md b/education/windows/suspcs/reference.md index 278344c047..3cec502ea5 100644 --- a/education/windows/suspcs/reference.md +++ b/education/windows/suspcs/reference.md @@ -1,8 +1,8 @@ --- title: Set up School PCs app technical reference overview -description: Describes the purpose of the Set up School PCs app for Windows 10 devices. +description: Describes the purpose of the Set up School PCs app for Windows devices. ms.topic: overview -ms.date: 01/16/2024 +ms.date: 10/29/2024 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -12,12 +12,12 @@ appliesto: The **Set up School PCs** app helps you configure new Windows 10 PCs for school use. The app, which is available for Windows 10 version 1703 and later, configures and saves school-optimized settings, apps, and policies into a single provisioning package. You can then save the package to a USB drive and distribute it to your school PCs. -If your school uses Microsoft Entra ID or Office 365, the Set up +If your school uses Microsoft Entra ID or Microsoft 365, the Set up School PCs app will create a setup file. This file joins the PC to your Microsoft Entra tenant. The app also helps set up PCs for use with or without Internet connectivity. ## Join devices to Microsoft Entra ID -If your school uses Microsoft Entra ID or Office 365, the Set up School PCs app creates a setup file that joins your PC to your Microsoft Entra ID tenant. +If your school uses Microsoft Entra ID or Microsoft 365, the Set up School PCs app creates a setup file that joins your PC to your Microsoft Entra ID tenant. The app also helps set up PCs for use with or without Internet connectivity. diff --git a/education/windows/take-tests-in-windows.md b/education/windows/take-tests-in-windows.md index 8c46ac4b93..b43345436f 100644 --- a/education/windows/take-tests-in-windows.md +++ b/education/windows/take-tests-in-windows.md @@ -1,7 +1,7 @@ --- title: Take tests and assessments in Windows description: Learn about the built-in Take a Test app for Windows and how to use it. -ms.date: 02/29/2024 +ms.date: 11/11/2024 ms.topic: how-to --- @@ -9,11 +9,11 @@ ms.topic: how-to Many schools use online testing for formative and summation assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. To help schools with testing, Windows provides an application called **Take a Test**. The application is a secure browser that provides different features to help with testing, and can be configured to only allow access a specific URL or a list of URLs. When using Take a Test, students can't: -- print, use screen capture, or text suggestions (unless enabled by the teacher or administrator) -- access other applications -- change system settings, such as display extension, notifications, updates -- access Cortana -- access content copied to the clipboard +- Print, use screen capture, or text suggestions (unless enabled by the teacher or administrator) +- Access other applications +- Change system settings, such as display extension, notifications, updates +- Access Cortana +- Access content copied to the clipboard ## How to use Take a Test @@ -22,7 +22,7 @@ There are different ways to use Take a Test, depending on the use case: - For lower stakes assessments, such a quick quiz in a class, a teacher can generate a *secure assessment URL* and share it with the students. Students can then open the URL to access the assessment through Take a Test. To learn more, see the next section: [Create a secure assessment link](#create-a-secure-assessment-link) - For higher stakes assessments, you can configure Windows devices to use a dedicated account for testing and execute Take a Test in a locked-down mode, called **kiosk mode**. Once signed in with the dedicated account, Windows will execute Take a Test in a lock-down mode, preventing the execution of any applications other than Take a Test. For more information, see [Configure Take a Test in kiosk mode](edu-take-a-test-kiosk-mode.md) -:::image type="content" source="./images/takeatest/flow-chart.png" alt-text="Set up and user flow for the Take a Test app." border="false"::: + :::image type="content" source="./images/takeatest/flow-chart.png" alt-text="Set up and user flow for the Take a Test app." border="false"::: ## Create a secure assessment link @@ -37,9 +37,9 @@ To create a secure assessment link to the test, there are two options: For this option, copy the assessment URL and open the web application Customize your assessment URL, where you can: -- Paste the link to the assessment URL -- Select the options you want to allow during the test -- Generate the link by selecting the button Create link +- Paste the link to the assessment URL. +- Select the options you want to allow during the test. +- Generate the link by selecting the button Create link. This is an ideal option for teachers who want to create a link to a specific assessment and share it with students using OneNote, for example. @@ -67,7 +67,7 @@ To enable permissive mode, don't include `enforceLockdown` in the schema paramet ## Distribute the secure assessment link -Once the link is created, it can be distributed through the web, email, OneNote, or any other method of your choosing. +Once the link is created, it can be distributed through the web, email, OneNote, or any other method of your choice. For example, you can create and copy the shortcut to the assessment URL to the students' desktop. @@ -85,4 +85,4 @@ To take the test, have the students open the link. Teachers can use **Microsoft Forms** to create tests. For more information, see [Create tests using Microsoft Forms](https://support.microsoft.com/en-us/office/create-a-quiz-with-microsoft-forms-a082a018-24a1-48c1-b176-4b3616cdc83d). -To learn more about the policies and settings set by the Take a Test app, see [Take a Test app technical reference](take-a-test-app-technical.md). \ No newline at end of file +To learn more about the policies and settings set by the Take a Test app, see [Take a Test app technical reference](take-a-test-app-technical.md). diff --git a/includes/licensing/_edition-requirements.md b/includes/licensing/_edition-requirements.md index 9810ebe8bf..19e8e7499f 100644 --- a/includes/licensing/_edition-requirements.md +++ b/includes/licensing/_edition-requirements.md @@ -1,11 +1,11 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 09/18/2023 +ms.date: 11/06/2024 ms.topic: include --- -| Feature name | Windows Pro | Windows Enterprise | Windows Pro Education/SE | Windows Education | +| Feature name | Windows Pro | Windows Enterprise/IoT Enterprise | Windows Pro Education | Windows Education | |:---|:---:|:---:|:---:|:---:| |**[Access Control (ACL/SACL)](/windows/security/identity-protection/access-control/access-control)**|Yes|Yes|Yes|Yes| |**[Account Lockout Policy](/windows/security/threat-protection/security-policy-settings/account-lockout-policy)**|Yes|Yes|Yes|Yes| @@ -13,7 +13,7 @@ ms.topic: include |**[Always On VPN (device tunnel)](/Windows-server/remote/remote-access/overview-always-on-vpn)**|❌|Yes|❌|Yes| |**[App containers](/virtualization/windowscontainers/about/)**|Yes|Yes|Yes|Yes| |**[AppLocker](/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview)**|Yes|Yes|Yes|Yes| -|**[Assigned Access (kiosk mode)](/windows/configuration/kiosk-methods)**|Yes|Yes|Yes|Yes| +|**[Assigned Access (kiosk mode)](/windows/configuration/assigned-access)**|Yes|Yes|Yes|Yes| |**[Attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction)**|Yes|Yes|Yes|Yes| |**[Azure Code Signing](/windows/security/application-security/application-control/windows-defender-application-control/deployment/use-code-signing-for-better-control-and-protection)**|Yes|Yes|Yes|Yes| |**[BitLocker enablement](/windows/security/operating-system-security/data-protection/bitlocker/)**|Yes|Yes|Yes|Yes| @@ -32,7 +32,7 @@ ms.topic: include |**[Federal Information Processing Standard (FIPS) 140 validation](/windows/security/security-foundations/certification/fips-140-validation)**|Yes|Yes|Yes|Yes| |**[Federated sign-in](/education/windows/federated-sign-in)**|❌|❌|Yes|Yes| |**[FIDO2 security key](/azure/active-directory/authentication/howto-authentication-passwordless-security-key)**|Yes|Yes|Yes|Yes| -|**[Hardware-enforced stack protection](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/understanding-hardware-enforced-stack-protection/ba-p/1247815)**|Yes|Yes|Yes|Yes| +|**[Hardware-enforced stack protection](https://techcommunity.microsoft.com/blog/windowsosplatform/understanding-hardware-enforced-stack-protection/1247815)**|Yes|Yes|Yes|Yes| |**[Hypervisor-protected Code Integrity (HVCI)](/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity)**|Yes|Yes|Yes|Yes| |**[Kernel Direct Memory Access (DMA) protection](/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt)**|Yes|Yes|Yes|Yes| |**[Local Security Authority (LSA) Protection](/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection)**|Yes|Yes|Yes|Yes| @@ -53,7 +53,7 @@ ms.topic: include |**[OneFuzz service](https://www.microsoft.com/security/blog/2020/09/15/microsoft-onefuzz-framework-open-source-developer-tool-fix-bugs/)**|Yes|Yes|Yes|Yes| |**Opportunistic Wireless Encryption (OWE)**|Yes|Yes|Yes|Yes| |**[Passkeys](/windows/security/identity-protection/passkeys)**|Yes|Yes|Yes|Yes| -|**[Personal data encryption (PDE)](/windows/security/operating-system-security/data-protection/personal-data-encryption/)**|❌|Yes|❌|Yes| +|**[Personal Data Encryption (PDE)](/windows/security/operating-system-security/data-protection/personal-data-encryption/)**|❌|Yes|❌|Yes| |**Privacy Resource Usage**|Yes|Yes|Yes|Yes| |**Privacy Transparency and Controls**|Yes|Yes|Yes|Yes| |**[Remote Credential Guard](/windows/security/identity-protection/remote-credential-guard)**|Yes|Yes|Yes|Yes| @@ -84,6 +84,7 @@ ms.topic: include |**[Windows Firewall](/windows/security/operating-system-security/network-security/windows-firewall)**|Yes|Yes|Yes|Yes| |**[Windows Hello for Business](/windows/security/identity-protection/hello-for-business/)**|Yes|Yes|Yes|Yes| |**[Windows Hello for Business Enhanced Security Sign-in (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)**|Yes|Yes|Yes|Yes| +|**Windows Hotpatch**|❌|Yes|❌|❌| |**[Windows LAPS](/windows-server/identity/laps/laps-overview)**|Yes|Yes|Yes|Yes| |**[Windows passwordless experience](/windows/security/identity-protection/passwordless-experience)**|Yes|Yes|Yes|Yes| |**[Windows presence sensing](https://support.microsoft.com/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb)**|Yes|Yes|Yes|Yes| diff --git a/includes/licensing/_licensing-requirements.md b/includes/licensing/_licensing-requirements.md index 022cbf278b..0ba2e7193a 100644 --- a/includes/licensing/_licensing-requirements.md +++ b/includes/licensing/_licensing-requirements.md @@ -5,7 +5,7 @@ ms.date: 11/02/2023 ms.topic: include --- -|Feature name|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| +|Feature name|Windows Pro/Pro Education|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| |:---|:---:|:---:|:---:|:---:|:---:| |**[Access Control (ACL/SACL)](/windows/security/identity-protection/access-control/access-control)**|Yes|Yes|Yes|Yes|Yes| |**[Account Lockout Policy](/windows/security/threat-protection/security-policy-settings/account-lockout-policy)**|Yes|Yes|Yes|Yes|Yes| @@ -13,7 +13,7 @@ ms.topic: include |**[Always On VPN (device tunnel)](/Windows-server/remote/remote-access/overview-always-on-vpn)**|❌|Yes|Yes|Yes|Yes| |**[App containers](/virtualization/windowscontainers/about/)**|Yes|Yes|Yes|Yes|Yes| |**[AppLocker](/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview)**|❌|Yes|Yes|Yes|Yes| -|**[Assigned Access (kiosk mode)](/windows/configuration/kiosk-methods)**|Yes|Yes|Yes|Yes|Yes| +|**[Assigned Access (kiosk mode)](/windows/configuration/assigned-access)**|Yes|Yes|Yes|Yes|Yes| |**[Attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction)**|Yes|Yes|Yes|Yes|Yes| |**[Azure Code Signing](/windows/security/application-security/application-control/windows-defender-application-control/deployment/use-code-signing-for-better-control-and-protection)**|Yes|Yes|Yes|Yes|Yes| |**[BitLocker enablement](/windows/security/operating-system-security/data-protection/bitlocker/)**|Yes|Yes|Yes|Yes|Yes| @@ -53,7 +53,7 @@ ms.topic: include |**[OneFuzz service](https://www.microsoft.com/security/blog/2020/09/15/microsoft-onefuzz-framework-open-source-developer-tool-fix-bugs/)**|Yes|Yes|Yes|Yes|Yes| |**Opportunistic Wireless Encryption (OWE)**|Yes|Yes|Yes|Yes|Yes| |**[Passkeys](/windows/security/identity-protection/passkeys)**|Yes|Yes|Yes|Yes|Yes| -|**[Personal data encryption (PDE)](/windows/security/operating-system-security/data-protection/personal-data-encryption/)**|❌|Yes|Yes|Yes|Yes| +|**[Personal Data Encryption (PDE)](/windows/security/operating-system-security/data-protection/personal-data-encryption/)**|❌|Yes|Yes|Yes|Yes| |**Privacy Resource Usage**|Yes|Yes|Yes|Yes|Yes| |**Privacy Transparency and Controls**|Yes|Yes|Yes|Yes|Yes| |**[Remote Credential Guard](/windows/security/identity-protection/remote-credential-guard)**|Yes|Yes|Yes|Yes|Yes| @@ -84,6 +84,7 @@ ms.topic: include |**[Windows Firewall](/windows/security/operating-system-security/network-security/windows-firewall)**|Yes|Yes|Yes|Yes|Yes| |**[Windows Hello for Business](/windows/security/identity-protection/hello-for-business/)**|Yes|Yes|Yes|Yes|Yes| |**[Windows Hello for Business Enhanced Security Sign-in (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)**|Yes|Yes|Yes|Yes|Yes| +|**Windows Hotpatch**|❌|Yes|Yes|❌|❌| |**[Windows LAPS](/windows-server/identity/laps/laps-overview)**|Yes|Yes|Yes|Yes|Yes| |**[Windows passwordless experience](/windows/security/identity-protection/passwordless-experience)**|Yes|Yes|Yes|Yes|Yes| |**[Windows presence sensing](https://support.microsoft.com/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb)**|Yes|Yes|Yes|Yes|Yes| diff --git a/windows/client-management/declared-configuration.md b/windows/client-management/declared-configuration.md index a0a28f91ae..ec20778da6 100644 --- a/windows/client-management/declared-configuration.md +++ b/windows/client-management/declared-configuration.md @@ -121,7 +121,7 @@ If the processing of declared configuration document fails, the errors are logge - If the Document ID doesn't match between the `` and inside DeclaredConfiguration document, Admin event log shows an error message similar to: - `MDM Declared Configuration: End document parsing from CSP: Document Id: (DCA000B5-397D-40A1-AABF-40B25078A7F91), Scenario: (MSFTVPN), Version: (A0), Enrollment Id: (DAD70CC2-365B-450D-A8AB-2EB23F4300CC), Current User: (S-1-5-21-3436249567-4017981746-3373817415-1001), Schema: (1.0), Download URL: (), Scope: (0x1), Enroll Type: (0x1A), File size: (0xDE2), CSP Count: (0x1), URI Count: (0xF), Action Requested: (0x0), Model: (0x1), Result:(0x8000FFFF) Catastrophic failure.` + `MDM Declared Configuration: End document parsing from CSP: Document Id: (DCA000B5-397D-40A1-AABF-40B25078A7F91), Scenario: (MSFTVPN), Version: (A0), Enrollment Id: (DAD70CC2-365B-450D-A8AB-2EB23F4300CC), Current User: (S-1-5-21-1004336348-1177238915-682003330-1234), Schema: (1.0), Download URL: (), Scope: (0x1), Enroll Type: (0x1A), File size: (0xDE2), CSP Count: (0x1), URI Count: (0xF), Action Requested: (0x0), Model: (0x1), Result:(0x8000FFFF) Catastrophic failure.` - Any typo in the OMA-URI results in a failure. In this example, `TrafficFilterList` is specified instead of `TrafficFilterLists`, and Admin event log shows an error message similar to: @@ -129,4 +129,4 @@ If the processing of declared configuration document fails, the errors are logge There's also another warning message in operational channel: - `MDM Declared Configuration: Function (DeclaredConfigurationExtension_PolicyCSPConfigureGivenCurrentDoc) operation (ErrorAtDocLevel: one or more CSPs failed) failed with (Unknown Win32 Error code: 0x82d00007)` \ No newline at end of file + `MDM Declared Configuration: Function (DeclaredConfigurationExtension_PolicyCSPConfigureGivenCurrentDoc) operation (ErrorAtDocLevel: one or more CSPs failed) failed with (Unknown Win32 Error code: 0x82d00007).` diff --git a/windows/client-management/images/8908044-recall-search.png b/windows/client-management/images/8908044-recall-search.png new file mode 100644 index 0000000000..16ec5fda8b Binary files /dev/null and b/windows/client-management/images/8908044-recall-search.png differ diff --git a/windows/client-management/images/8908044-recall.png b/windows/client-management/images/8908044-recall.png deleted file mode 100644 index 92c93c46cb..0000000000 Binary files a/windows/client-management/images/8908044-recall.png and /dev/null differ diff --git a/windows/client-management/manage-recall.md b/windows/client-management/manage-recall.md index 82a405289c..f8a052962b 100644 --- a/windows/client-management/manage-recall.md +++ b/windows/client-management/manage-recall.md @@ -1,9 +1,9 @@ --- title: Manage Recall for Windows clients -description: Learn how to manage Recall for commercial environments using MDM and group policy. Learn about Recall features. +description: Learn how to manage Recall for commercial environments and about Recall features. ms.topic: how-to ms.subservice: windows-copilot -ms.date: 06/13/2024 +ms.date: 11/22/2024 ms.author: mstewart author: mestew ms.collection: @@ -18,72 +18,161 @@ appliesto: >**Looking for consumer information?** See [Retrace your steps with Recall](https://support.microsoft.com/windows/retrace-your-steps-with-recall-aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c). -Recall allows you to search across time to find the content you need. Just describe how you remember it, and Recall retrieves the moment you saw it. Recall takes snapshots of your screen and stores them in a timeline. Snapshots are taken every five seconds while content on the screen is different from the previous snapshot. Snapshots are locally stored and locally analyzed on your PC. Recall's analysis allows you to search for content, including both images and text, using natural language. +Recall (preview) allows users to search locally saved and locally analyzed snapshots of their screen using natural language. By default, Recall is disabled and removed on managed devices. IT admins can choose if they want to allow Recall to be used in their organizations and users, on their own, won't be able to enable it on their managed device if the Allow Recall policy is disabled. IT admins, on their own, can't start saving snapshots for end users. Recall is an opt-in experience that requires end user consent to save snapshots. Users can choose to enable or disable saving snapshots for themselves anytime. IT admins can only set policies that give users the option to enable saving snapshots and configure certain policies for Recall. + +This article provides information about Recall and how to manage it in a commercial environment. > [!NOTE] -> Recall is coming soon through a post-launch Windows update. See [aka.ms/copilotpluspcs](https://aka.ms/copilotpluspcs). +> - Recall is now available in preview to Copilot+ PCs through the Windows Insider Program. For more information, see [Previewing Recall with Click to Do on Copilot+ PCs with Windows Insiders in the Dev Channel](https://blogs.windows.com/windows-insider/2024/11/22/previewing-recall-with-click-to-do-on-copilot-pcs-with-windows-insiders-in-the-dev-channel/). +> - In-market commercial devices are defined as devices with an Enterprise (ENT) or Education (EDU) SKU or any premium SKU device that is managed by an IT administrator (whether via Microsoft Endpoint Manager or other endpoint management solution), has a volume license key, or is joined to a domain. Commercial devices during Out of Box Experience (OOBE) are defined as those with ENT or EDU SKU or any premium SKU device that has a volume license key or is Microsoft Entra joined. +> - Recall is optimized for select languages English, Chinese (simplified), French, German, Japanese, and Spanish. Content-based and storage limitations apply. For more information, see [https://aka.ms/copilotpluspcs](https://aka.ms/copilotpluspcs). -When Recall opens the snapshot a user selected, it enables screenray, which runs on top of the saved snapshot. Screenray analyzes what's in the snapshot and allows users to interact with individual elements in the snapshot. For instance, users can copy text from the snapshot or send pictures from the snapshot to an app that supports `jpeg` files. +## What is Recall? -:::image type="content" source="images/8908044-recall.png" alt-text="Screenshot of Recall with search results displayed for a query about a restaurant that the user's friend sent them." lightbox="images/8908044-recall.png"::: +Recall (preview) allows you to search across time to find the content you need. Just describe how you remember it, and Recall retrieves the moment you saw it. Snapshots are taken periodically while content on the screen is different from the previous snapshot. The snapshots of your screen are organized into a timeline. Snapshots are locally stored and locally analyzed on your PC. Recall's analysis allows you to search for content, including both images and text, using natural language. + +When Recall opens a snapshot you selected, it enables Click to Do, which runs on top of the saved snapshot. Click to Do analyzes what's in the snapshot and allows you to interact with individual elements in the snapshot. For instance, you can copy text from the snapshot or send pictures from the snapshot to an app that supports `jpeg` files. + +:::image type="content" border="true" source="images/8908044-recall-search.png" alt-text="Screenshot of Recall with search results displayed for a query for a presentation with a red barn." lightbox="images/8908044-recall-search.png"::: + +### Recall security and privacy architecture + +Privacy and security are built into Recall's design. With Copilot+ PCs, you get powerful AI that runs locally on the device. No internet or cloud connections are required or used to save and analyze snapshots. Snapshots aren't sent to Microsoft. Recall AI processing occurs locally, and snapshots are securely stored on the local device only. + +Recall doesn't share snapshots with other users that are signed into Windows on the same device and IT admins can't access or view the snapshots on end-user devices. Microsoft can't access or view the snapshots. Recall requires users to confirm their identity with [Windows Hello](https://support.microsoft.com/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0) before it launches and before accessing snapshots. At least one biometric sign-in option must be enabled for Windows Hello, either facial recognition or a fingerprint, to launch and use Recall. Before snapshots start getting saved to the device, users need to open Recall and authenticate. Recall takes advantage of just in time decryption protected by [Hello Enhanced Sign-in Security (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security). Snapshots and any associated information in the vector database are always encrypted. Encryption keys are protected via Trusted Platform Module (TPM), which is tied to the user's Windows Hello ESS identity, and can be used by operations within a secure environment called a [Virtualization-based Security Enclave (VBS Enclave)](/windows/win32/trusted-execution/vbs-enclaves). This means that other users can't access these keys and thus can't decrypt this information. Device Encryption or BitLocker are enabled by default on Windows 11. For more information, see [Recall security and privacy architecture in the Windows Experience Blog](https://blogs.windows.com/windowsexperience/?p=179096). + +When using Recall, the **Sensitive information filtering** setting is enabled by default to help ensure your data's confidentiality. This feature operates directly on your device, utilizing the NPU and the Microsoft Classification Engine (MCE) - the same technology leveraged by [Microsoft Purview](/purview/purview) for detecting and labeling sensitive information. When this setting is enabled, snapshots won't be saved when potentially sensitive information is detected. Most importantly, the sensitive information remains on the device at all times, regardless of whether the **Sensitive information filtering** setting is enabled or disabled. For more information about the types of potentially sensitive information, see [Reference for sensitive information filtering in Recall](recall-sensitive-information-filtering.md). + +In keeping with Microsoft's commitment to data privacy and security, all saved images and processed data are kept on the device and processed locally. However, Click to Do allows users to choose if they want to perform additional actions on their content. + +Click to Do allows users to choose to get more information about their selected content online. When users choose one of the following Click to Do actions, the selected content is sent to the online provider from the local device to complete the request: + +- **Search the web**: Sends the selected content to the default search engine of the default browser +- **Open website**: Opens the selected website in the default browser +- **Visual search with Bing**: Sends the selected content to Bing visual search using the default browser. + +When you choose to send info from Click to Do to an app, like Paint, Click to Do will temporarily save this info in order to complete the transfer. Click to Do creates a temporary file in the following location: + +- `C:\Users\[username]\AppData\Local\Temp` + +Temporary files may also be saved when you choose send feedback. These temporary files aren't saved long term. Click to Do doesn't keep any content from your screen after completing the requested action, but some basic telemetry is gathered to keep Click to Do secure, up to date, and working. ## System requirements -Recall has the following minimum system requirements: -- A [Copilot+ PC](https://www.microsoft.com/windows/business/devices/copilot-plus-pcs#copilot-plus-pcs) +Recall has the following minimum requirements: + +- A [Copilot+ PC](https://www.microsoft.com/windows/business/devices/copilot-plus-pcs#copilot-plus-pcs) that meets the [Secured-core standard](/windows-hardware/design/device-experiences/oem-highly-secure-11) +- 40 TOPs NPU ([neural processing unit](https://support.microsoft.com/windows/all-about-neural-processing-units-npus-e77a5637-7705-4915-96c8-0c6a975f9db4)) - 16 GB RAM - 8 logical processors - 256 GB storage capacity - To enable Recall, you need at least 50 GB of space free - - Snapshot capture automatically pauses once the device has less than 25 GB of disk space + - Saving snapshots automatically pauses once the device has less than 25 GB of storage space +- Users need to enable Device Encryption or BitLocker +- Users need to enroll into [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security) with at least one biometric sign-in option enabled in order to authenticate. ## Supported browsers -Users need a supported browser for Recall to [filter websites](#user-controlled-settings-for-recall) and to automatically filter private browsing activity. Supported browsers, and their capabilities include: +Users need a supported browser for Recall to [filter websites](#app-and-website-filtering-policies) and to automatically filter private browsing activity. Supported browsers, and their capabilities include: -- **Microsoft Edge**: blocks websites and filters private browsing activity -- **Firefox**: blocks websites and filters private browsing activity -- **Opera**: blocks websites and filters private browsing activity -- **Google Chrome**: blocks websites and filters private browsing activity -- **Chromium based browsers** (124 or later): For Chromium-based browsers not listed above, filters private browsing activity only, doesn't block specific websites +- **Microsoft Edge**: filters specified websites and filters private browsing activity +- **Firefox**: filters specified websites and filters private browsing activity +- **Opera**: filtered specified websites and filters private browsing activity +- **Google Chrome**: filters specified websites and filters private browsing activity +- **Chromium based browsers** (124 or later): For Chromium-based browsers not listed, filters private browsing activity only, doesn't filter specific websites ## Configure policies for Recall -Organizations that aren't ready to use AI for historical analysis can disable it until they're ready with the **Turn off saving snapshots for Windows** policy. If snapshots were previously saved on a device, they'll be deleted when this policy is enabled. The following policy allows you to disable analysis of user content: +By default, Recall is removed on commercially managed devices. If you want to allow Recall to be available for users in your organization and allow them to choose to save snapshots, you need to configure both the **Allow Recall to be enabled** and **Turn off saving snapshots for Windows** policies. Policies for Recall fall into the following general areas: + +- [Allow Recall and snapshots policies](#allow-recall-and-snapshots-policies) +- [Storage policies](#storage-policies) +- [App and website filtering policies](#app-and-website-filtering-policies) + + +### Allow Recall and snapshots policies + +The **Allow Recall to be enabled** policy setting allows you to determine whether the Recall optional component is available for end users to enable on their device. By default, Recall is disabled and removed for managed devices. Recall isn't available on managed devices by default, and individual users can't enable Recall on their own. If you disable this policy, the Recall component will be in disabled state and the bits for Recall will be removed from the device. If snapshots were previously saved on the device, they'll be deleted when this policy is disabled. Removing Recall requires a device restart. If the policy is enabled, end users will have Recall available on their device. Depending on the state of the DisableAIDataAnalysis policy (Turn off saving snapshots for use with Recall), end users will be able to choose if they want to save snapshots of their screen and use Recall to find things they've seen on their device. |   | Setting | |---|---| -| **CSP** | ./User/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis) | -| **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** | - -## Limitations - -In two specific scenarios, Recall captures snapshots that include InPrivate windows, blocked apps, and blocked websites. If Recall gets launched, or the **Now** option is selected in Recall, then a snapshot is taken even when InPrivate windows, blocked apps, and blocked websites are displayed. However, Recall doesn't save these snapshots. If you choose to send the information from this snapshot to another app, a temp file is created in `C:\Users\[username]\AppData\Local\Temp` to share the content. The temporary file is deleted once the content is transferred over the app you selected to use. - -## User controlled settings for Recall - -The following options are user controlled in Recall from the **Settings** > **Privacy & Security** > **Recall & Snapshots** page: - -- Website filtering -- App filtering -- Storage allocation - - When the storage limit is reached, the oldest snapshots are deleted first. -- Deleting snapshots - - Delete all snapshots - - Delete snapshots within a specific time frame +| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[AllowRecallEnablement](mdm/policy-csp-windowsai.md#allowrecallenablement) | +| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Allow Recall to be enabled** | -### Storage allocation +The **Turn off saving snapshots for Windows** policy allows you to give the users the choice to save snapshots of their screen for use with Recall. Administrators can't enable saving snapshots on behalf of their users. The choice to enable saving snapshots requires individual user opt-in consent. By default, snapshots won't be saved for use with Recall. If snapshots were previously saved on a device, they'll be deleted when this policy is enabled. If you set this policy to disabled, end users will have a choice to save snapshots of their screen and use Recall to find things they've seen on their device. -The amount of disk space users can allocate to Recall varies depending on how much storage the device has. The following chart shows the storage space options for Recall: - -| Device storage capacity | Storage allocation options for Recall | +|   | Setting | |---|---| -| 256 GB | 25 GB (default), 10 GB | -| 512 GB | 75 GB (default), 50 GB, 25 GB | -| 1 TB, or more | 150 GB (default), 100 GB, 75 GB, 50 GB, 25 GB | +| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis)

./User/Vendor/MSFT/Policy/Config/WindowsAI/[DisableAIDataAnalysis](mdm/policy-csp-windowsai.md#disableaidataanalysis)| +| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows**

User Configuration > Administrative Templates > Windows Components > Windows AI > **Turn off saving snapshots for Windows** | +### Storage policies + +You can define how much disk space Recall can use by using the **Set maximum storage for snapshots used by Recall** policy. You can set the maximum amount of disk space for snapshots to be 10, 25, 50, 75, 100, or 150 GB. When the storage limit is reached, the oldest snapshots are deleted first. When this setting isn't configured, the OS configures the storage allocation for snapshots based on the device storage capacity. 25 GB is allocated when the device storage capacity is 256 GB. 75 GB is allocated when the device storage capacity is 512 GB. 150 GB is allocated when the device storage capacity is 1 TB or higher. + +|   | Setting | +|---|---| +| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[SetMaximumStorageSpaceForRecallSnapshots](mdm/policy-csp-windowsai.md#setmaximumstoragespaceforrecallsnapshots)

./User/Vendor/MSFT/Policy/Config/WindowsAI/[SetMaximumStorageSpaceForRecallSnapshots](mdm/policy-csp-windowsai.md#setmaximumstoragespaceforrecallsnapshots)| +| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Set maximum storage for snapshots used by Recall**

User Configuration > Administrative Templates > Windows Components > Windows AI > **Set maximum storage for snapshots used by Recall** | + +You can define how long snapshots can be retained on the device by using the **Set maximum duration for storing snapshots used by Recall** policy. You can configure the maximum storage duration to be 30, 60, 90, or 180 days. If the policy isn't configured, snapshots aren't deleted until the maximum storage allocation is reached, and then the oldest snapshots are deleted first. + +|   | Setting | +|---|---| +| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[SetMaximumStorageDurationForRecallSnapshots](mdm/policy-csp-windowsai.md#setmaximumstoragedurationforrecallsnapshots)

./User/Vendor/MSFT/Policy/Config/WindowsAI/[SetMaximumStorageDurationForRecallSnapshots](mdm/policy-csp-windowsai.md#setmaximumstoragedurationforrecallsnapshots)| +| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Set maximum storage for snapshots used by Recall**

User Configuration > Administrative Templates > Windows Components > Windows AI > **Set maximum duration for storing snapshots used by Recall** | + + +### App and website filtering policies + +You can filter both apps and websites from being saved in snapshots. Users are able to add to these filter lists from the **Recall & Snapshots** settings page. Some remote desktop connection clients are filtered by default from snapshots. For more information, see the [Remote desktop connection clients filtered from snapshots](#remote-desktop-connection-clients-filtered-from-snapshots) section. + +To filter websites from being saved in snapshots, use the **Set a list of URIs to be filtered from snapshots for Recall** policy. Define the list using a semicolon to separate URIs. Make sure you include the URL scheme such as `http://`, `file://`, `https://www.`. Sites local to a supported browser like `edge://`, or `chrome://`, are filtered by default. For example: `https://www.Contoso.com;https://www.WoodgroveBank.com;https://www.Adatum.com` + +> [!NOTE] +> - Private browsing activity is filtered by default when using [supported web browsers](#supported-browsers). +> - Be aware that websites are filtered when they are in the foreground or are in the currently opened tab of a supported browser. Parts of filtered websites can still appear in snapshots such as embedded content, the browser's history, or an opened tab that isn't in the foreground. +> - Filtering doesn't prevent browsers, internet service providers (ISPs), websites, organizations, or others from knowing that the website was accessed and building a history. +> - Changes to this policy take effect after device restart. + +|   | Setting | +|---|---| +| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[SetDenyUriListForRecall](mdm/policy-csp-windowsai.md#setdenyurilistforrecall)

./User/Vendor/MSFT/Policy/Config/WindowsAI/[SetDenyUriListForRecall](mdm/policy-csp-windowsai.md#setdenyurilistforrecall)| +| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **>Set a list of URIs to be filtered from snapshots for Recall**

User Configuration > Administrative Templates > Windows Components > Windows AI > **>Set a list of URIs to be filtered from snapshots for Recall** | + + +**Set a list of apps to be filtered from snapshots for Recall** policy allows you to filter apps from being saved in snapshots. Define the list using a semicolon to separate apps. The list can include Application User Model IDs (AUMID) or the name of the executable file. For example: `code.exe;Microsoft. WindowsNotepad_8wekyb3d8bbwe!App;ms-teams.exe` + +> [!Note] +> - Like other Windows apps, such as the Snipping Tool, Recall won't store digital rights management (DRM) content. +> - Changes to this policy take effect after device restart. + +|   | Setting | +|---|---| +| **CSP** | ./Device/Vendor/MSFT/Policy/Config/WindowsAI/[SetDenyAppListForRecall](mdm/policy-csp-windowsai.md#setdenyapplistforrecall)

./User/Vendor/MSFT/Policy/Config/WindowsAI/[SetDenyAppListForRecall](mdm/policy-csp-windowsai.md#setdenyapplistforrecall)| +| **Group policy** | Computer Configuration > Administrative Templates > Windows Components > Windows AI > **Set a list of apps to be filtered from snapshots for Recall**

User Configuration > Administrative Templates > Windows Components > Windows AI > **Set a list of apps to be filtered from snapshots for Recall**| + + +#### Remote desktop connection clients filtered from snapshots + +Snapshots won't be saved when remote desktop connection clients are used. The following remote desktop connection clients are filtered from snapshots: + + - [Remote Desktop Connection (mstsc.exe)](/windows-server/administration/windows-commands/mstsc) + - [VMConnect.exe](/windows-server/virtualization/hyper-v/learn-more/hyper-v-virtual-machine-connect) + - [Microsoft Remote Desktop from the Microsoft Store](/windows-server/remote/remote-desktop-services/clients/windows) is saved in snapshots. To prevent the app from being saved in snapshots, add it to the app filtering list. + - [Azure Virtual Desktop (MSI)](/azure/virtual-desktop/users/connect-windows) + - [Azure Virtual Desktop apps from the Microsoft Store](/azure/virtual-desktop/users/connect-remote-desktop-client) are saved in snapshots. To prevent these apps from being saved in snapshots, add them to the app filtering list. + - [Remote applications integrated locally (RAIL)](/openspecs/windows_protocols/ms-rdperp/485e6f6d-2401-4a9c-9330-46454f0c5aba) windows + - [Windows App from the Microsoft Store](/windows-app/get-started-connect-devices-desktops-apps) is saved in snapshots. To prevent the app from being saved in snapshots, add it to the app filtering list. + + + + +## Information for developers + +If you're a developer and want to launch Recall, you can call the `ms-recall` protocol URI. When you call this URI, Recall opens and takes a snapshot of the screen, which is the default behavior for when Recall is launched. For more information about using Recall in your Windows app, see [Recall overview](/windows/ai/apis/recall) in the Windows AI API documentation. ## Microsoft's commitment to responsible AI @@ -91,6 +180,10 @@ Microsoft has been on a responsible AI journey since 2017, when we defined our p Recall uses optical character recognition (OCR), local to the PC, to analyze snapshots and facilitate search. For more information about OCR, see [Transparency note and use cases for OCR](/legal/cognitive-services/computer-vision/ocr-transparency-note). For more information about privacy and security, see [Privacy and control over your Recall experience](https://support.microsoft.com/windows/privacy-and-control-over-your-recall-experience-d404f672-7647-41e5-886c-a3c59680af15). -## Information for developers - -If you're a developer and want to launch Recall, you can call the `ms-recall` protocol URI. When you call this, Recall opens and takes a snapshot of the screen, which is the default behavior for when Recall is launched. For more information about using Recall in your Windows app, see [Recall overview](/windows/ai/apis/recall) in the Windows AI API documentation. +## Related links +- [Policy CSP - WindowsAI](/windows/client-management/mdm/policy-csp-windowsai) +- [Update on Recall security and privacy architecture](https://blogs.windows.com/windowsexperience/2024/09/27/update-on-recall-security-and-privacy-architecture/) +- [Retrace your steps with Recall](https://support.microsoft.com/windows/aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c) +- [Privacy and control over your Recall experience](https://support.microsoft.com/windows/d404f672-7647-41e5-886c-a3c59680af15) +- [Click to Do in Recall](https://support.microsoft.com/topic/967304a8-32d1-4812-a904-fad59b5e6abf) +- [Previewing Recall with Click to Do on Copilot+ PCs with Windows Insiders in the Dev Channel](https://blogs.windows.com/windows-insider/2024/11/22/previewing-recall-with-click-to-do-on-copilot-pcs-with-windows-insiders-in-the-dev-channel/) diff --git a/windows/client-management/mdm/declaredconfiguration-csp.md b/windows/client-management/mdm/declaredconfiguration-csp.md index 4251c9ab44..e9843249a5 100644 --- a/windows/client-management/mdm/declaredconfiguration-csp.md +++ b/windows/client-management/mdm/declaredconfiguration-csp.md @@ -1,7 +1,7 @@ --- title: DeclaredConfiguration CSP description: Learn more about the DeclaredConfiguration CSP. -ms.date: 09/12/2024 +ms.date: 11/05/2024 --- @@ -45,6 +45,8 @@ The following list shows the DeclaredConfiguration configuration service provide - [Results](#hostinventoryresults) - [{DocID}](#hostinventoryresultsdocid) - [Document](#hostinventoryresultsdociddocument) + - [ManagementServiceConfiguration](#managementserviceconfiguration) + - [ConflictResolution](#managementserviceconfigurationconflictresolution) @@ -728,6 +730,93 @@ The Document node's value is an XML based document containing a collection of se + +## ManagementServiceConfiguration + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/DeclaredConfiguration/ManagementServiceConfiguration +``` + + + + +The ManagementServiceConfiguration node that's used to control certain Windows Declared Configuration behavior. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `node` | +| Access Type | Get | + + + + + + + + + +### ManagementServiceConfiguration/ConflictResolution + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/DeclaredConfiguration/ManagementServiceConfiguration/ConflictResolution +``` + + + + +This node controls to turn on conflict resolution on and off. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | The conflict resolution is OFF. | +| 1 | The conflict resolution is ON. | + + + + + + + + ## DeclaredConfiguration OMA URI diff --git a/windows/client-management/mdm/declaredconfiguration-ddf-file.md b/windows/client-management/mdm/declaredconfiguration-ddf-file.md index 07e2e406e6..6d50da92cb 100644 --- a/windows/client-management/mdm/declaredconfiguration-ddf-file.md +++ b/windows/client-management/mdm/declaredconfiguration-ddf-file.md @@ -1,7 +1,7 @@ --- title: DeclaredConfiguration DDF file description: View the XML file containing the device description framework (DDF) for the DeclaredConfiguration configuration service provider. -ms.date: 06/28/2024 +ms.date: 11/05/2024 --- @@ -466,6 +466,61 @@ The following XML file contains the device description framework (DDF) for the D + + ManagementServiceConfiguration + + + + + The ManagementServiceConfiguration node that is used to control certain Windows Declared Configuration behavior + + + + + + + + + + + + + + + ConflictResolution + + + + + + + + This node controls to turn on conflict resolution on and off. + + + + + + + + + + + + + + + 0 + The conflict resolution is OFF. + + + 1 + The conflict resolution is ON. + + + + + ``` diff --git a/windows/client-management/mdm/laps-csp.md b/windows/client-management/mdm/laps-csp.md index 76508deef5..b524fe09eb 100644 --- a/windows/client-management/mdm/laps-csp.md +++ b/windows/client-management/mdm/laps-csp.md @@ -1,7 +1,7 @@ --- title: LAPS CSP description: Learn more about the LAPS CSP. -ms.date: 09/27/2024 +ms.date: 11/05/2024 --- @@ -325,7 +325,7 @@ Note if a custom managed local administrator account name is specified in this s Use this setting to configure whether the password is encrypted before being stored in Active Directory. -This setting is ignored if the password is currently being stored in Azure. +This setting is ignored if the password is currently being stored in Microsoft Entra ID. This setting is only honored when the Active Directory domain is at Windows Server 2016 Domain Functional Level or higher. @@ -387,7 +387,7 @@ If not specified, this setting defaults to True. Use this setting to configure the name or SID of a user or group that can decrypt the password stored in Active Directory. -This setting is ignored if the password is currently being stored in Azure. +This setting is ignored if the password is currently being stored in Microsoft Entra ID. If not specified, the password will be decryptable by the Domain Admins group in the device's domain. diff --git a/windows/client-management/mdm/laps-ddf-file.md b/windows/client-management/mdm/laps-ddf-file.md index d32a646434..8924f4d542 100644 --- a/windows/client-management/mdm/laps-ddf-file.md +++ b/windows/client-management/mdm/laps-ddf-file.md @@ -1,7 +1,7 @@ --- title: LAPS DDF file description: View the XML file containing the device description framework (DDF) for the LAPS configuration service provider. -ms.date: 09/27/2024 +ms.date: 11/05/2024 --- @@ -80,7 +80,7 @@ The following XML file contains the device description framework (DDF) for the L The allowable settings are: 0=Disabled (password will not be backed up) -1=Backup the password to Azure AD only +1=Backup the password to Microsoft Entra ID only 2=Backup the password to Active Directory only If not specified, this setting will default to 0. @@ -103,7 +103,7 @@ If not specified, this setting will default to 0. 1 - Backup the password to Azure AD only + Backup the password to Microsoft Entra ID only 2 @@ -126,7 +126,7 @@ If not specified, this setting will default to 0. If not specified, this setting will default to 30 days -This setting has a minimum allowed value of 1 day when backing the password to onpremises Active Directory, and 7 days when backing the password to Azure AD. +This setting has a minimum allowed value of 1 day when backing the password to onpremises Active Directory, and 7 days when backing the password to Microsoft Entra ID. This setting has a maximum allowed value of 365 days. @@ -154,7 +154,7 @@ This setting has a maximum allowed value of 365 days. 1 - BackupDirectory configured to Azure AD + BackupDirectory configured to Microsoft Entra ID @@ -442,7 +442,7 @@ If not specified, this setting defaults to True. True Use this setting to configure whether the password is encrypted before being stored in Active Directory. -This setting is ignored if the password is currently being stored in Azure. +This setting is ignored if the password is currently being stored in Microsoft Entra ID. This setting is only honored when the Active Directory domain is at Windows Server 2016 Domain Functional Level or higher. @@ -499,7 +499,7 @@ If not specified, this setting defaults to True. Use this setting to configure the name or SID of a user or group that can decrypt the password stored in Active Directory. -This setting is ignored if the password is currently being stored in Azure. +This setting is ignored if the password is currently being stored in Microsoft Entra ID. If not specified, the password will be decryptable by the Domain Admins group in the device's domain. diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index 2b322e0891..3dcbc10721 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -1,7 +1,7 @@ --- title: PassportForWork CSP description: Learn more about the PassportForWork CSP. -ms.date: 08/06/2024 +ms.date: 11/05/2024 --- @@ -265,7 +265,7 @@ If the user forgets their PIN, it can be changed to a new PIN using the Windows | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621] and later | diff --git a/windows/client-management/mdm/passportforwork-ddf.md b/windows/client-management/mdm/passportforwork-ddf.md index c94b22aed5..e53fb8e225 100644 --- a/windows/client-management/mdm/passportforwork-ddf.md +++ b/windows/client-management/mdm/passportforwork-ddf.md @@ -1,7 +1,7 @@ --- title: PassportForWork DDF file description: View the XML file containing the device description framework (DDF) for the PassportForWork configuration service provider. -ms.date: 06/28/2024 +ms.date: 11/05/2024 --- @@ -831,7 +831,7 @@ If you disable or do not configure this policy setting, the PIN recovery secret - 99.9.99999 + 10.0.22621 1.6 diff --git a/windows/client-management/mdm/personaldataencryption-csp.md b/windows/client-management/mdm/personaldataencryption-csp.md index 2a4648393a..afef3cb25e 100644 --- a/windows/client-management/mdm/personaldataencryption-csp.md +++ b/windows/client-management/mdm/personaldataencryption-csp.md @@ -1,21 +1,21 @@ --- -title: PDE CSP -description: Learn more about the PDE CSP. +title: Personal Data Encryption CSP +description: Learn more about the Personal Data Encryption CSP. ms.date: 01/18/2024 --- -# PDE CSP +# Personal Data Encryption CSP -The Personal Data Encryption (PDE) configuration service provider (CSP) is used by the enterprise to protect data confidentiality of PCs and devices. This CSP was added in Windows 11, version 22H2. +The Personal Data Encryption configuration service provider (CSP) is used by the enterprise to protect data confidentiality of PCs and devices. This CSP was added in Windows 11, version 22H2. -The following list shows the PDE configuration service provider nodes: +The following list shows the Personal Data Encryption configuration service provider nodes: - ./User/Vendor/MSFT/PDE - [EnablePersonalDataEncryption](#enablepersonaldataencryption) @@ -45,7 +45,7 @@ Allows the Admin to enable Personal Data Encryption. Set to '1' to set this poli -The [UserDataProtectionManager Class](/uwp/api/windows.security.dataprotection.userdataprotectionmanager) public API allows the applications running as the user to encrypt data as soon as this policy is enabled. However, prerequisites must be met for PDE to be enabled. +The [UserDataProtectionManager Class](/uwp/api/windows.security.dataprotection.userdataprotectionmanager) public API allows the applications running as the user to encrypt data as soon as this policy is enabled. However, prerequisites must be met for Personal Data Encryption to be enabled. @@ -93,10 +93,10 @@ The [UserDataProtectionManager Class](/uwp/api/windows.security.dataprotection.u -Reports the current status of Personal Data Encryption (PDE) for the user. +Reports the current status of Personal Data Encryption for the user. -- If prerequisites of PDE aren't met, then the status will be 0. -- If all prerequisites are met for PDE, then PDE will be enabled and status will be 1. +- If prerequisites of Personal Data Encryption aren't met, then the status will be 0. +- If all prerequisites are met for Personal Data Encryption, then Personal Data Encryption will be enabled and status will be 1. diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md index ebfe368e86..ea1f4f9b24 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -1,7 +1,7 @@ --- title: Policies supported by Windows 10 Team description: Learn about the policies supported by Windows 10 Team. -ms.date: 08/06/2024 +ms.date: 11/05/2024 --- @@ -417,6 +417,7 @@ This article lists the policies that are applicable for the Surface Hub operatin - [ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#excludejapaneseimeexceptjis0208andeudc) - [ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#excludejapaneseimeexceptshiftjis) - [ForceTouchKeyboardDockedState](policy-csp-textinput.md#forcetouchkeyboarddockedstate) +- [TouchKeyboardControllerModeAvailability](policy-csp-textinput.md#touchkeyboardcontrollermodeavailability) - [TouchKeyboardDictationButtonAvailability](policy-csp-textinput.md#touchkeyboarddictationbuttonavailability) - [TouchKeyboardEmojiButtonAvailability](policy-csp-textinput.md#touchkeyboardemojibuttonavailability) - [TouchKeyboardFullModeAvailability](policy-csp-textinput.md#touchkeyboardfullmodeavailability) diff --git a/windows/client-management/mdm/policies-in-preview.md b/windows/client-management/mdm/policies-in-preview.md index 2c62565783..34a182dd13 100644 --- a/windows/client-management/mdm/policies-in-preview.md +++ b/windows/client-management/mdm/policies-in-preview.md @@ -1,7 +1,7 @@ --- title: Configuration service provider preview policies description: Learn more about configuration service provider (CSP) policies that are available for Windows Insider Preview. -ms.date: 09/27/2024 +ms.date: 11/22/2024 --- @@ -29,10 +29,17 @@ This article lists the policies that are applicable for Windows Insider Preview - [EnablePhysicalDeviceAccessOnErrorScreens](clouddesktop-csp.md#userenablephysicaldeviceaccessonerrorscreens) - [EnableBootToCloudSharedPCMode](clouddesktop-csp.md#deviceenableboottocloudsharedpcmode) +## Connectivity + +- [UseCellularWhenWiFiPoor](policy-csp-connectivity.md#usecellularwhenwifipoor) +- [DisableCellularSettingsPage](policy-csp-connectivity.md#disablecellularsettingspage) +- [DisableCellularOperatorSettingsPage](policy-csp-connectivity.md#disablecellularoperatorsettingspage) + ## DeclaredConfiguration CSP - [Document](declaredconfiguration-csp.md#hostcompletedocumentsdociddocument) - [Abandoned](declaredconfiguration-csp.md#hostcompletedocumentsdocidpropertiesabandoned) +- [ConflictResolution](declaredconfiguration-csp.md#managementserviceconfigurationconflictresolution) ## DeliveryOptimization @@ -52,6 +59,10 @@ This article lists the policies that are applicable for Windows Insider Preview - [MdmAgentInstalled](devicepreparation-csp.md#mdmprovidermdmagentinstalled) - [RebootRequired](devicepreparation-csp.md#mdmproviderrebootrequired) +## Display + +- [ConfigureMultipleDisplayMode](policy-csp-display.md#configuremultipledisplaymode) + ## DMClient CSP - [DiscoveryEndpoint](dmclient-csp.md#deviceproviderprovideridlinkedenrollmentdiscoveryendpoint) @@ -97,7 +108,6 @@ This article lists the policies that are applicable for Windows Insider Preview ## PassportForWork CSP -- [EnableWindowsHelloProvisioningForSecurityKeys](passportforwork-csp.md#devicetenantidpoliciesenablewindowshelloprovisioningforsecuritykeys) - [DisablePostLogonProvisioning](passportforwork-csp.md#devicetenantidpoliciesdisablepostlogonprovisioning) ## Reboot CSP @@ -112,6 +122,10 @@ This article lists the policies that are applicable for Windows Insider Preview - [ExchangeModernAuthEnabled](surfacehub-csp.md#deviceaccountexchangemodernauthenabled) +## TextInput + +- [TouchKeyboardControllerModeAvailability](policy-csp-textinput.md#touchkeyboardcontrollermodeavailability) + ## Update - [AllowTemporaryEnterpriseFeatureControl](policy-csp-update.md#allowtemporaryenterprisefeaturecontrol) @@ -123,9 +137,15 @@ This article lists the policies that are applicable for Windows Insider Preview ## WindowsAI +- [DisableAIDataAnalysis](policy-csp-windowsai.md#disableaidataanalysis) - [SetCopilotHardwareKey](policy-csp-windowsai.md#setcopilothardwarekey) +- [SetDenyAppListForRecall](policy-csp-windowsai.md#setdenyapplistforrecall) +- [SetDenyUriListForRecall](policy-csp-windowsai.md#setdenyurilistforrecall) +- [SetMaximumStorageSpaceForRecallSnapshots](policy-csp-windowsai.md#setmaximumstoragespaceforrecallsnapshots) +- [SetMaximumStorageDurationForRecallSnapshots](policy-csp-windowsai.md#setmaximumstoragedurationforrecallsnapshots) - [DisableImageCreator](policy-csp-windowsai.md#disableimagecreator) - [DisableCocreator](policy-csp-windowsai.md#disablecocreator) +- [AllowRecallEnablement](policy-csp-windowsai.md#allowrecallenablement) ## WindowsLicensing CSP diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 1a15adf8c0..5ed3127e3f 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -1,7 +1,7 @@ --- title: Connectivity Policy CSP description: Learn more about the Connectivity Area in Policy CSP. -ms.date: 04/10/2024 +ms.date: 11/05/2024 --- @@ -11,6 +11,8 @@ ms.date: 04/10/2024 [!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)] +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + @@ -584,6 +586,104 @@ Also, see the "Web-based printing" policy setting in Computer Configuration/Admi + +## DisableCellularOperatorSettingsPage + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Connectivity/DisableCellularOperatorSettingsPage +``` + + + + +This policy makes all configurable settings in the 'Cellular' > 'Mobile operator settings' page read-only. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + + + + + + + +## DisableCellularSettingsPage + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Connectivity/DisableCellularSettingsPage +``` + + + + +This policy makes all configurable settings in the 'Cellular' Settings page read-only. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + + + + + + ## DisableDownloadingOfPrintDriversOverHTTP @@ -899,6 +999,55 @@ If you disable this setting or don't configure it, the user will be able to crea + +## UseCellularWhenWiFiPoor + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Connectivity/UseCellularWhenWiFiPoor +``` + + + + +This policy allows the use of a cellular connection when Wi-Fi connectivity is limited. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disabled. | +| 1 (Default) | Enabled. | + + + + + + + + diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index cd2bf997f6..863938353d 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -37,7 +37,7 @@ If set to 1 then any MDM policy that's set that has an equivalent GP policy will > [!NOTE] -> MDMWinsOverGP only applies to policies in Policy CSP. MDM policies win over Group Policies where applicable; not all Group Policies are available via MDM or CSP. It does not apply to other MDM settings with equivalent GP settings that are defined in other CSPs such as the [Defender CSP](defender-csp.md). Nor does it apply to the [Update Policy CSP](policy-csp-update.md) for managing Windows updates. +> MDMWinsOverGP only applies to policies in Policy CSP. MDM policies win over Group Policies where applicable; not all Group Policies are available via MDM or CSP. It does not apply to other MDM settings with equivalent GP settings that are defined in other CSPs such as the [Defender CSP](defender-csp.md). This policy is used to ensure that MDM policy wins over GP when policy is configured on MDM channel. The default value is 0. The MDM policies in Policy CSP will behave as described if this policy value is set 1. diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 171f5c4349..c058b8bccf 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -164,7 +164,7 @@ One or more values can be added as either fully qualified domain names (FQDN) or > [!NOTE] -> Clients don't talk to multiple Microsoft Connected Cache (MCC) servers at the same time. If you configure a list of MCC servers in this policy, the clients will round robin until they successfully connect to an MCC server. The clients have no way to determine if the MCC server has the content or not. If the MCC server doesn't have the content, it caches the content as it is handing the content back to the client. +> Clients don't talk to multiple Microsoft Connected Cache servers at the same time. If you configure a list of Connected Cache servers in this policy, the clients will round robin until they successfully connect to a Connected Cache server. The clients have no way to determine if the Connected Cache server has the content or not. If the Connected Cache server doesn't have the content, it caches the content as it is handing the content back to the client. @@ -578,7 +578,7 @@ Specifies the download method that Delivery Optimization can use in downloads of > [!NOTE] -> The Delivery Optimization service on the clients checks to see if there are peers and/or an MCC server which contains the content and determines the best source for the content. +> The Delivery Optimization service on the clients checks to see if there are peers and/or a Connected Cache server which contains the content and determines the best source for the content. diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index 8f021f8337..01753099d8 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -1,7 +1,7 @@ --- title: Display Policy CSP description: Learn more about the Display Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 11/05/2024 --- @@ -9,10 +9,72 @@ ms.date: 01/18/2024 # Policy CSP - Display +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + + +## ConfigureMultipleDisplayMode + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Display/ConfigureMultipleDisplayMode +``` + + + + +This policy set the default display to set the arrangement between cloning or extending. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Default. | +| 1 (Default) | Clone. | +| 2 | Extend. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ConfigureMultipleDisplayMode | +| Path | Display > AT > System > DisplayCat | +| Element Name | ConfigureMultipleDisplayModePrompt | + + + + + + + + ## DisablePerProcessDpiForApps diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 031f151e0e..bdd4e1fcd0 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -1,7 +1,7 @@ --- title: LocalPoliciesSecurityOptions Policy CSP description: Learn more about the LocalPoliciesSecurityOptions Area in Policy CSP. -ms.date: 09/27/2024 +ms.date: 11/05/2024 --- @@ -388,10 +388,27 @@ Audit: Audit the use of Backup and Restore privilege This security setting deter |:--|:--| | Format | `b64` | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: ``) | -| Default Value | 00 | +| Default Value | AA== | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| AQ== | Enable. | +| AA== (Default) | Disable. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Audit: Audit the use of Backup and Restore privilege | +| Path | Windows Settings > Security Settings > Local Policies > Security Options | + + diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md index 70acc4ac5e..a3d59bef8b 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md +++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md @@ -1,7 +1,7 @@ --- title: RemoteDesktopServices Policy CSP description: Learn more about the RemoteDesktopServices Area in Policy CSP. -ms.date: 09/27/2024 +ms.date: 11/05/2024 --- @@ -156,7 +156,7 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2461] and later
✅ [10.0.25398.887] and later
✅ Windows 10, version 2004 [10.0.19041.4474] and later
✅ Windows 11, version 21H2 with [KB5037770](https://support.microsoft.com/help/5037770) [10.0.22000.2960] and later
✅ Windows 11, version 22H2 with [KB5037771](https://support.microsoft.com/help/5037771) [10.0.22621.3593] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | @@ -217,7 +217,7 @@ This policy applies only when using legacy authentication to authenticate to the | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ [10.0.20348.2461] and later
✅ [10.0.25398.887] and later
✅ Windows 10, version 2004 [10.0.19041.4474] and later
✅ Windows 11, version 21H2 with [KB5037770](https://support.microsoft.com/help/5037770) [10.0.22000.2960] and later
✅ Windows 11, version 22H2 with [KB5037771](https://support.microsoft.com/help/5037771) [10.0.22621.3593] and later
✅ Windows 11, version 24H2 [10.0.26100] and later | diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 359c78a5c8..ef469c7c40 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -1,7 +1,7 @@ --- title: TextInput Policy CSP description: Learn more about the TextInput Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 11/05/2024 --- @@ -9,6 +9,8 @@ ms.date: 01/18/2024 # Policy CSP - TextInput +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + @@ -1172,6 +1174,56 @@ Specifies the touch keyboard is always docked. When this policy is set to enable + +## TouchKeyboardControllerModeAvailability + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/TextInput/TouchKeyboardControllerModeAvailability +``` + + + + +Specifies whether the controller keyboard mode is enabled or disabled for the touch keyboard. When this policy is set to disabled, the controller keyboard mode for touch keyboard is disabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | The OS determines when it's most appropriate to be available. | +| 1 | Controller keyboard is always available. | +| 2 | Controller keyboard is always disabled. | + + + + + + + + ## TouchKeyboardDictationButtonAvailability diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index 677a40fffb..547985d9b2 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -1,7 +1,7 @@ --- title: Wifi Policy CSP description: Learn more about the Wifi Area in Policy CSP. -ms.date: 01/31/2024 +ms.date: 11/05/2024 --- @@ -188,10 +188,7 @@ By default, ICS is disabled when you create a remote access connection, but admi -Allow or disallow connecting to Wi-Fi outside of MDM server-installed networks. Most restricted value is 0. - -> [!NOTE] -> Setting this policy deletes any previously installed user-configured and Wi-Fi sense Wi-Fi profiles from the device. Certain Wi-Fi profiles that aren't user configured nor Wi-Fi sense might not be deleted. In addition, not all non-MDM profiles are completely deleted. +Allow or block connections to Wi-Fi outside of MDM server-installed networks. If you change this setting to Block, you must deploy enterprise Wi-Fi profiles to the device using the Wi-Fi CSP before you apply this setting. Otherwise, the device will go offline since it won't be able to connect to Wi-Fi. Note that choosing to block Wi-Fi connections will delete any previously installed user-configured Wi-Fi profiles from the device, though not all non-MDM profiles will be deleted. diff --git a/windows/client-management/mdm/policy-csp-windowsai.md b/windows/client-management/mdm/policy-csp-windowsai.md index 642e2df000..5db33c8daf 100644 --- a/windows/client-management/mdm/policy-csp-windowsai.md +++ b/windows/client-management/mdm/policy-csp-windowsai.md @@ -1,7 +1,7 @@ --- title: WindowsAI Policy CSP description: Learn more about the WindowsAI Area in Policy CSP. -ms.date: 09/27/2024 +ms.date: 11/22/2024 --- @@ -15,28 +15,103 @@ ms.date: 09/27/2024 + +## AllowRecallEnablement + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsAI/AllowRecallEnablement +``` + + + + +This policy setting allows you to determine whether the Recall optional component is available for end users to enable on their device. By default, Recall is disabled for managed commercial devices. Recall isn't available on managed devices by default, and individual users can't enable Recall on their own. + +- If this policy isn't configured, end users will have the Recall component in a disabled state. + +- If this policy is disabled, the Recall component will be in disabled state and the bits for Recall will be removed from the device. If snapshots were previously saved on the device, they'll be deleted when this policy is disabled. Removing Recall requires a device restart. + +- If the policy is enabled, end users will have Recall available on their device. Depending on the state of the DisableAIDataAnalysis policy (Turn off saving snapshots for use with Recall), end users are able to choose if they want to save snapshots of their screen and use Recall to find things they've seen on their device. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Recall isn't available. | +| 1 (Default) | Recall is available. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | AllowRecallEnablement | +| Friendly Name | Allow Recall to be enabled | +| Location | Computer Configuration | +| Path | Windows Components > Windows AI | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI | +| Registry Value Name | AllowRecallEnablement | +| ADMX File Name | WindowsCopilot.admx | + + + + + + + + ## DisableAIDataAnalysis | Scope | Editions | Applicable OS | |:--|:--|:--| -| ❌ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100] and later | +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | ```User ./User/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis ``` + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsAI/DisableAIDataAnalysis +``` -This policy setting allows you to control whether Windows saves snapshots of the screen and analyzes the user's activity on their device. +This policy setting allows you to determine whether snapshots of the screen can be saved for use with Recall. By default, snapshots for Recall aren't enabled. IT administrators can't, on their own, enable saving snapshots on behalf of their users. The choice to enable saving snapshots requires individual user opt-in consent. -- If you enable this policy setting, Windows won't be able to save snapshots and users won't be able to search for or browse through their historical device activity using Recall. +- If the policy isn't configured, snapshots won't be saved for use with Recall. -- If you disable or don't configure this policy setting, Windows will save snapshots of the screen and users will be able to search for or browse through a timeline of their past activities using Recall. +- If you enable this policy, snapshots won't be saved for use with Recall. If snapshots were previously saved on the device, they'll be deleted when this policy is enabled. + +If you set this policy to disabled, end users will have a choice to save snapshots of their screen and use Recall to find things they've seen on their device. @@ -68,8 +143,8 @@ This policy setting allows you to control whether Windows saves snapshots of the | Name | Value | |:--|:--| | Name | DisableAIDataAnalysis | -| Friendly Name | Turn off Saving Snapshots for Windows | -| Location | User Configuration | +| Friendly Name | Turn off saving snapshots for use with Recall | +| Location | Computer and User Configuration | | Path | Windows Components > Windows AI | | Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI | | Registry Value Name | DisableAIDataAnalysis | @@ -222,7 +297,7 @@ This policy setting allows you to control whether Image Creator functionality is - + This policy setting determines which app opens when the user presses the Copilot key on their keyboard. - If the policy is enabled, the specified app will open when the user presses the Copilot key. Users can change the key assignment in Settings. @@ -249,7 +324,11 @@ This policy setting determines which app opens when the user presses the Copilot | Name | Value | |:--|:--| | Name | SetCopilotHardwareKey | -| Path | WindowsCopilot > AT > WindowsComponents > WindowsCopilot | +| Friendly Name | Set Copilot Hardware Key | +| Location | User Configuration | +| Path | Windows Components > Windows Copilot | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\CopilotKey | +| ADMX File Name | WindowsCopilot.admx | @@ -258,12 +337,297 @@ This policy setting determines which app opens when the user presses the Copilot + +## SetDenyAppListForRecall + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyAppListForRecall +``` + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyAppListForRecall +``` + + + + +This policy allows you to define a list of apps that won't be included in snapshots for Recall. + +Users are able to add additional applications to exclude from snapshots using Recall settings. + +The list can include Application User Model IDs (AUMID) or name of the executable file. + +Use a semicolon-separated list of apps to define the deny app list for Recall. + +For example: `code.exe;Microsoft.WindowsNotepad_8wekyb3d8bbwe!App;ms-teams.exe` + +> [!IMPORTANT] +> When configuring this policy setting, changes won't take effect until the device restarts. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `;`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SetDenyAppListForRecall | +| Friendly Name | Set a list of apps to be filtered from snapshots for Recall | +| Location | Computer and User Configuration | +| Path | Windows Components > Windows AI | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI | +| Registry Value Name | SetDenyAppListForRecall | +| ADMX File Name | WindowsCopilot.admx | + + + + + + + + + +## SetDenyUriListForRecall + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyUriListForRecall +``` + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetDenyUriListForRecall +``` + + + + +This policy setting lets you define a list of URIs that won't be included in snapshots for Recall when a supported browser is used. People within your organization can use Recall settings to add more websites to the list. Define the list using a semicolon to separate URIs. + +For example: `https://www.Contoso.com;https://www.WoodgroveBank.com;https://www.Adatum.com`. + +Adding `https://www.WoodgroveBank.com` to the list would also filter `https://Account.WoodgroveBank.com` and `https://www.WoodgroveBank.com/Account`. + +> [!IMPORTANT] +> Changes to this policy take effect after device restart. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `;`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SetDenyUriListForRecall | +| Friendly Name | Set a list of URIs to be filtered from snapshots for Recall | +| Location | Computer and User Configuration | +| Path | Windows Components > Windows AI | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI | +| Registry Value Name | SetDenyUriListForRecall | +| ADMX File Name | WindowsCopilot.admx | + + + + + + + + + +## SetMaximumStorageDurationForRecallSnapshots + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageDurationForRecallSnapshots +``` + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageDurationForRecallSnapshots +``` + + + + +This policy setting allows you to control the maximum amount of time (in days) that Windows saves snapshots for Recall. + +When the policy is enabled, you can configure the maximum storage duration to be 30, 60, 90, or 180 days. + +When this policy isn't configured, a time frame isn't set for deleting snapshots. + +Snapshots aren't deleted until the maximum storage allocation for Recall is reached, and then the oldest snapshots are deleted first. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Let the OS define the maximum amount of time the snapshots will be saved. | +| 30 | 30 days. | +| 60 | 60 days. | +| 90 | 90 days. | +| 180 | 180 days. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SetMaximumStorageDurationForRecallSnapshots | +| Friendly Name | Set maximum duration for storing snapshots used by Recall | +| Location | Computer and User Configuration | +| Path | Windows Components > Windows AI | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI | +| Registry Value Name | SetMaximumStorageDurationForRecallSnapshots | +| ADMX File Name | WindowsCopilot.admx | + + + + + + + + + +## SetMaximumStorageSpaceForRecallSnapshots + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageSpaceForRecallSnapshots +``` + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsAI/SetMaximumStorageSpaceForRecallSnapshots +``` + + + + +This policy setting allows you to control the maximum amount of disk space that can be used by Windows to save snapshots for Recall. + +You can set the maximum amount of disk space for snapshots to be 10, 25, 50, 75, 100, or 150 GB. + +When this setting isn't configured, the OS configures the storage allocation for snapshots based on the device storage capacity. + +25 GB is allocated when the device storage capacity is 256 GB. 75 GB is allocated when the device storage capacity is 512 GB. 150 GB is allocated when the device storage capacity is 1 TB or higher. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Let the OS define the maximum storage amount based on hard drive storage size. | +| 10000 | 10GB. | +| 25000 | 25GB. | +| 50000 | 50GB. | +| 75000 | 75GB. | +| 100000 | 100GB. | +| 150000 | 150GB. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SetMaximumStorageSpaceForRecallSnapshots | +| Friendly Name | Set maximum storage for snapshots used by Recall | +| Location | Computer and User Configuration | +| Path | Windows Components > Windows AI | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\WindowsAI | +| Registry Value Name | SetMaximumStorageSpaceForRecallSnapshots | +| ADMX File Name | WindowsCopilot.admx | + + + + + + + + ## TurnOffWindowsCopilot -> [!NOTE] -> This policy is deprecated and may be removed in a future release. - | Scope | Editions | Applicable OS | |:--|:--|:--| @@ -282,14 +646,13 @@ This policy setting allows you to turn off Windows Copilot. - If you enable this policy setting, users won't be able to use Copilot. The Copilot icon won't appear on the taskbar either. -- If you disable or don't configure this policy setting, users will be able to use Copilot when it's available to them. +- If you disable or don't configure this policy setting, users are able to use Copilot when it's available to them. - -> [!Note] -> - The TurnOffWindowsCopilot policy isn't for the [new Copilot experience](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/evolving-copilot-in-windows-for-your-workforce/ba-p/4141999) that's in some [Windows Insider builds](https://blogs.windows.com/windows-insider/2024/05/22/releasing-windows-11-version-24h2-to-the-release-preview-channel/) and that will be gradually rolling out to Windows 11 and Windows 10 devices. +> [!NOTE] +> - The TurnOffWindowsCopilot policy isn't for the [new Copilot experience](https://techcommunity.microsoft.com/blog/windows-itpro-blog/evolving-copilot-in-windows-for-your-workforce/4141999) that's in some [Windows Insider builds](https://blogs.windows.com/windows-insider/2024/05/22/releasing-windows-11-version-24h2-to-the-release-preview-channel/) and that will be gradually rolling out to Windows 11 and Windows 10 devices. diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 3011ad91da..4b5c7ff09c 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -837,10 +837,10 @@ items: items: - name: PassportForWork DDF file href: passportforwork-ddf.md - - name: PDE + - name: Personal Data Encryption href: personaldataencryption-csp.md items: - - name: PDE DDF file + - name: Personal Data Encryption DDF file href: personaldataencryption-ddf-file.md - name: Personalization href: personalization-csp.md diff --git a/windows/client-management/recall-sensitive-information-filtering.md b/windows/client-management/recall-sensitive-information-filtering.md new file mode 100644 index 0000000000..e6d8c32969 --- /dev/null +++ b/windows/client-management/recall-sensitive-information-filtering.md @@ -0,0 +1,190 @@ +--- +title: Sensitive information filtering in Recall +description: Learn about the types of potentially sensitive information Recall detects. +ms.topic: reference +ms.subservice: windows-copilot +ms.date: 11/22/2024 +ms.author: mstewart +author: mestew +ms.collection: + - windows-copilot + - magic-ai-copilot +appliesto: +- ✅ Copilot+ PCs +--- + + +# Reference for sensitive information filtering in Recall + +This article provides information about the types of potentially sensitive information that [Recall](manage-recall.md) detects when the **Sensitive Information Filtering** setting is enabled. + +## Types of potentially sensitive information + +Types of potentially sensitive information that Recall detects and filters include: + +ABA Routing Number
+Argentina National Identity (DNI) Number
+Argentina Unique Tax Identification Key (CUIT/CUIL)
+Australia Bank Account Number
+Australia Drivers License Number
+Australia Tax File Number
+Austria Driver's License Number
+Austria Identity Card
+Austria Social Security Number
+Austria Tax Identification Number
+Austria Value Added Tax
+Azure Document DB Auth Key
+Azure IAAS Database Connection String and Azure SQL Connection String
+Azure IoT Connection String
+Azure Redis Cache Connection String
+Azure SAS
+Azure Secrets (Generic)
+Azure Service Bus Connection String
+Azure Storage Account Key
+Belgium Driver's License Number
+Belgium National Number
+Belgium Value Added Tax Number
+Brazil CPF Number
+Brazil Legal Entity Number (CNPJ)
+Brazil National ID Card (RG)
+Bulgaria Driver's License Number
+Bulgaria Uniform Civil Number
+Canada Bank Account Number
+Canada Driver's License Number
+Canada Social Insurance Number
+Chile Identity Card Number
+China Resident Identity Card (PRC) Number
+Colombia National ID
+Credit Card Number
+Croatia Driver's License Number
+Croatia Identity Card Number
+Croatia Personal Identification (OIB) Number
+Cyprus Driver's License Number
+Cyprus Identity Card
+Cyprus Tax Identification Number
+Czech Driver's License Number
+Czech Personal Identity Number
+DEA Number
+Denmark Driver's License Number
+Denmark Personal Identification Number
+Ecuador Unique Identification Number
+Estonia Driver's License Number
+Estonia Personal Identification Code
+EU Debit Card Number
+EU Driver's License Number
+EU National Id Card
+EU SSN or Equivalent Number
+EU Tax File Number
+Finland Driver's License Number
+Finnish National ID
+France CNI
+France Driver's License Number
+France INSEE
+France Tax Identification Number (numéro SPI.)
+France Value Added Tax Number
+General Password
+German Driver's License Number
+Germany Identity Card Number
+Germany Tax Identification Number
+Germany Value Added Tax Number
+Greece Driver's License Number
+Greece National ID Card
+Greece Social Security Number (AMKA)
+Greek Tax Identification Number
+Hong Kong Identity Card (HKID) number
+Hungarian Social Security Number (TAJ)
+Hungarian Value Added Tax Number
+Hungary Driver's License Number
+Hungary Personal Identification Number
+Hungary Tax Identification Number
+IBAN
+India Driver's License Number
+India GST number
+India Permanent Account Number
+India Unique Identification (Aadhaar) number
+India Voter Id Card
+Indonesia Drivers License Number
+Indonesia Identity Card (KTP) Number
+Ireland Driver's License Number
+Ireland Personal Public Service (PPS) Number
+Israel Bank Account Number
+Israel National ID Number
+Italy Driver's license Number
+Italy Fiscal Code
+Italy Value Added Tax
+Japan Bank Account Number
+Japan Driver's License Number
+Japan Residence Card Number
+Japan Resident Registration Number
+Japan Social Insurance Number
+Japanese My Number – Corporate
+Japanese My Number – Personal
+Latvia Driver's License Number
+Latvia Personal Code
+Lithuania Driver's License Number
+Lithuania Personal Code
+Luxembourg Driver's License Number
+Luxembourg National Identification Number (Natural persons)
+Luxembourg National Identification Number (Non-natural persons)
+Malaysia ID Card Number
+Malta Driver's License Number
+Malta Identity Card Number
+Malta Tax ID Number
+Mexico Unique Population Registry Code (CURP)
+Netherlands Citizen's Service (BSN) Number
+Netherlands Driver's License Number
+Netherlands Tax Identification Number
+Netherlands Value Added Tax Number
+New Zealand Bank Account Number
+New Zealand Driver License Number
+New Zealand Inland Revenue Number
+Newzealand Social Welfare Number
+Norway Identification Number
+Philippines National ID
+Philippines Passport Number
+Philippines Unified Multi-Purpose ID number
+Poland Driver's License Number
+Poland Identity Card
+Poland National ID (PESEL)
+Poland Tax Identification Number
+Polish REGON Number
+Portugal Citizen Card Number
+Portugal Driver's License Number
+Portugal Tax Identification Number
+Qatari ID Card Number
+Romania Driver's License Number
+Romania Personal Numerical Code (CNP)
+Saudi Arabia National ID
+Singapore Driving License Number
+Singapore National Registration Identity Card (NRIC) Number
+Slovakia Driver's License Number
+Slovakia Personal Number
+Slovenia Driver's License Number
+Slovenia Tax Identification Number
+Slovenia Unique Master Citizen Number
+South Africa Identification Number
+South Korea Driver's License Number
+South Korea Resident Registration Number
+Spain DNI
+Spain Driver's License Number
+Spain SSN
+Spain Tax Identification Number
+Sweden Driver's License Number
+Sweden National ID
+Sweden Tax Identification Number
+SWIFT Code
+Swiss SSN AHV Number
+Taiwan Resident Certificate (ARC/TARC)
+Taiwanese National ID
+Thai Citizen ID
+Turkish National Identity
+U.K. Driver's License Number
+U.K. Electoral Number
+U.K. NHS Number
+U.K. NINO
+U.K. Unique Taxpayer Reference Number
+U.S. Bank Account Number
+U.S. Driver's License Number
+U.S. Individual Taxpayer Identification Number (ITIN)
+U.S. Social Security Number
+UAE Identity Card Number
diff --git a/windows/client-management/toc.yml b/windows/client-management/toc.yml index 4aa913ef53..711bc21aea 100644 --- a/windows/client-management/toc.yml +++ b/windows/client-management/toc.yml @@ -51,7 +51,9 @@ items: - name: Updated Windows and Microsoft Copilot experience href: manage-windows-copilot.md - name: Manage Recall - href: manage-recall.md + href: manage-recall.md + - name: Reference for sensitive information filtering in Recall + href: recall-sensitive-information-filtering.md - name: Secured-Core PC Configuration Lock href: config-lock.md - name: Certificate renewal diff --git a/windows/configuration/assigned-access/configuration-file.md b/windows/configuration/assigned-access/configuration-file.md index 3d2532b2af..26cb548ff8 100644 --- a/windows/configuration/assigned-access/configuration-file.md +++ b/windows/configuration/assigned-access/configuration-file.md @@ -3,7 +3,7 @@ title: Create an Assigned Access configuration file description: Learn how to create an XML file to configure Assigned Access. ms.topic: how-to zone_pivot_groups: windows-versions-11-10 -ms.date: 03/04/2024 +ms.date: 10/31/2024 appliesto: --- diff --git a/windows/configuration/assigned-access/examples.md b/windows/configuration/assigned-access/examples.md index 3c0c865d64..0970cd2d90 100644 --- a/windows/configuration/assigned-access/examples.md +++ b/windows/configuration/assigned-access/examples.md @@ -1,7 +1,7 @@ --- title: Assigned Access examples description: Practical examples of XML files to configure Assigned Access. -ms.date: 03/04/2024 +ms.date: 10/31/2024 ms.topic: reference zone_pivot_groups: windows-versions-11-10 appliesto: diff --git a/windows/configuration/assigned-access/images/restricted-user-experience-example.png b/windows/configuration/assigned-access/images/restricted-user-experience-example.png new file mode 100644 index 0000000000..e2863c0f06 Binary files /dev/null and b/windows/configuration/assigned-access/images/restricted-user-experience-example.png differ diff --git a/windows/configuration/assigned-access/images/restricted-user-experience-windows-11.png b/windows/configuration/assigned-access/images/restricted-user-experience-windows-11.png index 6105c7bdd7..6deca437a7 100644 Binary files a/windows/configuration/assigned-access/images/restricted-user-experience-windows-11.png and b/windows/configuration/assigned-access/images/restricted-user-experience-windows-11.png differ diff --git a/windows/configuration/assigned-access/index.md b/windows/configuration/assigned-access/index.md index e8f3ecf20b..198d5e431c 100644 --- a/windows/configuration/assigned-access/index.md +++ b/windows/configuration/assigned-access/index.md @@ -2,7 +2,7 @@ title: Windows kiosks and restricted user experiences description: Learn about the options available in Windows to configure kiosks and restricted user experiences. ms.topic: overview -ms.date: 03/04/2024 +ms.date: 10/31/2024 --- # Windows kiosks and restricted user experiences @@ -43,6 +43,8 @@ Windows offers two different features to configure a kiosk experience: This option loads the Windows desktop, but it only allows to run a defined set of applications. When the designated user signs in, the user can only run the apps that are allowed. The Start menu is customized to show only the apps that are allowed to execute. With this approach, you can configure a locked-down experience for different account types. This option is sometimes referred to as *multi-app kiosk*. +:::image type="content" source="images/restricted-user-experience-example.png" alt-text="Screenshot of a restricted user experience in Windows 11." border="false"::: + To configure a restricted user experience, you use the **Assigned Access** feature. ## Choose the right experience diff --git a/windows/configuration/assigned-access/overview.md b/windows/configuration/assigned-access/overview.md index 12ed03cf42..9e87bd19a5 100644 --- a/windows/configuration/assigned-access/overview.md +++ b/windows/configuration/assigned-access/overview.md @@ -1,7 +1,7 @@ --- title: What is Assigned Access? description: Learn how to configure a Windows kiosk for single-app and multi-app scenarios with Assigned Access. -ms.date: 06/14/2024 +ms.date: 10/31/2024 ms.topic: overview --- @@ -298,35 +298,6 @@ To change the default time for Assigned Access to resume, add *IdleTimeOut* (DWO The Breakout Sequence of Ctrl + Alt + Del is the default, but this sequence can be configured to be a different sequence of keys. The breakout sequence uses the format **modifiers + keys**. An example breakout sequence is CTRL + ALT + A, where CTRL + ALT are the modifiers, and A is the key value. To learn more, see [Create an Assigned Access configuration XML file](configuration-file.md). -### Keyboard shortcuts - -The following keyboard shortcuts are blocked for the user accounts with Assigned Access: - -| Keyboard shortcut | Action | -|------------------------------------------------------|-----------------------------------------------------------------------------------------------| -| Ctrl + Shift + Esc | Open Task Manager | -| WIN + , (comma) | Temporarily peek at the desktop | -| WIN + A | Open Action center | -| WIN + Alt + D | Display and hide the date and time on the desktop | -| WIN + Ctrl + F | Find computer objects in Active Directory | -| WIN + D | Display and hide the desktop | -| WIN + E | Open File Explorer | -| WIN + F | Open Feedback Hub | -| WIN + G | Open Game bar when a game is open | -| WIN + I | Open Settings | -| WIN + J | Set focus to a Windows tip when one is available | -| WIN + O | Lock device orientation | -| WIN + Q | Open search | -| WIN + R | Open the Run dialog box | -| WIN + S | Open search | -| WIN + Shift + C | Open Cortana in listening mode | -| WIN + X | Open the Quick Link menu | -| LaunchApp1 | Open the app that is assigned to this key | -| LaunchApp2 | Open the app that is assigned to this key. On many Microsoft keyboards, the app is Calculator | -| LaunchMail | Open the default mail client | - -For information on how to customize keyboard shortcuts, see [Assigned Access recommendations](recommendations.md#keyboard-shortcuts). - ## Remove Assigned Access Deleting the restricted user experience removes the policy settings associated with the users, but it can't revert all the configurations. For example, the Start menu configuration is maintained. diff --git a/windows/configuration/assigned-access/policy-settings.md b/windows/configuration/assigned-access/policy-settings.md index 0bf8a93e30..64518f0dca 100644 --- a/windows/configuration/assigned-access/policy-settings.md +++ b/windows/configuration/assigned-access/policy-settings.md @@ -2,7 +2,7 @@ title: Assigned Access policy settings description: Learn about the policy settings enforced on a device configured with Assigned Access. ms.topic: reference -ms.date: 03/04/2024 +ms.date: 10/31/2024 --- # Assigned Access policy settings @@ -39,7 +39,7 @@ The following policy settings are applied at the device level when you deploy a ## User policy settings -The following policy settings are applied to any nonadministrator account when you deploy a restricted user experience: +The following policy settings are applied to targeted user accounts when you deploy a restricted user experience: | Type | Path | Name/Description | |---------|----------------------------------------------------------------------------------|-------------------------------------------------------------------| @@ -47,8 +47,9 @@ The following policy settings are applied to any nonadministrator account when y | **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/HidePeopleBar` | Hide People Bar from appearing on taskbar | | **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/HideRecentlyAddedApps` | Hide recently added apps from appearing on the Start menu | | **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/HideRecentJumplists` | Hide recent jumplists from appearing on the Start menu/taskbar | +| **GPO** | User Configuration\Administrative Templates\Desktop | Hide and disable all items on the desktop | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Clear history of recently opened documents on exit | -| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Disable showing balloon notifications as toast | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Disable showing balloon notifications as toasts | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Do not allow pinning items in Jump Lists | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Do not allow pinning programs to the Taskbar | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Do not display or track items in Jump Lists from remote locations | @@ -69,21 +70,23 @@ The following policy settings are applied to any nonadministrator account when y | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove Notification and Action Center | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove Quick Settings | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove Run menu from Start Menu | -| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Remove the Security and Maintenance icon | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Turn off all balloon notifications | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar | Turn off feature advertisement balloon notifications | +| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar\Notifications | Hide the TaskView button | | **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar\Notifications | Turn off toast notifications | | **GPO** | User Configuration\Administrative Templates\System\Ctrl+Alt+Del Options | Remove Change Password | | **GPO** | User Configuration\Administrative Templates\System\Ctrl+Alt+Del Options | Remove Logoff | | **GPO** | User Configuration\Administrative Templates\System\Ctrl+Alt+Del Options | Remove Task Manager | +| **GPO** | User Configuration\Administrative Templates\Windows Components\File Explorer | Prevent access to drives from My Computer | | **GPO** | User Configuration\Administrative Templates\Windows Components\File Explorer | Remove *Map network drive* and *Disconnect Network Drive* | | **GPO** | User Configuration\Administrative Templates\Windows Components\File Explorer | Remove File Explorer's default context menu | +| **GPO** | User Configuration\Administrative Templates\Windows Components\Windows Copilot | Turn off Windows Copilot | The following policy settings are applied to the kiosk account when you configure a kiosk experience with Microsoft Edge: | Type | Path | Name/Description | |---------|-----------------------------------------------------------------------------------|--------------------------------------------------------| -| **GPO** | User Configuration\Administrative Templates\Start Menu and Taskbar\Notifications | Run only specified Windows applications > `msedge.exe` | +| **GPO** | User Configuration\Administrative Templates\System | Run only specified Windows applications > `msedge.exe` | | **GPO** | User Configuration\Administrative Templates\System | Turn off toast notifications | | **GPO** | User Configuration\Administrative Templates\Windows Components\Attachment Manager | Default risk level for file attachments > High risk | | **GPO** | User Configuration\Administrative Templates\Windows Components\Attachment Manager | Inclusion list for low file types > `.pdf;.epub` | @@ -112,3 +115,32 @@ The deny list is used to prevent the user from accessing the apps, which are cur 1. The default rule is to allow all users to launch the desktop programs signed with *Microsoft Certificate* for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. 1. There's a predefined inbox desktop app deny list for the Assigned Access user account, which is updated based on the *desktop app allow list* that you defined in the Assigned Access configuration 1. Enterprise-defined allowed desktop apps are added in the AppLocker allow list + +## Keyboard shortcuts + +The following keyboard shortcuts are blocked for the user accounts with Assigned Access: + +| Keyboard shortcut | Action | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------| +| Ctrl + Shift + Esc | Open Task Manager | +| WIN + , (comma) | Temporarily peek at the desktop | +| WIN + A | Open Action center | +| WIN + Alt + D | Display and hide the date and time on the desktop | +| WIN + Ctrl + F | Find computer objects in Active Directory | +| WIN + D | Display and hide the desktop | +| WIN + E | Open File Explorer | +| WIN + F | Open Feedback Hub | +| WIN + G | Open Game bar when a game is open | +| WIN + I | Open Settings | +| WIN + J | Set focus to a Windows tip when one is available | +| WIN + O | Lock device orientation | +| WIN + Q | Open search | +| WIN + R | Open the Run dialog box | +| WIN + S | Open search | +| WIN + Shift + C | Open Cortana in listening mode | +| WIN + X | Open the Quick Link menu | +| LaunchApp1 | Open the app that is assigned to this key | +| LaunchApp2 | Open the app that is assigned to this key. On many Microsoft keyboards, the app is Calculator | +| LaunchMail | Open the default mail client | + +For information on how to customize keyboard shortcuts, see [Assigned Access recommendations](recommendations.md#keyboard-shortcuts). diff --git a/windows/configuration/assigned-access/quickstart-kiosk.md b/windows/configuration/assigned-access/quickstart-kiosk.md index 0dd9ff9fa7..b0583377da 100644 --- a/windows/configuration/assigned-access/quickstart-kiosk.md +++ b/windows/configuration/assigned-access/quickstart-kiosk.md @@ -2,7 +2,7 @@ title: "Quickstart: configure a kiosk experience with Assigned Access" description: Learn how to configure a kiosk experience with Assigned Access using the Assigned Access configuration service provider (CSP), Microsoft Intune, PowerShell, or group policy (GPO). ms.topic: quickstart -ms.date: 03/04/2024 +ms.date: 10/31/2024 --- # Quickstart: configure a kiosk with Assigned Access diff --git a/windows/configuration/assigned-access/quickstart-restricted-user-experience.md b/windows/configuration/assigned-access/quickstart-restricted-user-experience.md index de5573c281..75d9bb74c1 100644 --- a/windows/configuration/assigned-access/quickstart-restricted-user-experience.md +++ b/windows/configuration/assigned-access/quickstart-restricted-user-experience.md @@ -2,7 +2,7 @@ title: "Quickstart: configure a restricted user experience with Assigned Access" description: Learn how to configure a restricted user experience with Assigned Access using the Assigned Access configuration service provider (CSP), Microsoft Intune, PowerShell, or group policy (GPO). ms.topic: quickstart -ms.date: 03/04/2024 +ms.date: 10/31/2024 appliesto: zone_pivot_groups: windows-versions-11-10 --- diff --git a/windows/configuration/assigned-access/recommendations.md b/windows/configuration/assigned-access/recommendations.md index 64b2ce4d5c..10a4e13dcf 100644 --- a/windows/configuration/assigned-access/recommendations.md +++ b/windows/configuration/assigned-access/recommendations.md @@ -2,7 +2,7 @@ title: Assigned Access recommendations description: Learn about the recommended kiosk and restricted user experience configuration options. ms.topic: best-practice -ms.date: 03/11/2024 +ms.date: 10/31/2024 --- # Assigned Access recommendations diff --git a/windows/configuration/assigned-access/shell-launcher/configuration-file.md b/windows/configuration/assigned-access/shell-launcher/configuration-file.md index d63efdb85b..459b26e0a2 100644 --- a/windows/configuration/assigned-access/shell-launcher/configuration-file.md +++ b/windows/configuration/assigned-access/shell-launcher/configuration-file.md @@ -1,7 +1,7 @@ --- title: Create a Shell Launcher configuration file description: Learn how to create an XML file to configure a device with Shell Launcher. -ms.date: 02/12/2024 +ms.date: 10/31/2024 ms.topic: how-to --- diff --git a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-intune.md b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-intune.md index eb3b1a1b04..67b1c7788a 100644 --- a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-intune.md +++ b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-intune.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 02/05/2024 +ms.date: 10/31/2024 ms.topic: include --- diff --git a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-ps.md b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-ps.md index c783de00f6..d6c03611c6 100644 --- a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-ps.md +++ b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-ps.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 02/05/2024 +ms.date: 10/31/2024 ms.topic: include --- diff --git a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-xml.md b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-xml.md index 80e9dd0bb8..085c937378 100644 --- a/windows/configuration/assigned-access/shell-launcher/includes/quickstart-xml.md +++ b/windows/configuration/assigned-access/shell-launcher/includes/quickstart-xml.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 02/05/2024 +ms.date: 10/31/2024 ms.topic: include --- diff --git a/windows/configuration/assigned-access/shell-launcher/index.md b/windows/configuration/assigned-access/shell-launcher/index.md index 4a51fa2143..4c942afd74 100644 --- a/windows/configuration/assigned-access/shell-launcher/index.md +++ b/windows/configuration/assigned-access/shell-launcher/index.md @@ -1,7 +1,7 @@ --- title: What is Shell Launcher? description: Learn how to configure devices with Shell Launcher. -ms.date: 06/18/2024 +ms.date: 10/31/2024 ms.topic: overview --- diff --git a/windows/configuration/assigned-access/shell-launcher/quickstart-kiosk.md b/windows/configuration/assigned-access/shell-launcher/quickstart-kiosk.md index f217d88363..c843e767a5 100644 --- a/windows/configuration/assigned-access/shell-launcher/quickstart-kiosk.md +++ b/windows/configuration/assigned-access/shell-launcher/quickstart-kiosk.md @@ -2,7 +2,7 @@ title: "Quickstart: configure a kiosk experience with Shell Launcher" description: Learn how to configure a kiosk experience with Shell Launcher, using the Assigned Access configuration service provider (CSP), Microsoft Intune, PowerShell, or group policy (GPO). ms.topic: quickstart -ms.date: 02/05/2024 +ms.date: 10/31/2024 --- # Quickstart: configure a kiosk experience with Shell Launcher diff --git a/windows/configuration/assigned-access/shell-launcher/xsd.md b/windows/configuration/assigned-access/shell-launcher/xsd.md index ef624ae434..3dcc586570 100644 --- a/windows/configuration/assigned-access/shell-launcher/xsd.md +++ b/windows/configuration/assigned-access/shell-launcher/xsd.md @@ -2,7 +2,7 @@ title: Shell Launcher XML Schema Definition (XSD) description: Shell Launcher XSD reference article. ms.topic: reference -ms.date: 02/15/2024 +ms.date: 10/31/2024 --- # Shell Launcher XML Schema Definition (XSD) diff --git a/windows/configuration/assigned-access/xsd.md b/windows/configuration/assigned-access/xsd.md index 5cd75dccbe..36c51137aa 100644 --- a/windows/configuration/assigned-access/xsd.md +++ b/windows/configuration/assigned-access/xsd.md @@ -2,7 +2,7 @@ title: Assigned Access XML Schema Definition (XSD) description: Assigned Access XSD reference article. ms.topic: reference -ms.date: 04/08/2024 +ms.date: 10/31/2024 --- # Assigned Access XML Schema Definition (XSD) diff --git a/windows/configuration/shared-pc/set-up-shared-or-guest-pc.md b/windows/configuration/shared-pc/set-up-shared-or-guest-pc.md index 15c139b82e..4d13b9b87e 100644 --- a/windows/configuration/shared-pc/set-up-shared-or-guest-pc.md +++ b/windows/configuration/shared-pc/set-up-shared-or-guest-pc.md @@ -1,7 +1,7 @@ --- title: Configure a shared or guest Windows device description: Description of how to configured Shared PC mode, which is a Windows feature that optimizes devices for shared use scenarios. -ms.date: 09/06/2024 +ms.date: 10/31/2024 ms.topic: how-to --- diff --git a/windows/configuration/shared-pc/shared-devices-concepts.md b/windows/configuration/shared-pc/shared-devices-concepts.md index fdb4b3ed52..84659c4325 100644 --- a/windows/configuration/shared-pc/shared-devices-concepts.md +++ b/windows/configuration/shared-pc/shared-devices-concepts.md @@ -1,7 +1,7 @@ --- title: Manage multi-user and guest Windows devices description: options to optimize Windows devices used in shared scenarios, such touchdown spaces in an enterprise, temporary customer use in retail or shared devices in a school. -ms.date: 02/06/2024 +ms.date: 10/31/2024 ms.topic: concept-article --- diff --git a/windows/configuration/shared-pc/shared-pc-technical.md b/windows/configuration/shared-pc/shared-pc-technical.md index 62edc9d451..dbd8ff2fd7 100644 --- a/windows/configuration/shared-pc/shared-pc-technical.md +++ b/windows/configuration/shared-pc/shared-pc-technical.md @@ -1,7 +1,7 @@ --- title: Shared PC technical reference description: List of policies and settings applied by the Shared PC options. -ms.date: 02/06/2024 +ms.date: 10/31/2024 ms.topic: reference --- diff --git a/windows/configuration/start/includes/disable-account-notifications.md b/windows/configuration/start/includes/disable-account-notifications.md new file mode 100644 index 0000000000..02d3427ef9 --- /dev/null +++ b/windows/configuration/start/includes/disable-account-notifications.md @@ -0,0 +1,25 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 11/04/2024 +ms.topic: include +--- + +### Disable Account Notifications + +This policy controls the notifications to Microsoft account (MSA) and local users in the Start's user tile: + +- When enabled, Windows doesn't send account related notifications for local and MSA users to the user tile in Start +- Wen disabled or not configured, Windows sends account related notifications for local and MSA users to the user tile in Start + +Notifications include getting users to: + +- reauthenticate +- back up their device +- manage cloud storage quotas +- manage their Microsoft 365 or XBOX subscription + +| | Path | +|--|--| +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Notifications/`[DisableAccountNotifications](/windows/client-management/mdm/policy-csp-notifications#disableaccountnotifications) | +| **GPO** | **User Configuration** > **Administrative Templates** > **Windows Components** > **Account Notifications** > **Turn off account notifications in Start** | diff --git a/windows/configuration/start/layout.md b/windows/configuration/start/layout.md index 30baa389a1..81f5d11c75 100644 --- a/windows/configuration/start/layout.md +++ b/windows/configuration/start/layout.md @@ -304,10 +304,10 @@ Column="2"/> You can use the `start:SecondaryTile` tag to pin a web link through a Microsoft Edge secondary tile. This method doesn't require more actions compared to the method of using legacy `.url` shortcuts (through the `start:DesktopApplicationTile` tag). -The following example shows how to create a tile of the Web site's URL using the Microsoft Edge secondary tile: +The following example shows how to create a tile of the Web site's URL using the Microsoft Edge secondary tile. Ensure to replace `<--Microsoft Edge AUMID-->` with the AUMID of Microsoft Edge (learn how to [Find the Application User Model ID of an installed app](../store/find-aumid.md)): ```XML - [!IMPORTANT] -> If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the `explorer.exe` process restarts. If your configuration pins an app and the user then unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration that allows users to make changes that will persist, apply your configuration by using CSP or GPO. +### Taskbar configuration and policy refresh + +Depending on the method you use to configure the taskbar, the configuration is reapplied at different intervals. When the taskbar configuration is reapplied, user changes are overwritten. + +| Configuration method | Reapplied interval | +|--|--| +| Configuration service provider (CSP) | Every 8 hours or based on the [ConfigRefresh](/windows/client-management/mdm/dmclient-csp#deviceproviderprovideridconfigrefresh) interval. | +| Provisioning package (PPKG) | Each time the `explorer.exe` process restarts. | +| Group policy (GPO) | In case of a group policy change. | > [!CAUTION] -> The use of the `Import-StartLayout` PowerShell cmdlet to provision the Taskbar layout is no longer supported in Windows 11. The only supported configuration in Windows 11 is to use a provisioning package. +> The use of the `Import-StartLayout` PowerShell cmdlet to provision the Taskbar layout is no longer supported in Windows 11. + ::: zone pivot="windows-10" >[!NOTE] @@ -78,13 +86,13 @@ Here you can find an example of taskbar layout that you can use as a reference: You can change the apps pinned to the taskbar by modifying the `` node. 1. In the `` node, add (or remove) the apps you want pinned. You can pin Universal Windows Platform (UWP) apps and desktop apps: - - ``: Select this option for UWP apps. Add the *AUMID* of the UWP app - - ``: Select this option for desktop apps. Add the *Desktop Application ID* or the *Desktop Application Link Path* of the desktop app + - ``: Select this option for UWP apps. Add the *AUMID* of the UWP app. + - ``: Select this option for desktop apps. Add the *Desktop Application ID* or the *Desktop Application Link Path* of the desktop app. 1. In the `` node, the apps you add are pinned after the default apps. If you want to remove the default apps, and only show the apps you add in the XML file, then add `PinListPlacement="Replace"`: - - ``: Keeps the default pinned apps. After the default apps, the apps you add are pinned - - ``: Unpins the default apps. Only the apps you add are pinned. If you want to remove some of the default pinned apps, then add `PinListPlacement="Replace"`. When you add your apps to ``, include the default apps you still want pinned -1. In the `` node, use `region=" | "` to use different taskbar configurations based on the device locale and region -1. Save the file + - ``: Keeps the default pinned apps. After the default apps, the apps you add are pinned. + - ``: Unpins the default apps. Only the apps you add are pinned. If you want to remove some of the default pinned apps, then add `PinListPlacement="Replace"`. When you add your apps to ``, include the default apps you still want pinned. +1. In the `` node, use `region=" | "` to use different taskbar configurations based on the device locale and region. +1. Save the file. For practical examples of how to add, remove, or replace pinned apps, see the following sections: @@ -147,8 +155,8 @@ In the following XML example, two regions are added: `US|UK` and `DE|FR|IT`: [!INCLUDE [example](includes/example-region.md)] -- If the `` node has region matching the one configured on the device, then the configuration applies -- If the `` node doesn't have a region matching the one configured on the device, then the first `` node without region applies +- If the `` node has region matching the one configured on the device, then the configuration applies. +- If the `` node doesn't have a region matching the one configured on the device, then the first `` node without region applies. > [!NOTE] > [Look up country and region codes (use the ISO Short column)](/previous-versions/commerce-server/ee799297(v=cs.20)) @@ -212,15 +220,15 @@ After the taskbar layout is applied, the users must sign out and sign in again t On a clean install of Windows, if you apply a taskbar layout, the following apps are pinned to the taskbar: -- Any default apps you don't remove -- Apps that you specifically pin in the XML file +- Any default apps you don't remove. +- Apps that you specifically pin in the XML file. On a Windows OS upgrade, apps are already pinned to the taskbar. The taskbar layout applies the following logic: -- If users pinned apps to the taskbar, then those pinned apps remain. New apps are pinned after the existing user-pinned apps -- If the apps are pinned during the install or by a policy (not by a user), and the apps aren't pinned in an updated layout file, then the apps are unpinned -- If a user didn't pin an app, and the same app is pinned in the updated layout file, then the app is pinned after any existing pinned apps -- New apps in updated layout file are pinned after the user's pinned apps +- If users pinned apps to the taskbar, then those pinned apps remain. New apps are pinned after the existing user-pinned apps. +- If the apps are pinned during the install or by a policy (not by a user), and the apps aren't pinned in an updated layout file, then the apps are unpinned. +- If a user didn't pin an app, and the same app is pinned in the updated layout file, then the app is pinned after any existing pinned apps. +- New apps in updated layout file are pinned after the user's pinned apps. If you apply the taskbar configuration to a clean install or an update, users can still: diff --git a/windows/configuration/taskbar/policy-settings.md b/windows/configuration/taskbar/policy-settings.md index 72ca73538b..ed1b04da64 100644 --- a/windows/configuration/taskbar/policy-settings.md +++ b/windows/configuration/taskbar/policy-settings.md @@ -1,8 +1,8 @@ --- -title: Taskbar policy settings -description: Learn about the policy settings to configure the Windows taskbar. +title: List of the Policy Settings To Configure the Windows Taskbar +description: Learn about the CSP and GPO policy settings to configure the Windows taskbar. ms.topic: reference -ms.date: 04/17/2024 +ms.date: 11/07/2024 appliesto: zone_pivot_groups: windows-versions-11-10 --- diff --git a/windows/configuration/taskbar/xsd.md b/windows/configuration/taskbar/xsd.md index c6d5ded3aa..da97f38e11 100644 --- a/windows/configuration/taskbar/xsd.md +++ b/windows/configuration/taskbar/xsd.md @@ -1,8 +1,8 @@ --- -title: Taskbar XML Schema Definition (XSD) -description: Taskbar XSD reference article. +title: Windows Taskbar XML Schema Definition (XSD) +description: Reference article about the Taskbar XML schema definition (XSD). ms.topic: reference -ms.date: 02/15/2024 +ms.date: 11/11/2024 --- # Taskbar XML Schema Definition (XSD) diff --git a/windows/deployment/customize-boot-image.md b/windows/deployment/customize-boot-image.md index 31420e8890..858a5e63bf 100644 --- a/windows/deployment/customize-boot-image.md +++ b/windows/deployment/customize-boot-image.md @@ -1,6 +1,6 @@ --- title: Customize Windows PE boot images -description: This article describes how to customize a Windows PE (WinPE) boot image including updating it with the latest cumulative update, adding drivers, and adding optional components. +description: This article describes how to customize a Windows PE (WinPE) boot image, including updating it with the latest cumulative update, adding drivers, and adding optional components. ms.service: windows-client ms.localizationpriority: medium author: frankroj @@ -23,13 +23,13 @@ appliesto: The Windows PE (WinPE) boot images that are included with the Windows ADK have a minimal number of features and drivers. However the boot images can be customized by adding drivers, optional components, and applying the latest cumulative update. -Microsoft recommends updating Windows PE boot images with the latest cumulative update for maximum security and protection. The latest cumulative updates may also resolve known issues. For example, the Windows PE boot image can be updated with the latest cumulative update to address the BlackLotus UEFI bootkit vulnerability as documented in [KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932](https://prod.support.services.microsoft.com/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d) and [CVE-2023-24932](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24932). +Microsoft recommends updating Windows PE boot images with the latest cumulative update for maximum security and protection. The latest cumulative updates may also resolve known issues. For example, the Windows PE boot image can be updated with the latest cumulative update to address the BlackLotus UEFI bootkit vulnerability as documented in [KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932](https://support.microsoft.com/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d) and [CVE-2023-24932](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24932). > [!TIP] > > The boot images from the [ADK 10.1.26100.1 (May 2024)](/windows-hardware/get-started/adk-install) and later already contain the cumulative update to address the BlackLotus UEFI bootkit vulnerability. -This walkthrough describes how to customize a Windows PE boot image including updating with the latest cumulative update, adding drivers, and adding optional components. Additionally this walkthrough goes over how customizations in boot images affect several different popular products that utilize boot images, such as Microsoft Configuration Manager, Microsoft Deployment Toolkit (MDT), and Windows Deployment Services (WDS). +This walkthrough describes how to customize a Windows PE boot image, including updating with the latest cumulative update, adding drivers, and adding optional components. Additionally this walkthrough goes over how customizations in boot images affect several different popular products that utilize boot images, such as Microsoft Configuration Manager, Microsoft Deployment Toolkit (MDT), and Windows Deployment Services (WDS). ## Prerequisites @@ -332,7 +332,7 @@ The cumulative update installed later in this walkthrough doesn't affect drivers **Example**: ```powershell - Add-WindowsPackage -PackagePath "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-Scripting_en-us.cab" -Path "C:\Mount" -Verbose + Add-WindowsPackage -PackagePath "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-Scripting_en-us.cab" -Path "C:\Mount" -Verbose ``` These examples assume a 64-bit boot image. If a different architecture is being used, then adjust the paths accordingly. @@ -668,7 +668,7 @@ For more information, see [copy](/windows-server/administration/windows-commands This step doesn't update or change the boot image. However, it makes sure that the latest bootmgr boot files are available to the Windows ADK when creating bootable media via the Windows ADK. When these files are updated in the Windows ADK, products that use the Windows ADK to create bootable media, such as **Microsoft Deployment Toolkit (MDT)**, also have access to the updated bootmgr boot files. -In particular, this step is needed when addressing the BlackLotus UEFI bootkit vulnerability as documented in [KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932](https://prod.support.services.microsoft.com/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d) and [CVE-2023-24932](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24932). +In particular, this step is needed when addressing the BlackLotus UEFI bootkit vulnerability as documented in [KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932](https://support.microsoft.com/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d) and [CVE-2023-24932](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24932). > [!TIP] > @@ -839,7 +839,7 @@ For more information, see [Modify a Windows image using DISM: Unmounting an imag --- 1. Once the export has completed: - + 1. Delete the original updated boot image: ### [:::image type="icon" source="images/icons/powershell-18.svg"::: **PowerShell**](#tab/powershell) @@ -1295,4 +1295,4 @@ For more information, see [Windows Server 2012 R2 Lifecycle](/lifecycle/products - [Create bootable Windows PE media: Update the Windows PE add-on for the Windows ADK](/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive#update-the-windows-pe-add-on-for-the-windows-adk) - [Update Windows installation media with Dynamic Update: Update WinPE](/windows/deployment/update/media-dynamic-update#update-winpe) -- [KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932: Updating bootable media](https://prod.support.services.microsoft.com/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d?preview=true#updatebootable5025885) +- [KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932: Updating bootable media](https://support.microsoft.com/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d) diff --git a/windows/deployment/do/TOC.yml b/windows/deployment/do/TOC.yml index fe1b2a0cf3..b9d7757f89 100644 --- a/windows/deployment/do/TOC.yml +++ b/windows/deployment/do/TOC.yml @@ -33,21 +33,45 @@ items: - name: What is Microsoft Connected Cache? href: waas-microsoft-connected-cache.md - - name: MCC for Enterprise and Education + - name: Microsoft Connected Cache for Enterprise and Education items: - - name: MCC for Enterprise and Education Overview + - name: Connected Cache for Enterprise and Education overview href: mcc-ent-edu-overview.md - name: Requirements - href: mcc-enterprise-prerequisites.md - - name: Deploy Microsoft Connected Cache - href: mcc-enterprise-deploy.md - - name: Update or uninstall MCC - href: mcc-enterprise-update-uninstall.md - - name: Appendix - href: mcc-enterprise-appendix.md - - name: MCC for ISPs + href: mcc-ent-prerequisites.md + - name: How-to guides + items: + - name: Create and configure Connected Cache resources and cache nodes + href: mcc-ent-create-resource-and-cache.md + - name: Deploy Connected Cache nodes to host machines + items: + - name: Deploy Connected Cache to Linux + href: mcc-ent-deploy-to-linux.md + - name: Deploy Connected Cache to Windows + href: mcc-ent-deploy-to-windows.md + - name: Use Azure CLI to manage Connected Cache + href: mcc-ent-manage-using-cli.md + - name: Verify Connected Cache node functionality + href: mcc-ent-verify-cache-node.md + - name: Monitor Connected Cache nodes + href: mcc-ent-monitoring.md + - name: Update Connected Cache nodes + href: mcc-ent-update-cache-node.md + - name: Uninstall Connected Cache nodes + href: mcc-ent-uninstall-cache-node.md + - name: Resources + items: + - name: Frequent Asked Questions + href: mcc-ent-faq.yml + - name: Troubleshooting + href: mcc-ent-troubleshooting.md + - name: Microsoft Connected Cache for Enterprise and Education early preview + href: mcc-ent-early-preview.md + - name: Release notes + href: mcc-ent-release-notes.md + - name: Microsoft Connected Cache for ISPs items: - - name: MCC for ISPs Overview + - name: Connected Cache for ISPs Overview href: mcc-isp-overview.md - name: How-to guides items: @@ -67,9 +91,8 @@ href: mcc-isp-vm-performance.md - name: Support and troubleshooting href: mcc-isp-support.md - - name: MCC for ISPs (early preview) + - name: Connected Cache for ISPs (early preview) href: mcc-isp.md - name: Endpoints for Microsoft Connected Cache content and services href: delivery-optimization-endpoints.md - diff --git a/windows/deployment/do/delivery-optimization-configure.md b/windows/deployment/do/delivery-optimization-configure.md index cfe43ce385..7722670c70 100644 --- a/windows/deployment/do/delivery-optimization-configure.md +++ b/windows/deployment/do/delivery-optimization-configure.md @@ -35,7 +35,7 @@ Use this checklist to guide you through different aspects when modifying Deliver * System resources * Improve P2P efficiencies -1. Using Connected Cache (MCC) +1. Using Microsoft Connected Cache 1. Choose where to set Delivery Optimization policies ## 1. Prerequisites to allow Delivery Optimization communication @@ -189,7 +189,7 @@ Regardless of P2P, consider setting the following policies to avoid network disr > [!NOTE] > The absolute policies are recommended in low bandwidth environments. -## 3. Using Connected Cache (MCC) +## 3. Using Connected Cache :::image type="content" source="images/do-setup-connected-cache.png" alt-text="Screenshot of Delivery Optimization options when using Connected Cache." lightbox="images/do-setup-connected-cache.png"::: diff --git a/windows/deployment/do/delivery-optimization-troubleshoot.md b/windows/deployment/do/delivery-optimization-troubleshoot.md index 5ade7e311f..972b148de4 100644 --- a/windows/deployment/do/delivery-optimization-troubleshoot.md +++ b/windows/deployment/do/delivery-optimization-troubleshoot.md @@ -29,7 +29,7 @@ This article discusses how to troubleshoot Delivery Optimization. - -HealthCheck: Provides an overall check of the device setup to ensure Delivery Optimization communication is possible on the device. - -P2P: Provides output specific to P2P settings, efficiency, and errors. -- -MCC: Provides output specific to MCC settings and verifies the client can access the cache server. +- -MCC: Provides output specific to Microsoft Connected Cache settings and verifies the client can access the cache server. ## Common problems and solutions diff --git a/windows/deployment/do/images/elixir_ux/readme-elixir-ux-files.md b/windows/deployment/do/images/elixir_ux/readme-elixir-ux-files.md index 8b132e7d76..4bf73fa9c9 100644 --- a/windows/deployment/do/images/elixir_ux/readme-elixir-ux-files.md +++ b/windows/deployment/do/images/elixir_ux/readme-elixir-ux-files.md @@ -25,4 +25,4 @@ This file contains the images that are included in this GitHub repository that a :::image type="content" source="ux-iot-edge-list.png" alt-text="A screenshot of the terminal after the command 'iotedge list', showing all three containers running successfully."::: -:::image type="content" source="ux-mcc-failed.png" alt-text="A screenshot of the terminal after the command 'iotedge list', showing the MCC container in a failure state."::: \ No newline at end of file +:::image type="content" source="ux-mcc-failed.png" alt-text="A screenshot of the terminal after the command 'iotedge list', showing the Microsoft Connected Cache container in a failure state."::: \ No newline at end of file diff --git a/windows/deployment/do/images/mcc_ent_publicpreview.png b/windows/deployment/do/images/mcc_ent_publicpreview.png new file mode 100644 index 0000000000..6f6f292d58 Binary files /dev/null and b/windows/deployment/do/images/mcc_ent_publicpreview.png differ diff --git a/windows/deployment/do/includes/get-azure-subscription.md b/windows/deployment/do/includes/get-azure-subscription.md index 5e0061e00b..0be764aea7 100644 --- a/windows/deployment/do/includes/get-azure-subscription.md +++ b/windows/deployment/do/includes/get-azure-subscription.md @@ -14,6 +14,6 @@ ms.localizationpriority: medium 1. Sign in to the [Azure portal](https://portal.azure.com). 1. Select **Subscriptions**. If you don't see **Subscriptions**, type **Subscriptions** in the search bar. As you begin typing, the list filters based on your input. 1. If you already have an Azure Subscription, skip to step 5. If you don't have an Azure Subscription, select **+ Add** on the top left. -1. Select the **Pay-As-You-Go** subscription. You'll be asked to enter credit card information, but you'll not be charged for using the MCC service. +1. Select the **Pay-As-You-Go** subscription. You'll be asked to enter credit card information, but you'll not be charged for using the Microsoft Connected Cache service. 1. On the **Subscriptions** page, you'll find details about your current subscription. Select the subscription name. 1. After you select the subscription name, you'll find the subscription ID in the **Overview** tab. Select the **Copy to clipboard** icon next to your Subscription ID to copy the value. diff --git a/windows/deployment/do/index.yml b/windows/deployment/do/index.yml index d2e3a5c60a..dc1e99b304 100644 --- a/windows/deployment/do/index.yml +++ b/windows/deployment/do/index.yml @@ -15,7 +15,7 @@ metadata: author: aczechowski ms.author: aaroncz manager: aaroncz - ms.date: 12/22/2023 #Required; mm/dd/yyyy format. + ms.date: 10/30/2024 #Required; mm/dd/yyyy format. ms.localizationpriority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new @@ -32,7 +32,7 @@ landingContent: url: waas-delivery-optimization.md - text: What's new in Delivery Optimization url: whats-new-do.md - - text: Microsoft Connected Cache (MCC) overview + - text: Microsoft Connected Cache overview url: waas-microsoft-connected-cache.md @@ -63,25 +63,25 @@ landingContent: url: /mem/intune/configuration/delivery-optimization-windows # Card - - title: Microsoft Connected Cache (MCC) for Enterprise and Education + - title: Microsoft Connected Cache for Enterprise and Education linkLists: - linkListType: deploy links: - - text: MCC for Enterprise and Education (early preview) - url: waas-microsoft-connected-cache.md - - text: Sign up - url: https://aka.ms/MSConnectedCacheSignup + - text: Connected Cache for Enterprise and Education overview + url: mcc-ent-edu-overview.md + - text: Connected Cache for Enterprise and Education requirements + url: mcc-ent-prerequisites.md + - text: Create the Microsoft Connected Cache Azure resource and cache nodes + url: mcc-ent-create-resource-and-cache.md # Card - - title: Microsoft Connected Cache (MCC) for Internet Service Providers (ISPs) + - title: Microsoft Connected Cache for Internet Service Providers (ISPs) linkLists: - linkListType: deploy links: - - text: MCC for ISPs (public preview) + - text: Connected Cache for ISPs (public preview) url: mcc-isp-signup.md - - text: Sign up - url: https://aka.ms/MCCForISPSurvey - - text: MCC for ISPs (early preview) + - text: Connected Cache for ISPs (early preview) url: mcc-isp.md diff --git a/windows/deployment/do/mcc-ent-create-resource-and-cache.md b/windows/deployment/do/mcc-ent-create-resource-and-cache.md new file mode 100644 index 0000000000..9340c11d38 --- /dev/null +++ b/windows/deployment/do/mcc-ent-create-resource-and-cache.md @@ -0,0 +1,349 @@ +--- +title: Create and configure Microsoft Connected Cache nodes +description: Details on how to create and configure Microsoft Connected Cache for Enterprise and Education cache nodes. +ms.service: windows-client +ms.subservice: itpro-updates +ms.topic: how-to +manager: naengler +ms.author: nidos +author: doshnid +appliesto: +- ✅ Windows 11 +- ✅ Supported Linux distributions +- ✅ Microsoft Connected Cache for Enterprise +ms.date: 10/30/2024 +--- + +# Create Microsoft Connected Cache Azure resource and cache nodes + +This article outlines how to create and configure your Microsoft Connected Cache for Enterprise and Education cache nodes. The creation and configuration of your cache node takes place in Azure. The deployment of your cache node requires downloading and running an OS-specific provisioning package on your host machine. + +## Prerequisites + +1. **Azure Pay-As-You-Go subscription**: Microsoft Connected Cache is a free-of-charge service hosted in Azure. You'll need a pay-as-you-go Azure subscription in order to onboard to our service. To create a subscription, go to [pay-as-you-go subscription page](https://azure.microsoft.com/offers/ms-azr-0003p/). +2. **Hardware to host Connected Cache**: The recommended configuration serves approximately 35,000 managed devices, downloading a 2-GB payload in 24-hour timeframe at a sustained rate of 6.5 Gbps. + +For more information on sizing and OS requirements, see [the prerequisites for using Connected Cache](mcc-ent-prerequisites.md). + + +## Create Connected Cache Azure resource + +# [Azure portal](#tab/portal) + +1. In the [Azure portal](https://portal.azure.com), select **Create a Resource** and search for `Microsoft Connected Cache for Enterprise and Education`. + + +1. Select the Microsoft Connected Cache for Enterprise resource. When prompted, choose the subscription, resource group, and location for the resource. Then enter a name for the resource, then select Review + Create. + +1. After a few moments, you'll see a "Validation successful" message, indicating you can move onto the next step and select Create. + +1. The creation of the resource might take a few minutes. After a successful creation, you'll see a page stating the deployment is complete. Select **Go to resource** to create cache nodes. + + +# [Azure CLI](#tab/cli) + +### Prerequisites + +* An Azure CLI environment: + + * Use the Bash environment in [Azure Cloud Shell](/azure/cloud-shell/get-started/classic). + + * Or, if you prefer to run CLI reference commands locally, [install the Azure CLI](/cli/azure/install-azure-cli) + + * Sign in to the Azure CLI by using the [az login](/cli/azure/reference-index#az-login) command. + + * Run [az version](/cli/azure/reference-index#az-version) to find the version and dependent libraries that are installed. To upgrade to the latest version, run [az upgrade](/cli/azure/reference-index#az-upgrade). + + * Install Azure CLI extension **mcc** by following the instructions [here](/cli/azure/azure-cli-extensions-overview#how-to-install-extensions). + + * Resource group under which a Connected Cache resource can be created. Use the [az group create](/cli/azure/group#az-group-create) command to create a new Resource group if you don't already have one. + +#### Create Connected Cache Azure resource + +Replace the following placeholders with your own information: +* *\*: Name of an existing resource group in your subscription. +* *\*: A name for your Microsoft Connected Cache for Enterprise resource. +* *\*: The Azure region where your Microsoft Connected Cache will be located. + +```azurecli-interactive +az mcc ent resource create --mcc-resource-name --resource-group --location +``` + +--- + +## Create Connected Cache cache node + +# [Azure portal](#tab/portal) + + 1. Open Azure portal and navigate to the Microsoft Connected Cache for Enterprise resource that you created.
+ 1. Under Cache Node Management, select **Cache Nodes** then **Create Cache Node**.
+ + 1. Provide a name for your cache node and select the host OS you plan to deploy the cache node on, then select **Create**. Note, cache node names have to be unique under the Microsoft Connected Cache resource. + + The creation of the cache node might take a few minutes. Select **Refresh** to see your recently created cache node. +Once the cache node state changes to **Not Configured**, you can now configure your cache node.
+For more information about different cache node states, see [Cache node states](#cache-node-states). + + +# [Azure CLI](#tab/cli) + +Use the following command to create a new cache node if you don't already have one. + +Replace the following placeholders with your own information: +* *\*: Name of existing resource group in your subscription. +* *\*: Name of the Microsoft Connected Cache for Enterprise resource. +* *\*: A name for your Microsoft Connected Cache node. +* *\*: The OS on which cache node will be provisioned. + Accepted values: `windows`, `linux` + +```azurecli-interactive +az mcc ent node create --cache-node-name --mcc-resource-name --resource-group --host-os +``` + +
+ +>[!NOTE] +>To ensure cache node has been created successfully, run the following command before continuing with cache node configuration. +>```azurecli-interactive +>az mcc ent node show --cache-node-name --mcc-resource-name --resource-group +>``` +>In the output look for **cacheNodeState**. If ***cacheNodeState = Not Configured***, you can continue with cache node configuration. +>If ***cacheNodeState = Registration in Progress***, then the cache node is still in process of being created. Wait a couple of minutes and run the command again. +>To know more about different cache node state, see [Cache node states](#cache-node-states). + +--- + +## Configure Connected Cache node + +# [Azure portal](#tab/portal) +Enter required values to configure your cache node. For more information about the definitions of each field, review the [Configuration fields](#general-configuration-fields) at the bottom of this article. +Don't forget to select save after adding configuration information. + + +# [Azure CLI](#tab/cli) + +### Configure Linux-hosted Connected Cache node +Use the following command to configure cache node for deployment to a **Linux** host machine. + +Replace the following placeholders with your own information: + +* *\*: Name of the resource group in your subscription. +* *\*: Name of your Microsoft Connected Cache for Enterprise resource. +* *\*: Name for your Microsoft Connected Cache node. +* *\*: The cache drive path. You can add up to nine cache drives. +* *\*: The size of cache drive. Must be at least 50 Gb. +* *\*: If proxy needs to be enabled or not.
+ Accepted values: `enabled`, `disabled`
+ Proxy should be set to enabled if the cache node will need to pass through a network proxy to download content. The provided proxy will also be used during deployment of the Connected Cache cache node to your host machine. +* *\*: The proxy host name or ip address. Required if proxy is set to enabled. +* *\*: Proxy port number. Required if proxy is set to enabled. +* *\*: Update ring the cache node should have.
+ Accepted values: `slow`, `fast`.
+ If update ring is set to slow, you must provide the day of week, time of day and week of month the cache node should be updated. +* *\*: The day of the week cache node should be updated. Week starts from Monday.
+ Accepted values: 1,2,3,4,5,6,7 +* *\*: The time of day cache node should be updated in 24 hour format (hh:mm) +* *\*: The week of month cache node should be updated.
+ Accepted values: 1,2,3,4 + +```azurecli-interactive +az mcc ent node update --cache-node-name --mcc-resource-name --resource-group +--cache-drive "[{physical-path:,size-in-gb:},{,size-in-gb:}...]"> --proxy --proxy-host <"proxy host name"> --proxy-port --auto-update-day --auto-update-time