diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 1fe80284d7..0c4909bd02 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -15038,6 +15038,11 @@ "redirect_document_id": true }, { +"source_path": "windows/deployment/windows-10-architecture-posters.md", +"redirect_url": "/windows/deployment/windows-10-deployment-scenarios", +"redirect_document_id": true +}, +{ "source_path": "windows/device-security/index.md", "redirect_url": "/windows/security/threat-protection", "redirect_document_id": true diff --git a/devices/surface-hub/surface-hub-2s-manage-intune.md b/devices/surface-hub/surface-hub-2s-manage-intune.md index 6c4f69a022..1853f3264d 100644 --- a/devices/surface-hub/surface-hub-2s-manage-intune.md +++ b/devices/surface-hub/surface-hub-2s-manage-intune.md @@ -35,11 +35,11 @@ Select Windows 10 Team for preset device restriction settings for Surface Hub an ![Set device restrictions for Surface Hub 2S.](images/sh2-set-intune3.png)
-These settings include user experience and app behavior, Azure Log Analytics registration, Maintenance windows configuration, Session settings, and Miracast settings. For a complete list of configuration service providers (CSPs) for the Windows 10 Team operating system, see [Surface Hub CSPs in Windows 10](https://docs.microsoft.com/windows/client-management/mdm/surfacehub-csp) +These settings include user experience and app behavior, Azure Log Analytics registration, Maintenance windows configuration, Session settings, and Miracast settings. For a complete list of available Windows 10 Team settings, see [SurfaceHub CSP](https://docs.microsoft.com/windows/client-management/mdm/surfacehub-csp). -## Additional supported configuration service providers +## Additional supported configuration service providers (CSPs) -For addtional supported CSPs, see [SurfaceHub CSP](https://docs.microsoft.com/en-us/windows/client-management/mdm/configuration-service-provider-reference#surfacehubcspsuppor). +For additional supported CSPs, see [Surface Hub CSPs in Windows 10](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference#surfacehubcspsupport). ## Quality of Service (QoS) settings diff --git a/education/docfx.json b/education/docfx.json index 5e87a91352..7a2761cf2e 100644 --- a/education/docfx.json +++ b/education/docfx.json @@ -14,7 +14,9 @@ "resource": [ { "files": [ - "**/images/**" + "**/*.png", + "**/*.jpg", + "**/*.svg" ], "exclude": [ "**/obj/**" diff --git a/education/images/data-streamer.png b/education/images/data-streamer.png new file mode 100644 index 0000000000..6473d9da33 Binary files /dev/null and b/education/images/data-streamer.png differ diff --git a/education/images/education-partner-aep-2.svg b/education/images/education-partner-aep-2.svg index 96ecbf019b..6bf0c2c3ac 100644 --- a/education/images/education-partner-aep-2.svg +++ b/education/images/education-partner-aep-2.svg @@ -1,4 +1,4 @@ - +
- +
@@ -163,7 +163,7 @@ ms.prod: w10
- +
@@ -182,7 +182,7 @@ ms.prod: w10
- +
@@ -194,6 +194,25 @@ ms.prod: w10
+
  • + +
    +
    +
    +
    +
    + +
    +
    +
    +

    Data Streamer

    +

    Bring new STEM experiences into the classroom with real-time data in Excel using Data Streamer. Data Streamer can send data to Excel from a sensor or application.

    +
    +
    +
    +
    +     +
    • diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 90adb44dd4..02bc107fd3 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -738,10 +738,10 @@ The following diagram shows the Policy configuration service provider in tree fo
    - Cryptography/AllowFipsAlgorithmPolicy + Cryptography/AllowFipsAlgorithmPolicy
    - Cryptography/TLSCipherSuites + Cryptography/TLSCipherSuites
    @@ -4395,7 +4395,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) - [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) - [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) -- [Cryptography/AllowFipsAlgorithmPolicy](./policy-csp-cryptography.md#cryptographyallowfipsalgorithmpolicy) +- [Cryptography/AllowFipsAlgorithmPolicy](./policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) - [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) - [Defender/AllowArchiveScanning](./policy-csp-defender.md#defender-allowarchivescanning) - [Defender/AllowBehaviorMonitoring](./policy-csp-defender.md#defender-allowbehaviormonitoring) @@ -5260,8 +5260,8 @@ The following diagram shows the Policy configuration service provider in tree fo - [Camera/AllowCamera](#camera-allowcamera) - [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) -- [Cryptography/AllowFipsAlgorithmPolicy](#cryptographyallowfipsalgorithmpolicy) -- [Cryptography/TLSCipherSuites](#cryptographytlsciphersuites) +- [Cryptography/AllowFipsAlgorithmPolicy](#cryptography-allowfipsalgorithmpolicy) +- [Cryptography/TLSCipherSuites](#cryptography-tlsciphersuites) - [Defender/AllowArchiveScanning](#defender-allowarchivescanning) - [Defender/AllowBehaviorMonitoring](#defender-allowbehaviormonitoring) - [Defender/AllowCloudProtection](#defender-allowcloudprotection) diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md index 1921989b07..4aaf66a50c 100644 --- a/windows/client-management/mdm/policy-csp-cryptography.md +++ b/windows/client-management/mdm/policy-csp-cryptography.md @@ -6,43 +6,56 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/14/2018 +ms.date: 06/19/2019 ms.reviewer: manager: dansimp --- # Policy CSP - Cryptography + +
    ## Cryptography policies +
    +
    + Cryptography/AllowFipsAlgorithmPolicy +
    +
    + Cryptography/TLSCipherSuites +
    +
    + -<<<<<<< HEAD -* [Cryptography/AllowFipsAlgorithmPolicy](#CryptographyAllowFipsAlgorithmPolicy) -* [Cryptography/TLSCipherSuites](#CryptographyTLSCipherSuites) -======= -* [Cryptography/AllowFipsAlgorithmPolicy](#cryptographyallowfipsalgorithmpolicy) -* [Cryptography/TLSCipherSuites](#cryptographytlsciphersuites) ->>>>>>> master -* [Cryptography/Microsoft Surface Hub](#cryptography-policies-supported-by-microsoft-surface-hub)
    - -<<<<<<< HEAD -## Cryptography/AllowFipsAlgorithmPolicy -======= -## Cryptography/AllowFipsAlgorithmPolicy ->>>>>>> master +**Cryptography/AllowFipsAlgorithmPolicy** - -|Home|Pro|Business |Enterprise |Education |Mobile |Mobile Enterprise | -| :---: | :---: | :---: | :---: | :---: | :---: | :---: | -|![][x] | ![][check] | ![][check] | ![][check] | ![][check] | ![][check] | ![][check]| - + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcheck markcheck mark
    @@ -58,36 +71,53 @@ manager: dansimp Allows or disallows the Federal Information Processing Standard (FIPS) policy. - -GP Info: + + +ADMX Info: - GP English name: *System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - + The following list shows the supported values: - 0 (default) – Not allowed. - 1– Allowed. - + + + + + +
    - -<<<<<<< HEAD -## Cryptography/TLSCipherSuites -======= -## Cryptography/TLSCipherSuites ->>>>>>> master +**Cryptography/TLSCipherSuites** -|Home|Pro|Business |Enterprise |Education |Mobile |Mobile Enterprise | -| :---: | :---: | :---: | :---: | :---: | :---: | :---: | -|![][x] | ![][check] | ![][check] | ![][check] | ![][check] | ![][check] | ![][check]| - + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcheck markcheck mark
    @@ -103,26 +133,36 @@ The following list shows the supported values: Lists the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win. + + + + + + + + + + + + + -
    -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. - - -## Cryptography policies supported by Microsoft Surface Hub +## Cryptography policies supported by Microsoft Surface Hub -- [Cryptography/AllowFipsAlgorithmPolicy](#CryptographyAllowFipsAlgorithmPolicy) -- [Cryptography/TLSCipherSuites](#CryptographyTLSCipherSuites) - +- [Cryptography/AllowFipsAlgorithmPolicy](#cryptography-allowfipsalgorithmpolicy) +- [Cryptography/TLSCipherSuites](#cryptography-tlsciphersuites) + +
    +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. -[check]: images/checkmark.png "Check" -[x]: images/crossmark.png "X" diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md index 57fb6fe644..dc75df4d5f 100644 --- a/windows/deployment/TOC.md +++ b/windows/deployment/TOC.md @@ -1,5 +1,4 @@ # [Deploy and update Windows 10](https://docs.microsoft.com/windows/deployment) -## [Architectural planning posters for Windows 10](windows-10-architecture-posters.md) ## [Deploy Windows 10 with Microsoft 365](deploy-m365.md) ## [What's new in Windows 10 deployment](deploy-whats-new.md) ## [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) diff --git a/windows/deployment/windows-10-architecture-posters.md b/windows/deployment/windows-10-architecture-posters.md deleted file mode 100644 index f0245f7e83..0000000000 --- a/windows/deployment/windows-10-architecture-posters.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Deploy Windows 10 - architectural posters -description: Provides architural planning posters for Windows 10 in the enterprise -ms.prod: w10 -ms.author: greg-lindsay -author: greg-lindsay -ms.date: 09/28/2017 -ms.reviewer: -manager: laurawi -ms.tgt_pltfrm: na -ms.topic: article -ms.localizationpriority: medium ---- -# Architectural planning posters for Windows 10 - -You can download the following posters for architectural information about deploying Windows 10 in the enterprise. - -- [Deploy Windows 10 - Clean installation](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/master/windows/media/ModernSecureDeployment/Deploy-CleanInstallation.pdf) - Learn about the options and steps for a new installation of Windows 10. -- [Deploy Windows 10 - In-place upgrade](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/master/windows/media/ModernSecureDeployment/Deploy-InplaceUpgrade.pdf) - Learn about the steps to upgrade from a previous version of Windows. -- [Deploy Windows 10 - Windows Autopilot](https://github.com/MicrosoftDocs/windows-itpro-docs/blob/master/windows/media/ModernSecureDeployment/Deploy-WindowsAutoPilot.pdf) - Learn how you can set up and pre-configure Windows 10 devices. -- [Deploy Windows 10 - Windows servicing](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/master/windows/media/ModernSecureDeployment/WindowsServicing.pdf) - Learn how to keep Windows up to date. -- [Deploy Windows 10 - Protection solutions](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/master/windows/media/ModernSecureDeployment/ProtectionSolutions.pdf) - Learn about the two tiers of protection available for Windows 10 devices. diff --git a/windows/release-information/resolved-issues-windows-server-2012.yml b/windows/release-information/resolved-issues-windows-server-2012.yml index 2735e58837..15736d25c5 100644 --- a/windows/release-information/resolved-issues-windows-server-2012.yml +++ b/windows/release-information/resolved-issues-windows-server-2012.yml @@ -32,6 +32,7 @@ sections: - type: markdown text: " + @@ -64,6 +65,7 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusDate resolved
    Some devices and generation 2 Hyper-V VMs may have issues installing updates
    Some devices and generation 2 Hyper-V virtual machines (VMs) may have issues installing some updates when Secure Boot is enabled.

    See details >    		June 11, 2019
    KB4503285    		Resolved
    KB4503295    		June 21, 2019
    02:00 PM PT
    IE11 may stop working when loading or interacting with Power BI reports
    Power BI reports that contain line charts with markers may cause Internet Explorer 11 to stop working.

    See details >    		May 14, 2019
    KB4499171    		Resolved
    KB4503295    		June 21, 2019
    02:00 PM PT
    Event Viewer may close or you may receive an error when using Custom Views
    When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

    See details >    		June 11, 2019
    KB4503285    		Resolved
    KB4503295    		June 20, 2019
    02:00 PM PT
    Issue using PXE to start a device from WDS
    There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension.

    See details >    		March 12, 2019
    KB4489891    		Resolved
    KB4503285    		June 11, 2019
    10:00 AM PT
    +
    DetailsOriginating updateStatusHistory
    Some devices and generation 2 Hyper-V VMs may have issues installing updates
    Some devices and generation 2 Hyper-V virtual machines (VMs) may have issues installing KB4503285 or later updates when Secure Boot is enabled.

    Affected platforms:
    • Server: Windows Server 2012
    Resolution: This issue was resolved in KB4503295. If your device is using Security Only updates, this issue was resolved in KB4508776.

    Back to top    		June 11, 2019
    KB4503285    		Resolved
    KB4503295    		Resolved:
    June 21, 2019
    02:00 PM PT

    Opened:
    June 19, 2019
    04:57 PM PT
    IE11 may stop working when loading or interacting with Power BI reports
    Internet Explorer 11 may stop working when loading or interacting with Power BI reports that have line charts with markers. This issue may also occur when viewing other content that contains Scalable Vector Graphics (SVG) markers.


    Affected platforms:
    • Client: Windows 7 SP1; Windows 8.1
    • Server: Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2

    Resolution: This issue was resolved in Preview Rollup KB4503295. If you are using the Internet Explorer cumulative updates, this issue was resolved in KB4508646.

    Back to top    		May 14, 2019
    KB4499171    		Resolved
    KB4503295    		Resolved:
    June 21, 2019
    02:00 PM PT

    Opened:
    June 07, 2019
    02:57 PM PT
    Event Viewer may close or you may receive an error when using Custom Views
    When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
    Resolution: This issue was resolved in KB4503295. If you are using Security Only updates, see KB4508640 for resolving KB for your platform.

    Back to top    		June 11, 2019
    KB4503285    		Resolved
    KB4503295    		Resolved:
    June 20, 2019
    02:00 PM PT

    Opened:
    June 12, 2019
    11:11 AM PT
    diff --git a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml index d03c300a4e..74ca531bab 100644 --- a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml +++ b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml @@ -61,8 +61,8 @@ sections: text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    + - @@ -98,7 +98,7 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusLast updated
    Difficulty connecting to some iSCSI-based SANs
    Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

    See details >    		OS Build 14393.2999

    May 23, 2019
    KB4499177    		Investigating
    		June 21, 2019
    10:08 AM PT
    Devices with Hyper-V enabled may see BitLocker error 0xC0210000
    Some devices with Hyper-V enabled may start into BitLocker recovery with error 0xC0210000

    See details >    		OS Build 14393.2969

    May 14, 2019
    KB4494440    		Mitigated
    		June 21, 2019
    05:23 PM PT
    Some applications may fail to run as expected on clients of AD FS 2016
    Some applications may fail to run as expected on clients of Active Directory Federation Services 2016 (AD FS 2016)

    See details >    		OS Build 14393.2941

    April 25, 2019
    KB4493473    		Mitigated
    		June 07, 2019
    04:25 PM PT
    Devices running Windows Server 2016 with Hyper-V seeing Bitlocker error 0xC0210000
    Some devices running Windows Server with Hyper-V enabled may start into Bitlocker recovery with error 0xC0210000

    See details >    		OS Build 14393.2969

    May 14, 2019
    KB4494440    		Mitigated
    		May 23, 2019
    09:57 AM PT
    Cluster service may fail if the minimum password length is set to greater than 14
    The cluster service may fail to start with the error “2245 (NERR_PasswordTooShort)” if the Group Policy “Minimum Password Length” is configured with greater than 14 characters.

    See details >    		OS Build 14393.2639

    November 27, 2018
    KB4467684    		Mitigated
    		April 25, 2019
    02:00 PM PT
    SCVMM cannot enumerate and manage logical switches deployed on the host
    For hosts managed by System Center Virtual Machine Manager (VMM), VMM cannot enumerate and manage logical switches deployed on the host.

    See details >    		OS Build 14393.2639

    November 27, 2018
    KB4467684    		Mitigated
    		April 25, 2019
    02:00 PM PT
    Certain operations performed on a Cluster Shared Volume may fail
    Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

    See details >    		OS Build 14393.2724

    January 08, 2019
    KB4480961    		Mitigated
    		April 25, 2019
    02:00 PM PT
    - +
    DetailsOriginating updateStatusHistory
    Devices running Windows Server 2016 with Hyper-V seeing Bitlocker error 0xC0210000
    Some devices running Windows Server 2016 with Hyper-V enabled may enter Bitlocker recovery mode and receive an error, \"0xC0210000\" after installing KB4494440 and restarting.

    Note Windows 10, version 1607 may also be affected when Bitlocker and Hyper-V are both enabled.

    Affected platforms:
    • Client: Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server 2016
    Workaround: If your device is already in this state, you can successfully start Windows after suspending Bitlocker from the Windows Recovery Environment (WinRE) using the following steps:
    1. Retrieve the 48 digit Bitlocker recovery password for the OS volume from your organization's portal or from wherever the key was stored when Bitlocker was first enabled.
    2. From the recovery screen, press the enter key and enter the recovery password when prompted.
    3. If your device starts in the Windows Recovery Environment and asks for recovery key again, select Skip the drive to continue to WinRE.
    4. select Advanced options then Troubleshoot then Advanced options then Command Prompt.
    5. Unlock OS drive using the command: Manage-bde -unlock c: -rp <48 digit numerical recovery password separated by “-“ in 6 digit group>
    6. Suspend Bitlocker using the command: Manage-bde -protectors -disable c:
    7. Exit the command window using the command: exit
    8. Select Continue from recovery environment.
    9. The device should now start Windows.
    10. Once started, launch an Administrator Command Prompt and resume the Bitlocker to ensure the system remains protected, using the command: Manage-bde -protectors -enable c:
    Note The workaround needs to be followed on every system restart unless Bitlocker is suspended before restarting.

    To prevent this issue, execute the following command to temporarily suspend Bitlocker just before restarting the system: Manage-bde -protectors -disable c: -rc 1
    Note This command will suspend Bitlocker for 1 restart of the device (-rc 1 option only works inside OS and does not work from recovery environment).

    Next steps: Microsoft is presently investigating this issue and will provide an update when available.

    Back to top    		OS Build 14393.2969

    May 14, 2019
    KB4494440    		Mitigated
    		Last updated:
    May 23, 2019
    09:57 AM PT

    Opened:
    May 21, 2019
    08:50 AM PT
    Devices with Hyper-V enabled may see BitLocker error 0xC0210000
    Some devices with Hyper-V enabled may enter BitLocker recovery mode and receive an error, \"0xC0210000\" after installing KB4494440 and restarting.

    Affected platforms:
    • Client: Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server 2016
    Workaround: If your device is already in this state, you can successfully start Windows after suspending BitLocker from the Windows Recovery Environment (WinRE) using the following steps:
    1. Retrieve the 48 digit BitLocker recovery password for the OS volume from your organization's portal or from wherever the key was stored when BitLocker was first enabled.
    2. From the recovery screen, press the enter key and enter the recovery password when prompted.
    3. If your device starts in the Windows Recovery Environment and asks for recovery key again, select Skip the drive to continue to WinRE.
    4. select Advanced options then Troubleshoot then Advanced options then Command Prompt.
    5. Unlock OS drive using the command: Manage-bde -unlock c: -rp <48 digit numerical recovery password separated by “-“ in 6 digit group>
    6. Suspend BitLocker using the command: Manage-bde -protectors -disable c:
    7. Exit the command window using the command: exit
    8. Select Continue from recovery environment.
    9. The device should now start Windows.
    10. Once started, launch an Administrator Command Prompt and resume the BitLocker to ensure the system remains protected, using the command: Manage-bde -protectors -enable c:
    Note The workaround needs to be followed on every system restart unless BitLocker is suspended before restarting.

    To prevent this issue, execute the following command to temporarily suspend BitLocker just before restarting the system: Manage-bde -protectors -disable c: -rc 1
    Note This command will suspend BitLocker for 1 restart of the device (-rc 1 option only works inside OS and does not work from recovery environment).

    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to top    		OS Build 14393.2969

    May 14, 2019
    KB4494440    		Mitigated
    		Last updated:
    June 21, 2019
    05:23 PM PT

    Opened:
    May 21, 2019
    08:50 AM PT
    Update not showing as applicable through WSUS or SCCM or when manually installed
    KB4494440 or later updates may not show as applicable through WSUS or SCCM to the affected platforms. When manually installing the standalone update from Microsoft Update Catalog, it may fail to install with the error, \"The update is not applicable to your computer.\"


    Affected platforms:
    • Client: Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server 2016

    Resolution: The servicing stack update (SSU) (KB4498947) must be installed before installing the latest cumulative update (LCU). The LCU will not be reported as applicable until the SSU is installed. For more information, see Servicing stack updates.

    Back to top    		OS Build 14393.2969

    May 14, 2019
    KB4494440    		Resolved
    KB4498947    		Resolved:
    May 14, 2019
    10:00 AM PT

    Opened:
    May 24, 2019
    04:20 PM PT
    " diff --git a/windows/release-information/status-windows-10-1703.yml b/windows/release-information/status-windows-10-1703.yml index d1eadde8fc..5b45e36e2d 100644 --- a/windows/release-information/status-windows-10-1703.yml +++ b/windows/release-information/status-windows-10-1703.yml @@ -61,6 +61,7 @@ sections: text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    + @@ -85,6 +86,15 @@ sections:
    SummaryOriginating updateStatusLast updated
    Difficulty connecting to some iSCSI-based SANs
    Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

    See details >    		OS Build 15063.1839

    May 28, 2019
    KB4499162    		Investigating
    		June 21, 2019
    10:08 AM PT
    Devices with Hyper-V enabled may see BitLocker error 0xC0210000
    Some devices with Hyper-V enabled may start into BitLocker recovery with error 0xC0210000

    See details >    		OS Build 15063.1805

    May 14, 2019
    KB4499181    		Mitigated
    		June 21, 2019
    05:23 PM PT
    Certain operations performed on a Cluster Shared Volume may fail
    Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

    See details >    		OS Build 15063.1563

    January 08, 2019
    KB4480973    		Mitigated
    		April 25, 2019
    02:00 PM PT
    Event Viewer may close or you may receive an error when using Custom Views
    When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

    See details >    		OS Build 15063.1868

    June 11, 2019
    KB4503279    		Resolved
    KB4503289    		June 18, 2019
    02:00 PM PT
    Opening Internet Explorer 11 may fail
    Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.

    See details >    		OS Build 15063.1839

    May 28, 2019
    KB4499162    		Resolved
    KB4503279    		June 11, 2019
    10:00 AM PT
    " +- title: May 2019 +- items: + - type: markdown + text: " + + +
    DetailsOriginating updateStatusHistory
    Devices with Hyper-V enabled may see BitLocker error 0xC0210000
    Some devices with Hyper-V enabled may enter BitLocker recovery mode and receive an error, \"0xC0210000\" after installing KB4499181 and restarting.

    Affected platforms:
    • Client: Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server 2016
    Workaround: If your device is already in this state, you can successfully start Windows after suspending BitLocker from the Windows Recovery Environment (WinRE) using the following steps:
    1. Retrieve the 48 digit BitLocker recovery password for the OS volume from your organization's portal or from wherever the key was stored when BitLocker was first enabled.
    2. From the recovery screen, press the enter key and enter the recovery password when prompted.
    3. If your device starts in the Windows Recovery Environment and asks for recovery key again, select Skip the drive to continue to WinRE.
    4. select Advanced options then Troubleshoot then Advanced options then Command Prompt.
    5. Unlock OS drive using the command: Manage-bde -unlock c: -rp <48 digit numerical recovery password separated by “-“ in 6 digit group>
    6. Suspend BitLocker using the command: Manage-bde -protectors -disable c:
    7. Exit the command window using the command: exit
    8. Select Continue from recovery environment.
    9. The device should now start Windows.
    10. Once started, launch an Administrator Command Prompt and resume the BitLocker to ensure the system remains protected, using the command: Manage-bde -protectors -enable c:
    Note The workaround needs to be followed on every system restart unless BitLocker is suspended before restarting.

    To prevent this issue, execute the following command to temporarily suspend BitLocker just before restarting the system: Manage-bde -protectors -disable c: -rc 1
    Note This command will suspend BitLocker for 1 restart of the device (-rc 1 option only works inside OS and does not work from recovery environment).

    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to top    		OS Build 15063.1805

    May 14, 2019
    KB4499181    		Mitigated
    		Last updated:
    June 21, 2019
    05:23 PM PT

    Opened:
    May 21, 2019
    08:50 AM PT
    + " + - title: January 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-server-2012.yml b/windows/release-information/status-windows-server-2012.yml index 45c7ef8b45..7588536963 100644 --- a/windows/release-information/status-windows-server-2012.yml +++ b/windows/release-information/status-windows-server-2012.yml @@ -60,9 +60,9 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    - + @@ -81,7 +81,7 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusLast updated
    Some devices and generation 2 Hyper-V VMs may have issues installing updates
    Some devices and generation 2 Hyper-V virtual machines (VMs) may have issues installing some updates when Secure Boot is enabled.

    See details >    		June 11, 2019
    KB4503285    		Mitigated
    		June 19, 2019
    04:57 PM PT
    Japanese IME doesn't show the new Japanese Era name as a text input option
    If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.

    See details >    		April 25, 2019
    KB4493462    		Mitigated
    		May 15, 2019
    05:53 PM PT
    Certain operations performed on a Cluster Shared Volume may fail
    Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.

    See details >    		January 08, 2019
    KB4480975    		Mitigated
    		April 25, 2019
    02:00 PM PT
    Some devices and generation 2 Hyper-V VMs may have issues installing updates
    Some devices and generation 2 Hyper-V virtual machines (VMs) may have issues installing some updates when Secure Boot is enabled.

    See details >    		June 11, 2019
    KB4503285    		Resolved
    KB4503295    		June 21, 2019
    02:00 PM PT
    IE11 may stop working when loading or interacting with Power BI reports
    Power BI reports that contain line charts with markers may cause Internet Explorer 11 to stop working.

    See details >    		May 14, 2019
    KB4499171    		Resolved
    KB4503295    		June 21, 2019
    02:00 PM PT
    Event Viewer may close or you may receive an error when using Custom Views
    When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

    See details >    		June 11, 2019
    KB4503285    		Resolved
    KB4503295    		June 20, 2019
    02:00 PM PT
    Issue using PXE to start a device from WDS
    There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension.

    See details >    		March 12, 2019
    KB4489891    		Resolved
    KB4503285    		June 11, 2019
    10:00 AM PT
    - +
    DetailsOriginating updateStatusHistory
    Some devices and generation 2 Hyper-V VMs may have issues installing updates
    Some devices and generation 2 Hyper-V virtual machines (VMs) may have issues installing KB4503285 or later updates when Secure Boot is enabled.

    Affected platforms:
    • Server: Windows Server 2012
    Workaround: Disabling Secure Boot should allow the update to install as expected. You can enable Secure Boot again after installation is complete.

    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to top    		June 11, 2019
    KB4503285    		Mitigated
    		Last updated:
    June 19, 2019
    04:57 PM PT

    Opened:
    June 19, 2019
    04:57 PM PT
    Some devices and generation 2 Hyper-V VMs may have issues installing updates
    Some devices and generation 2 Hyper-V virtual machines (VMs) may have issues installing KB4503285 or later updates when Secure Boot is enabled.

    Affected platforms:
    • Server: Windows Server 2012
    Resolution: This issue was resolved in KB4503295. If your device is using Security Only updates, this issue was resolved in KB4508776.

    Back to top    		June 11, 2019
    KB4503285    		Resolved
    KB4503295    		Resolved:
    June 21, 2019
    02:00 PM PT

    Opened:
    June 19, 2019
    04:57 PM PT
    IE11 may stop working when loading or interacting with Power BI reports
    Internet Explorer 11 may stop working when loading or interacting with Power BI reports that have line charts with markers. This issue may also occur when viewing other content that contains Scalable Vector Graphics (SVG) markers.


    Affected platforms:
    • Client: Windows 7 SP1; Windows 8.1
    • Server: Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2

    Resolution: This issue was resolved in Preview Rollup KB4503295. If you are using the Internet Explorer cumulative updates, this issue was resolved in KB4508646.

    Back to top    		May 14, 2019
    KB4499171    		Resolved
    KB4503295    		Resolved:
    June 21, 2019
    02:00 PM PT

    Opened:
    June 07, 2019
    02:57 PM PT
    Event Viewer may close or you may receive an error when using Custom Views
    When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
    Resolution: This issue was resolved in KB4503295. If you are using Security Only updates, see KB4508640 for resolving KB for your platform.

    Back to top    		June 11, 2019
    KB4503285    		Resolved
    KB4503295    		Resolved:
    June 20, 2019
    02:00 PM PT

    Opened:
    June 12, 2019
    11:11 AM PT
    diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index 4e0e71aa57..eaf63601ae 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -66,6 +66,9 @@ After a successful key registration, Windows creates a certificate request using The AD FS registration authority verifies the key used in the certificate request matches the key that was previously registered. On a successful match, the AD FS registration authority signs the certificate request using its enrollment agent certificate and sends it to the certificate authority. +> [!NOTE] +> In order for AD FS to verify the key used in the certificate request, it needs to be able to access the https://enterpriseregistration.windows.net endpoint. + The certificate authority validates the certificate was signed by the registration authority. On successful validation of the signature, it issues a certificate based on the request and returns the certificate to the AD FS registration authority. The registration authority returns the certificate to Windows where it then installs the certificate in the current user’s certificate store. Once this process completes, the Windows Hello for Business provisioning workflow informs the user that they can use their PIN to sign-in through the Windows Action Center.

    diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md index da3bf064e5..c4d3011a16 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md @@ -28,6 +28,9 @@ The Windows Server 2016 Active Directory Federation Server Certificate Registrat The Windows Hello for Business Authentication certificate template is configured to only issue certificates to certificate requests that have been signed with an enrollment agent certificate. +> [!NOTE] +> In order for AD FS to verify user certificate requests for Windows Hello for Business, it needs to be able to access the https://enterpriseregistration.windows.net endpoint. + ### Configure the Registration Authority Sign-in the AD FS server with *Domain Admin* equivalent credentials. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md index 6e3126b3c7..3a8ba5db87 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -55,7 +55,7 @@ Sign-in a certificate authority or management workstations with _Domain Admin_ e 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. 8. Close the console. -#### Configure Certificate Suspeding for the Domain Controller Authentication (Kerberos) Certificate Template +#### Configure Certificate Superseding for the Domain Controller Authentication (Kerberos) Certificate Template Many domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers--the domain controller certificate template. Later releases provided a new certificate template--the domain controller authentication certificate template. These certificate templates were provided prior to update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the **KDC Authentication** extension. @@ -77,6 +77,9 @@ Sign-in a certificate authority or management workstations with _Enterprise Admi The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. +>[!NOTE] +>The Domain Controller Certificate must be present in the NTAuth store. By default, Microsoft Enterprise CAs are added to the NTAuth store. If you are using a 3rd party CA, this may not be done by default. If the Domain Controller Certificate is not present in the NTAuth store, user authentication will fail. + ### Enrollment Agent certificate template Active Directory Federation Server used for Windows Hello for Business certificate enrollment performs its own certificate life-cycle management. Once the registration authority is configured with the proper certificate template, the AD FS server attempts to enroll the certificate on the first certificate request or when the service first starts. @@ -183,6 +186,7 @@ Sign-in to the certificate authority or management workstation with _Enterprise 4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. 5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. + ### Section Review > [!div class="checklist"] > * Domain Controller certificate template diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md index 0c6d6de655..bda944c54a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md @@ -77,6 +77,8 @@ Sign-in a certificate authority or management workstations with _Enterprise Admi The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. +>[!NOTE] +>The Domain Controller Certificate must be present in the NTAuth store. By default, Microsoft Enterprise CAs are added to the NTAuth store. If you are using a 3rd party CA, this may not be done by default. If the Domain Controller Certificate is not present in the NTAuth store, user authentication will fail. ### Publish Certificate Templates to a Certificate Authority diff --git a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md index 81599231f8..a194696c88 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md +++ b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md @@ -11,7 +11,6 @@ ms.pagetype: security ms.localizationpriority: medium author: dansimp ms.author: dansimp -ms.date: 09/03/2018 ms.reviewer: manager: dansimp --- @@ -22,7 +21,9 @@ manager: dansimp - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -When you use [Windows Analytics Update Compliance to obtain reporting into the protection status of machines or endpoints](/windows/deployment/update/update-compliance-using#wdav-assessment) in your network that are using Windows Defender Antivirus, you may encounter problems or issues. +You can use Windows Defender Antivirus with Update Compliance. You’ll see status for E3, B, F1, VL, and Pro licenses. However, for E5 licenses, you need to use the [Microsoft Defender ATP portal](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints). To learn more about licensing options, see [Windows 10 product licensing options](https://www.microsoft.com/licensing/product-licensing/windows10.aspx). + +When you use [Windows Analytics Update Compliance to obtain reporting into the protection status of devices or endpoints](/windows/deployment/update/update-compliance-using#wdav-assessment) in your network that are using Windows Defender Antivirus, you might encounter problems or issues. Typically, the most common indicators of a problem are: - You only see a small number or subset of all the devices you were expecting to see @@ -52,7 +53,9 @@ In order for devices to properly show up in Update Compliance, you have to meet > - If the endpoint is running Windows 10 version 1607 or earlier, [Windows 10 diagnostic data must be set to the Enhanced level](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#enhanced-level). > - It has been 3 days since all requirements have been met -If the above pre-requisites have all been met, you may need to proceed to the next step to collect diagnostic information and send it to us. +“You can use Windows Defender Antivirus with Update Compliance. You’ll see status for E3, B, F1, VL, and Pro licenses. However, for E5 licenses, you need to use the Microsoft Defender ATP portal (https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints). To learn more about licensing options, see Windows 10 product licensing options" + +If the above pre-requisites have all been met, you might need to proceed to the next step to collect diagnostic information and send it to us. > [!div class="nextstepaction"] > [Collect diagnostic data for Update Compliance troubleshooting](collect-diagnostic-data-update-compliance.md)