diff --git a/education/docfx.json b/education/docfx.json index 8662cf333f..9297b1ed0d 100644 --- a/education/docfx.json +++ b/education/docfx.json @@ -67,6 +67,15 @@ "v-stsavell" ] }, + "fileMetadata": { + "appliesto":{ + "windows/**/*.md": [ + "✅ Windows 11", + "✅ Windows 11 SE", + "✅ Windows 10" + ] + } + }, "externalReference": [], "template": "op.html", "dest": "education", diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md index c6fc526cd0..adc2f3d815 100644 --- a/education/windows/autopilot-reset.md +++ b/education/windows/autopilot-reset.md @@ -15,7 +15,7 @@ ms.collection: IT admins or technical teachers can use Autopilot Reset to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen anytime and apply original settings and management enrollment (Azure Active Directory and device management) so the devices are ready to use. With Autopilot Reset, devices are returned to a fully configured or known IT-approved state. -To enable Autopilot Reset in Windows 10, version 1709 (Fall Creators Update), you must: +To enable Autopilot Reset you must: 1. [Enable the policy for the feature](#enable-autopilot-reset) 2. [Trigger a reset for each device](#trigger-autopilot-reset) diff --git a/education/windows/change-home-to-edu.md b/education/windows/change-home-to-edu.md index f92de780a3..df5e41eb07 100644 --- a/education/windows/change-home-to-edu.md +++ b/education/windows/change-home-to-edu.md @@ -10,8 +10,6 @@ manager: jeffbu ms.collection: - tier3 - education -appliesto: - - ✅ Windows 10 and later --- # Upgrade Windows Home to Windows Education on student-owned devices diff --git a/education/windows/configure-aad-google-trust.md b/education/windows/configure-aad-google-trust.md index 2afa86f4c1..b6d4229e8f 100644 --- a/education/windows/configure-aad-google-trust.md +++ b/education/windows/configure-aad-google-trust.md @@ -3,6 +3,7 @@ title: Configure federation between Google Workspace and Azure AD description: Configuration of a federated trust between Google Workspace and Azure AD, with Google Workspace acting as an identity provider (IdP) for Azure AD. ms.date: 02/24/2023 ms.topic: how-to +appliesto: --- # Configure federation between Google Workspace and Azure AD diff --git a/education/windows/edu-take-a-test-kiosk-mode.md b/education/windows/edu-take-a-test-kiosk-mode.md index 5b6c073fcd..10c843fc0b 100644 --- a/education/windows/edu-take-a-test-kiosk-mode.md +++ b/education/windows/edu-take-a-test-kiosk-mode.md @@ -3,8 +3,6 @@ title: Configure Take a Test in kiosk mode description: Learn how to configure Windows to execute the Take a Test app in kiosk mode, using Intune and provisioning packages. ms.date: 09/30/2022 ms.topic: how-to -appliesto: - - ✅ Windows 10 and later --- # Configure Take a Test in kiosk mode diff --git a/education/windows/edu-themes.md b/education/windows/edu-themes.md index f76298ef68..bd941025f7 100644 --- a/education/windows/edu-themes.md +++ b/education/windows/edu-themes.md @@ -5,6 +5,7 @@ ms.date: 09/15/2022 ms.topic: how-to appliesto: - ✅ Windows 11 + - ✅ Windows 11 SE --- # Configure education themes for Windows 11 diff --git a/education/windows/federated-sign-in.md b/education/windows/federated-sign-in.md index 4799a4d3cc..28ba477eec 100644 --- a/education/windows/federated-sign-in.md +++ b/education/windows/federated-sign-in.md @@ -5,6 +5,7 @@ ms.date: 03/15/2023 ms.topic: how-to appliesto: - ✅ Windows 11 + - ✅ Windows 11 SE ms.collection: - highpri - tier1 diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index ca7f319eb1..3fb0972c89 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -3,8 +3,6 @@ title: Get and deploy Minecraft Education description: Learn how to obtain and distribute Minecraft Education to Windows devices. ms.topic: how-to ms.date: 02/23/2023 -appliesto: - - ✅ Windows 10 and later ms.collection: - highpri - education diff --git a/education/windows/includes/intune-custom-settings-1.md b/education/windows/includes/intune-custom-settings-1.md index 5be4cd1204..d911751e75 100644 --- a/education/windows/includes/intune-custom-settings-1.md +++ b/education/windows/includes/intune-custom-settings-1.md @@ -1,6 +1,4 @@ --- -author: paolomatarazzo -ms.author: paoloma ms.date: 02/22/2022 ms.topic: include --- diff --git a/education/windows/includes/intune-custom-settings-2.md b/education/windows/includes/intune-custom-settings-2.md index d623773324..1a601acaa7 100644 --- a/education/windows/includes/intune-custom-settings-2.md +++ b/education/windows/includes/intune-custom-settings-2.md @@ -1,6 +1,4 @@ --- -author: paolomatarazzo -ms.author: paoloma ms.date: 11/08/2022 ms.topic: include --- diff --git a/education/windows/includes/intune-custom-settings-info.md b/education/windows/includes/intune-custom-settings-info.md index a7376ee4ff..8ff9da4294 100644 --- a/education/windows/includes/intune-custom-settings-info.md +++ b/education/windows/includes/intune-custom-settings-info.md @@ -1,6 +1,4 @@ --- -author: paolomatarazzo -ms.author: paoloma ms.date: 11/08/2022 ms.topic: include --- diff --git a/education/windows/set-up-school-pcs-whats-new.md b/education/windows/set-up-school-pcs-whats-new.md index 2b46d073f5..97988171bf 100644 --- a/education/windows/set-up-school-pcs-whats-new.md +++ b/education/windows/set-up-school-pcs-whats-new.md @@ -3,8 +3,6 @@ title: What's new in the Windows Set up School PCs app description: Find out about app updates and new features in Set up School PCs. ms.topic: whats-new ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 and later --- # What's new in Set up School PCs diff --git a/education/windows/take-a-test-app-technical.md b/education/windows/take-a-test-app-technical.md index daab02821c..da1540090d 100644 --- a/education/windows/take-a-test-app-technical.md +++ b/education/windows/take-a-test-app-technical.md @@ -1,10 +1,8 @@ --- title: Take a Test app technical reference description: List of policies and settings applied by the Take a Test app. -ms.date: 09/30/2022 +ms.date: 03/31/2023 ms.topic: reference -appliesto: - - ✅ Windows 10 and later --- # Take a Test app technical reference diff --git a/education/windows/take-tests-in-windows.md b/education/windows/take-tests-in-windows.md index 1eea480188..2533467fca 100644 --- a/education/windows/take-tests-in-windows.md +++ b/education/windows/take-tests-in-windows.md @@ -1,10 +1,8 @@ --- title: Take tests and assessments in Windows description: Learn about the built-in Take a Test app for Windows and how to use it. -ms.date: 09/30/2022 +ms.date: 03/31/2023 ms.topic: conceptual -appliesto: - - ✅ Windows 10 and later --- # Take tests and assessments in Windows diff --git a/education/windows/tutorial-school-deployment/configure-device-apps.md b/education/windows/tutorial-school-deployment/configure-device-apps.md index 89eb913446..9b34e2d7cf 100644 --- a/education/windows/tutorial-school-deployment/configure-device-apps.md +++ b/education/windows/tutorial-school-deployment/configure-device-apps.md @@ -3,8 +3,6 @@ title: Configure applications with Microsoft Intune description: Learn how to configure applications with Microsoft Intune in preparation for device deployment. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Configure applications with Microsoft Intune diff --git a/education/windows/tutorial-school-deployment/configure-device-settings.md b/education/windows/tutorial-school-deployment/configure-device-settings.md index 5b63ea0b0b..f9d1d2046f 100644 --- a/education/windows/tutorial-school-deployment/configure-device-settings.md +++ b/education/windows/tutorial-school-deployment/configure-device-settings.md @@ -3,8 +3,6 @@ title: Configure and secure devices with Microsoft Intune description: Learn how to configure policies with Microsoft Intune in preparation for device deployment. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Configure and secure devices with Microsoft Intune diff --git a/education/windows/tutorial-school-deployment/configure-devices-overview.md b/education/windows/tutorial-school-deployment/configure-devices-overview.md index 60bc205647..075d9fe6d3 100644 --- a/education/windows/tutorial-school-deployment/configure-devices-overview.md +++ b/education/windows/tutorial-school-deployment/configure-devices-overview.md @@ -3,8 +3,6 @@ title: Configure devices with Microsoft Intune description: Learn how to configure policies and applications in preparation for device deployment. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Configure settings and applications with Microsoft Intune diff --git a/education/windows/tutorial-school-deployment/enroll-aadj.md b/education/windows/tutorial-school-deployment/enroll-aadj.md index ddcb5d2bb8..1dc7d9beeb 100644 --- a/education/windows/tutorial-school-deployment/enroll-aadj.md +++ b/education/windows/tutorial-school-deployment/enroll-aadj.md @@ -3,8 +3,6 @@ title: Enrollment in Intune with standard out-of-box experience (OOBE) description: Learn how to join devices to Azure AD from OOBE and automatically get them enrolled in Intune. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Automatic Intune enrollment via Azure AD join diff --git a/education/windows/tutorial-school-deployment/enroll-autopilot.md b/education/windows/tutorial-school-deployment/enroll-autopilot.md index 32ff8c37ed..88cec25ed6 100644 --- a/education/windows/tutorial-school-deployment/enroll-autopilot.md +++ b/education/windows/tutorial-school-deployment/enroll-autopilot.md @@ -3,8 +3,6 @@ title: Enrollment in Intune with Windows Autopilot description: Learn how to join Azure AD and enroll in Intune using Windows Autopilot. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Windows Autopilot diff --git a/education/windows/tutorial-school-deployment/enroll-overview.md b/education/windows/tutorial-school-deployment/enroll-overview.md index d816ed1b94..6537b7ea3a 100644 --- a/education/windows/tutorial-school-deployment/enroll-overview.md +++ b/education/windows/tutorial-school-deployment/enroll-overview.md @@ -3,8 +3,6 @@ title: Device enrollment overview description: Learn about the different options to enroll Windows devices in Microsoft Intune ms.date: 08/31/2022 ms.topic: overview -appliesto: - - ✅ Windows 10 and later --- # Device enrollment overview diff --git a/education/windows/tutorial-school-deployment/enroll-package.md b/education/windows/tutorial-school-deployment/enroll-package.md index 9f96234636..e73ef21957 100644 --- a/education/windows/tutorial-school-deployment/enroll-package.md +++ b/education/windows/tutorial-school-deployment/enroll-package.md @@ -3,8 +3,6 @@ title: Enrollment of Windows devices with provisioning packages description: Learn about how to enroll Windows devices with provisioning packages using SUSPCs and Windows Configuration Designer. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Enrollment with provisioning packages diff --git a/education/windows/tutorial-school-deployment/index.md b/education/windows/tutorial-school-deployment/index.md index a23afe72b0..b91d83d780 100644 --- a/education/windows/tutorial-school-deployment/index.md +++ b/education/windows/tutorial-school-deployment/index.md @@ -3,8 +3,6 @@ title: Introduction to the tutorial deploy and manage Windows devices in a schoo description: Introduction to deployment and management of Windows devices in education environments. ms.date: 08/31/2022 ms.topic: conceptual -appliesto: - - ✅ Windows 10 and later --- # Tutorial: deploy and manage Windows devices in a school diff --git a/education/windows/tutorial-school-deployment/manage-overview.md b/education/windows/tutorial-school-deployment/manage-overview.md index 00559d4384..ff0997fad9 100644 --- a/education/windows/tutorial-school-deployment/manage-overview.md +++ b/education/windows/tutorial-school-deployment/manage-overview.md @@ -3,8 +3,6 @@ title: Manage devices with Microsoft Intune description: Overview of device management capabilities in Intune for Education, including remote actions, remote assistance and inventory/reporting. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Manage devices with Microsoft Intune diff --git a/education/windows/tutorial-school-deployment/reset-wipe.md b/education/windows/tutorial-school-deployment/reset-wipe.md index b9a1f80094..488d2513f1 100644 --- a/education/windows/tutorial-school-deployment/reset-wipe.md +++ b/education/windows/tutorial-school-deployment/reset-wipe.md @@ -3,8 +3,6 @@ title: Reset and wipe Windows devices description: Learn about the reset and wipe options for Windows devices using Intune for Education, including scenarios when to delete devices. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Device reset options diff --git a/education/windows/tutorial-school-deployment/set-up-azure-ad.md b/education/windows/tutorial-school-deployment/set-up-azure-ad.md index 899b8298dd..6aaea36211 100644 --- a/education/windows/tutorial-school-deployment/set-up-azure-ad.md +++ b/education/windows/tutorial-school-deployment/set-up-azure-ad.md @@ -3,6 +3,7 @@ title: Set up Azure Active Directory description: Learn how to create and prepare your Azure AD tenant for an education environment. ms.date: 08/31/2022 ms.topic: tutorial +appliesto: --- # Set up Azure Active Directory diff --git a/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md b/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md index 8d1b84254e..f55a5262c3 100644 --- a/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md +++ b/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md @@ -3,6 +3,7 @@ title: Set up device management description: Learn how to configure the Intune service and set up the environment for education. ms.date: 08/31/2022 ms.topic: tutorial +appliesto: --- # Set up Microsoft Intune diff --git a/education/windows/tutorial-school-deployment/troubleshoot-overview.md b/education/windows/tutorial-school-deployment/troubleshoot-overview.md index a58a7f2d9a..5e27915802 100644 --- a/education/windows/tutorial-school-deployment/troubleshoot-overview.md +++ b/education/windows/tutorial-school-deployment/troubleshoot-overview.md @@ -3,8 +3,6 @@ title: Troubleshoot Windows devices description: Learn how to troubleshoot Windows devices from Intune and contact Microsoft Support for issues related to Intune and other services. ms.date: 08/31/2022 ms.topic: tutorial -appliesto: - - ✅ Windows 10 and later --- # Troubleshoot Windows devices diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 7591454011..5d4dda26a8 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -76,11 +76,46 @@ "identity-protection/**/*.md": "paoloma", "threat-protection/windows-firewall/*.md": "aaroncz" }, + "appliesto":{ + "identity-protection/**/*.md": [ + "✅ Windows 11", + "✅ Windows 10" + ], + "identity-protection/credential-guard/**/*.md": [ + "✅ Windows 11", + "✅ Windows 10", + "✅ Windows Server 2022", + "✅ Windows Server 2019", + "✅ Windows Server 2016" + ], + "identity-protection/smart-cards/**/*.md": [ + "✅ Windows 11", + "✅ Windows 10", + "✅ Windows Server 2022", + "✅ Windows Server 2019", + "✅ Windows Server 2016" + ], + "identity-protection/user-account-control/**/*.md": [ + "✅ Windows 11", + "✅ Windows 10", + "✅ Windows Server 2022", + "✅ Windows Server 2019", + "✅ Windows Server 2016" + ], + "identity-protection/virtual-smart-cards/**/*.md": [ + "✅ Windows 11", + "✅ Windows 10", + "✅ Windows Server 2022", + "✅ Windows Server 2019", + "✅ Windows Server 2016" + ] + }, "ms.reviewer":{ "identity-protection/hello-for-business/*.md": "erikdau", "identity-protection/credential-guard/*.md": "zwhittington", "identity-protection/access-control/*.md": "sulahiri", - "threat-protection/windows-firewall/*.md": "paoloma" + "threat-protection/windows-firewall/*.md": "paoloma", + "identity-protection/vpn/*.md": "pesmith" }, "ms.collection":{ "identity-protection/hello-for-business/*.md": "tier1", diff --git a/windows/security/identity-protection/access-control/access-control.md b/windows/security/identity-protection/access-control/access-control.md index 4ddce5cb4e..6bec9ee14c 100644 --- a/windows/security/identity-protection/access-control/access-control.md +++ b/windows/security/identity-protection/access-control/access-control.md @@ -1,13 +1,14 @@ --- +ms.date: 11/22/2022 title: Access Control Overview description: Description of the access controls in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer. -ms.prod: windows-client ms.topic: article -ms.date: 11/22/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later -ms.technology: itpro-security +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 --- # Access Control Overview diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index f6baab162b..a2c64c37a0 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -1,15 +1,17 @@ --- +ms.date: 12/05/2022 title: Local Accounts description: Learn how to secure and manage access to the resources on a standalone or member server for services or users. -ms.date: 12/05/2022 +ms.topic: conceptual ms.collection: - highpri - tier2 -ms.topic: article appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later -ms.technology: itpro-security +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 --- # Local Accounts @@ -60,7 +62,7 @@ Group Policy can be used to control the use of the local Administrators group au > [!IMPORTANT] > -> - Blank passwords are not allowed in the versions designated in the **Applies To** list at the beginning of this topic. +> - Blank passwords are not allowed. > > - Even when the Administrator account has been disabled, it can still be used to gain access to a computer by using safe mode. In the Recovery Console or in safe mode, the Administrator account is automatically enabled. When normal operations are resumed, it is disabled. diff --git a/windows/security/identity-protection/configure-s-mime.md b/windows/security/identity-protection/configure-s-mime.md index e7d4d83f53..317ef89a50 100644 --- a/windows/security/identity-protection/configure-s-mime.md +++ b/windows/security/identity-protection/configure-s-mime.md @@ -1,26 +1,13 @@ --- title: Configure S/MIME for Windows description: S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients with a digital ID, also known as a certificate, can read them. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 07/27/2017 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security --- # Configure S/MIME for Windows -**Applies to** -- Windows 10 -- Windows 11 - S/MIME stands for Secure/Multipurpose Internet Mail Extensions, and provides an added layer of security for email sent to and from an Exchange ActiveSync (EAS) account. S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. ## About message encryption @@ -31,11 +18,11 @@ Encrypted messages can be read only by recipients who have a certificate. If you ## About digital signatures -A digitally signed message reassures the recipient that the message hasn't been tampered with and verifies the identity of the sender. Recipients can only verify the digital signature if they’re using an email client that supports S/MIME. +A digitally signed message reassures the recipient that the message hasn't been tampered with and verifies the identity of the sender. Recipients can only verify the digital signature if they're using an email client that supports S/MIME. ## Prerequisites -- [S/MIME is enabled for Exchange accounts](/microsoft-365/security/office-365-security/s-mime-for-message-signing-and-encryption) (on-premises and Office 365). Users can’t use S/MIME signing and encryption with a personal account such as Outlook.com. +- [S/MIME is enabled for Exchange accounts](/microsoft-365/security/office-365-security/s-mime-for-message-signing-and-encryption) (on-premises and Office 365). Users can't use S/MIME signing and encryption with a personal account such as Outlook.com. - Valid Personal Information Exchange (PFX) certificates are installed on the device. - [How to Create PFX Certificate Profiles in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/mt131410(v=technet.10)) @@ -49,11 +36,11 @@ On the device, perform the following steps: (add select certificate) 2. Open **Settings** by tapping the gear icon on a PC, or the ellipsis (...) and then the gear icon on a phone. - :::image type="content" alt-text="settings icon in mail app." source="images/mailsettings.png"::: + :::image type="content" alt-text="settings icon in mail app." source="images/mailsettings.png"::: 3. Tap **Email security**. - :::image type="content" alt-text="email security settings." source="images/emailsecurity.png"::: + :::image type="content" alt-text="email security settings." source="images/emailsecurity.png"::: 4. In **Select an account**, select the account for which you want to configure S/MIME options. @@ -74,7 +61,7 @@ On the device, perform the following steps: (add select certificate) 2. Use **Sign** and **Encrypt** icons to turn on digital signature and encryption for this message. - :::image type="content" alt-text="sign or encrypt message." source="images/signencrypt.png"::: + :::image type="content" alt-text="sign or encrypt message." source="images/signencrypt.png"::: ## Read signed or encrypted messages @@ -90,5 +77,5 @@ When you receive a signed email, the app provides a feature to install correspon 3. Tap **Install.** - :::image type="content" alt-text="message security information." source="images/installcert.png"::: + :::image type="content" alt-text="message security information." source="images/installcert.png":::   diff --git a/windows/security/identity-protection/credential-guard/additional-mitigations.md b/windows/security/identity-protection/credential-guard/additional-mitigations.md index c8ed1adc92..ca9c7acd52 100644 --- a/windows/security/identity-protection/credential-guard/additional-mitigations.md +++ b/windows/security/identity-protection/credential-guard/additional-mitigations.md @@ -1,11 +1,8 @@ --- +ms.date: 08/17/2017 title: Additional mitigations description: Advice and sample code for making your domain environment more secure and robust with Windows Defender Credential Guard. -ms.date: 08/17/2017 ms.topic: article -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Additional mitigations diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md index bde6066c0c..d48686101c 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md @@ -1,11 +1,8 @@ --- +ms.date: 01/06/2023 title: Considerations when using Windows Defender Credential Guard description: Considerations and recommendations for certain scenarios when using Windows Defender Credential Guard. -ms.date: 01/06/2023 ms.topic: article -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Considerations when using Windows Defender Credential Guard diff --git a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md index c9ed9e42c7..f6fafc39c0 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md @@ -1,11 +1,8 @@ --- +ms.date: 08/17/2017 title: How Windows Defender Credential Guard works description: Learn how Windows Defender Credential Guard uses virtualization to protect secrets, so that only privileged system software can access them. -ms.date: 08/17/2017 ms.topic: conceptual -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # How Windows Defender Credential Guard works diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index 07d9647887..f05c26620f 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -1,11 +1,8 @@ --- +ms.date: 11/28/2022 title: Windows Defender Credential Guard - Known issues description: Windows Defender Credential Guard - Known issues in Windows Enterprise ms.topic: article -ms.date: 11/28/2022 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Windows Defender Credential Guard: Known issues diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index a4f523f78b..eb38ab1250 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -6,9 +6,6 @@ ms.collection: - highpri - tier2 ms.topic: article -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Manage Windows Defender Credential Guard diff --git a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md index 42fbe2a663..6b9dbeadc9 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md @@ -3,9 +3,6 @@ title: Windows Defender Credential Guard protection limits (Windows) description: Some ways to store credentials are not protected by Windows Defender Credential Guard in Windows. Learn more with this guide. ms.date: 08/17/2017 ms.topic: article -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Windows Defender Credential Guard protection limits diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index 164f0f776e..ea7bf02bae 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -3,9 +3,6 @@ title: Windows Defender Credential Guard requirements description: Windows Defender Credential Guard baseline hardware, firmware, and software requirements, and additional protections for improved security. ms.date: 12/27/2021 ms.topic: article -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Windows Defender Credential Guard requirements diff --git a/windows/security/identity-protection/credential-guard/credential-guard.md b/windows/security/identity-protection/credential-guard/credential-guard.md index 0ab05c22ab..af00a1aef1 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard.md +++ b/windows/security/identity-protection/credential-guard/credential-guard.md @@ -6,9 +6,6 @@ ms.topic: article ms.collection: - highpri - tier2 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Protect derived domain credentials with Windows Defender Credential Guard diff --git a/windows/security/identity-protection/enterprise-certificate-pinning.md b/windows/security/identity-protection/enterprise-certificate-pinning.md index 6b2de2aa60..d4f8cceb8d 100644 --- a/windows/security/identity-protection/enterprise-certificate-pinning.md +++ b/windows/security/identity-protection/enterprise-certificate-pinning.md @@ -1,17 +1,8 @@ --- title: Enterprise Certificate Pinning description: Enterprise certificate pinning is a Windows feature for remembering; or pinning a root issuing certificate authority, or end entity certificate to a given domain name. -author: paolomatarazzo -ms.author: paoloma -manager: aaroncz -ms.topic: article -ms.prod: windows-client -ms.technology: itpro-security -ms.localizationpriority: medium +ms.topic: conceptual ms.date: 07/27/2017 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 --- # Enterprise Certificate Pinning @@ -22,7 +13,7 @@ Enterprise certificate pinning helps reduce man-in-the-middle attacks by enablin > [!NOTE] > External domain names, where the certificate issued to these domains is issued by a public certificate authority, are not ideal for enterprise certificate pinning. -Windows Certificate APIs (CertVerifyCertificateChainPolicy and WinVerifyTrust) are updated to check if the site’s chain that authenticates servers matches a restricted set of certificates. +Windows Certificate APIs (CertVerifyCertificateChainPolicy and WinVerifyTrust) are updated to check if the site's chain that authenticates servers matches a restricted set of certificates. These restrictions are encapsulated in a Pin Rules Certificate Trust List (CTL) that is configured and deployed to Windows 10 computers. Any site certificate that triggers a name mismatch causes Windows to write an event to the CAPI2 event log and prevents the user from navigating to the web site using Microsoft Edge or Internet Explorer. @@ -97,7 +88,7 @@ The **Certificate** element can have the following attributes. | **File** | Path to a file containing one or more certificates. Where the certificate(s) can be encoded as:
- single certificate
- p7b
- sst
These files can also be Base64 formatted. All **Site** elements included in the same **PinRule** element can match any of these certificates. | Yes (File, Directory, or Base64 must be present). | | **Directory** | Path to a directory containing one or more of the above certificate files. Skips any files not containing any certificates. | Yes (File, Directory, or Base64 must be present). | | **Base64** | Base64 encoded certificate(s). Where the certificate(s) can be encoded as:
- single certificate
- p7b
- sst
This allows the certificates to be included in the XML file without a file directory dependency.
Note:
You can use **certutil -encode** to convert a .cer file into base64. You can then use Notepad to copy and paste the base64 encoded certificate into the pin rule. | Yes (File, Directory, or Base64 must be present). | -| **EndDate** | Enables you to configure an expiration date for when the certificate is no longer valid in the pin rule.
If you are in the process of switching to a new root or CA, you can set the **EndDate** to allow matching of this element’s certificates.
If the current time is past the **EndDate**, then, when creating the certificate trust list (CTL), the parser outputs a warning message and excludes the certificate(s) from the Pin Rule in the generated CTL.
For help with formatting Pin Rules, see [Representing a Date in XML](#representing-a-date-in-xml).| No.| +| **EndDate** | Enables you to configure an expiration date for when the certificate is no longer valid in the pin rule.
If you are in the process of switching to a new root or CA, you can set the **EndDate** to allow matching of this element's certificates.
If the current time is past the **EndDate**, then, when creating the certificate trust list (CTL), the parser outputs a warning message and excludes the certificate(s) from the Pin Rule in the generated CTL.
For help with formatting Pin Rules, see [Representing a Date in XML](#representing-a-date-in-xml).| No.| #### Site element @@ -154,7 +145,7 @@ Use **certutil.exe** to apply your certificate pinning rules to your reference c The **setreg** argument takes a secondary argument that determines the location of where certutil writes the certificate pining rules. This secondary argument is **chain\PinRules**. The last argument you provide is the name of file that contains your certificate pinning rules in certificate trust list format (.stl). -You’ll pass the name of the file as the last argument; however, you need to prefix the file name with the '@' symbol as shown in the following example. +You'll pass the name of the file as the last argument; however, you need to prefix the file name with the '@' symbol as shown in the following example. You need to perform this command from an elevated command prompt. ```code @@ -174,7 +165,7 @@ Certutil writes the binary information to the following registration location: ### Deploying Enterprise Pin Rule Settings using Group Policy -You’ve successfully created a certificate pinning rules XML file. +You've successfully created a certificate pinning rules XML file. From the XML file you've created a certificate pinning trust list file, and you've applied the contents of that file to your reference computer from which you can run the Group Policy Management Console. Now you need to configure a Group Policy object to include the applied certificate pin rule settings and deploy it to your environment. @@ -182,7 +173,7 @@ Sign-in to the reference computer using domain administrator equivalent credenti 1. Start the **Group Policy Management Console** (gpmc.msc) 2. In the navigation pane, expand the forest node and then expand the domain node. -3. Expand the node that contains your Active Directory’s domain name +3. Expand the node that contains your Active Directory's domain name 4. Select the **Group Policy objects** node. Right-click the **Group Policy objects** node and click **New**. 5. In the **New GPO** dialog box, type _Enterprise Certificate Pinning Rules_ in the **Name** text box and click **OK**. 6. In the content pane, right-click the **Enterprise Certificate Pinning Rules** Group Policy object and click **Edit**. @@ -227,16 +218,16 @@ icacls %PinRulesLogDir% /grant *S-1-5-12:(OI)(CI)(F) icacls %PinRulesLogDir% /inheritance:e /setintegritylevel (OI)(CI)L ``` -Whenever an application verifies a TLS/SSL certificate chain that contains a server name matching a DNS name in the server certificate, Windows writes a .p7b file consisting of all the certificates in the server’s chain to one of three child folders: +Whenever an application verifies a TLS/SSL certificate chain that contains a server name matching a DNS name in the server certificate, Windows writes a .p7b file consisting of all the certificates in the server's chain to one of three child folders: - AdminPinRules Matched a site in the enterprise certificate pinning rules. - AutoUpdatePinRules Matched a site in the certificate pinning rules managed by Microsoft. - NoPinRules - Didn’t match any site in the certificate pin rules. + Didn't match any site in the certificate pin rules. -The output file name consists of the leading eight ASCII hex digits of the root’s SHA1 thumbprint followed by the server name. +The output file name consists of the leading eight ASCII hex digits of the root's SHA1 thumbprint followed by the server name. For example: - `D4DE20D0_xsi.outlook.com.p7b` @@ -255,7 +246,7 @@ You can then copy and paste the output of the cmdlet into the XML file. ![Representing a date.](images/enterprise-certificate-pinning-representing-a-date.png) For simplicity, you can truncate decimal point (.) and the numbers after it. -However, be certain to append the uppercase “Z” to the end of the XML date string. +However, be certain to append the uppercase "Z" to the end of the XML date string. ```code 2015-05-11T07:00:00.2655691Z @@ -264,7 +255,7 @@ However, be certain to append the uppercase “Z” to the end of the XML date s ## Converting an XML Date -You can also use Windows PowerShell to validate and convert an XML date into a human readable date to validate it’s the correct date. +You can also use Windows PowerShell to validate and convert an XML date into a human readable date to validate it's the correct date. ![Converting an XML date.](images/enterprise-certificate-pinning-converting-an-xml-date.png) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index 1ca04993a0..c4e5d43423 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -1,9 +1,7 @@ --- title: Multi-factor unlock description: Learn how Windows offers multi-factor device unlock by extending Windows Hello with trusted signals. -ms.date: 03/09/2023 -appliesto: -- ✅ Windows 10 and later +ms.date: 03/30/2023 ms.topic: how-to --- # Multi-factor unlock diff --git a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md index fa405ca079..8838fb1b97 100644 --- a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md +++ b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md @@ -2,8 +2,6 @@ title: Windows Hello for Business cloud-only deployment description: Learn how to configure Windows Hello for Business in a cloud-only deployment scenario. ms.date: 06/23/2021 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Cloud-only deployment diff --git a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md index 6607d17abb..f825873fc9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md +++ b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md @@ -3,8 +3,11 @@ title: Plan an adequate number of Domain Controllers for Windows Hello for Busin description: Learn how to plan for an adequate number of Domain Controllers to support Windows Hello for Business deployments. ms.date: 03/10/2023 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: conceptual --- # Plan an adequate number of Domain Controllers for Windows Hello for Business deployments diff --git a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md index 5d311af3bb..2b3a033a16 100644 --- a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md +++ b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md @@ -2,8 +2,6 @@ title: Windows Hello and password changes description: Learn the impact of changing a password when using Windows Hello. ms.date: 03/15/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: conceptual --- # Windows Hello and password changes diff --git a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md index e6a01bb2b8..f1a275279e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md +++ b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md @@ -2,8 +2,6 @@ title: Windows Hello biometrics in the enterprise (Windows) description: Windows Hello uses biometrics to authenticate users and guard against potential spoofing, through fingerprint matching and facial recognition. ms.date: 01/12/2021 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index c765eb789e..744816323d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -3,8 +3,11 @@ title: Prepare and deploy Active Directory Federation Services in an on-premises description: Learn how to configure Active Directory Federation Services to support the Windows Hello for Business on-premises certificate trust model. ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Prepare and deploy Active Directory Federation Services - on-premises certificate trust diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md index 5d92d9dcb7..b3059ee0c0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md @@ -2,12 +2,9 @@ title: Configure Windows Hello for Business Policy settings in an on-premises certificate trust description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises certificate trust scenario ms.collection: - - highpri - - tier1 +- highpri +- tier1 ms.date: 12/12/2022 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later ms.topic: tutorial --- # Configure Windows Hello for Business group policy settings - on-premises certificate Trust diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md index 629e59b1e2..455d4055a2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md @@ -3,8 +3,11 @@ title: Validate Active Directory prerequisites in an on-premises certificate tru description: Validate Active Directory prerequisites when deploying Windows Hello for Business in a certificate trust model. ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Validate Active Directory prerequisites - on-premises certificate trust diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md index c7c5b09a61..c7b67abec3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md @@ -3,8 +3,11 @@ title: Validate and Deploy MFA for Windows Hello for Business with certificate t description: Validate and deploy multi-factor authentication (MFA) for Windows Hello for Business in an on-premises certificate trust model. ms.date: 12/13/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md index 27f2375bae..6174ed348a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md @@ -3,8 +3,11 @@ title: Configure and validate the Public Key Infrastructure in an on-premises ce description: Configure and validate the Public Key Infrastructure the Public Key Infrastructure when deploying Windows Hello for Business in a certificate trust model. ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Configure and validate the Public Key Infrastructure - on-premises certificate trust diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md index 0775ea4e9d..70a5ee4feb 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md @@ -3,8 +3,11 @@ title: Windows Hello for Business deployment guide for the on-premises certifica description: Learn how to deploy Windows Hello for Business in an on-premises, certificate trust model. ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Deployment guide overview - on-premises certificate trust diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md index 22f170e86e..9646f16b66 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md @@ -2,8 +2,6 @@ title: Windows Hello for Business Deployment Overview description: Use this deployment guide to successfully deploy Windows Hello for Business in an existing environment. ms.date: 02/15/2022 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Windows Hello for Business Deployment Overview diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md index 8c8fd3b65d..655c8961da 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md @@ -2,8 +2,6 @@ title: Windows Hello for Business Deployment Known Issues description: A Troubleshooting Guide for Known Windows Hello for Business Deployment Issues ms.date: 05/03/2021 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Windows Hello for Business Known Deployment Issues diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md index 6104c34401..56d613052d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md @@ -2,9 +2,6 @@ title: Windows Hello for Business deployment guide for the on-premises key trust model description: Learn how to deploy Windows Hello for Business in an on-premises, key trust model. ms.date: 12/12/2022 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later ms.topic: tutorial --- # Deployment guide overview - on-premises key trust diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index 7d4f20063d..0b255e1d93 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -6,8 +6,6 @@ ms.collection: - tier1 ms.topic: article ms.date: 03/15/2023 -appliesto: -- ✅ Windows 10 and later --- # Deploy certificates for remote desktop (RDP) sign-in diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index e1b28aec6f..23537daa14 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -1,10 +1,8 @@ --- -title: Windows Hello errors during PIN creation (Windows) -description: When you set up Windows Hello in Windows 10/11, you may get an error during the Create a work PIN step. +title: Windows Hello errors during PIN creation +description: When you set up Windows Hello, you may get an error during the Create a work PIN step. ms.topic: troubleshooting -ms.date: 05/05/2018 -appliesto: -- ✅ Windows 10 and later +ms.date: 03/31/2023 --- # Windows Hello errors during PIN creation diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index bb59a07821..0a5083fd99 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -9,8 +9,6 @@ metadata: - tier1 ms.topic: faq ms.date: 03/09/2023 - appliesto: - - ✅ Windows 10 and later title: Common questions about Windows Hello for Business summary: Windows Hello for Business replaces password sign-in with strong authentication, using an asymmetric key pair. This Frequently Asked Questions (FAQ) article is intended to help you learn more about Windows Hello for Business. diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md index d6d35b189a..2f6540362a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md @@ -2,8 +2,6 @@ title: Dual Enrollment description: Learn how to configure Windows Hello for Business dual enrollment. Also, learn how to configure Active Directory to support Domain Administrator enrollment. ms.date: 09/09/2019 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md index 5fea59fc25..28401253c2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md @@ -2,8 +2,6 @@ title: Dynamic lock description: Learn how to configure dynamic lock on Windows devices via group policies. This feature locks a device when a Bluetooth signal falls below a set value. ms.date: 03/10/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: how-to --- diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index ea7e72e5d4..916a8890bf 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -5,8 +5,6 @@ ms.collection: - highpri - tier1 ms.date: 03/10/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: how-to --- diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md index 2f1c460668..45fc8c784f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -2,8 +2,6 @@ title: Remote Desktop description: Learn how Windows Hello for Business supports using biometrics with remote desktop ms.date: 02/24/2021 -appliesto: -- ✅ Windows 10 and later ms.topic: article ms.collection: - tier1 diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md index 27dde9400e..f25bac5b47 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md @@ -2,8 +2,6 @@ title: How Windows Hello for Business works - Authentication description: Learn about the authentication flow for Windows Hello for Business. ms.date: 02/15/2022 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Windows Hello for Business and Authentication diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md index 6d250848d5..219e82d35c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md @@ -2,8 +2,6 @@ title: How Windows Hello for Business works - Provisioning description: Explore the provisioning flows for Windows Hello for Business, from within a variety of environments. ms.date: 2/15/2022 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Windows Hello for Business Provisioning diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index b3765851fa..76368b1c12 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -2,8 +2,6 @@ title: How Windows Hello for Business works - technology and terms description: Explore technology and terms associated with Windows Hello for Business. Learn how Windows Hello for Business works. ms.date: 10/08/2018 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md index 40e094e6c7..93bfd6d56a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md @@ -2,8 +2,6 @@ title: How Windows Hello for Business works description: Learn how Windows Hello for Business works, and how it can help your users authenticate to services. ms.date: 05/05/2018 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # How Windows Hello for Business works in Windows Devices diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index fbed200f77..3eeb4f536d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -2,8 +2,6 @@ title: Use Certificates to enable SSO for Azure AD join devices description: If you want to use certificates for on-premises single-sign on for Azure Active Directory-joined devices, then follow these additional steps. ms.date: 08/19/2018 -appliesto: -- ✅ Windows 10 and later ms.topic: how-to --- diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md index d0aa2590f7..9a5646c257 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md @@ -2,8 +2,6 @@ title: Configure single sign-on (SSO) for Azure AD joined devices description: Learn how to configure single sign-on to on-premises resources for Azure AD-joined devices, using Windows Hello for Business. ms.date: 12/30/2022 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Configure single sign-on for Azure AD joined devices diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md index 788cd8af15..662e259872 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md @@ -3,8 +3,11 @@ title: Configure and validate the Public Key Infrastructure in an hybrid certifi description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in a hybrid certificate trust model. ms.date: 01/03/2023 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Configure and validate the Public Key Infrastructure - hybrid certificate trust diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md index 02c36f3fbe..eabb6ec24d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md @@ -3,8 +3,11 @@ title: Windows Hello for Business hybrid certificate trust deployment description: Learn how to deploy Windows Hello for Business in a hybrid certificate trust scenario. ms.date: 03/16/2023 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: how-to --- diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index a1a88d6f2e..629d9c561e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -2,8 +2,6 @@ title: Windows Hello for Business hybrid certificate trust clients configuration and enrollment description: Learn how to configure devices and enroll them in Windows Hello for Business in a hybrid certificate trust scenario. ms.date: 01/03/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: tutorial --- diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md index ca0662ddde..2a40af9e7f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md @@ -3,8 +3,11 @@ title: Configure Active Directory Federation Services in a hybrid certificate tr description: Learn how to configure Active Directory Federation Services to support the Windows Hello for Business hybrid certificate trust model. ms.date: 01/03/2023 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Configure Active Directory Federation Services - hybrid certificate trust diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md index 73c27e5835..31e4fb9ee2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md @@ -2,8 +2,6 @@ title: Windows Hello for Business hybrid key trust clients configuration and enrollment description: Learn how to configure devices and enroll them in Windows Hello for Business in a hybrid key trust scenario. ms.date: 01/03/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: tutorial --- diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md index 19c9df7d89..c4248ffb62 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md @@ -3,8 +3,11 @@ title: Configure and validate the Public Key Infrastructure in an hybrid key tru description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in an hybrid key trust model. ms.date: 01/03/2023 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Configure and validate the Public Key Infrastructure - hybrid key trust diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md index 042fe747a8..8ab43e5406 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md @@ -3,8 +3,11 @@ title: Windows Hello for Business hybrid key trust deployment description: Learn how to deploy Windows Hello for Business in a hybrid key trust scenario. ms.date: 12/28/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: how-to --- # Hybrid key trust deployment diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 518283865d..9c4a5f6165 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -1,14 +1,17 @@ --- +ms.date: 12/13/2022 title: Windows Hello for Business Deployment Prerequisite Overview description: Overview of all the different infrastructure requirements for Windows Hello for Business deployment models -ms.collection: +ms.topic: article +ms.collection: - highpri - tier1 -ms.date: 12/13/2022 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later -ms.topic: article +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 --- # Windows Hello for Business Deployment Prerequisite Overview diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md index b0cf1c66b8..be437d043f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md @@ -1,10 +1,13 @@ --- +ms.date: 12/12/2022 title: Prepare and deploy Active Directory Federation Services in an on-premises key trust description: Learn how to configure Active Directory Federation Services to support the Windows Hello for Business key trust model. -ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Prepare and deploy Active Directory Federation Services - on-premises key trust diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md index d9446b6eec..3fd25ec607 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md @@ -1,10 +1,10 @@ --- +ms.date: 12/12/2022 title: Configure Windows Hello for Business Policy settings in an on-premises key trust description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises key trust scenario -ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 ms.topic: tutorial --- # Configure Windows Hello for Business group policy settings - on-premises key trust diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md index 07673151d3..19fe709d3f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md @@ -3,8 +3,11 @@ title: Validate Active Directory prerequisites in an on-premises key trust description: Validate Active Directory prerequisites when deploying Windows Hello for Business in a key trust model. ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Validate Active Directory prerequisites - on-premises key trust diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md index 65f12b5274..4d089851ff 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md @@ -3,8 +3,11 @@ title: Validate and Deploy MFA for Windows Hello for Business with key trust description: Validate and deploy multi-factor authentication (MFA) for Windows Hello for Business in an on-premises key trust model. ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md index 96505087ec..e2f7510aac 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md @@ -3,8 +3,11 @@ title: Configure and validate the Public Key Infrastructure in an on-premises ke description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in a key trust model. ms.date: 12/12/2022 appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Configure and validate the Public Key Infrastructure - on-premises key trust diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index e666aa4beb..2676f0066f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -5,8 +5,6 @@ ms.collection: - highpri - tier1 ms.date: 2/15/2022 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index d6e6de308d..005fb6c685 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -5,8 +5,6 @@ ms.collection: - highpri - tier1 ms.topic: conceptual -appliesto: - - ✅ Windows 10 and later ms.date: 12/31/2017 --- # Windows Hello for Business Overview diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index f3e0b27534..b941c37a84 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -2,8 +2,6 @@ title: Planning a Windows Hello for Business Deployment description: Learn about the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of your infrastructure. ms.date: 09/16/2020 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Planning a Windows Hello for Business Deployment diff --git a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md index 1d36c9e14c..90bd5ec677 100644 --- a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md +++ b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md @@ -2,8 +2,6 @@ title: Prepare people to use Windows Hello (Windows) description: When you set a policy to require Windows Hello for Business in the workplace, you will want to prepare people in your organization. ms.date: 08/19/2018 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Prepare people to use Windows Hello diff --git a/windows/security/identity-protection/hello-for-business/hello-videos.md b/windows/security/identity-protection/hello-for-business/hello-videos.md index 1afbc43168..0963b04163 100644 --- a/windows/security/identity-protection/hello-for-business/hello-videos.md +++ b/windows/security/identity-protection/hello-for-business/hello-videos.md @@ -2,8 +2,6 @@ title: Windows Hello for Business Videos description: View several informative videos describing features and experiences in Windows Hello for Business in Windows 10 and Windows 11. ms.date: 03/09/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # Windows Hello for Business Videos diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md index 80c0b844fc..9c3cd5a067 100644 --- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md +++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md @@ -5,8 +5,6 @@ ms.collection: - highpri - tier1 ms.date: 03/15/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: conceptual --- # Why a PIN is better than an online password diff --git a/windows/security/identity-protection/hello-for-business/index.yml b/windows/security/identity-protection/hello-for-business/index.yml index 4d8789f403..e888c0e2f7 100644 --- a/windows/security/identity-protection/hello-for-business/index.yml +++ b/windows/security/identity-protection/hello-for-business/index.yml @@ -6,12 +6,7 @@ summary: Learn how to manage and deploy Windows Hello for Business. metadata: title: Windows Hello for Business documentation description: Learn how to manage and deploy Windows Hello for Business. - ms.prod: windows-client - ms.technology: itpro-security ms.topic: landing-page - author: paolomatarazzo - ms.author: paoloma - manager: aaroncz ms.date: 03/09/2023 ms.collection: - highpri diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index 4b2daf06b4..3ad9597e77 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -3,8 +3,6 @@ title: Password-less strategy description: Learn about the password-less strategy and how Windows Hello for Business implements this strategy in Windows 10 and Windows 11. ms.topic: conceptual ms.date: 05/24/2022 -appliesto: -- ✅ Windows 10 and later --- # Password-less strategy diff --git a/windows/security/identity-protection/hello-for-business/webauthn-apis.md b/windows/security/identity-protection/hello-for-business/webauthn-apis.md index 654302f210..f2aa96a5ea 100644 --- a/windows/security/identity-protection/hello-for-business/webauthn-apis.md +++ b/windows/security/identity-protection/hello-for-business/webauthn-apis.md @@ -2,8 +2,6 @@ title: WebAuthn APIs description: Learn how to use WebAuthn APIs to enable passwordless authentication for your sites and apps. ms.date: 03/09/2023 -appliesto: -- ✅ Windows 10 and later ms.topic: article --- # WebAuthn APIs for passwordless authentication on Windows diff --git a/windows/security/identity-protection/index.md b/windows/security/identity-protection/index.md index dc71f52903..c16e630bed 100644 --- a/windows/security/identity-protection/index.md +++ b/windows/security/identity-protection/index.md @@ -1,17 +1,8 @@ --- -title: Identity and access management (Windows 10) +title: Identity and access management description: Learn more about identity and access protection technologies in Windows. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 02/05/2018 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security --- # Identity and access management diff --git a/windows/security/identity-protection/password-support-policy.md b/windows/security/identity-protection/password-support-policy.md index fe76412c23..46e3507908 100644 --- a/windows/security/identity-protection/password-support-policy.md +++ b/windows/security/identity-protection/password-support-policy.md @@ -1,22 +1,13 @@ --- title: Technical support policy for lost or forgotten passwords description: Outlines the ways in which Microsoft can help you reset a lost or forgotten password, and provides links to instructions for doing so. -ms.custom: - - CI ID 110060 - - CSSTroubleshoot -ms.prod: windows-client ms.topic: article -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -manager: aaroncz ms.date: 11/20/2019 -ms.technology: itpro-security --- # Technical support policy for lost or forgotten passwords -Microsoft takes security seriously. This is for your protection. Microsoft accounts, the Windows operating system, and other Microsoft products include passwords to help secure your information. This article provides some options that you can use to reset or recover your password if you forget it. If these options don’t work, Microsoft support engineers can't help you retrieve or circumvent a lost or forgotten password. +Microsoft takes security seriously. This is for your protection. Microsoft accounts, the Windows operating system, and other Microsoft products include passwords to help secure your information. This article provides some options that you can use to reset or recover your password if you forget it. If these options don't work, Microsoft support engineers can't help you retrieve or circumvent a lost or forgotten password. If you lose or forget a password, you can use the links in this article to find published support information that will help you reset the password. diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index 63c2e03d67..64e9869d2a 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -1,20 +1,17 @@ --- title: Protect Remote Desktop credentials with Windows Defender Remote Credential Guard (Windows 10) description: Windows Defender Remote Credential Guard helps to secure your Remote Desktop credentials by never sending them to the target device. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -manager: aaroncz ms.collection: - - highpri - - tier2 +- highpri +- tier2 ms.topic: article -ms.localizationpriority: medium ms.date: 01/12/2018 appliesto: - - ✅ Windows 10 - - ✅ Windows Server 2016 -ms.technology: itpro-security +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 --- # Protect Remote Desktop credentials with Windows Defender Remote Credential Guard diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index 7c25e23d15..365f168f07 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -1,27 +1,15 @@ --- +ms.date: 09/24/2021 title: Smart Card and Remote Desktop Services (Windows) description: This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium -ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security +ms.reviewer: ardenw --- # Smart Card and Remote Desktop Services This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in. -The content in this topic applies to the versions of Windows that are designated in the **Applies To** list at the beginning of this topic. In these versions, smart card redirection logic and **WinSCard** API are combined to support multiple redirected sessions into a single process. +Smart card redirection logic and **WinSCard** API are combined to support multiple redirected sessions into a single process. Smart card support is required to enable many Remote Desktop Services scenarios. These include: @@ -95,7 +83,8 @@ Where <*CertFile*> is the root certificate of the KDC certificate issuer. For information about this option for the command-line tool, see [-addstore](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#BKMK_addstore). -> **Note**  If you use the credential SSP on computers running the supported versions of the operating system that are designated in the **Applies To** list at the beginning of this topic: To sign in with a smart card from a computer that is not joined to a domain, the smart card must contain the root certification of the domain controller. A public key infrastructure (PKI) secure channel cannot be established without the root certification of the domain controller. +> [!NOTE] +> To sign in with a smart card from a computer that is not joined to a domain, the smart card must contain the root certification of the domain controller. A public key infrastructure (PKI) secure channel cannot be established without the root certification of the domain controller. Sign-in to Remote Desktop Services across a domain works only if the UPN in the certificate uses the following form: <*ClientName*>@<*DomainDNSName*> diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 0b300b959d..5a810263fc 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -1,21 +1,9 @@ --- title: Smart Card Architecture (Windows) description: This topic for the IT professional describes the system architecture that supports smart cards in the Windows operating system. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Smart Card Architecture @@ -94,7 +82,7 @@ Figure 2 illustrates the relationship between the CryptoAPI, CSPs, the Smart Ca ### Caching with Base CSP and smart card KSP -Smart card architecture uses caching mechanisms to assist in streamlining operations and to improve a user’s access to a PIN. +Smart card architecture uses caching mechanisms to assist in streamlining operations and to improve a user's access to a PIN. - [Data caching](#data-caching): The data cache provides for a single process to minimize smart card I/O operations. @@ -320,8 +308,6 @@ Figure 4 shows the Cryptography architecture that is used by the Windows operat ### Base CSP and smart card KSP properties in Windows -The following properties are supported in versions of Windows designated in the **Applies To** list at the beginning of this topic. - > **Note**  The API definitions are located in WinCrypt.h and WinSCard.h. | **Property** | **Description** | diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index ad23803395..bbdab0c142 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -1,21 +1,9 @@ --- title: Certificate Propagation Service (Windows) description: This topic for the IT professional describes the certificate propagation service (CertPropSvc), which is used in smart card implementation. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 08/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Certificate Propagation Service diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index 4d2926242d..e52b7eeabd 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -1,21 +1,9 @@ --- title: Certificate Requirements and Enumeration (Windows) description: This topic for the IT professional and smart card developers describes how certificates are managed and used for smart card sign-in. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Certificate Requirements and Enumeration @@ -81,7 +69,7 @@ The following table lists the certificate support in older Windows operating sys Most issues during authentication occur because of session behavior changes. When changes occur, the Local Security Authority (LSA) does not reacquire the session context; it relies instead on the Cryptographic Service Provider to handle the session change. -In the supported versions of Windows designated in the **Applies To** list at the beginning of this topic, client certificates that do not contain a UPN in the **subjectAltName** (SAN) field of the certificate can be enabled for sign-in, which supports a wider variety of certificates and supports multiple sign-in certificates on the same card. +Client certificates that do not contain a UPN in the **subjectAltName** (SAN) field of the certificate can be enabled for sign-in, which supports a wider variety of certificates and supports multiple sign-in certificates on the same card. Support for multiple certificates on the same card is enabled by default. New certificate types must be enabled through Group Policy. @@ -131,7 +119,7 @@ Following are the steps that are performed during a smart card sign-in: 12. The KDC validates the user's certificate (time, path, and revocation status) to ensure that the certificate is from a trusted source. The KDC uses CryptoAPI to build a certification path from the user's certificate to a root certification authority (CA) certificate that resides in the root store on the domain controller. The KDC then uses CryptoAPI to verify the digital signature on the signed authenticator that was included in the preauthentication data fields. The domain controller verifies the signature and uses the public key from the user's certificate to prove that the request originated from the owner of the private key that corresponds to the public key. The KDC also verifies that the issuer is trusted and appears in the NTAUTH certificate store. -13. The KDC service retrieves user account information from AD DS. The KDC constructs a TGT, which is based on the user account information that it retrieves from AD DS. The TGT’s authorization data fields include the user's security identifier (SID), the SIDs for universal and global domain groups to which the user belongs, and (in a multidomain environment) the SIDs for any universal groups of which the user is a member. +13. The KDC service retrieves user account information from AD DS. The KDC constructs a TGT, which is based on the user account information that it retrieves from AD DS. The TGT's authorization data fields include the user's security identifier (SID), the SIDs for universal and global domain groups to which the user belongs, and (in a multidomain environment) the SIDs for any universal groups of which the user is a member. 14. The domain controller returns the TGT to the client as part of the KRB\_AS\_REP response. diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md index 10b6bda518..72b31805ae 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md +++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md @@ -1,24 +1,12 @@ --- title: Smart Card Troubleshooting (Windows) description: Describes the tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.collection: - highpri - tier2 ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Smart Card Troubleshooting diff --git a/windows/security/identity-protection/smart-cards/smart-card-events.md b/windows/security/identity-protection/smart-cards/smart-card-events.md index ed07b57089..50e701debe 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-events.md +++ b/windows/security/identity-protection/smart-cards/smart-card-events.md @@ -1,21 +1,9 @@ --- title: Smart Card Events (Windows) description: This topic for the IT professional and smart card developer describes events that are related to smart card deployment and development. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Smart Card Events diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index 26f06f48c2..78fe0f4b8a 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -1,21 +1,9 @@ --- title: Smart Card Group Policy and Registry Settings (Windows) description: Discover the Group Policy, registry key, local security policy, and credential delegation policy settings that are available for configuring smart cards. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 11/02/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Smart Card Group Policy and Registry Settings @@ -222,7 +210,7 @@ You can use this policy setting to change the default message that a user sees i When this policy setting is turned on, you can create and manage the displayed message that the user sees when a smart card is blocked. -When this policy setting isn't turned on (and the integrated unblock feature is also enabled), the user sees the system’s default message when the smart card is blocked. +When this policy setting isn't turned on (and the integrated unblock feature is also enabled), the user sees the system's default message when the smart card is blocked. | **Item** | **Description** | |--------------------------------------|-------------------------| @@ -236,7 +224,7 @@ When this policy setting isn't turned on (and the integrated unblock feature is You can use this policy setting to configure which valid sign-in certificates are displayed. > [!NOTE] -> During the certificate renewal period, a user’s smart card can have multiple valid sign-in certificates issued from the same certificate template, which can cause confusion about which certificate to select. This behavior can occur when a certificate is renewed and the old certificate has not expired yet. +> During the certificate renewal period, a user's smart card can have multiple valid sign-in certificates issued from the same certificate template, which can cause confusion about which certificate to select. This behavior can occur when a certificate is renewed and the old certificate has not expired yet. > > If two certificates are issued from the same template with the same major version and they are for the same user (this is determined by their UPN), they are determined to be the same. @@ -288,7 +276,7 @@ When this setting isn't turned on, the user doesn't see a smart card device driv You can use this policy setting to prevent Credential Manager from returning plaintext PINs. > [!NOTE] -> Credential Manager is controlled by the user on the local computer, and it stores credentials from supported browsers and Windows applications. Credentials are saved in special encrypted folders on the computer under the user’s profile. +> Credential Manager is controlled by the user on the local computer, and it stores credentials from supported browsers and Windows applications. Credentials are saved in special encrypted folders on the computer under the user's profile. When this policy setting is turned on, Credential Manager doesn't return a plaintext PIN. @@ -310,7 +298,7 @@ You can use this policy setting to control the way the subject name appears duri When this policy setting is turned on, the subject name during sign-in appears reversed from the way that it's stored in the certificate. -When this policy setting isn’t turned on, the subject name appears the same as it’s stored in the certificate. +When this policy setting isn't turned on, the subject name appears the same as it's stored in the certificate. | **Item** | **Description** | @@ -346,7 +334,7 @@ You can use this policy setting to manage the root certificate propagation that When this policy setting is turned on, root certificate propagation occurs when the user inserts the smart card. -When this policy setting isn’t turned on, root certificate propagation doesn’t occur when the user inserts the smart card. +When this policy setting isn't turned on, root certificate propagation doesn't occur when the user inserts the smart card. | **Item** | **Description** | |--------------------------------------|---------------------------------------------------------------------------------------------------------| diff --git a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md index b0989b839d..a44e2533fc 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md +++ b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md @@ -1,21 +1,9 @@ --- title: How Smart Card Sign-in Works in Windows description: This topic for IT professional provides links to resources about the implementation of smart card technologies in the Windows operating system. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # How Smart Card Sign-in Works in Windows diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md index 1df09c74c0..40f781ce63 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md @@ -1,21 +1,9 @@ --- title: Smart Card Removal Policy Service (Windows) description: This topic for the IT professional describes the role of the removal policy service (ScPolicySvc) in smart card implementation. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Smart Card Removal Policy Service diff --git a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md index 187d0bc8a9..170dfa5cf4 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md @@ -1,21 +1,9 @@ --- title: Smart Cards for Windows Service (Windows) description: This topic for the IT professional and smart card developers describes how the Smart Cards for Windows service manages readers and application interactions. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Smart Cards for Windows Service diff --git a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md index c543380fcd..bb1e4d8fb6 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md @@ -1,21 +1,9 @@ --- title: Smart Card Tools and Settings (Windows) description: This topic for the IT professional and smart card developer links to information about smart card debugging, settings, and events. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma ms.reviewer: ardenw -manager: aaroncz ms.topic: article -ms.localizationpriority: medium ms.date: 09/24/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security --- # Smart Card Tools and Settings diff --git a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md index d5912c3e8d..3b74397463 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md +++ b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md @@ -4,10 +4,6 @@ description: Learn about the Windows smart card infrastructure for physical smar ms.reviewer: ardenw ms.topic: article ms.date: 09/24/2021 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later -ms.technology: itpro-security --- # Smart Card Technical Reference diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md index 8037f68045..0e56328a44 100644 --- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md +++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md @@ -5,11 +5,7 @@ ms.collection: - highpri - tier2 ms.topic: article -ms.localizationpriority: medium ms.date: 09/23/2021 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # How User Account Control works diff --git a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md index 979a7ae1f1..08e9ce3e06 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md @@ -6,9 +6,6 @@ ms.collection: - tier2 ms.topic: article ms.date: 04/19/2017 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # User Account Control Group Policy and registry key settings diff --git a/windows/security/identity-protection/user-account-control/user-account-control-overview.md b/windows/security/identity-protection/user-account-control/user-account-control-overview.md index 93502be3e3..e85aae3ab9 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-overview.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-overview.md @@ -6,9 +6,6 @@ ms.collection: - tier2 ms.topic: article ms.date: 09/24/2011 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # User Account Control diff --git a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md index 28f209a22e..ffdb4e4a3f 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md @@ -3,9 +3,6 @@ title: User Account Control security policy settings (Windows) description: You can use security policies to configure how User Account Control works in your organization. ms.topic: article ms.date: 09/24/2021 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # User Account Control security policy settings diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md index 63ac28b3e9..b20f03522b 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md @@ -3,9 +3,6 @@ title: Deploy Virtual Smart Cards description: Learn about what to consider when deploying a virtual smart card authentication solution ms.topic: conceptual ms.date: 02/22/2023 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Deploy Virtual Smart Cards diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md index b2afb7673e..d86c288331 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md @@ -3,9 +3,6 @@ title: Evaluate Virtual Smart Card Security description: Learn about the security characteristics and considerations when deploying TPM virtual smart cards. ms.topic: conceptual ms.date: 02/22/2023 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Evaluate Virtual Smart Card Security diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md index ab3569f8ab..9d8e125298 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md @@ -3,9 +3,6 @@ title: Get Started with Virtual Smart Cards - Walkthrough Guide (Windows 10) description: This topic for the IT professional describes how to set up a basic test environment for using TPM virtual smart cards. ms.topic: conceptual ms.date: 02/22/2023 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Get Started with Virtual Smart Cards: Walkthrough Guide diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md index 05598bf6ee..1445f06ad2 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md @@ -3,9 +3,6 @@ title: Virtual Smart Card Overview description: Learn about virtual smart card technology for Windows. ms.topic: conceptual ms.date: 02/22/2023 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Virtual Smart Card Overview diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md index 5f39e38b48..5eca1fae1e 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md @@ -3,9 +3,6 @@ title: Tpmvscmgr description: Learn about the Tpmvscmgr command-line tool, through which an administrator can create and delete TPM virtual smart cards on a computer. ms.topic: conceptual ms.date: 02/22/2023 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Tpmvscmgr diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md index dfde051a1a..77e78baaf2 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md @@ -4,9 +4,6 @@ description: Learn how smart card technology can fit into your authentication de ms.prod: windows-client ms.topic: conceptual ms.date: 02/22/2023 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Understand and Evaluate Virtual Smart Cards diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md index eb4d234c61..ddb91270e5 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md @@ -3,9 +3,6 @@ title: Use Virtual Smart Cards description: Learn about the requirements for virtual smart cards, how to use and manage them. ms.topic: conceptual ms.date: 02/22/2023 -appliesto: -- ✅ Windows 10 and later -- ✅ Windows Server 2016 and later --- # Use Virtual Smart Cards diff --git a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md index 188fe97442..834f56a321 100644 --- a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md +++ b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md @@ -1,24 +1,12 @@ --- -title: How to configure Diffie Hellman protocol over IKEv2 VPN connections (Windows 10 and Windows 11) +title: How to configure Diffie Hellman protocol over IKEv2 VPN connections description: Learn how to update the Diffie Hellman configuration of VPN servers and clients by running VPN cmdlets to secure connections. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -ms.localizationpriority: medium ms.date: 09/23/2021 -manager: aaroncz -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: how-to --- # How to configure Diffie Hellman protocol over IKEv2 VPN connections ->Applies To: Windows Server (General Availability Channel), Windows Server 2016, Windows 10, Windows 11 - In IKEv2 VPN connections, the default configuration for Diffie Hellman group is Group 2, which is not secure for IKE exchanges. To secure the connections, update the configuration of VPN servers and clients by running VPN cmdlets. @@ -31,7 +19,7 @@ For VPN servers that run Windows Server 2012 R2 or later, you need to run [Set-V Set-VpnServerConfiguration -TunnelType IKEv2 -CustomPolicy ``` -On an earlier version of Windows Server, run [Set-VpnServerIPsecConfiguration](/previous-versions/windows/powershell-scripting/hh918373(v=wps.620)). Since `Set-VpnServerIPsecConfiguration` doesn’t have `-TunnelType`, the configuration applies to all tunnel types on the server. +On an earlier version of Windows Server, run [Set-VpnServerIPsecConfiguration](/previous-versions/windows/powershell-scripting/hh918373(v=wps.620)). Since `Set-VpnServerIPsecConfiguration` doesn't have `-TunnelType`, the configuration applies to all tunnel types on the server. ```powershell Set-VpnServerIPsecConfiguration -CustomPolicy diff --git a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md index e44a13a1a8..08b4c532c8 100644 --- a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md +++ b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md @@ -1,16 +1,7 @@ --- title: How to use Single Sign-On (SSO) over VPN and Wi-Fi connections description: Explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections. -ms.prod: windows-client -author: paolomatarazzo ms.date: 12/28/2022 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: how-to --- @@ -95,7 +86,7 @@ For more information, see [Configure certificate infrastructure for SCEP](/mem/i You need IP connectivity to a DNS server and domain controller over the network interface so that authentication can succeed as well. -Domain controllers must have appropriate KDC certificates for the client to trust them as domain controllers. Because phones are not domain-joined, the root CA of the KDC’s certificate must be in the Third-Party Root CA or Smart Card Trusted Roots store. +Domain controllers must have appropriate KDC certificates for the client to trust them as domain controllers. Because phones are not domain-joined, the root CA of the KDC's certificate must be in the Third-Party Root CA or Smart Card Trusted Roots store. Domain controllers must be using certificates based on the updated KDC certificate template Kerberos Authentication. This requires that all authenticating domain controllers run Windows Server 2016, or you'll need to enable strict KDC validation on domain controllers that run previous versions of Windows Server. diff --git a/windows/security/identity-protection/vpn/vpn-authentication.md b/windows/security/identity-protection/vpn/vpn-authentication.md index f14e959f6b..c74740f325 100644 --- a/windows/security/identity-protection/vpn/vpn-authentication.md +++ b/windows/security/identity-protection/vpn/vpn-authentication.md @@ -1,17 +1,7 @@ --- title: VPN authentication options (Windows 10 and Windows 11) description: Learn about the EAP authentication methods that Windows supports in VPNs to provide secure authentication using username/password and certificate-based methods. -ms.prod: windows-client -author: paolomatarazzo -ms.localizationpriority: medium ms.date: 09/23/2021 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- diff --git a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md index 61044232d2..51c5aebb16 100644 --- a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md +++ b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md @@ -1,23 +1,13 @@ --- title: VPN auto-triggered profile options (Windows 10 and Windows 11) description: Learn about the types of auto-trigger rules for VPNs in Windows, which start a VPN when it is needed to access a resource. -ms.prod: windows-client -author: paolomatarazzo -ms.localizationpriority: medium ms.date: 09/23/2021 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- # VPN auto-triggered profile options -In Windows 10 and Windows 11, a number of features have been added to auto-trigger VPN so users won’t have to manually connect when VPN is needed to access necessary resources. There are three different types of auto-trigger rules: +In Windows 10 and Windows 11, a number of features have been added to auto-trigger VPN so users won't have to manually connect when VPN is needed to access necessary resources. There are three different types of auto-trigger rules: - App trigger - Name-based trigger @@ -64,7 +54,7 @@ When a device has multiple profiles with Always On triggers, the user can specif ## Preserving user Always On preference -Windows has a feature to preserve a user’s AlwaysOn preference. In the event that a user manually unchecks the “Connect automatically” checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value **AutoTriggerDisabledProfilesList**. +Windows has a feature to preserve a user's AlwaysOn preference. In the event that a user manually unchecks the "Connect automatically" checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value **AutoTriggerDisabledProfilesList**. Should a management tool remove or add the same profile name back and set **AlwaysOn** to **true**, Windows will not check the box if the profile name exists in the following registry value in order to preserve user preference. diff --git a/windows/security/identity-protection/vpn/vpn-conditional-access.md b/windows/security/identity-protection/vpn/vpn-conditional-access.md index 4e7d339c66..392b5cf099 100644 --- a/windows/security/identity-protection/vpn/vpn-conditional-access.md +++ b/windows/security/identity-protection/vpn/vpn-conditional-access.md @@ -1,17 +1,7 @@ --- title: VPN and conditional access (Windows 10 and Windows 11) description: Learn how to integrate the VPN client with the Conditional Access Platform, so you can create access rules for Azure Active Directory (Azure AD) connected apps. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: pesmith -manager: aaroncz -ms.localizationpriority: medium ms.date: 09/23/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- @@ -63,43 +53,34 @@ After the server side is set up, VPN admins can add the policy settings for cond Two client-side configuration service providers are leveraged for VPN device compliance. - VPNv2 CSP DeviceCompliance settings: - - - **Enabled**: enables the Device Compliance flow from the client. If marked as **true**, the VPN client attempts to communicate with Azure AD to get a certificate to use for authentication. The VPN should be set up to use certificate authentication and the VPN server must trust the server returned by Azure AD. - - **Sso**: entries under SSO should be used to direct the VPN client to use a certificate other than the VPN authentication certificate when accessing resources that require Kerberos authentication. - - **Sso/Enabled**: if this field is set to **true**, the VPN client looks for a separate certificate for Kerberos authentication. - - **Sso/IssuerHash**: hashes for the VPN client to look for the correct certificate for Kerberos authentication. - - **Sso/Eku**: comma-separated list of extended key usage (EKU) extensions for the VPN client to look for the correct certificate for Kerberos authentication. - + - **Enabled**: enables the Device Compliance flow from the client. If marked as **true**, the VPN client attempts to communicate with Azure AD to get a certificate to use for authentication. The VPN should be set up to use certificate authentication and the VPN server must trust the server returned by Azure AD. + - **Sso**: entries under SSO should be used to direct the VPN client to use a certificate other than the VPN authentication certificate when accessing resources that require Kerberos authentication. + - **Sso/Enabled**: if this field is set to **true**, the VPN client looks for a separate certificate for Kerberos authentication. + - **Sso/IssuerHash**: hashes for the VPN client to look for the correct certificate for Kerberos authentication. + - **Sso/Eku**: comma-separated list of extended key usage (EKU) extensions for the VPN client to look for the correct certificate for Kerberos authentication. - HealthAttestation CSP (not a requirement) - functions performed by the HealthAttestation CSP include: + - Collects TPM data used to verify health states + - Forwards the data to the Health Attestation Service (HAS) + - Provisions the Health Attestation Certificate received from the HAS + - Upon request, forward the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification - - Collects TPM data used to verify health states - - Forwards the data to the Health Attestation Service (HAS) - - Provisions the Health Attestation Certificate received from the HAS - - Upon request, forward the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification - > [!NOTE] -> Currently, it is required that certificates used for obtaining Kerberos tickets must be issued from an on-premises CA, and that SSO must be enabled in the user’s VPN profile. This will enable the user to access on-premises resources. -> +> It's required that certificates used for obtaining Kerberos tickets to be issued from an on-premises CA, and that SSO to be enabled in the user's VPN profile. This will enable the user to access on-premises resources. > In the case of AzureAD-only joined devices (not hybrid joined devices), if the user certificate issued by the on-premises CA has the user UPN from AzureAD in Subject and SAN (Subject Alternative Name), the VPN profile must be modified to ensure that the client does not cache the credentials used for VPN authentication. To do this, after deploying the VPN profile to the client, modify the *Rasphone.pbk* on the client by changing the entry **UseRasCredentials** from 1 (default) to 0 (zero). ## Client connection flow The VPN client side connection flow works as follows: -> [!div class="mx-imgBorder"] -> ![Device compliance workflow when VPN client attempts to connect.](images/vpn-device-compliance.png) - +![Device compliance workflow when VPN client attempts to connect.](images/vpn-device-compliance.png) + When a VPNv2 Profile is configured with \ \true<\/Enabled> the VPN client uses this connection flow: -1. The VPN client calls into Windows 10’s or Windows 11’s Azure AD Token Broker, identifying itself as a VPN client. - -2. The Azure AD Token Broker authenticates to Azure AD and provides it with information about the device trying to connect. The Azure AD Server checks if the device is in compliance with the policies. - -3. If compliant, Azure AD requests a short-lived certificate. - -4. Azure AD pushes down a short-lived certificate to the Certificate Store via the Token Broker. The Token Broker then returns control back over to the VPN client for further connection processing. - -5. The VPN client uses the Azure AD-issued certificate to authenticate with the VPN server. +1. The VPN client calls into Windows 10's or Windows 11's Azure AD Token Broker, identifying itself as a VPN client. +1. The Azure AD Token Broker authenticates to Azure AD and provides it with information about the device trying to connect. The Azure AD Server checks if the device is in compliance with the policies. +1. If compliant, Azure AD requests a short-lived certificate. +1. Azure AD pushes down a short-lived certificate to the Certificate Store via the Token Broker. The Token Broker then returns control back over to the VPN client for further connection processing. +1. The VPN client uses the Azure AD-issued certificate to authenticate with the VPN server. ## Configure conditional access diff --git a/windows/security/identity-protection/vpn/vpn-connection-type.md b/windows/security/identity-protection/vpn/vpn-connection-type.md index e9eecdbbb9..0ae1626c8b 100644 --- a/windows/security/identity-protection/vpn/vpn-connection-type.md +++ b/windows/security/identity-protection/vpn/vpn-connection-type.md @@ -1,23 +1,13 @@ --- title: VPN connection types (Windows 10 and Windows 11) description: Learn about Windows VPN platform clients and the VPN connection-type features that can be configured. -ms.prod: windows-client -author: paolomatarazzo -ms.localizationpriority: medium ms.date: 08/23/2021 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- # VPN connection types -Virtual private networks (VPNs) are point-to-point connections across a private or public network, such as the Internet. A VPN client uses special TCP/IP or UDP-based protocols, called *tunneling protocols*, to make a virtual call to a virtual port on a VPN server. In a typical VPN deployment, a client initiates a virtual point-to-point connection to a remote access server over the Internet. The remote access server answers the call, authenticates the caller, and transfers data between the VPN client and the organization’s private network. +Virtual private networks (VPNs) are point-to-point connections across a private or public network, such as the Internet. A VPN client uses special TCP/IP or UDP-based protocols, called *tunneling protocols*, to make a virtual call to a virtual port on a VPN server. In a typical VPN deployment, a client initiates a virtual point-to-point connection to a remote access server over the Internet. The remote access server answers the call, authenticates the caller, and transfers data between the VPN client and the organization's private network. There are many options for VPN clients. In Windows 10 and Windows 11, the built-in plug-in and the Universal Windows Platform (UWP) VPN plug-in platform are built on top of the Windows VPN platform. This guide focuses on the Windows VPN platform clients and the features that can be configured. diff --git a/windows/security/identity-protection/vpn/vpn-guide.md b/windows/security/identity-protection/vpn/vpn-guide.md index f8cf27d242..15f788082b 100644 --- a/windows/security/identity-protection/vpn/vpn-guide.md +++ b/windows/security/identity-protection/vpn/vpn-guide.md @@ -1,17 +1,7 @@ --- title: Windows VPN technical guide (Windows 10 and Windows 11) description: Learn about decisions to make for Windows 10 or Windows 11 clients in your enterprise VPN solution and how to configure your deployment. -ms.prod: windows-client -author: paolomatarazzo -ms.localizationpriority: medium ms.date: 02/21/2022 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- diff --git a/windows/security/identity-protection/vpn/vpn-name-resolution.md b/windows/security/identity-protection/vpn/vpn-name-resolution.md index 34f201d00a..2c6402477a 100644 --- a/windows/security/identity-protection/vpn/vpn-name-resolution.md +++ b/windows/security/identity-protection/vpn/vpn-name-resolution.md @@ -1,17 +1,7 @@ --- title: VPN name resolution (Windows 10 and Windows 11) description: Learn how the name resolution setting in the VPN profile configures how name resolution works when a VPN client connects to a VPN server. -ms.prod: windows-client -author: paolomatarazzo -ms.localizationpriority: medium ms.date: 09/23/2021 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- @@ -23,7 +13,7 @@ The name resolution setting in the VPN profile configures how name resolution sh ## Name Resolution Policy table (NRPT) -The NRPT is a table of namespaces that determines the DNS client’s behavior when issuing name resolution queries and processing responses. It is the first place that the stack will look after the DNSCache. +The NRPT is a table of namespaces that determines the DNS client's behavior when issuing name resolution queries and processing responses. It is the first place that the stack will look after the DNSCache. There are 3 types of name matches that can set up for NRPT: diff --git a/windows/security/identity-protection/vpn/vpn-office-365-optimization.md b/windows/security/identity-protection/vpn/vpn-office-365-optimization.md index 6e45c35a7e..8eb30c7bce 100644 --- a/windows/security/identity-protection/vpn/vpn-office-365-optimization.md +++ b/windows/security/identity-protection/vpn/vpn-office-365-optimization.md @@ -1,18 +1,8 @@ --- -title: Optimizing Office 365 traffic for remote workers with the native Windows 10 or Windows 11 VPN client -description: tbd -ms.prod: windows-client +title: Optimizing Office 365 traffic for remote workers with the native Windows VPN client +description: Learn how to optimize Office 365 traffic for remote workers with the native Windows VPN client ms.topic: article -ms.localizationpriority: medium ms.date: 09/23/2021 -author: paolomatarazzo -ms.author: paoloma -manager: aaroncz -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security --- # Optimizing Office 365 traffic for remote workers with the native Windows 10 and Windows 11 VPN client diff --git a/windows/security/identity-protection/vpn/vpn-profile-options.md b/windows/security/identity-protection/vpn/vpn-profile-options.md index a6330f4ad8..2ebbff5348 100644 --- a/windows/security/identity-protection/vpn/vpn-profile-options.md +++ b/windows/security/identity-protection/vpn/vpn-profile-options.md @@ -1,17 +1,7 @@ --- title: VPN profile options (Windows 10 and Windows 11) description: Windows adds Virtual Private Network (VPN) profile options to help manage how users connect. VPNs give users secure remote access to the company network. -manager: aaroncz -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: pesmith -ms.localizationpriority: medium ms.date: 05/17/2018 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- @@ -221,75 +211,75 @@ The following sample is a sample plug-in VPN profile. This blob would fall under ```xml - TestVpnProfile - - testserver1.contoso.com;testserver2.contoso..com - JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy - <pulse-schema><isSingleSignOnCredential>true</isSingleSignOnCredential></pulse-schema> - - -
192.168.0.0
- 24 - - -
10.10.0.0
- 16 - - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - - - - %ProgramFiles%\Internet Explorer\iexplore.exe - - - - - %ProgramFiles%\Internet Explorer\iexplore.exe - - 6 - 10,20-50,100-200 - 20-50,100-200,300 - 30.30.0.0/16,10.10.10.10-20.20.20.20 - - - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - 3.3.3.3/32,1.1.1.1-2.2.2.2 - - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - O:SYG:SYD:(A;;CC;;;AU) - - - - corp.contoso.com - 1.2.3.4,5.6.7.8 - 5.5.5.5 - false - - - corp.contoso.com - 10.10.10.10,20.20.20.20 - 100.100.100.100 - - - true - false - corp.contoso.com - contoso.com,test.corp.contoso.com - - - HelloServer - - Helloworld.Com - + TestVpnProfile + + testserver1.contoso.com;testserver2.contoso..com + JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy + <pulse-schema><isSingleSignOnCredential>true</isSingleSignOnCredential></pulse-schema> + + +
192.168.0.0
+ 24 + + +
10.10.0.0
+ 16 + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + + + + %ProgramFiles%\Internet Explorer\iexplore.exe + + + + + %ProgramFiles%\Internet Explorer\iexplore.exe + + 6 + 10,20-50,100-200 + 20-50,100-200,300 + 30.30.0.0/16,10.10.10.10-20.20.20.20 + + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + 3.3.3.3/32,1.1.1.1-2.2.2.2 + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + O:SYG:SYD:(A;;CC;;;AU) + + + + corp.contoso.com + 1.2.3.4,5.6.7.8 + 5.5.5.5 + false + + + corp.contoso.com + 10.10.10.10,20.20.20.20 + 100.100.100.100 + + + true + false + corp.contoso.com + contoso.com,test.corp.contoso.com + + + HelloServer + + Helloworld.Com + ``` diff --git a/windows/security/identity-protection/vpn/vpn-routing.md b/windows/security/identity-protection/vpn/vpn-routing.md index be5bc1caf0..925b124da9 100644 --- a/windows/security/identity-protection/vpn/vpn-routing.md +++ b/windows/security/identity-protection/vpn/vpn-routing.md @@ -1,17 +1,7 @@ --- -title: VPN routing decisions (Windows 10 and Windows 10) -description: Learn about approaches that either send all data through a VPN or only selected data. The one you choose impacts capacity planning and security expectations. -ms.prod: windows-client -author: paolomatarazzo -ms.localizationpriority: medium ms.date: 09/23/2021 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security +title: VPN routing decisions +description: Learn about approaches that either send all data through a VPN or only selected data. The one you choose impacts capacity planning and security expectations. ms.topic: conceptual --- # VPN routing decisions @@ -38,7 +28,7 @@ Routes can also be added at connect time through the server for UWP VPN apps. In a force tunnel configuration, all traffic will go over VPN. This is the default configuration and takes effect if no routes are specified. -The only implication of this setting is the manipulation of routing entries. In the case of a force tunnel, VPN V4 and V6 default routes (for example. 0.0.0.0/0) are added to the routing table with a lower metric than ones for other interfaces. This sends traffic through the VPN as long as there isn’t a specific route on the physical interface itself. +The only implication of this setting is the manipulation of routing entries. In the case of a force tunnel, VPN V4 and V6 default routes (for example. 0.0.0.0/0) are added to the routing table with a lower metric than ones for other interfaces. This sends traffic through the VPN as long as there isn't a specific route on the physical interface itself. For built-in VPN, this decision is controlled using the MDM setting **VPNv2/ProfileName/NativeProfile/RoutingPolicyType**. diff --git a/windows/security/identity-protection/vpn/vpn-security-features.md b/windows/security/identity-protection/vpn/vpn-security-features.md index f8fb6861a0..c4d9da3ec4 100644 --- a/windows/security/identity-protection/vpn/vpn-security-features.md +++ b/windows/security/identity-protection/vpn/vpn-security-features.md @@ -1,17 +1,7 @@ --- title: VPN security features description: Learn about security features for VPN, including LockDown VPN, Windows Information Protection integration with VPN, and traffic filters. -ms.prod: windows-client -author: paolomatarazzo -ms.localizationpriority: medium ms.date: 07/21/2022 -manager: aaroncz -ms.author: paoloma -ms.reviewer: pesmith -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security ms.topic: conceptual --- diff --git a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md index aee7a82d2d..5cbde2e21f 100644 --- a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md +++ b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md @@ -1,17 +1,8 @@ --- title: Windows Credential Theft Mitigation Guide Abstract description: Provides a summary of the Windows credential theft mitigation guide. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -manager: aaroncz -ms.topic: article -ms.localizationpriority: medium -ms.date: 04/19/2017 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.technology: itpro-security +ms.topic: conceptual +ms.date: 03/31/2023 --- # Windows Credential Theft Mitigation Guide Abstract @@ -65,5 +56,3 @@ This sections covers how to detect the use of stolen credentials and how to coll ## Responding to suspicious activity Learn Microsoft's recommendations for responding to incidents, including how to recover control of compromised accounts, how to investigate attacks, and how to recover from a breach. - -