diff --git a/.openpublishing.redirection.education.json b/.openpublishing.redirection.education.json index 3e1fbaef85..7e028ba6b7 100644 --- a/.openpublishing.redirection.education.json +++ b/.openpublishing.redirection.education.json @@ -194,6 +194,41 @@ "source_path": "education/windows/chromebook-migration-guide.md", "redirect_url": "/education/windows", "redirect_document_id": false + }, + { + "source_path": "education/windows/autopilot-reset.md", + "redirect_url": "/autopilot/windows-autopilot-reset", + "redirect_document_id": false + }, + { + "source_path": "education/windows/set-up-students-pcs-with-apps.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/set-up-windows-10.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/edu-deployment-recommendations.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/set-up-school-pcs-azure-ad-join.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/set-up-students-pcs-to-join-domain.md", + "redirect_url": "/education/windows", + "redirect_document_id": false + }, + { + "source_path": "education/windows/windows-editions-for-education-customers.md", + "redirect_url": "/education/windows", + "redirect_document_id": false } ] -} +} \ No newline at end of file diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index df4ae61d44..32f09c3ff2 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -2052,7 +2052,7 @@ }, { "source_path": "windows/deploy/sideload-apps-in-windows-10.md", - "redirect_url": "/windows/application-management/sideload-apps-in-windows-10", + "redirect_url": "/windows/application-management/sideload-apps-in-windows", "redirect_document_id": false }, { @@ -12734,6 +12734,11 @@ "source_path": "windows/deployment/windows-10-media.md", "redirect_url": "/licensing/", "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md", + "redirect_url": "/windows/deployment/upgrade/resolve-windows-upgrade-errors", + "redirect_document_id": false } ] -} +} \ No newline at end of file diff --git a/.openpublishing.redirection.windows-application-management.json b/.openpublishing.redirection.windows-application-management.json index 4b1866c772..b602d2f3f0 100644 --- a/.openpublishing.redirection.windows-application-management.json +++ b/.openpublishing.redirection.windows-application-management.json @@ -24,6 +24,11 @@ "source_path": "windows/application-management/apps-in-windows-10.md", "redirect_url": "/windows/application-management/overview-windows-apps", "redirect_document_id": false + }, + { + "source_path": "windows/application-management/sideload-apps-in-windows-10.md", + "redirect_url": "/windows/application-management/sideload-apps-in-windows", + "redirect_document_id": false } ] } diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 53c54e8c87..d0bee7874b 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -15,6 +15,21 @@ "redirect_url": "/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", "redirect_document_id": false }, + { + "source_path": "windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md", + "redirect_url": "/windows/security/operating-system-security/device-management/override-mitigation-options-for-app-related-security-policies", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md", + "redirect_url": "/windows/security/operating-system-security/device-management/block-untrusted-fonts-in-enterprise", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md", + "redirect_url": "/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection", + "redirect_document_id": false + }, { "source_path": "windows/security//threat-protection/mbsa-removal-and-guidance.md", "redirect_url": "/windows/security/operating-system-security/device-management/windows-security-configuration-framework/mbsa-removal-and-guidance", @@ -4560,6 +4575,11 @@ "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-settings", "redirect_document_id": false }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-settings.md", + "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-technical-reference", @@ -4660,6 +4680,11 @@ "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-your-application-control-objectives", "redirect_document_id": false }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/determine-your-application-control-objectives.md", + "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", @@ -4830,6 +4855,11 @@ "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-enforcement-settings", "redirect_document_id": false }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md", + "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-rules#enforcement-modes", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions", @@ -4900,6 +4930,11 @@ "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", "redirect_document_id": false }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md", + "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/wdac", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets", @@ -4915,6 +4950,11 @@ "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies", "redirect_document_id": false }, + { + "source_path": "windows/security/application-security/application-control/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md", + "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/wdac", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md", "redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker", @@ -8064,6 +8104,126 @@ "source_path": "windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md", "redirect_url": "/windows-server/administration/performance-tuning/role/active-directory-server/capacity-planning-for-active-directory-domain-services", "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-adfs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-adfs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-mfa", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-pki", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/cloud", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust-enroll", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-deployment-guide.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-adfs", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-mfa", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-pki", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-identity-verification.md", + "redirect_url": "/windows/security/identity-protection/hello-for-business/deploy/requirements", + "redirect_document_id": false } ] } \ No newline at end of file diff --git a/browsers/internet-explorer/kb-support/ie-edge-faqs.yml b/browsers/internet-explorer/kb-support/ie-edge-faqs.yml index 996e07597a..fc5a540272 100644 --- a/browsers/internet-explorer/kb-support/ie-edge-faqs.yml +++ b/browsers/internet-explorer/kb-support/ie-edge-faqs.yml @@ -6,7 +6,7 @@ metadata: author: ramakoni1 ms.author: ramakoni ms.reviewer: ramakoni, DEV_Triage - ms.prod: internet-explorer + ms.service: internet-explorer ms.technology: ms.topic: faq ms.localizationpriority: medium diff --git a/education/includes/education-content-updates.md b/education/includes/education-content-updates.md new file mode 100644 index 0000000000..4046e74047 --- /dev/null +++ b/education/includes/education-content-updates.md @@ -0,0 +1,20 @@ + + + + +## Week of January 15, 2024 + + +| Published On |Topic title | Change | +|------|------------|--------| +| 1/16/2024 | Deployment recommendations for school IT administrators | removed | +| 1/16/2024 | Microsoft Entra join with Set up School PCs app | removed | +| 1/16/2024 | [Set up School PCs app technical reference overview](/education/windows/set-up-school-pcs-technical) | modified | +| 1/16/2024 | Set up student PCs to join domain | removed | +| 1/16/2024 | Provision student PCs with apps | removed | +| 1/16/2024 | Set up Windows devices for education | removed | +| 1/16/2024 | [Configure applications with Microsoft Intune](/education/windows/tutorial-school-deployment/configure-device-apps) | modified | +| 1/16/2024 | [Configure and secure devices with Microsoft Intune](/education/windows/tutorial-school-deployment/configure-device-settings) | modified | +| 1/16/2024 | [Configure devices with Microsoft Intune](/education/windows/tutorial-school-deployment/configure-devices-overview) | modified | +| 1/16/2024 | [Set up Microsoft Entra ID](/education/windows/tutorial-school-deployment/set-up-microsoft-entra-id) | modified | +| 1/16/2024 | Windows 10 editions for education customers | removed | diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md deleted file mode 100644 index bb0223c8fc..0000000000 --- a/education/windows/autopilot-reset.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: Reset devices with Autopilot Reset -description: Learn about Autopilot Reset and how to enable and use it. -ms.date: 08/10/2022 -ms.topic: how-to -appliesto: - - ✅ Windows 10 ---- - -# Reset devices with Autopilot Reset - -IT admins or technical teachers can use Autopilot Reset to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen anytime and apply original settings and management enrollment (Microsoft Entra ID and device management) so the devices are ready to use. With Autopilot Reset, devices are returned to a fully configured or known IT-approved state. - -To enable Autopilot Reset, you must: - -1. [Enable the policy for the feature](#enable-autopilot-reset) -2. [Trigger a reset for each device](#trigger-autopilot-reset) - -## Enable Autopilot Reset - -To use Autopilot Reset, Windows Recovery Environment (WinRE) must be enabled on the device. - -**DisableAutomaticReDeploymentCredentials** is a policy that enables or disables the visibility of the credentials for Autopilot Reset. It's a policy node in the [Policy CSP](/windows/client-management/mdm/policy-csp-credentialproviders), **CredentialProviders/DisableAutomaticReDeploymentCredentials**. By default, this policy is set to 1 (Disable). This setting ensures that Autopilot Reset isn't triggered by accident. - -You can set the policy using one of these methods: - -- MDM provider - - Check your MDM provider documentation on how to set this policy. If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set. - - For example, in Intune, create a new configuration policy and add an OMA-URI. - - OMA-URI: ./Vendor/MSFT/Policy/Config/CredentialProviders/DisableAutomaticReDeploymentCredentials - - Data type: Integer - - Value: 0 - -- Windows Configuration Designer - - You can [use Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-create-package) to set the **Runtime settings > Policies > CredentialProviders > DisableAutomaticReDeploymentCredentials** setting and create a provisioning package. - -- Set up School PCs app - - Autopilot Reset in the Set up School PCs app is available in the latest release of the app. Make sure you're running Windows 10, version 1709 on the student PCs if you want to use Autopilot Reset through the Set up School PCs app. You can check the version several ways: - - - Reach out to your device manufacturer. - - - If you manage your PCs using Intune or Intune for Education, you can check the OS version by checking the **OS version** info for the device. If you're using another MDM provider, check the documentation for the MDM provider to confirm the OS version. - - - Log into the PCs, go to the **Settings > System > About** page, look in the **Windows specifications** section and confirm **Version** is set to 1709. - - To use the Autopilot Reset setting in the Set up School PCs app: - - - When using [Set up School PCs](use-set-up-school-pcs-app.md), in the **Configure student PC settings** screen, select **Enable Windows 10 Autopilot Reset** among the list of settings for the student PC as shown in the following example: - - ![Configure student PC settings in Set up School PCs.](images/suspcs/suspc_configure_pc2.jpg) - -## Trigger Autopilot Reset - -Autopilot Reset is a two-step process: trigger it and then authenticate. Once you've done these two steps, you can let the process execute and once it's done, the device is again ready for use. - -To trigger Autopilot Reset: - -1. From the Windows device lock screen, enter the keystroke: CTRL + WIN + R. - - ![Enter CTRL+Windows key+R on the Windows lockscreen.](images/autopilot-reset-lockscreen.png) - - This keystroke opens up a custom sign-in screen for Autopilot Reset. The screen serves two purposes: - - 1. Confirm/verify that the end user has the right to trigger Autopilot Reset - 1. Notify the user in case a provisioning package, created using Windows Configuration Designer or Set up School PCs, will be used as part of the process. - - ![Custom login screen for Autopilot Reset.](images/autopilot-reset-customlogin.png) - -1. Sign in with the admin account credentials. If you created a provisioning package, plug in the USB drive and trigger Autopilot Reset. - - > [!IMPORTANT] - > To reestablish Wi-Fi connectivity after reset, make sure the **Connect automatically** box is checked for the device's wireless network connection. - - Once Autopilot Reset is triggered, the reset process starts. - - After reset, the device: - - - Sets the region, language, and keyboard - - Connects to Wi-Fi - - If you provided a provisioning package when Autopilot Reset is triggered, the system applies this new provisioning package. Otherwise, the system reapplies the original provisioning package on the device - - Is returned to a known good managed state, connected to Microsoft Entra ID and MDM. - - ![Notification that provisioning is complete.](images/autopilot-reset-provisioningcomplete.png) - - Once provisioning is complete, the device is again ready for use. - -## Troubleshoot Autopilot Reset - -Autopilot Reset fails when the [Windows Recovery Environment (WinRE)](/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference) isn't enabled on the device. The error code is: `ERROR_NOT_SUPPORTED (0x80070032)`. - -To make sure WinRE is enabled, use the [REAgentC.exe tool](/windows-hardware/manufacture/desktop/reagentc-command-line-options) to run the following command: - -```cmd -reagentc.exe /enable -``` - -If Autopilot Reset fails after enabling WinRE, or if you're unable to enable WinRE, kindly contact [Microsoft Support](https://support.microsoft.com) for assistance. diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md deleted file mode 100644 index d343391f22..0000000000 --- a/education/windows/edu-deployment-recommendations.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Deployment recommendations for school IT administrators -description: Provides guidance on ways to customize the OS privacy settings, and some of the apps, for Windows-based devices used in schools so that you can choose what information is shared with Microsoft. -ms.topic: best-practice -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- - -# Deployment recommendations for school IT administrators - -Your privacy is important to us, so we want to provide you with ways to customize the OS privacy settings, and some of the apps, so that you can choose what information is shared with Microsoft. To learn more about Microsoft's commitment to privacy, see [Windows 10 and privacy](https://go.microsoft.com/fwlink/?LinkId=809305). The following sections provide some best practices and specific privacy settings we'd like you to be aware of. For more information about ways to customize the OS diagnostic data, consumer experiences, Cortana, and search, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). - -We want all students to have the chance to use the apps they need for success in the classroom and all school personnel to have apps they need for their job. Students and school personnel who use assistive technology apps not available in the Microsoft Store, and use devices running Windows 10 S, will be able to configure the device at no extra charge to Windows 10 Pro Education. To learn more about the steps to configure this device, see [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md). - -## Deployment best practices - -Keep these best practices in mind when deploying any edition of Windows 10 in schools or districts: - -* A Microsoft account is only intended for consumer services. Enterprises and educational institutions should use enterprise versions where possible, such as Skype for Business, OneDrive for Business, and so on. For schools, consider using mobile device management (MDM) or Group Policy to block students from adding a Microsoft account as a secondary account -* If schools allow the use of personal accounts by their students to access personal services, schools should be aware that these accounts belong to individuals, not the school -* IT administrators, school officials, and teachers should also consider ratings when picking apps from the Microsoft Store -* If you've students or school personnel who rely on assistive technology apps that aren't available in the Microsoft Store, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) for more info - -## Windows 10 Contacts privacy settings - -If you're an IT administrator who deploys Windows 10 in a school or district, we recommend that you review these deployment resources to make informed decisions about how you can configure telemetry for your school or district: - -* [Configure Windows telemetry in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization) - Describes the types of telemetry we gather and the ways you can manage this data -* [Manage connections from Windows operating system components to Microsoft services](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) - Learn about network connections that Windows components make to Microsoft and also the privacy settings (such as location, camera, messaging, and more) that affect data that is shared with either Microsoft or apps and how you can manage this data - -In particular, the **Contacts** area in the **Settings** > **Privacy** section lets you choose which apps can access a student's contacts list. By default, this setting is turned on. - -To change the setting, you can: -* [Turn off access to contacts for all apps](#turn-off-access-to-contacts-for-all-apps) -* [Choose the apps that you want to allow access to contacts](#choose-the-apps-that-you-want-to-allow-access-to-contacts) - -### Turn off access to contacts for all apps - -To turn off access to contacts for all apps on individual Windows devices: - -1. On the computer, go to **Settings** and select **Privacy**. -1. Under the list of **Privacy** areas, select **Contacts**. -1. Turn off **Let apps access my contacts**. - -For IT-managed Windows devices, you can use a Group Policy to turn off the setting. To turn off the setting: - -1. Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access contacts**. -1. Set the **Select a setting** box to **Force Deny**. - -### Choose the apps that you want to allow access to contacts - -If you want to allow only certain apps to have access to contacts, you can use the switch for each app to specify which ones you want on or off. - -The list of apps on the Windows-based device may vary from the above example. The list depends on what apps you've installed and which of these apps access contacts. - -To allow only certain apps to have access to contacts, you can: - -- Configure each app individually using the **Settings** > **Contacts** option in the Windows UI -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access contacts** and then specify the default for each app by adding the app's Package Family Name under the default behavior you want to enforce - -## Skype and Xbox settings - -Skype (a Universal Windows Platform [UWP]) and Xbox are preinstalled as part of Windows 10. - -The Skype app replaces the integration of Skype features into Skype video and Messaging apps on Windows PCs and large tablets. The Skype app provides all these features in one place and lets users have a single place to manage both their chat and voice conversations so they can take better advantage of their screen. For information about the new Skype UWP app preview, see [Skype for Windows 10 Insiders – your most asked questions](https://go.microsoft.com/fwlink/?LinkId=821441). - -With the Xbox app, students can use their Xbox profiles to play and make progress on their games using their Windows-based device. They can also unlock achievements and show off to their friends with game clips and screenshots. The Xbox app requires a Microsoft account, which is a personal account. - -Both Skype and Xbox include searchable directories that let students find other people to connect to. The online privacy and security settings for Skype and Xbox aren't manageable through Group Policy so we recommend that school IT administrators and school officials let parents and students know about these searchable directories. - -If the school allows the use of personal or Microsoft account in addition to organization accounts, we also recommend that IT administrators inform parents and students that they can optionally remove any identifying information from the directories by: - -* [Managing the user profile](#managing-the-user-profile) -* [Deleting the account if the user name is part of the identifying information](#delete-an-account-if-username-is-identifying) - -### Managing the user profile - -#### Skype - -Skype uses the user's contact details to deliver important information about the account and it also lets friends find each other on Skype. - -To manage and edit your profile in the Skype UWP app, follow these steps: - -1. In the Skype UWP app, select the user profile icon to go to the user's profile page. -2. In the account page, select **Manage account** for the Skype account that you want to change. This will take you to the online Skype portal. -3. In the online Skype portal, scroll down to the **Account details** section. In **Settings and preferences**, click **Edit profile**. - - The profile page includes these sections: - - * Personal information - * Contact details - * Profile settings - -4. Review the information in each section and click **Edit profile** in either or both the **Personal information** and **Contact details** sections to change the information being shared. You can also remove the checks in the **Profile settings** section to change settings on discoverability, notifications, and staying in touch. -5. If you don't wish the name to be included, edit the fields and replace the fields with **XXX**. -6. To change the profile picture, go to the Skype app and click on the current profile picture or avatar. The **Manage Profile Picture** window pops up. - - * To take a new picture, click the camera icon in the pop-up window. To upload a new picture, click the three dots (**...**) - * You can also change the visibility of the profile picture between public (everyone) or for contacts only. To change the profile picture visibility, select the dropdown under **Profile picture** and choose between **Show to everyone** or **Show to contacts only** - -#### Xbox - -A user's Xbox friends and their friends' friends can see their real name and profile. By default, the Xbox privacy settings enforce that no personal identifying information of a minor is shared on the Xbox Live network, although adults in the child's family can change these default settings to allow it to be more permissive. - -To learn more about how families can manage security and privacy settings on Xbox, see this [Xbox article on security](https://go.microsoft.com/fwlink/?LinkId=821445). - - -### Delete an account if username is identifying - -If you want to delete either (or both) the Skype and the Xbox accounts, here's how to do it. - -#### Skype - -To delete a Skype account, you can follow the instructions here: [How do I close my Skype account?](https://go.microsoft.com/fwlink/?LinkId=816515) - -If you need help with deleting the account, you can contact Skype customer service by going to the [Skype support request page](https://go.microsoft.com/fwlink/?LinkId=816519). You may need to sign in and specify a Skype account. Once you've signed in, you can: - -1. Select a help topic (**Account and Password**) -1. Select a related problem (**Deleting an account**) -1. Click **Next**. -1. Select a contact method to get answers to your questions. - -#### Xbox - -To delete an Xbox account, you can follow the instructions here: [How to delete your Microsoft account and personal information associated with it](https://go.microsoft.com/fwlink/?LinkId=816521). - -## Related topics -[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) diff --git a/education/windows/images/autopilot-reset-customlogin.png b/education/windows/images/autopilot-reset-customlogin.png deleted file mode 100644 index d86cb57895..0000000000 Binary files a/education/windows/images/autopilot-reset-customlogin.png and /dev/null differ diff --git a/education/windows/images/autopilot-reset-lockscreen.png b/education/windows/images/autopilot-reset-lockscreen.png deleted file mode 100644 index f6fa6d3467..0000000000 Binary files a/education/windows/images/autopilot-reset-lockscreen.png and /dev/null differ diff --git a/education/windows/images/autopilot-reset-provisioningcomplete.png b/education/windows/images/autopilot-reset-provisioningcomplete.png deleted file mode 100644 index dd62db8c72..0000000000 Binary files a/education/windows/images/autopilot-reset-provisioningcomplete.png and /dev/null differ diff --git a/education/windows/images/suspcs/suspc_configure_pc2.jpg b/education/windows/images/suspcs/suspc_configure_pc2.jpg deleted file mode 100644 index 68c0080b22..0000000000 Binary files a/education/windows/images/suspcs/suspc_configure_pc2.jpg and /dev/null differ diff --git a/education/windows/set-up-school-pcs-azure-ad-join.md b/education/windows/set-up-school-pcs-azure-ad-join.md deleted file mode 100644 index 27bffd9a4e..0000000000 --- a/education/windows/set-up-school-pcs-azure-ad-join.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: Microsoft Entra join with Set up School PCs app -description: Learn how Microsoft Entra join is configured in the Set up School PCs app. -ms.topic: reference -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- - -# Microsoft Entra join for school PCs - -> [!NOTE] -> Set up School PCs app uses Microsoft Entra join to configure PCs. The app is helpful if you use the cloud based directory, Microsoft Entra ID. If your organization uses Active Directory or requires no account to connect, install and use [Windows Configuration -> Designer](set-up-students-pcs-to-join-domain.md) to -> join your PCs to your school's domain. - -Set up School PCs lets you create a provisioning package that automates Microsoft Entra ID -Join on your devices. This feature eliminates the need to manually: - -- Connect to your school's network. -- Join your organization's domain. - -## Automated connection to school domain - -During initial device setup, Microsoft Entra join automatically connects your PCs to your school's Microsoft Entra domain. You can skip all of the Windows setup experience that is typically a part of the out-of-the-box-experience (OOBE). Devices that are managed by a mobile device manager, such as Intune, are automatically enrolled with the provider upon initial device startup. - -Students who sign in to their PCs with their Microsoft Entra credentials get access to on-premises apps and the following cloud apps: -* Office 365 -* OneDrive -* OneNote - - - -## Enable Microsoft Entra join - -Learn how to enable Microsoft Entra join for your school. After you configure this setting, you'll be able to request an automated Microsoft Entra bulk token, which you need to create a provisioning package. - -1. Sign in to the Azure portal with your organization's credentials. -2. Go to **Azure -Active Directory** \> **Devices** \> **Device settings**. -3. Enable the setting -for Microsoft Entra ID by selecting **All** or **Selected**. If you choose the latter -option, select the teachers and IT staff to allow them to connect to Microsoft Entra ID. - -![Select the users you want to let join devices to Azure AD.](images/suspcs/suspc-enable-shared-pc-1807.png) - -You can also create an account that holds the exclusive rights to join devices. When a student PC has to be set up, provide the account credentials to the appropriate teachers or staff. - -## All Device Settings - -The following table describes each setting within **Device Settings**. - -| Setting | Description | -|------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Users may join devices to Microsoft Entra ID | Choose the scope of people in your organization that are allowed to join devices to Microsoft Entra ID. **All** allows all users and groups within your tenant to join devices. **Selected** prompts you to choose specific users or groups to allow. **None** allows no one in your tenant to join devices to Microsoft Entra ID. | -| More local administrators on Microsoft Entra joined devices | Only applicable to Microsoft Entra ID P1 or P2 tenants. Grant extra local administrator rights on devices, to selected users. Global administrators and the device owner are granted local administrator rights by default. | -| Users may register their devices with Microsoft Entra ID | Allow all or none of your users to register their devices with Microsoft Entra ID (Workplace Join). If you're enrolled in Microsoft Intune or Mobile Device Management for Office 365, your devices are required to be registered. In this case, **All** is automatically selected for you. | -| Require Multi-Factor Authentication to join devices | Recommended when adding devices to Microsoft Entra ID. When set to **Yes**, users that are setting up devices must enter a second method of authentication. | -| Maximum number of devices per user | Set the maximum number of devices a user is allowed to have in Microsoft Entra ID. If the maximum is exceeded, the user must remove one or more existing devices before more devices are added. | -| Users may sync settings and enterprise app data | Allow all or none of your users to sync settings and app data across multiple devices. Tenants with Microsoft Entra ID P1 or P2 are permitted to select specific users to allow. | - - - -## Clear Microsoft Entra tokens - -Your Intune tenant can only have 500 active Microsoft Entra tokens, or packages, at a time. You'll receive a notification in the Intune portal when you reach 500 active tokens. - -To reduce your inventory, clear out all unnecessary and inactive tokens. -1. Go to **Microsoft Entra ID** > **Users** > **All users** -2. In the **User Name** column, select and delete all accounts with a **package\ _** -prefix. These accounts are created at a 1:1 ratio for every token and are safe -to delete. -3. Select and delete inactive and expired user accounts. - -### How do I know if my package expired? -Automated Microsoft Entra tokens expire after 180 days. The expiration date for each token is appended to the end of the saved provisioning package, on the USB drive. After this date, you must create a new package. Be careful that you don't delete active accounts. - -![Screenshot of the Azure portal, Microsoft Entra ID, All Users page. Highlights all accounts that start with the prefix package_ and can be deleted.](images/suspcs/suspc-admin-token-delete-1807.png) - -## Next steps -Learn more about setting up devices with the Set up School PCs app. -* [What's in my provisioning package?](set-up-school-pcs-provisioning-package.md) -* [Set up School PCs technical reference](set-up-school-pcs-technical.md) -* [Set up Windows 10 devices for education](set-up-windows-10.md) - -When you're ready to create and apply your provisioning package, see [Use Set up School PCs app](use-set-up-school-pcs-app.md). diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 8dd635d04e..213c75c26f 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -2,7 +2,7 @@ title: Set up School PCs app technical reference overview description: Describes the purpose of the Set up School PCs app for Windows 10 devices. ms.topic: overview -ms.date: 08/10/2022 +ms.date: 01/16/2024 appliesto: - ✅ Windows 10 --- @@ -14,47 +14,36 @@ The **Set up School PCs** app helps you configure new Windows 10 PCs for school If your school uses Microsoft Entra ID or Office 365, the Set up School PCs app will create a setup file. This file joins the PC to your Microsoft Entra tenant. The app also helps set up PCs for use with or without Internet connectivity. - +## Join devices to Microsoft Entra ID -## Join PC to Microsoft Entra ID -If your school uses Microsoft Entra ID or Office 365, the Set up -School PCs app creates a setup file that joins your PC to your Azure Active -Directory tenant. +If your school uses Microsoft Entra ID or Office 365, the Set up School PCs app creates a setup file that joins your PC to your Microsoft Entra ID tenant. The app also helps set up PCs for use with or without Internet connectivity. ## List of Set up School PCs features + The following table describes the Set up School PCs app features and lists each type of Intune subscription. An X indicates that the feature is available with the specific subscription. -| Feature | No Internet | Microsoft Entra ID | Office 365 | Microsoft Entra ID P1 or P2 | -|--------------------------------------------------------------------------------------------------------|-------------|----------|------------|------------------| -| **Fast sign-in** | X | X | X | X | -| Students sign in and start using the computer in under a minute, even on initial sign-in. | | | | | -| **Custom Start experience** | X | X | X | X | -| Necessary classroom apps are pinned to Start and unnecessary apps are removed. | | | | | -| **Guest account, no sign-in required** | X | X | X | X | -| Set up computers for use by anyone with or without an account. | | | | | -| **School policies** | X | X | X | X | -| Settings create a relevant, useful learning environment and optimal computer performance. | | | | | -| **Microsoft Entra join** | | X | X | X | -| Computers join with your existing Microsoft Entra ID or Office 365 subscription for centralized management. | | | | | -| **Single sign-on to Office 365** | | | X | X | -| Students sign in with their IDs to access all Office 365 web apps or installed Office apps. | | | | | -| **Take a Test app** | | | | X | -| Administer quizzes and assessments through test providers such as Smarter Balanced. | | | | | -| [Settings roaming](/azure/active-directory/devices/enterprise-state-roaming-overview) **via Microsoft Entra ID** | | | | X | -| Synchronize student and application data across devices for a personalized experience. | | | | | +| Feature | No Internet | Microsoft Entra ID | Office 365 | Microsoft Entra ID P1 or P2 | +|--|--|--|--|--| +| **Fast sign-in** | X | X | X | X | +| Students sign in and start using the computer in under a minute, even on initial sign-in. | | | | | +| **Custom Start experience** | X | X | X | X | +| Necessary classroom apps are pinned to Start and unnecessary apps are removed. | | | | | +| **Guest account, no sign-in required** | X | X | X | X | +| Set up computers for use by anyone with or without an account. | | | | | +| **School policies** | X | X | X | X | +| Settings create a relevant, useful learning environment and optimal computer performance. | | | | | +| **Microsoft Entra join** | | X | X | X | +| Computers join with your existing Microsoft Entra ID or Office 365 subscription for centralized management. | | | | | +| **Single sign-on to Office 365** | | | X | X | +| Students sign in with their IDs to access all Office 365 web apps or installed Office apps. | | | | | +| **Take a Test app** | | | | X | +| Administer quizzes and assessments through test providers such as Smarter Balanced. | | | | | +| [Settings roaming](/azure/active-directory/devices/enterprise-state-roaming-overview) **via Microsoft Entra ID** | | | | X | +| Synchronize student and application data across devices for a personalized experience. | | | | | -> [!NOTE] -> If your school uses Active Directory, use [Windows Configuration -> Designer](set-up-students-pcs-to-join-domain.md) -> to configure your PCs to join the domain. You can only use the Set up School -> PCs app to set up PCs that are connected to Microsoft Entra ID. - -## Next steps -Learn more about setting up devices with the Set up School PCs app. -* [Microsoft Entra join with Set up School PCs](set-up-school-pcs-azure-ad-join.md) -* [What's in my provisioning package](set-up-school-pcs-provisioning-package.md) -* [Set up Windows 10 devices for education](set-up-windows-10.md) +>[!NOTE] +>You can only use the Set up School PCs app to set up PCs that are connected to Microsoft Entra ID. When you're ready to create and apply your provisioning package, see [Use Set up School PCs app](use-set-up-school-pcs-app.md). diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md deleted file mode 100644 index 91f2ad28d1..0000000000 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Set up student PCs to join domain -description: Learn how to use Windows Configuration Designer to provision student devices to join Active Directory. -ms.topic: how-to -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- - -# Set up student PCs to join domain - -If your school uses Active Directory, use the Windows Configuration Designer tool to create a provisioning package that will configure a PC for student use that is joined to the Active Directory domain. - -## Install Windows Configuration Designer -Follow the instructions in [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). - -## Create the provisioning package -Follow the steps in [Provision PCs with common settings for initial deployment (desktop wizard)](/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment). However, make a note of these steps to further customize the provisioning package for use in a school that will join a student PC to a domain: - -1. In the **Account Management** step: - - > [!WARNING] - > If you don't create a local administrator account and the device fails to enroll in Active Directory for any reason, you'll have to reimage the device and start over. As a best practice, we recommend: - > - Use a least-privileged domain account to join the device to the domain. - > - Create a temporary administrator account to use for debugging or reprovisioning if the device fails to enroll successfully. - > - [Use Group Policy to delete the temporary administrator account](/archive/blogs/canitpro/group-policy-creating-a-standard-local-admin-account) after the device is enrolled in Active Directory. - -2. After you're done with the wizard, don't click **Create**. Instead, click the **Switch to advanced editor** to switch the project to the advanced editor to see all the available **Runtime settings**. -3. Find the **SharedPC** settings group. - - Set **EnableSharedPCMode** to **TRUE** to configure the PC for shared use. -4. (Optional) To configure the PC for secure testing, follow these steps. - 1. Under **Runtime settings**, go to **AssignedAccess > AssignedAccessSettings**. - 2. Enter **{"Account":"*redmond\\kioskuser*","AUMID":” Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App "}**, using the account that you want to set up. - - **Figure 7** - Add the account to use for test-taking - - ![Add the account to use for test-taking.](images/wcd/wcd_settings_assignedaccess.png) - - The account can be in one of the following formats: - - username - - domain\username - - computer name\\username - - username@tenant.com - - 3. Under **Runtime settings**, go to **TakeATest** and configure the following settings: - 1. In **LaunchURI**, enter the assessment URL. - 2. In **TesterAccount**, enter the test account you entered in the previous step. - -5. To configure other settings to make Windows education ready, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md) and follow the guidance on what settings you can set using Windows Configuration Designer. - -6. Follow the steps to [build a package](/windows/configuration/provisioning-packages/provisioning-create-package#build-package). - - You'll see the file path for your provisioning package. By default, this path is set to %windir%\Users\*your_username\Windows Imaging and Configuration Designer (WICD)\*Project name). - - Copy the provisioning package to a USB drive. - - > [!IMPORTANT] - > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -## Apply package -Follow the steps in [Apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-apply-package) to apply the package that you created. \ No newline at end of file diff --git a/education/windows/set-up-students-pcs-with-apps.md b/education/windows/set-up-students-pcs-with-apps.md deleted file mode 100644 index 669dc2484c..0000000000 --- a/education/windows/set-up-students-pcs-with-apps.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: Provision student PCs with apps -description: Learn how to use Windows Configuration Designer to easily provision student devices to join Active Directory. -ms.topic: how-to -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- -# Provision student PCs with apps - -To create and apply a provisioning package that contains apps to a device running all desktop editions of Windows 10 except Windows 10 Home, follow the steps in [Provision PCs with apps](/windows/configuration/provisioning-packages/provision-pcs-with-apps). - -Provisioning packages can include management instructions and policies, installation of specific apps, customization of network connections and policies, and more. - -You can apply a provisioning package on a USB drive to off-the-shelf devices during setup, making it fast and easy to configure new devices. - -- If you want to [provision a school PC to join a domain](set-up-students-pcs-to-join-domain.md) and add apps in the same provisioning package, follow the steps in [Provision PCs with apps](/windows/configuration/provisioning-packages/provision-pcs-with-apps). - -- If you want to provision a school PC to join Microsoft Entra ID, set up the PC using the steps in [Use Set up School PCs App](use-set-up-school-pcs-app.md). Set up School PCs now lets you add recommended apps from the Store so you can add these apps while you're creating your package through Set up School PCs. You can also follow the steps in [Provision PCs with apps](/windows/configuration/provisioning-packages/provision-pcs-with-apps) if you want to add apps to student PCs after initial setup with the Set up School PCs package. - -## Learn more - --[Develop Universal Windows Education apps](/windows/uwp/apps-for-education/) - -- [Build and apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package) diff --git a/education/windows/set-up-windows-10.md b/education/windows/set-up-windows-10.md deleted file mode 100644 index 784d5978ac..0000000000 --- a/education/windows/set-up-windows-10.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: Set up Windows devices for education -description: Decide which option for setting up Windows 10 is right for you. -ms.topic: overview -ms.date: 08/10/2022 -appliesto: - - ✅ Windows 10 ---- - -# Set up Windows devices for education - -You have two tools to choose from to set up PCs for your classroom: - -- Set up School PCs -- Windows Configuration Designer - -Choose the tool that is appropriate for how your students will sign in (Active Directory, Microsoft Entra ID, or no account). - -You can use the following diagram to compare the tools. - -![Which tool to use to set up Windows 10.](images/suspcs/suspc_wcd_featureslist.png) - -## In this section - -- [Use the Set up School PCs app](use-set-up-school-pcs-app.md) -- [Technical reference for the Set up School PCs app](set-up-school-pcs-technical.md) -- [Set up student PCs to join domain](set-up-students-pcs-to-join-domain.md) -- [Provision student PCs with apps](set-up-students-pcs-with-apps.md) - -## Related topics - -[Take tests in Windows](take-tests-in-windows.md) -[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)S diff --git a/education/windows/toc.yml b/education/windows/toc.yml index dab0b937a3..ef02b15f30 100644 --- a/education/windows/toc.yml +++ b/education/windows/toc.yml @@ -26,8 +26,6 @@ items: href: /windows/deployment/windows-10-pro-in-s-mode?context=/education/context/context - name: Deploy Win32 apps to S Mode devices href: /windows/security/threat-protection/windows-defender-application-control/lob-win32-apps-on-s?context=/education/context/context - - name: Windows 10 editions for education customers - href: windows-editions-for-education-customers.md - name: Considerations for shared and guest devices href: /windows/configuration/shared-devices-concepts?context=/education/context/context - name: Windows 10 configuration recommendations for education customers @@ -56,8 +54,6 @@ items: href: use-set-up-school-pcs-app.md - name: Upgrade Windows Home to Windows Education on student-owned devices href: change-home-to-edu.md - - name: Reset devices with Autopilot Reset - href: autopilot-reset.md - name: Reference items: - name: Set up School PCs @@ -66,8 +62,6 @@ items: href: set-up-school-pcs-technical.md - name: Provisioning package settings href: set-up-school-pcs-provisioning-package.md - - name: What's new in Set up School PCs - href: set-up-school-pcs-whats-new.md - name: Take a Test technical reference href: take-a-test-app-technical.md - name: Shared PC technical reference diff --git a/education/windows/tutorial-school-deployment/configure-device-apps.md b/education/windows/tutorial-school-deployment/configure-device-apps.md index ef1e695396..25171ff770 100644 --- a/education/windows/tutorial-school-deployment/configure-device-apps.md +++ b/education/windows/tutorial-school-deployment/configure-device-apps.md @@ -1,7 +1,7 @@ --- title: Configure applications with Microsoft Intune description: Learn how to configure applications with Microsoft Intune in preparation for device deployment. -ms.date: 03/08/2023 +ms.date: 01/16/2024 ms.topic: tutorial --- @@ -14,11 +14,12 @@ Applications can be assigned to groups: - If you target apps to a **group of users**, the apps will be installed on any managed devices that the users sign into - If you target apps to a **group of devices**, the apps will be installed on those devices and available to any user who signs in -In this section you will: > [!div class="checklist"] -> * Add apps to Intune for Education -> * Assign apps to groups -> * Review some considerations for Windows 11 SE devices +>In this section you will: +> +> - Add apps to Intune for Education +> - Assign apps to groups +> - Review some considerations for Windows 11 SE devices ## Add apps to Intune for Education diff --git a/education/windows/tutorial-school-deployment/configure-device-settings.md b/education/windows/tutorial-school-deployment/configure-device-settings.md index fc71325532..0911784589 100644 --- a/education/windows/tutorial-school-deployment/configure-device-settings.md +++ b/education/windows/tutorial-school-deployment/configure-device-settings.md @@ -1,7 +1,7 @@ --- title: Configure and secure devices with Microsoft Intune description: Learn how to configure policies with Microsoft Intune in preparation for device deployment. -ms.date: 11/09/2023 +ms.date: 01/16/2024 ms.topic: tutorial --- @@ -23,12 +23,14 @@ There are two ways to manage settings in Intune for Education: > [!NOTE] > Express Configuration is ideal when you are getting started. Settings are pre-configured to Microsoft-recommended values, but can be changed to fit your school's needs. It is recommended to use Express Configuration to initially set up your Windows devices. -In this section you will: + > [!div class="checklist"] -> * Configure settings with Express Configuration -> * Configure group settings -> * Create Windows Update policies -> * Configure security policies +>In this section you will: +> +> - Configure settings with Express Configuration +> - Configure group settings +> - Create Windows Update policies +> - Configure security policies ## Configure settings with Express Configuration diff --git a/education/windows/tutorial-school-deployment/configure-devices-overview.md b/education/windows/tutorial-school-deployment/configure-devices-overview.md index fa6e5c218a..11039ebcbb 100644 --- a/education/windows/tutorial-school-deployment/configure-devices-overview.md +++ b/education/windows/tutorial-school-deployment/configure-devices-overview.md @@ -11,11 +11,13 @@ Before distributing devices to your users, you must ensure that the devices will Microsoft Intune uses Microsoft Entra groups to assign policies and applications to devices. With Microsoft Intune for Education, you can conveniently create groups and assign policies and applications to them. -In this section you will: + > [!div class="checklist"] -> * Create groups -> * Create and assign policies to groups -> * Create and assign applications to groups +>In this section you will: +> +> - Create groups +> - Create and assign policies to groups +> - Create and assign applications to groups ## Create groups diff --git a/education/windows/tutorial-school-deployment/enroll-autopilot.md b/education/windows/tutorial-school-deployment/enroll-autopilot.md index 26300b5115..23985289cf 100644 --- a/education/windows/tutorial-school-deployment/enroll-autopilot.md +++ b/education/windows/tutorial-school-deployment/enroll-autopilot.md @@ -1,7 +1,7 @@ --- title: Enrollment in Intune with Windows Autopilot description: Learn how to join Microsoft Entra ID and enroll in Intune using Windows Autopilot. -ms.date: 03/08/2023 +ms.date: 01/16/2024 ms.topic: tutorial --- @@ -61,8 +61,9 @@ More advanced dynamic membership rules can be created from Microsoft Intune admi For Autopilot devices to offer a customized OOBE experience, you must create **Windows Autopilot deployment profiles** and assign them to a group containing the devices. A deployment profile is a collection of settings that determine the behavior of the device during OOBE. Among other settings, a deployment profile specifies a **deployment mode**, which can either be: + 1. **User-driven:** devices with this profile are associated with the user enrolling the device. User credentials are required to complete the Microsoft Entra join process during OOBE -1. **Self-deploying:** devices with this profile aren't associated with the user enrolling the device. User credentials aren't required to complete the Microsoft Entra join process. Rather, the device is joined automatically and, for this reason, specific hardware requirements must be met to use this mode. +1. **Self-deploying:** devices with this profile aren't associated with the user enrolling the device. User credentials aren't required to complete the Microsoft Entra join process. Rather, the device is joined automatically and, for this reason, specific hardware requirements must be met to use this mode To create an Autopilot deployment profile: @@ -142,8 +143,6 @@ With the devices joined to Microsoft Entra tenant and managed by Intune, you can [M365-1]: https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2 -[EDU-1]: /education/windows/windows-11-se-overview -[EDU-2]: /intune-education/windows-11-se-overview#windows-autopilot [EDU-3]: ../tutorial-deploy-apps-winse/considerations.md#enrollment-status-page [SURF-1]: /surface/surface-autopilot-registration-support diff --git a/education/windows/tutorial-school-deployment/set-up-microsoft-entra-id.md b/education/windows/tutorial-school-deployment/set-up-microsoft-entra-id.md index b1ab1cfc12..845d66a892 100644 --- a/education/windows/tutorial-school-deployment/set-up-microsoft-entra-id.md +++ b/education/windows/tutorial-school-deployment/set-up-microsoft-entra-id.md @@ -1,7 +1,7 @@ --- title: Set up Microsoft Entra ID description: Learn how to create and prepare your Microsoft Entra tenant for an education environment. -ms.date: 11/09/2023 +ms.date: 01/16/2024 ms.topic: tutorial appliesto: --- @@ -12,12 +12,13 @@ The Microsoft platform for education simplifies the management of Windows device Microsoft Entra ID, which is included with the Microsoft 365 Education subscription, provides authentication and authorization to any Microsoft cloud services. Identity objects are defined in Microsoft Entra ID for human identities, like students and teachers, as well as non-human identities, like devices, services, and applications. Once users get Microsoft 365 licenses assigned, they'll be able to consume services and access resources within the tenant. With Microsoft 365 Education, you can manage identities for your teachers and students, assign licenses to devices and users, and create groups for the classrooms. -In this section you will: > [!div class="checklist"] -> * Set up a Microsoft 365 Education tenant -> * Add users, create groups, and assign licenses -> * Configure school branding -> * Enable bulk enrollment +>In this section you will: +> +> - Set up a Microsoft 365 Education tenant +> - Add users, create groups, and assign licenses +> - Configure school branding +> - Enable bulk enrollment ## Create a Microsoft 365 tenant @@ -45,7 +46,7 @@ For more information, see [Overview of the Microsoft 365 admin center][M365-2]. With the Microsoft 365 tenant in place, it's time to add users, create groups, and assign licenses. All students and teachers need a user account before they can sign in and access the different Microsoft 365 services. There are multiple ways to do this, including using School Data Sync (SDS), synchronizing an on-premises Active Directory, manually, or a combination of the above. > [!NOTE] -> Synchronizing your Student Information System (SIS) with School Data Sync is the preferred way to create students and teachers as users in a Microsoft 365 Education tenant. However, if you want to integrate an on-premises directory and synchronize accounts to the cloud, skip to [Azure Active Directory Sync](#azure-active-directory-sync) below. +> Synchronizing your Student Information System (SIS) with School Data Sync is the preferred way to create students and teachers as users in a Microsoft 365 Education tenant. However, if you want to integrate an on-premises directory and synchronize accounts to the cloud, skip to [Microsoft Entra Connect Sync](#microsoft-entra-connect-sync) below. ### School Data Sync @@ -61,7 +62,7 @@ For more information, see [Overview of School Data Sync][SDS-1]. > > Remember that you should typically deploy test SDS data (users, groups, and so on) in a separate test tenant, not your school production environment. -### Azure Active Directory Sync +### Microsoft Entra Connect Sync To integrate an on-premises directory with Microsoft Entra ID, you can use **Microsoft Entra Connect** to synchronize users, groups, and other objects. Microsoft Entra Connect lets you configure the authentication method appropriate for your school, including: diff --git a/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md b/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md index 38dc58b276..1ee9608b0c 100644 --- a/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md +++ b/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md @@ -1,7 +1,7 @@ --- title: Set up device management description: Learn how to configure the Intune service and set up the environment for education. -ms.date: 11/09/2023 +ms.date: 01/16/2024 ms.topic: tutorial appliesto: --- @@ -18,10 +18,11 @@ The Microsoft Intune service can be managed in different ways, and one of them i For more information, see [Intune for Education documentation][INT-1]. -In this section you will: > [!div class="checklist"] -> * Review Intune's licensing prerequisites -> * Configure the Intune service for education devices +>In this section you will: +> +> - Review Intune's licensing prerequisites +> - Configure the Intune service for education devices ## Prerequisites diff --git a/education/windows/windows-11-se-faq.yml b/education/windows/windows-11-se-faq.yml index 52fa4c5d69..4a9b022c07 100644 --- a/education/windows/windows-11-se-faq.yml +++ b/education/windows/windows-11-se-faq.yml @@ -3,7 +3,7 @@ metadata: title: Windows 11 SE Frequently Asked Questions (FAQ) description: Use these frequently asked questions (FAQ) to learn important details about Windows 11 SE. ms.topic: faq - ms.date: 03/09/2023 + ms.date: 01/16/2024 appliesto: - ✅ Windows 11 SE diff --git a/education/windows/windows-11-se-overview.md b/education/windows/windows-11-se-overview.md index e82eb8a227..eec8f909f1 100644 --- a/education/windows/windows-11-se-overview.md +++ b/education/windows/windows-11-se-overview.md @@ -2,7 +2,7 @@ title: Windows 11 SE Overview description: Learn about Windows 11 SE, and the apps that are included with the operating system. ms.topic: overview -ms.date: 11/02/2023 +ms.date: 01/09/2024 appliesto: - ✅ Windows 11 SE ms.collection: @@ -88,6 +88,7 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `AristotleK12 Borderless Classroom ` | 3.0.11. | `Win32` | `Sergeant Laboratories` | | `AristotleK12 Analytics ` | 10.0.6 | `Win32` | `Sergeant Laboratories` | | `AristotleK12 Network filter` | 3.1.10 | `Win32` | `Sergeant Laboratories` | +| `Bluebook` | 0.9.203 | `Win32` | `Collegeboard` | | `Brave Browser` | 106.0.5249.119 | `Win32` | `Brave` | | `Bulb Digital Portfolio` | 0.0.7.0 | `Store` | `Bulb` | | `CA Secure Browser` | 15.0.0 | `Win32` | `Cambium Development` | @@ -101,8 +102,9 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `ContentKeeper Cloud` | 9.01.45 | `Win32` | `ContentKeeper Technologies` | | `DigiExam` | 14.1.0 | `Win32` | `Digiexam` | | `Digital Secure testing browser` | 15.0.0 | `Win32` | `Digiexam` | +| `Dolphin Guide Connect` | 1.25 | `Win32` | `Dolphin Guide Connect` | | `Dragon Professional Individual` | 15.00.100 | `Win32` | `Nuance Communications` | -| `DRC INSIGHT Online Assessments` | 13.0.0.0 | `Store` | `Data recognition Corporation` | +| `DRC INSIGHT Online Assessments` | 14.0.0.0 | `Store` | `Data recognition Corporation` | | `Duo from Cisco` | 3.0.0 | `Win32` | `Cisco` | | `Dyknow` | 7.9.13.7 | `Win32` | `Dyknow` | | `e-Speaking Voice and Speech recognition` | 4.4.0.11 | `Win32` | `e-speaking` | @@ -125,9 +127,9 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `Impero Backdrop Client` | 5.0.151 | `Win32` | `Impero Software` | | `IMT Lazarus` | 2.86.0 | `Win32` | `IMTLazarus` | | `Inspiration 10` | 10.11 | `Win32` | `TechEdology Ltd` | -| `JAWS for Windows` | 2022.2112.24 | `Win32` | `Freedom Scientific` | +| `JAWS for Windows` | 2023.2307.37 | `Win32` | `Freedom Scientific` | | `Kite Student Portal` | 9.0.0.0 | `Win32` | `Dynamic Learning Maps` | -| `Keyman` | 16.0.141 | `Win32` | `SIL International` | +| `Keyman` | 16.0.142 | `Win32` | `SIL International` | | `Kortext` | 2.3.433.0 | `Store` | `Kortext` | | `Kurzweil 3000 Assistive Learning` | 20.13.0000 | `Win32` | `Kurzweil Educational Systems` | | `LanSchool Classic` | 9.1.0.46 | `Win32` | `Stoneware, Inc.` | @@ -135,10 +137,13 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `Lexibar` | 3.07.02 | `Win32` | `Lexibar` | | `LGfL HomeProtect` | 8.3.44.11 | `Win32` | `LGFL` | | `Lightspeed Smart Agent` | 1.9.1 | `Win32` | `Lightspeed Systems` | -| `Lightspeed Filter Agent` | 2.3.4 | `Win32` | `Lightspeed Systems` | +| `Lightspeed Classroom` | 3.4.5.0 | `Win32` | `Lightspeed Systems` | +| `Lightspeed Filter Agent` | 2.5.2 | `Win32` | `Lightspeed Systems` | | `Lightspeed Digital` | 3.12.3.11 | `Win32` | `Lightspeed Systems` | +| `Linewize Authentication agent ` |1.4.1 | `Win32` | `Linewize` | | `MetaMoJi ClassRoom` | 3.12.4.0 | `Store` | `MetaMoJi Corporation` | | `Microsoft Connect` | 10.0.22000.1 | `Store` | `Microsoft` | +| `Mind+ Desktop` | 1.8.0 | `Win32` | `Mind+Desktop` | | `Mozilla Firefox` | 116.0.2 | `Win32` | `Mozilla` | | `Mobile Plans` | 5.1911.3171.0 | `Store` | `Microsoft Corporation` | | `Musescore` | 4.1.1.232071203 | `Win32` | `Musescore` | @@ -157,19 +162,20 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `PaperCut` | 22.0.6 | `Win32` | `PaperCut Software International Pty Ltd` | | `Pearson TestNav` | 1.11.3 | `Store` | `Pearson` | | `Project Monarch Outlook` | 1.2023.831.400 | `Store` | `Microsoft` | -| `Questar Secure Browser` | 5.0.1.456 | `Win32` | `Questar, Inc` | +| `Questar Secure Browser` | 5.0.5.536 | `Win32` | `Questar, Inc` | | `ReadAndWriteForWindows` | 12.0.78 | `Win32` | `Texthelp Ltd.` | | `Remote Desktop client (MSRDC)` | 1.2.4487.0 | `Win32` | `Microsoft` | -| `Remote Help` | 4.0.1.13 | `Win32` | `Microsoft` | +| `Remote Help` | 5.0.1311.0 | `Win32` | `Microsoft` | | `Respondus Lockdown Browser` | 2.0.9.03 | `Win32` | `Respondus` | | `Safe Exam Browser` | 3.5.0.544 | `Win32` | `Safe Exam Browser` | -|`SchoolYear` | 3.5.4 | `Win32` |`SchoolYear` | -|`School Manager` | 3.6.8.1109 | `Win32` |`School Manager` | +|`SchoolYear` | 3.5.4 | `Win32` |`SchoolYear` | +|`School Manager` | 3.6.10-1149 | `Win32` |`Linewize` | +|`Schoolnet Secure Tester` | 2.1.0 | `Win32` |`School Net` | |`Scratch` | 3.0 | `Win32` |`MIT` | -| `Senso.Cloud` | 2021.11.15.0 | `Win32` | `Senso.Cloud` | +| `Senso.Cloud` |2021.11.15.0 | `Win32` | `Senso.Cloud` | | `Skoolnext` | 2.19 | `Win32` | `Skool.net` | | `Smoothwall Monitor` | 2.9.2 | `Win32` | `Smoothwall Ltd` | -| `SuperNova Magnifier & Screen Reader` | 22.02 | `Win32` | `Dolphin Computer Access` | +| `SuperNova Magnifier & Screen Reader` | 22.03 | `Win32` | `Dolphin Computer Access` | | `SuperNova Magnifier & Speech` | 21.03 | `Win32` | `Dolphin Computer Access` | |`TX Secure Browser` | 15.0.0 | `Win32` | `Cambium Development` | | `VitalSourceBookShelf` | 10.2.26.0 | `Win32` | `VitalSource Technologies Inc` | @@ -218,4 +224,4 @@ For more information on Intune requirements for adding education apps, see [Conf [EDUWIN-1]: /education/windows/tutorial-school-deployment/configure-device-apps [EDUWIN-2]: /education/windows/tutorial-school-deployment/ -[WIN-1]: /windows/whats-new/windows-11-requirements +[WIN-1]: /windows/whats-new/windows-11-requirements \ No newline at end of file diff --git a/education/windows/windows-editions-for-education-customers.md b/education/windows/windows-editions-for-education-customers.md deleted file mode 100644 index 7c6ecca23b..0000000000 --- a/education/windows/windows-editions-for-education-customers.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Windows 10 editions for education customers -description: Learn about the two Windows 10 editions that are designed for the needs of education institutions. -ms.topic: overview -ms.date: 07/25/2023 -appliesto: - - ✅ Windows 10 ---- - -# Windows 10 editions for education customers - -Windows 10 offers various new features and functionalities, such as simplified provisioning with the [Set up School PCs app](./use-set-up-school-pcs-app.md) or [Windows Configuration Designer](./set-up-students-pcs-to-join-domain.md), easier delivery of digital assessments with [Take a Test](./take-tests-in-windows.md), and faster sign-in performance for shared devices than ever before. These features work with all Windows for desktop editions, excluding Windows 10 Home. You can find more information on [windows.com](https://www.windows.com/). - -Windows 10 introduces two editions designed for the unique needs of K-12 institutions: [Windows 10 Pro Education](#windows-10-pro-education) and [Windows 10 Education](#windows-10-education). These editions provide education-specific default settings for the evolving landscape in K-12 education IT environments. - -## Windows 10 Pro Education - -Windows 10 Pro Education builds on the commercial version of Windows 10 Pro and provides important management controls needed in schools. Windows 10 Pro Education is a variant of Windows 10 Pro that provides education-specific default settings. These default settings disable tips, tricks and suggestions & Microsoft Store suggestions. More detailed information on these default settings is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions). - -Windows 10 Pro Education is available on new devices pre-installed with Windows 10, version 1607 or newer versions that are purchased with discounted K-12 academic licenses through OEM partners (these discounted licenses are sometimes referred to as National Academic or Shape the Future). - -Existing devices running Windows 10 Pro, currently activated with the original OEM digital product key and purchased with discounted K-12 academic licenses through OEM partners (these discounted licenses are sometimes referred to as National Academic or Shape the Future), will upgrade automatically to Windows 10 Pro Education as part of the Windows 10, version 1607 installation. - -Customers with Academic Volume Licensing agreements with rights for Windows can get Windows 10 Pro Education through the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). - -Customers who deploy Windows 10 Pro are able to configure the product to have similar feature settings to Windows 10 Pro Education using policies. More detailed information on these policies and the configuration steps required is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions). We recommend that K-12 customers using commercial Windows 10 Pro read the [document](/windows/configuration/manage-tips-and-suggestions) and apply desired settings for your environment. - -## Windows 10 Education - -Windows 10 Education builds on Windows 10 Enterprise and provides the enterprise-grade manageability and security desired by many schools. Windows 10 Education is effectively a variant of Windows 10 Enterprise that provides education-specific default settings. These default settings disable tips, tricks and suggestions & Microsoft Store suggestions. More detailed information on these default settings is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions). - -Windows 10 Education is available through Microsoft Volume Licensing. Customers who are already running Windows 10 Education can upgrade to Windows 10, version 1607 or newer versions through Windows Update or from the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). We recommend Windows 10 Education to all K-12 customers as it provides the most complete and secure edition for education environments. If you don't have access to Windows 10 Education, contact your Microsoft representative or see more information [here](https://go.microsoft.com/fwlink/?LinkId=822628). - -Customers who deploy Windows 10 Enterprise are able to configure the product to have similar feature settings to Windows 10 Education using policies. More detailed information on these policies and the configuration steps required is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions). We recommend that K-12 customers using commercial Windows 10 Enterprise read the [document](/windows/configuration/manage-tips-and-suggestions) and apply desired settings for your environment. - -For any other questions, contact [Microsoft Customer Service and Support](https://support.microsoft.com/en-us). - -## Related topics - -- [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) -- [Windows deployment for education](./index.yml) -- [Windows 10 upgrade paths](/windows/deployment/upgrade/windows-10-upgrade-paths) -- [Volume Activation for Windows 10](/windows/deployment/volume-activation/volume-activation-windows-10) -- [Plan for volume activation](/windows/deployment/volume-activation/plan-for-volume-activation-client) -- [Windows 10 subscription activation](/windows/deployment/windows-10-subscription-activation) -- \ No newline at end of file diff --git a/includes/licensing/windows-defender-system-guard.md b/includes/licensing/system-guard.md similarity index 75% rename from includes/licensing/windows-defender-system-guard.md rename to includes/licensing/system-guard.md index cecce5edd5..0c165234b4 100644 --- a/includes/licensing/windows-defender-system-guard.md +++ b/includes/licensing/system-guard.md @@ -7,13 +7,13 @@ ms.topic: include ## Windows edition and licensing requirements -The following table lists the Windows editions that support Windows Defender System Guard: +The following table lists the Windows editions that support System Guard: |Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education| |:---:|:---:|:---:|:---:| |Yes|Yes|Yes|Yes| -Windows Defender System Guard license entitlements are granted by the following licenses: +System Guard license entitlements are granted by the following licenses: |Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5| |:---:|:---:|:---:|:---:|:---:| diff --git a/store-for-business/release-history-microsoft-store-business-education.md b/store-for-business/release-history-microsoft-store-business-education.md index 15adb1f6c8..368df86b94 100644 --- a/store-for-business/release-history-microsoft-store-business-education.md +++ b/store-for-business/release-history-microsoft-store-business-education.md @@ -8,7 +8,7 @@ ms.author: cmcatee author: cmcatee-MSFT manager: scotv ms.topic: conceptual -ms.date: 06/29/2023 +ms.date: 01/11/2024 ms.reviewer: --- @@ -22,9 +22,17 @@ Because Microsoft Store for Business and Education will be retired, we no longer Looking for info on the latest release? Check out [What's new in Microsoft Store for Business and Education](whats-new-microsoft-store-business-education.md) +## January 2024 + +**Removal of private store capability from Microsoft Store for Business and Education** + +The private store tab and associated functionality was removed from the Microsoft Store for Business and Education portal. This includes the ability to add apps to private groups and to download and install apps from the private store. + +We recommend customers use the [Private app repository, Windows Package Manager, and Company Portal app](/windows/application-management/private-app-repository-mdm-company-portal-windows-11) to provide a private app repository within their organization. + ## May 2023 -### Removal of Microsoft Store for Business tab from Microsoft Store app on Windows 10 PCs +**Removal of Microsoft Store for Business tab from Microsoft Store app on Windows 10 PCs** The Microsoft Store for Business tab was removed from the Microsoft Store app on Windows 10. The Microsoft Store for Business tab is still available on HoloLens devices. @@ -45,33 +53,41 @@ We recommend that you add your apps through the new Microsoft Store app experien Follow the [Intune Customer Success blog](https://aka.ms/IntuneCustomerSuccess) where we will publish more information about this change. ## April 2023 + - **Tab removed from Microsoft Store apps on Windows 11 PCs** – The Microsoft Store for Business tab was removed from Microsoft Store apps on Windows 11 PCs. An interaction with existing MDM and GPO policies may lead to customers seeing errors when accessing the Microsoft Store app. [Get more info](manage-access-to-private-store.md#microsoft-store-for-business-tab-removed) ## October 2018 + - **Use security groups with Private store apps** - On the details page for apps in your private store, you can set Private store availability. This allows you to choose which security groups can see an app in the private store. [Get more info](app-inventory-management-microsoft-store-for-business.md) ## September 2018 + - **Performance improvements** - With updates and improvements in the private store, most changes, like adding an app, will take fifteen minutes or less. [Get more info](/microsoft-store/manage-private-store-settings#private-store-performance) ## August 2018 - **App requests** - People in your organization can make requests for apps that they need. hey can also request them on behalf of other people. Admins review requests and can decide on purchases. [Get more info](./acquire-apps-microsoft-store-for-business.md#allow-app-requests) ## July 2018 + - Bug fixes and performance improvements. ## June 2018 -- **Change order within private store collection** - Continuing our focus on improvements for private store, now you can customize the order of products in each private store collection. + +- **Change order within private store collection** - Continuing our focus on improvements for private store, now you can customize the order of products in each private store collection. - **Performance improvements in private store** - We continue to work on performance improvements in the private store. Now, most products new to your inventory are available in your private store within 15 minutes of adding them. [Get more info](./manage-private-store-settings.md#private-store-performance) ## May 2018 + - **Immersive Reader app available in Microsoft Store for Education** - This app is a free tool that uses proven techniques to improve reading and writing for people regardless of their age or ability. You can add the app to your private store, so students can easily install and use it. ## April 2018 + - **Assign apps to larger groups** - We're making it easier for admins to assign apps to groups of people. Admins can assign licenses to groups of any size, and include subgroups within those groups. We'll figure out who's in those groups, and assign licenses to people in the groups (skipping people who already have licenses). Along the way, we'll let you know how many licenses are needed, and provide an estimate on the time required to assign licenses. - **Change collection order in private store** - Private store collections make it easy for groups of people to find the apps that they need. Now, you can customize the order of your private store collections. - **Office 365 subscription management** - We know that sometimes customers need to cancel a subscription. While we don't want to lose a customer, we want the process for managing subscriptions to be easy. Now, you can delete your Office 365 subscription without calling Support. From Microsoft Store for Business and Education, you can request to delete an Office 365 subscription. We'll wait three days before permanently deleting the subscription. In case of a mistake, customers are welcome to reactivate subscriptions during the three-day period. ## March 2018 + - **Performance improvements in private store** - We've made it significantly faster for you to update the private store. Many changes to the private store are available immediately after you make them. [Get more info](./manage-private-store-settings.md#private-store-performance) - **Private store collection updates** - We've made it easier to find apps when creating private store collections – now you can search and filter results. [Get more info](./manage-private-store-settings.md#private-store-collections) @@ -79,19 +95,23 @@ Follow the [Intune Customer Success blog](https://aka.ms/IntuneCustomerSuccess) - **Upgrade Microsoft 365 trial subscription** - Customers with Office 365 can upgrade their subscription and automatically re-assign their user licenses over to a new target subscription. For example, you could upgrade your Office 365 for business subscription to a Microsoft 365 for business subscription. ## January and February 2018 + - **One place for apps, software, and subscriptions** - The new **Products & services** page in Microsoft Store for Business and Education gives customers a single place to manage all products and services. - **Create collections of apps in your private store** - Use **collections** to customize your private store. Collections allow you to create groups of apps that are commonly used in your organization or school -- you might create a collection for a Finance department, or a 6th-grade class. [Get more info](./manage-private-store-settings.md#private-store-collections) - **Upgrade Office 365 trial subscription** - Customers with Office 365 trials can now transition their trial to a paid subscription in Microsoft Store for Business. This works for trials you acquired from Microsoft Store for Business, or Office Admin Portal. - **Supporting Microsoft Product and Services Agreement customers** - If you are purchasing under the Microsoft Products and Services Agreement (MPSA), you can use Microsoft Store for Business. Here you will find access to Products & Services purchased, Downloads & Keys, Software Assurance benefits, Order history, and Agreement details. -- **Microsoft Product and Services Agreement customers can invite people to take roles** - MPSA admins can invite people to take Microsoft Store for Business roles even if the person is not in their tenant. You provide an email address when you assign the role, and we'll add the account to your tenant and assign the role. +- **Microsoft Product and Services Agreement customers can invite people to take roles** - MPSA admins can invite people to take Microsoft Store for Business roles even if the person is not in their tenant. You provide an email address when you assign the role, and we'll add the account to your tenant and assign the role. ## December 2017 + - Bug fixes and performance improvements. ## November 2017 + - **Export list of Minecraft: Education Edition users** - Admins and teachers can now export a list of users who have Minecraft: Education Edition licenses assigned to them. Click **Export users**, and Store for Education creates an Excel spreadsheet for you, and saves it as a .csv file. ## October 2017 + - Bug fixes and performance improvements. ## September 2017 @@ -102,4 +122,4 @@ Follow the [Intune Customer Success blog](https://aka.ms/IntuneCustomerSuccess) - **Manage prepaid Office 365 subscriptions** - Office 365 prepaid subscriptions can be redeemed using a prepaid token. Tokens are available through 3rd-party businesses, outside of Microsoft Store for Business or the Office 365 Admin portal. After redeeming prepaid subscriptions, Admins can add more licenses or extend the subscription's expiration date. - **Manage Office 365 subscriptions acquired by partners** - Office 365 subscriptions purchased for your organization by a partner or reseller can be managed in Microsoft Store for Business. Admins can assign and manage licenses for these subscriptions. - **Edge extensions in Microsoft Store** - Edge Extensions are now available from Microsoft Store! You can acquire and distribute them from Microsoft Store for Business just like any other app. -- **Search results in Microsoft Store for Business** - Search results now have sub categories to help you refine search results. \ No newline at end of file +- **Search results in Microsoft Store for Business** - Search results now have sub categories to help you refine search results. diff --git a/store-for-business/whats-new-microsoft-store-business-education.md b/store-for-business/whats-new-microsoft-store-business-education.md index 8ab993b759..964efc7788 100644 --- a/store-for-business/whats-new-microsoft-store-business-education.md +++ b/store-for-business/whats-new-microsoft-store-business-education.md @@ -8,7 +8,7 @@ ms.author: cmcatee author: cmcatee-MSFT manager: scotv ms.topic: conceptual -ms.date: 06/29/2023 +ms.date: 01/11/2024 ms.reviewer: --- @@ -20,40 +20,19 @@ ms.reviewer: ## Latest updates for Store for Business and Education -**May 2023** +**January 2024** -**Removal of Microsoft Store for Business tab from Microsoft Store app on Windows 10 PCs** +**Removal of private store capability from Microsoft Store for Business and Education** -The Microsoft Store for Business tab was removed from the Microsoft Store app on Windows 10. The Microsoft Store for Business tab is still available on HoloLens devices. +The private store tab and associated functionality was removed from the Microsoft Store for Business and Education portal. This includes the ability to add apps to private groups and to download and install apps from the private store. -Users on Windows 10 PCs can no longer do the following tasks: - -- see Line of Business (LOB) products listed in the Microsoft Store for Business tab -- acquire or install [online apps](/mem/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business#online-and-offline-apps) -- assign licenses for existing [online apps](/mem/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business#online-and-offline-apps) using the Store for Business portal or Store for Business app - -[Offline app](/mem/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business#online-and-offline-apps) distribution and licensing scenarios aren't impacted by this change. - -We recommend that you add your apps through the new Microsoft Store app experience in Intune. If an app isn’t available in the Microsoft Store, you must retrieve an app package from the vendor and install it as an LOB app or Win32 app. For instructions, read the following articles: - -- [Add Microsoft Store apps to Microsoft Intune](/mem/intune/apps/store-apps-microsoft) -- [Add a Windows line-of-business app to Microsoft Intune](/mem/intune/apps/lob-apps-windows) -- [Add, assign, and monitor a Win32 app in Microsoft Intune](/mem/intune/apps/apps-win32-add) - -Follow the [Intune Customer Success blog](https://aka.ms/IntuneCustomerSuccess) where we will publish more information about this change. - - +We recommend customers use the [Private app repository, Windows Package Manager, and Company Portal app](/windows/application-management/private-app-repository-mdm-company-portal-windows-11) to provide a private app repository within their organization. ## Previous releases and updates +[May 2023](release-history-microsoft-store-business-education.md#may-2023) +- Tab removed from Microsoft Store apps on Windows 10 PCs. + [April 2023](release-history-microsoft-store-business-education.md#april-2023) - Tab removed from Microsoft Store apps on Windows 11 PCs. diff --git a/windows/application-management/images/insider.png b/windows/application-management/images/insider.png new file mode 100644 index 0000000000..dbe00408cb Binary files /dev/null and b/windows/application-management/images/insider.png differ diff --git a/windows/application-management/includes/insider-note.md b/windows/application-management/includes/insider-note.md new file mode 100644 index 0000000000..a1160f8047 --- /dev/null +++ b/windows/application-management/includes/insider-note.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.topic: include +ms.date: 01/11/2024 +--- + +:::row::: +:::column span="1"::: +:::image type="content" source="../images/insider.png" alt-text="Logo of Windows Insider." border="false"::: +:::column-end::: +:::column span="3"::: +> [!IMPORTANT] +>This article describes features or settings that are under development and only applicable to [Windows Insider Preview builds](/windows-insider/). The content is subject to change and may have dependencies on other features or services in preview. +:::column-end::: +:::row-end::: diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index 200ea7e859..2ea7628c2f 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -1,81 +1,152 @@ --- title: Per-user services -description: Learn about per-user services, how to change the template service Startup Type, and manage per-user services through Group Policy and security templates. +description: Learn about per-user services, how to change the template service startup type, and manage per-user services through group policy and security templates. author: aczechowski ms.author: aaroncz manager: aaroncz -ms.date: 09/14/2017 +ms.date: 12/22/2023 ms.topic: how-to ms.prod: windows-client ms.technology: itpro-apps ms.localizationpriority: medium ms.collection: tier2 appliesto: + - ✅ Windows 11 - ✅ Windows 10 - ✅ Windows Server --- # Per-user services in Windows -Per-user services are services that are created when a user signs into Windows or Windows Server and are stopped and deleted when that user signs out. These services run in the security context of the user account - this provides better resource management than the previous approach of running these kinds of services in Explorer, associated with a preconfigured account, or as tasks. +When a user signs in to Windows, the OS creates *per-user services*. When the user signs out, these services are stopped and deleted. They run in the security context of the user account instead of a built-in security principal. This behavior provides better resource management than the previous approach of running these services associated with a preconfigured account or as tasks. > [!NOTE] -> Per-user services are only in available in Windows Server if you have installed the Desktop Experience. If you are running a Server Core or Nano Server installation, you won't see these services. +> Per-user services are only available in Windows Server if you install the Desktop Experience. For more information, see [Server Core vs Server with Desktop Experience install options](/windows-server/get-started/install-options-server-core-desktop-experience). -You can set the template service's **Startup Type** to **Disabled** to create per-user services in a stopped and disabled state. +Windows creates these per-user services based on templates defined in the registry. If you need to manage or control behaviors of these services, you can adjust the template. For example, you can set a template service's startup type to **Disabled**. In this example, Windows creates the per-user service in a stopped and disabled state. > [!IMPORTANT] -> Carefully test any changes to the template service's Startup Type before deploying to a production environment. +> Carefully test any changes to the template service's configuration before you broadly deploy them to a production environment. -Use the following information to understand per-user services, change the template service Startup Type, and manage per-user services through Group Policy and security templates. -For more information about disabling system services for Windows Server, see [Guidance on disabling system services on Windows Server with Desktop Experience](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server). +Use the information in this article to understand per-user services, configure user service templates, and manage per-user services through group policy and security templates. -## Per-user services +## List of per-user services -The following table lists per-user services and when they were added to Windows 10 and Windows Server with the Desktop Experience. The template services are located in the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. +The following table lists per-user services in the current version of Windows. Other versions of Windows 10/11 might not have the same services available. -Before you disable any of these services, review the **Description** column in this table to understand the implications, including dependent apps that will no longer work correctly. +Before you reconfigure any of these services, review this information to understand the implications. For example, if you disable the per-user service, there might be dependent apps that don't work correctly. -| Windows version | Key name | Display name | Default start type | Dependencies | Description | -|-----------------|------------------------|-----------------------------------------|--------------------|--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 1803 | BcastDVRUserService | GameDVR and Broadcast User Service | Manual | | Used for Game Recordings and Live Broadcasts | -| 1803 | BluetoothUserService | Bluetooth User Support Service | Manual | | Supports proper functionality of Bluetooth features relevant to each user session | -| 1803 | CaptureService | CaptureService | Manual | | OneCore Capture Service | -| 1607 | CDPUserSvc | CDPUserSvc | Auto | - Network Connection Broker
- Remote Procedure Call (RPC)
- TCP/IP Protocol Driver | Used for Connected Devices Platform scenarios | -| 1803 | DevicePickerUserSvc | DevicePicker | Manual | | Device Picker | -| 1703 | DevicesFlowUserSvc | DevicesFlow | Manual | | Device Discovery and Connecting | -| 1703 | MessagingService | MessagingService | Manual | | Service supporting text messaging and related functionality | -| 1607 | OneSyncSvc | Sync Host | Auto (delayed) | | Synchronizes mail, contacts, calendar, and other user data. Mail and other applications dependent on this service don't work correctly when this service isn't running. | -| 1607 | PimIndexMaintenanceSvc | Contact Data | Manual | UnistoreSvc | Indexes contact data for fast contact searching. If you stop or disable this service, search results might not display all contacts. | -| 1709 | PrintWorkflowUserSvc | PrintWorkflow | Manual | | Print Workflow | -| 1607 | UnistoreSvc | User Data Storage | Manual | | Handles storage of structured user data, including contact info, calendars, and messages. If you stop or disable this service, apps that use this data might not work correctly. | -| 1607 | UserDataSvc | User Data Access | Manual | UnistoreSvc | Provides apps access to structured user data, including contact info, calendars, and messages. If you stop or disable this service, apps that use this data might not work correctly. | -| 1607 | WpnUserService | Windows Push Notifications User Service | Manual | | Hosts Windows notification platform, which provides support for local and push notifications. Supported notifications are tile, toast, and raw. | +| Display name | Service name | Default start type | Dependencies | Description | +|--|--|--|--|--| +| **Agent Activation Runtime** | AarSvc | Manual | | Runtime for activating conversational agent applications. | +| **Bluetooth User Support Service** | BluetoothUserService | Manual | | Supports proper functionality of Bluetooth features relevant to each user session. | +| **OneCore Capture Service** | CaptureService | Manual | | Enables optional screen capture functionality for applications that call [screen capture](/windows/uwp/audio-video-camera/screen-capture) APIs of the [Windows.Graphics.Capture](/uwp/api/windows.graphics.capture) namespace. | +| **Clipboard User Service** | cbdhsvc | Automated (Delayed Start) | | Windows uses this user service for clipboard scenarios. For example, clipboard history or sync across devices. For more information, see [Clipboard in Windows](https://support.microsoft.com/windows/clipboard-in-windows-c436501e-985d-1c8d-97ea-fe46ddf338c6). | +| **Cloud Backup and Restore Service** | CloudBackupRestoreSvc | Manual | | Monitors the system for changes in application and setting states. When required, this service does cloud backup and restore operations. | +| **Connected Devices Platform User Service** | CDPUserSvc | Automatic | - Network Connection Broker
- Remote Procedure Call (RPC)
- TCP/IP Protocol Driver | This service allows the user to connect, manage, and control connected devices. These connected devices include mobile, Xbox, HoloLens, or smart/IoT devices. For one specific example, see [Share things with nearby devices in Windows](https://support.microsoft.com/windows/share-things-with-nearby-devices-in-windows-0efbfe40-e3e2-581b-13f4-1a0e9936c2d9). | +| **Consent UX User Service** | ConsentUxUserSvc | Manual | | Allows the system to request user consent to allow apps to access sensitive resources and information such as the device's location. | +| **Contact Data** | PimIndexMaintenanceSvc | Manual | UnistoreSvc | Indexes contact data for fast contact searching. If you stop or disable this service, contacts might be missing from your search results. | +| **Credential Enrollment Manager** | CredentialEnrollmentManagerUserSvc | Manual | | This service supports the secure storage and retrieval of user credentials. For example, tokens for web sites, remote desktop connections, or other apps. | +| **Device Association Broker** | DeviceAssociationBrokerSvc | Manual | - DevicePicker
- Shell Pairing UX | Supports in-app pairing and access checks for new device scenarios. | +| **Device Picker** | DevicePickerUserSvc | Manual | | Windows uses this user service to manage Miracast, Digital Living Network Alliance (DLNA), and Discovery and Launch (DIAL) experiences. | +| **Devices Flow** | DevicesFlowUserSvc | Manual | | Allows the Connect user interface and Settings app to connect and pair with WiFi displays and Bluetooth devices. | +| **Game DVR and Broadcast User Service** | BcastDVRUserService | Manual | | Windows uses this user service for game recordings and live broadcasts. | +| **Messaging Service** | MessagingService | Manual | | This service supports text messaging and related functionality. | +| **Now Playing Session Manager** | NPSMSvc | Manual | | The *now playing session manager* (NPSM) service manages media sessions running on the device. | +| **Plan 9 Redirector Service** | P9RdrService | Manual | | Enables trigger-starting plan9 file servers, which are supported by [Windows Subsystem for Linux](/windows/wsl/). For more information, see [Plan 9 from Bell Labs](https://wikipedia.org/wiki/Plan_9_from_Bell_Labs). | +| **Pen Service** | PenService | Manual | | When you press the tail button on a pen input device, this service responds to those actions. It can launch applications or take another action that you customize in Settings. For more information, see user documentation on [How to use your Surface Pen](https://support.microsoft.com/surface/how-to-use-your-surface-pen-8a403519-cd1f-15b2-c9df-faa5aa924e98) or hardware developer documentation on [Pen devices](/windows-hardware/design/component-guidelines/pen-devices). | +| **Print Workflow** | PrintWorkflowUserSvc | Manual | | Provides support for [Print Workflow](/windows/uwp/devices-sensors/print-workflow-customize) applications. If you turn off this service, some printing functions might not work successfully. | +| **Sync Host** | OneSyncSvc | Automated (Delayed Start) | | This service synchronizes mail, contacts, calendar, and other user data. When this service is stopped, mail and other applications dependent on this functionality don't work properly. | +| **UDK User Service** | UdkUserSvc | Manual | | Windows uses this service to coordinate between shell experiences. | +| **User Data Access** | UserDataSvc | Manual | UnistoreSvc | Provides apps access to structured user data, including contact info, calendars, messages, and other content. If you stop or disable this service, apps that use this data might not work correctly. | +| **User Data Storage** | UnistoreSvc | Manual | | Handles storage of structured user data, including contact info, calendars, messages, and other content. If you stop or disable this service, apps that use this data might not work correctly. | +| **Web Threat Defense User Service** | webthreatdefusersvc | Automatic | | This service helps protect your computer by warning the user when unauthorized entities attempt to gain access to their credentials. | +| **Windows Push Notifications User Service** | WpnUserService | Automatic | | This service hosts the [Windows push notification services](/windows/apps/design/shell/tiles-and-notifications/windows-push-notification-services--wns--overview) (WNS) platform, which provides support for local and push notifications. Supported notifications are tile, toast, and raw. | -## Disable per-user services +## View per-user services -The template service isn't displayed in the Services console (services.msc) so you need to edit the registry directly, either with Group Policy or a scripted solution, to disable a per-user service. +You can't view the user service templates outside of the Windows Registry, but you can see the user-specific per-user services. Windows displays these services with the following format: `_LUID` where `` is the display name of the user service and `LUID` is a locally unique identifier for the user context. + +For example, you might see the following per-user service names: + +- `Contact Data_443f50` +- `Sync Host_443f50` +- `User Data Access_443f50` +- `User Data Storage_443f50` > [!NOTE] -> Disabling a per-user service simply means that it is created in a stopped and disabled state. When the user signs out, the per-user service is removed. +> The display name and the service name for all per-user services include the same LUID suffix. -You can't manage all of the per-user service templates services using normal Group Policy management methods. Because the per-user services aren't displayed in the Services management console, they're also not displayed in the Group Policy Services policy editor UI. +### View per-user services in the Windows Services console + +When you sign in to Windows, run `services.msc` to open the Services console. When you view the local machine, you can see these services for your user account. + +### View per-user services using Windows PowerShell + +The following PowerShell script is an example of how to query for per-user services. It queries for service type values that include the `64` bit value. + +```powershell +# Define the bit value for per-user services in the ServiceType property of a service object +$flag = 64 + +# Define an empty array to store the resulting services that match the criteria +$serviceList = @() + +# Get all services on the computer and store them in the variable +$services = Get-Service + +# Loop through each service in the array of services. +foreach ( $service in $services ) { + # For each specific service, check if the service type property includes the 64 bit using the bitwise AND operator (-band). + # If the result equals the flag value, then the service is a per-user service. + if ( ( $service.ServiceType -band $flag ) -eq $flag ) { + # When a per-user service is found, then add that service object to the results array. + $serviceList += $service + } +} + +# Display the results array, sorted by display name, in a table format with the specified properties. +$serviceList | Sort-Object DisplayName | Format-Table DisplayName, Name, StartType, ServiceType +``` + +### View per-user services from the command line + +Run `cmd.exe` to open a Windows command prompt. Use the `sc qc` command to query these services. The **Type** value indicates whether the service is a user-service template or user-service instance. + +The following example queries for the template and user-specific instance of the **Game DVR and Broadcast User Service** (`BcastDVRUserService`) service: + +```cmd +sc qc BcastDVRUserService +sc qc BcastDVRUserService_18f113 +``` + +:::image type="content" source="media/cmd-type.png" alt-text="Screenshot of a Windows command line session running sc.exe qc on two services and highlighting the type values in the output."::: + +## How to disable per-user services + +The templates for user services aren't displayed in the **Services** console (services.msc). To disable a per-user service, you need to directly edit the registry, either with group policy or a scripted solution. The templates are located in the registry at `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services`. + +> [!NOTE] +> When you disable a per-user service, Windows still creates it when the user signs in, but in a stopped and disabled state. When the user signs out, Windows removes the per-user service. + +You can't manage all of the per-user service templates using normal group policy management methods. Because the per-user services aren't displayed in the **Services** management console, they're also not displayed in the group policy services policy editor. + +Additionally, there are four user services that you can't manage with a security template: -Additionally, there are four template services that can't be managed with a security template: - PimIndexMaintenanceSvc - UnistoreSvc - UserDataSvc - WpnUserService -In light of these restrictions, you can use the following methods to manage per-user services template services: +With these restrictions, you can use the following methods to manage per-user service templates: -- A combination of a security template and a script or Group Policy preferences registry policy -- Group Policy preferences for all of the services -- A script for all of the services +- A combination of a security template and a script, or group policy preferences registry policy. +- Group policy preferences for all of the services. +- A script for all of the services. ### Manage template services using a security template -You can manage the CDPUserSvc and OneSyncSvc per-user services with a [security template](/windows/device-security/security-policy-settings/administer-security-policy-settings#bkmk-sectmpl). For more information, visit [Administer security policy settings](/windows/device-security/security-policy-settings/administer-security-policy-settings). +You can manage the CDPUserSvc and OneSyncSvc per-user services with a [security template](/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings#security-templates). For example: @@ -89,41 +160,74 @@ Revision=1 "CDPUserSVC".4,"" ``` -### Manage template services using Group Policy preferences +### Use a script to manage per-user services -If a per-user service can't be disabled using the security template, you can disable it by using Group Policy preferences. +You can create a script to change the startup type for the per-user services. Then use group policy or another management solution such as Microsoft Configuration Manager to deploy the script to targeted devices. -1. On a Windows Server domain controller or Windows 10 PC that has the [Remote Server Administration Tools (RSAT)](https://www.microsoft.com/download/details.aspx?id=45520) installed, select **Start**, type GPMC.MSC, and then press **Enter** to open the **Group Policy Management Console**. +#### Example 1: Use the `Set-Service` PowerShell cmdlet -2. Create a new Group Policy Object (GPO) or use an existing GPO. +The following sample script uses the [Set-Service](/powershell/module/microsoft.powershell.management/set-service) PowerShell cmdlet to configure the PimIndexMaintenanceSvc service start type to disabled: -3. Right-click the GPO and select **Edit** to launch the Group Policy Object Editor. +```powershell +Set-Service -Name PimIndexMaintenanceSvc -StartupType Disabled +``` -4. Depending on how you want to target the Group Policy, under **Computer configuration** or **User configuration** browse to Preferences\Windows Settings\Registry. +#### Example 2: Use the `sc.exe config` command line -5. Right-click **Registry** > **New** > **Registry Item**. +The following sample script uses [`sc.exe config`](/windows-server/administration/windows-commands/sc-config) to configure the PimIndexMaintenanceSvc service start type to disabled: - ![Group Policy preferences disabling per-user services.](media/gpp-per-user-services.png) - -6. Make sure that HKEY_Local_Machine is selected for Hive and then select ... (the ellipses) next to Key Path. +```cmd +sc.exe configure PimIndexMaintenanceSvc start= disabled +``` - ![Choose HKLM.](media/gpp-hklm.png) - -7. Browse to **System\CurrentControlSet\Services\PimIndexMaintenanceSvc**. In the list of values, highlight **Start** and select **Select**. +> [!NOTE] +> The space after `=` is intentional. - ![Select Start.](media/gpp-svc-start.png) - -8. Change **Value data** from **00000003** to **00000004** and select **OK**. Note setting the Value data to **4** = **Disabled**. +### Manage template services using group policy preferences - ![Startup Type is Disabled.](media/gpp-svc-disabled.png) - -9. To add the other services that can't be managed with Group Policy templates, edit the policy and repeat steps 5-8. +If you can't disable a per-user service with the security template, use group policy preferences. -### Managing Template Services with reg.exe +1. Open the **Group Policy Management Console** (gpmc.msc). -If you can't use Group Policy Preferences to manage the per-user services, you can edit the registry with reg.exe. -To disable the Template Services, change the Startup Type for each service to 4 (disabled). -For example: +1. Create a new group policy object (GPO) or use an existing GPO. + +1. **Edit** the GPO to launch the group policy object editor. + +1. Depending on how you want to target the group policy, under **Computer configuration** or **User configuration** browse to **Preferences**, **Windows Settings**, and select **Registry**. + +1. Go to the **Action** menu, select **New**, and select **Registry Item**. + + :::image type="content" source="media/gpp-per-user-services.png" alt-text="Screenshot of the Group Policy Management Editor highlighting the contextual menu on registry preferences to create a new registry item."::: + +1. For the **Hive** select `HKEY_LOCAL_MACHINE`. + + :::image type="content" source="media/gpp-hklm.png" alt-text="Screenshot of the New Registry Properties window highlighting the Hive value set to HKEY_LOCAL_MACHINE."::: + +1. Select the ellipses (`...`) next to **Key Path**. Browse to `System\CurrentControlSet\Services` and then select the user service template. For example, `PimIndexMaintenanceSvc`. In the list of values, highlight **Start** and select **Select**. + + :::image type="content" source="media/gpp-svc-start.png" alt-text="Screenshot of the Registry Item Browser window with the PimIndexMaintenanceSvc registry item selected, and the Start value selected."::: + +1. In the **Start Properties** window, Change **Value data** from `00000003` to `00000004` and select **OK**. Note setting the Value data to **4** = **Disabled**. + + :::image type="content" source="media/gpp-svc-disabled.png" alt-text="Screenshot of the Start Properties window highlighting the Value data field with the value 00000004."::: + + > [!NOTE] + > The service start value `4` is **Disabled**. + +1. To add the other services that can't be managed with group policy templates, edit the policy and repeat the previous steps. + +### Managing user service templates with the Windows Registry + +If you can't use group policy preferences to manage the per-user services, you can edit the Windows Registry. To disable a user service template, change the startup type for each service to `4`, which is **Disabled**. + +> [!CAUTION] +> Don't directly edit the registry unless there's no other alternative. The Registry Editor or Windows don't validate these manual modifications to the registry. Incorrect values can be stored, which can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use group policy or other supported Windows tools to accomplish these tasks. If you must edit the registry, use extreme caution. + +#### Example 1: Use the `reg.exe` command line command to edit the registry + +1. As an administrator, run `cmd.exe` to open a Windows command prompt. + +1. The following example includes multiple commands that disable the specified Windows services by changing their **Start** value in the Windows Registry to `4`: ```cmd REG.EXE ADD HKLM\System\CurrentControlSet\Services\CDPUserSvc /v Start /t REG_DWORD /d 4 /f @@ -132,60 +236,26 @@ REG.EXE ADD HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc /v Sta REG.EXE ADD HKLM\System\CurrentControlSet\Services\UnistoreSvc /v Start /t REG_DWORD /d 4 /f REG.EXE ADD HKLM\System\CurrentControlSet\Services\UserDataSvc /v Start /t REG_DWORD /d 4 /f REG.EXE ADD HKLM\System\CurrentControlSet\Services\WpnUserService /v Start /t REG_DWORD /d 4 /f -``` - -> [!CAUTION] -> We recommend that you do not directly edit the registry unless there is no other alternative. Modifications to the registry are not validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC) to accomplish tasks. If you must edit the registry, use extreme caution. - -### Managing Template Services with regedit.exe - -If you can't use Group Policy preferences to manage the per-user services, you can edit the registry with regedit.exe. To disable the template services, change the Startup Type for each service to 4 (disabled): - -![Using Regedit to change servive Starup Type.](media/regedit-change-service-startup-type.png) - -> [!CAUTION] -> We recommend that you do not directly edit the registry unless there is no other alternative. Modifications to the registry are not validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC) to accomplish tasks. If you must edit the registry, use extreme caution. - -Beginning with Windows 10, version 1709 and Windows Server, version 1709, you can prevent the per-user service from being created by setting **UserServiceFlags** to 0 under the same service configuration in the registry: - -![Create per-user services in disabled state.](media/user-service-flag.png) - -### Manage template services by modifying the Windows image - -If you're using custom images to deploy Windows, you can modify the Startup Type for the template services as part of the normal imaging process. - -### Use a script to manage per-user services - -You can create a script to change the Startup Type for the per-user services. Then use Group Policy or another management solution to deploy the script in your environment. - -Sample script using [sc.exe](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc990290(v=ws.11)?f=255&MSPPError=-2147217396): - -```cmd -sc.exe configure start= disabled ``` -The space after "=" is intentional. +#### Example 2: Use the Registry Editor user interface to edit the registry -Sample script using the [Set-Service PowerShell cmdlet](/previous-versions/windows/it-pro/windows-powershell-1.0/ee176963(v=technet.10)): +1. As an administrator, run `regedit.exe` to open the Registry Editor. -```powershell -Set-Service -StartupType Disabled -``` +1. Browse to `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services` and then select the user service template. For example, `CDPSvc`. -## View per-user services in the Services console (services.msc) +1. In the list of values, open the **Start** value. -As mentioned you can't view the template services in the Services console, but you can see the user-specific per-user services - they're displayed using the \_LUID format (where LUID is the locally unique identifier). +1. Change the **Value data** to `4`. -For example, you might see the following per-user services listed in the Services console: +:::image type="content" source="media/regedit-change-service-startup-type.png" alt-text="Screenshot of the Registry Editor open to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CDPSvc and highlighting the Start value set to 4."::: -- CPDUserSVC_443f50 -- ContactData_443f50 -- Sync Host_443f50 -- User Data Access_443f50 -- User Data Storage_443f50 +#### Example 3: Prevent the creation of per-user services -## View per-user services from the command line +You can prevent Windows from creating a per-user service when a user signs on. In the same service template node of the registry, set `UserServiceFlags` to `0`. -You can query the service configuration from the command line. The **Type** value indicates whether the service is a user-service template or user-service instance. +:::image type="content" source="media/user-service-flag.png" alt-text="Screenshot of the Registry Editor open to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PimIndexMaintenanceSvc highlighting the UserServiceFlag set to 0."::: -![Use sc.exe to view service type.](media/cmd-type.png) +## Next steps + +For more information about disabling system services for Windows Server, see [Guidance on disabling system services on Windows Server with Desktop Experience](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server). diff --git a/windows/application-management/sideload-apps-in-windows-10.md b/windows/application-management/sideload-apps-in-windows-10.md deleted file mode 100644 index be0e459235..0000000000 --- a/windows/application-management/sideload-apps-in-windows-10.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: Sideload line of business apps -description: Learn how to sideload line-of-business (LOB) apps in Windows client operating systems. When you sideload an app, you deploy a signed app package to a device. -author: aczechowski -ms.author: aaroncz -manager: aaroncz -ms.date: 12/07/2017 -ms.topic: how-to -ms.prod: windows-client -ms.technology: itpro-apps -ms.localizationpriority: medium -ms.collection: tier2 -appliesto: - - ✅ Windows 11 - - ✅ Windows 10 ---- - -# Sideload line of business (LOB) apps - -> [!NOTE] -> Starting with Windows 10 2004, sideloading is enabled by default. You can deploy a signed package onto a device without a special configuration. - -Sideloading apps is when you install apps that aren't from an official source, such as the Microsoft store. Your organization may create its own apps, including line-of-business (LOB) apps. Many organizations create their own apps to solve problems unique to their business. - -When you sideload an app, you deploy a signed app package to a device. You maintain the signing, hosting, and deployment of these apps. Sideloading was also available with Windows 8 and Windows 8.1 - -Starting with Windows 10, sideloading is different than earlier versions of Windows: - -- You can unlock a device for sideloading using an enterprise policy, or through the **Settings** app. -- License keys aren't required. -- Devices don't have to be joined to a domain. - -To allow these apps to run on your Windows devices, you might have to enable sideloading on your devices. - -This article shows you how to: - -- **Turn on sideloading**: You can deploy using Group Policy or a mobile device management (MDM) provider. Or, you can use the **Settings** app to turn on sideloading. -- **Install the app certificate**: Import the security certificate to the local device. This certificate tells the local device to trust the app. -- **Install the app**: Use Windows PowerShell to install the app package. - -## Prerequisites - -- Windows devices that are unlocked for sideloading (unlock policy enabled). Meaning, sideloading isn't blocked by a policy. -- A trusted certificate that's assigned to your app. -- An app package that's signed with your certificate. - -## Step 1: Turn on sideloading - -You can sideload apps on managed or unmanaged devices. - -Managed devices are typically owned by your organization. They're managed by Group Policy (on-premises), or a Mobile Device Management (MDM) provider, such as Microsoft Intune (cloud). Bring your own devices (BYOD) and personal devices can also be managed by your organization. On managed devices, you can create a policy that turns on sideloading, and then deploy this policy to your Windows devices. - -Unmanaged devices are devices that aren't managed by your organization. These devices are typically personal devices owned by users. Users can turn on sideloading using the Settings app. - -> [!IMPORTANT] -> To install an app on Windows client, you can: -> -> - [Install Windows apps from a web page](/windows/msix/app-installer/installing-windows10-apps-web). -> - Users can double-click any `.msix` or `.appx` package. - -### User interface - -If you're working on your own device, or if devices are unmanaged, use the Settings app: - -1. Open the **Settings** app > **Update & Security** > **For developers**. -2. Select **Sideload apps**. - -For more information, see [Enable your device for development](/windows/apps/get-started/enable-your-device-for-development) and [Developer Mode features and debugging](/windows/apps/get-started/developer-mode-features-and-debugging). - -### Group Policy - -If you use Group Policy, use the `Computer Configuration\Administrative Templates\Windows Components\App Package Deployment` policies to enable or prevent sideloading apps: - -- `Allows development of Windows Store apps and installing them from an integrated development environment (IDE)` -- `Allow all trusted apps to install` - -By default, the OS might set these policies to **Not configured**, which means app sideloading is turned off. If you set these policies to **Enabled**, then users can sideload apps. - -### MDM - -Using Microsoft Intune, you can also enable sideloading apps on managed devices. For more information, see: - -- [Sign line-of-business apps so they can be deployed to Windows devices with Intune](/mem/intune/apps/app-sideload-windows) -- [App Store device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10#app-store) - -## Step 2: Import the security certificate - -This step installs the app certificate to the local device. Installing the certificate creates the trust between the app and the device. - -1. Open the security certificate for the `.msix` package, and select **Install Certificate**. - -2. On the **Certificate Import Wizard**, select **Local Machine**. - -3. Import the certificate to the **Trusted Root Certification Authorities** folder. - - -OR- - - You can use a runtime provisioning package to import a security certificate. For information about applying a provisioning package, see runtime instructions on [Create a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package). - -## Step 3: Install the app - -From the folder with the `.msix` package, run the Windows PowerShell `Add-AppxPackage` command to install the `.msix` package. - -For more information on this command, see [Add-AppxPackage](/powershell/module/appx/add-appxpackage). diff --git a/windows/application-management/sideload-apps-in-windows.md b/windows/application-management/sideload-apps-in-windows.md new file mode 100644 index 0000000000..f962fed76e --- /dev/null +++ b/windows/application-management/sideload-apps-in-windows.md @@ -0,0 +1,137 @@ +--- +title: Sideload line of business apps +description: Learn how to sideload line-of-business (LOB) apps in Windows client operating systems. When you sideload an app, you deploy a signed app package to a device. +author: aczechowski +ms.author: aaroncz +manager: aaroncz +ms.date: 12/22/2023 +ms.topic: how-to +ms.prod: windows-client +ms.technology: itpro-apps +ms.localizationpriority: medium +ms.collection: tier2 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 +--- + +# Sideload line of business (LOB) apps + +Sideloading apps is when you install apps that aren't from an official source, such as the Microsoft Store. Your organization can create its own apps, including line-of-business (LOB) apps. When you sideload an app, you deploy a signed app package to a device. You maintain the signing, hosting, and deployment of these apps. + +To allow these apps to run on your Windows devices, you might have to enable sideloading. + +> [!IMPORTANT] +> When you enable sideloading, you allow installing and running apps from outside the Microsoft Store. This action might increase security risks to the device and your data. Sideloaded apps need to be signed with a certificate that the device trusts. + +## Prerequisites + +- Windows devices with sideloading enabled. You can enable it with a group policy or a mobile device management (MDM) provider like Microsoft Intune. You can also use the **Settings** app to manually turn on sideloading. + +- A trusted certificate that you assign to your app. Import the security certificate to the local device. This certificate allows the device to trust the app. + +- An app package that you sign with the same certificate. + +> [!TIP] +> Unlike in earlier versions, with Windows 10/11: +> +> - License keys aren't required. +> - Devices don't have to be joined to a domain. + +## Step 1: Turn on sideloading + +You can sideload apps on managed or unmanaged devices. + +A *managed device* typically means your organization owns it and applies policies based on business requirements. You manage it with on-premises group policy or a mobile device management (MDM) provider like Microsoft Intune. On managed devices, you can create a policy that turns on sideloading, and then assign this policy to targeted devices. + +An *unmanaged device* means your organization doesn't manage it. These devices are typically personal devices that users own. Users can manually turn on sideloading with the **Settings** app. + +### User interface + +If you're working on your own device, or if devices are unmanaged, use the Settings app. The experience differs between Windows 11 and Windows 10. + +> [!NOTE] +> If sideloading is blocked by an organizational policy, then users can't even manually enable sideloading. + +#### Windows 11 setting + +1. Open the **Settings** app. + +1. Go to **System** and select **For developers**. + +1. Turn on the **Developer mode** setting. + +1. Review the notice, and select **Yes** to continue. + +> [!TIP] +> If you don't see the setting in this location on your version of Windows, use the *Find a setting* option. Search for *developer mode* to quickly jump to its location. + +#### Windows 10 setting + +1. Open the **Settings** app. + +1. Go to **Update & Security** and select **For developers**. + +1. Turn on the option to **Sideload apps**. + +1. Review the notice, and select **Yes** to continue. + +### Group policy + +If you use group policy, use the following policies to enable or prevent sideloading apps: + +Path: **Computer Configuration\Administrative Templates\Windows Components\App Package Deployment** + +- **Allows development of Windows Store apps and installing them from an integrated development environment (IDE)** +- **Allow all trusted apps to install** + +By default, the OS might set these policies to **Not configured**, which means app sideloading is turned off. If you set these policies to **Enabled**, then users can sideload apps. + +### MDM + +When you use Microsoft Intune, you can enable sideloading apps on managed devices. For more information, see the following articles: + +- [Sign line-of-business apps so they can be deployed to Windows devices with Intune](/mem/intune/apps/app-sideload-windows) +- [App Store device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10#app-store) + +Other MDM servers can implement similar behaviors using the [ApplicationManagement](/windows/client-management/mdm/policy-csp-applicationmanagement) policy CSP. + +## Step 2: Import the security certificate + +This step installs the app certificate to the local device. Installing the certificate creates the trust between the app and the device. + +1. Open the **Properties** for the app package. + + 1. Go to the **Digital Signatures** tab. + + 1. Select the certificate, and select **Details** to open the digital signature details window. + + 1. Select **View Certificate** to open the certificate window. + + 1. Select **Install Certificate** to launch the certificate import wizard. + +1. On the **Certificate Import Wizard**, select **Local Machine**. This action might require an administrator to elevate. + +1. Continue the process to import the certificate into the **Trusted Root Certification Authorities** store. + +> [!NOTE] +> There are other methods to install and manage certificates on devices. For example, with group policy or a provisioning package. + +## Step 3: Install the app + +After you enable sideloading and import the certificate, there are multiple methods you can use to install the app on devices. + +- Manually open the `.msix` or `.appx` package in Windows Explorer. + +- Distribute an [MSIX app](/windows/msix/overview) over the network with a web-based app installer. For more information, see [Install Windows apps from a web page](/windows/msix/app-installer/installing-windows10-apps-web). + +- Use the Windows PowerShell `Add-AppxPackage` cmdlet. For more information, see [Add-AppxPackage](/powershell/module/appx/add-appxpackage). + +## Next steps + +Learn about the [private app repository in Windows 11](private-app-repository-mdm-company-portal-windows-11.md) with the Company Portal and Microsoft Intune. + +For more information on sideloading, see the following articles on Windows app development: + +- [Enable your device for development](/windows/apps/get-started/enable-your-device-for-development) +- [Developer Mode features and debugging](/windows/apps/get-started/developer-mode-features-and-debugging) diff --git a/windows/application-management/toc.yml b/windows/application-management/toc.yml index be08bb1e0f..63f66e42cb 100644 --- a/windows/application-management/toc.yml +++ b/windows/application-management/toc.yml @@ -8,7 +8,7 @@ items: - name: Add or hide Windows features href: add-apps-and-features.md - name: Sideload line of business (LOB) apps - href: sideload-apps-in-windows-10.md + href: sideload-apps-in-windows.md - name: Private app repo on Windows 11 href: private-app-repository-mdm-company-portal-windows-11.md - name: Remove background task resource restrictions diff --git a/windows/client-management/azure-active-directory-integration-with-mdm.md b/windows/client-management/azure-active-directory-integration-with-mdm.md index efb65c5991..27c5fb235c 100644 --- a/windows/client-management/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/azure-active-directory-integration-with-mdm.md @@ -1,7 +1,7 @@ --- title: Microsoft Entra integration with MDM description: Microsoft Entra ID is the world's largest enterprise cloud identity management service. -ms.topic: article +ms.topic: conceptual ms.collection: - highpri - tier2 diff --git a/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md b/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md index e1c894e2c5..ab7c3e0a1c 100644 --- a/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md +++ b/windows/client-management/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md @@ -1,7 +1,7 @@ --- title: Automatic MDM enrollment in the Intune admin center description: Automatic MDM enrollment in the Intune admin center -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md index 522b5d05b6..d9938c6409 100644 --- a/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/bulk-enrollment-using-windows-provisioning-tool.md @@ -1,7 +1,7 @@ --- title: Bulk enrollment description: Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to reimage the devices. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/certificate-authentication-device-enrollment.md b/windows/client-management/certificate-authentication-device-enrollment.md index c1ab833e1c..e53a80cc55 100644 --- a/windows/client-management/certificate-authentication-device-enrollment.md +++ b/windows/client-management/certificate-authentication-device-enrollment.md @@ -1,7 +1,7 @@ --- title: Certificate authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using certificate authentication policy. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/certificate-renewal-windows-mdm.md b/windows/client-management/certificate-renewal-windows-mdm.md index 233a34e3dc..573cbe71b2 100644 --- a/windows/client-management/certificate-renewal-windows-mdm.md +++ b/windows/client-management/certificate-renewal-windows-mdm.md @@ -1,7 +1,7 @@ --- title: Certificate Renewal description: Learn how to find all the resources that you need to provide continuous access to client certificates. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/client-tools/administrative-tools-in-windows.md b/windows/client-management/client-tools/administrative-tools-in-windows.md index 7c30da23de..0988c6c58f 100644 --- a/windows/client-management/client-tools/administrative-tools-in-windows.md +++ b/windows/client-management/client-tools/administrative-tools-in-windows.md @@ -3,7 +3,7 @@ title: Windows Tools/Administrative Tools description: The folders for Windows Tools and Administrative Tools are folders in the Control Panel that contain tools for system administrators and advanced users. ms.localizationpriority: medium ms.date: 08/10/2023 -ms.topic: article +ms.topic: conceptual ms.collection: - highpri - tier2 diff --git a/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md b/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md index 1bcd9ff753..685f872e8a 100644 --- a/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md +++ b/windows/client-management/client-tools/change-default-removal-policy-external-storage-media.md @@ -2,7 +2,7 @@ title: Windows default media removal policy description: In Windows 10 and later, the default removal policy for external storage media changed from Better performance to Quick removal. ms.date: 08/10/2023 -ms.topic: article +ms.topic: conceptual ms.localizationpriority: medium --- diff --git a/windows/client-management/client-tools/connect-to-remote-aadj-pc.md b/windows/client-management/client-tools/connect-to-remote-aadj-pc.md index 2e3e741284..b47fad81ee 100644 --- a/windows/client-management/client-tools/connect-to-remote-aadj-pc.md +++ b/windows/client-management/client-tools/connect-to-remote-aadj-pc.md @@ -3,7 +3,7 @@ title: Connect to remote Microsoft Entra joined device description: Learn how to use Remote Desktop Connection to connect to a Microsoft Entra joined device. ms.localizationpriority: medium ms.date: 08/10/2023 -ms.topic: article +ms.topic: conceptual ms.collection: - highpri - tier2 diff --git a/windows/client-management/client-tools/manage-device-installation-with-group-policy.md b/windows/client-management/client-tools/manage-device-installation-with-group-policy.md index 8efcf24c66..0aaf41776d 100644 --- a/windows/client-management/client-tools/manage-device-installation-with-group-policy.md +++ b/windows/client-management/client-tools/manage-device-installation-with-group-policy.md @@ -2,7 +2,7 @@ title: Manage Device Installation with Group Policy description: Find out how to manage Device Installation Restrictions with Group Policy. ms.date: 08/10/2023 -ms.topic: article +ms.topic: conceptual --- # Manage Device Installation with Group Policy diff --git a/windows/client-management/client-tools/manage-settings-app-with-group-policy.md b/windows/client-management/client-tools/manage-settings-app-with-group-policy.md index afc00a6203..bf19bb6ad7 100644 --- a/windows/client-management/client-tools/manage-settings-app-with-group-policy.md +++ b/windows/client-management/client-tools/manage-settings-app-with-group-policy.md @@ -2,7 +2,7 @@ title: Manage the Settings app with Group Policy description: Find out how to manage the Settings app with Group Policy so you can hide specific pages from users. ms.date: 08/10/2023 -ms.topic: article +ms.topic: conceptual --- # Manage the Settings app with Group Policy diff --git a/windows/client-management/client-tools/mandatory-user-profile.md b/windows/client-management/client-tools/mandatory-user-profile.md index 5c867f498d..78e358f1fd 100644 --- a/windows/client-management/client-tools/mandatory-user-profile.md +++ b/windows/client-management/client-tools/mandatory-user-profile.md @@ -2,7 +2,7 @@ title: Create mandatory user profiles description: A mandatory user profile is a special type of pre-configured roaming user profile that administrators can use to specify settings for users. ms.date: 08/10/2023 -ms.topic: article +ms.topic: conceptual ms.collection: - highpri - tier2 diff --git a/windows/client-management/client-tools/quick-assist.md b/windows/client-management/client-tools/quick-assist.md index 58eceea5e1..f902b92204 100644 --- a/windows/client-management/client-tools/quick-assist.md +++ b/windows/client-management/client-tools/quick-assist.md @@ -2,7 +2,7 @@ title: Use Quick Assist to help users description: Learn how IT Pros can use Quick Assist to help users. ms.date: 08/10/2023 -ms.topic: article +ms.topic: conceptual ms.localizationpriority: medium ms.collection: - highpri diff --git a/windows/client-management/client-tools/windows-libraries.md b/windows/client-management/client-tools/windows-libraries.md index 43666505af..3486649f20 100644 --- a/windows/client-management/client-tools/windows-libraries.md +++ b/windows/client-management/client-tools/windows-libraries.md @@ -1,7 +1,7 @@ --- title: Windows Libraries description: All about Windows Libraries, which are containers for users' content, such as Documents and Pictures. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/client-tools/windows-version-search.md b/windows/client-management/client-tools/windows-version-search.md index a9ff816f27..2bb838cf72 100644 --- a/windows/client-management/client-tools/windows-version-search.md +++ b/windows/client-management/client-tools/windows-version-search.md @@ -2,7 +2,7 @@ title: What version of Windows am I running? description: Discover which version of Windows you're running to determine whether or not your device is enrolled in the Long-Term Servicing Channel or General Availability Channel. ms.date: 08/10/2023 -ms.topic: article +ms.topic: conceptual --- # What version of Windows am I running? diff --git a/windows/client-management/config-lock.md b/windows/client-management/config-lock.md index 443c29c949..30b905a41d 100644 --- a/windows/client-management/config-lock.md +++ b/windows/client-management/config-lock.md @@ -1,7 +1,7 @@ --- title: Secured-core configuration lock description: A secured-core PC (SCPC) feature that prevents configuration drift from secured-core PC features caused by unintentional misconfiguration. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 appliesto: - ✅ Windows 11 diff --git a/windows/client-management/device-update-management.md b/windows/client-management/device-update-management.md index e6c914668a..c298893a3a 100644 --- a/windows/client-management/device-update-management.md +++ b/windows/client-management/device-update-management.md @@ -1,7 +1,7 @@ --- title: Mobile device management MDM for device updates description: Windows provides several APIs to help mobile device management (MDM) solutions manage updates. Learn how to use these APIs to implement update management. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 ms.collection: - highpri diff --git a/windows/client-management/disconnecting-from-mdm-unenrollment.md b/windows/client-management/disconnecting-from-mdm-unenrollment.md index 00e2645545..612dd07651 100644 --- a/windows/client-management/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/disconnecting-from-mdm-unenrollment.md @@ -1,7 +1,7 @@ --- title: Disconnecting from the management infrastructure (unenrollment) description: Disconnecting is initiated either locally by the user using a phone or remotely by the IT admin using management server. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/docfx.json b/windows/client-management/docfx.json index aea6640ea0..d099e4731e 100644 --- a/windows/client-management/docfx.json +++ b/windows/client-management/docfx.json @@ -41,10 +41,10 @@ "zone_pivot_group_filename": "resources/zone-pivot-groups.json", "breadcrumb_path": "/windows/resources/breadcrumb/toc.json", "uhfHeaderId": "MSDocsHeader-Windows", - "ms.technology": "itpro-manage", "audience": "ITPro", - "ms.prod": "windows-client", - "ms.topic": "article", + "ms.service": "windows-client", + "ms.subservice": "itpro-manage", + "ms.topic": "conceptual", "ms.author": "vinpa", "author": "vinaypamnani-msft", "manager": "aaroncz", @@ -85,6 +85,9 @@ "✅ Windows 11", "✅ Windows 10" ] + }, + "ms.topic": { + "mdm/*.md": "reference" } }, "template": [], diff --git a/windows/client-management/enable-admx-backed-policies-in-mdm.md b/windows/client-management/enable-admx-backed-policies-in-mdm.md index bd41f63d4d..00618845b9 100644 --- a/windows/client-management/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/enable-admx-backed-policies-in-mdm.md @@ -1,7 +1,7 @@ --- title: Enable ADMX policies in MDM description: Use this step-by-step guide to configure a selected set of Group Policy administrative templates (ADMX policies) in Mobile Device Management (MDM). -ms.topic: article +ms.topic: conceptual ms.localizationpriority: medium ms.date: 08/10/2023 --- diff --git a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md index 853f60c4dd..f9ccd5cc0a 100644 --- a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -1,7 +1,7 @@ --- title: Enroll a Windows device automatically using Group Policy description: Learn how to use a Group Policy to trigger autoenrollment to MDM for Active Directory (AD) domain-joined devices. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 ms.collection: - highpri diff --git a/windows/client-management/enterprise-app-management.md b/windows/client-management/enterprise-app-management.md index 976b340e5a..b6e975a1c8 100644 --- a/windows/client-management/enterprise-app-management.md +++ b/windows/client-management/enterprise-app-management.md @@ -1,7 +1,7 @@ --- title: Enterprise app management description: This article covers one of the key mobile device management (MDM) features for managing the lifecycle of apps across Windows devices. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/federated-authentication-device-enrollment.md b/windows/client-management/federated-authentication-device-enrollment.md index a96b2ed7e3..ecb42e8160 100644 --- a/windows/client-management/federated-authentication-device-enrollment.md +++ b/windows/client-management/federated-authentication-device-enrollment.md @@ -1,7 +1,7 @@ --- title: Federated authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using federated authentication policy. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/images/insider.png b/windows/client-management/images/insider.png new file mode 100644 index 0000000000..dbe00408cb Binary files /dev/null and b/windows/client-management/images/insider.png differ diff --git a/windows/client-management/implement-server-side-mobile-application-management.md b/windows/client-management/implement-server-side-mobile-application-management.md index ae35a82630..e9c0ab5ecc 100644 --- a/windows/client-management/implement-server-side-mobile-application-management.md +++ b/windows/client-management/implement-server-side-mobile-application-management.md @@ -1,7 +1,7 @@ --- title: Support for Windows Information Protection (WIP) on Windows description: Learn about implementing the Windows version of Windows Information Protection (WIP), which is a lightweight solution for managing company data access and security on personal devices. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/includes/insider-note.md b/windows/client-management/includes/insider-note.md new file mode 100644 index 0000000000..a1160f8047 --- /dev/null +++ b/windows/client-management/includes/insider-note.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.topic: include +ms.date: 01/11/2024 +--- + +:::row::: +:::column span="1"::: +:::image type="content" source="../images/insider.png" alt-text="Logo of Windows Insider." border="false"::: +:::column-end::: +:::column span="3"::: +> [!IMPORTANT] +>This article describes features or settings that are under development and only applicable to [Windows Insider Preview builds](/windows-insider/). The content is subject to change and may have dependencies on other features or services in preview. +:::column-end::: +:::row-end::: diff --git a/windows/client-management/index.yml b/windows/client-management/index.yml index 40f4cb654f..860eb04bfe 100644 --- a/windows/client-management/index.yml +++ b/windows/client-management/index.yml @@ -7,15 +7,13 @@ metadata: title: Manage Windows client # Required; page title displayed in search results. Include the brand. < 60 chars. description: Learn about the administrative tools, tasks, and best practices for managing Windows clients across your enterprise. # Required; article description that is displayed in search results. < 160 chars. ms.topic: landing-page - ms.prod: windows-client - ms.technology: itpro-manage ms.collection: - highpri - tier1 author: vinaypamnani-msft ms.author: vinpa manager: aaroncz - ms.date: 09/26/2023 + ms.date: 01/18/2024 localization_priority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 7129573f55..cc6af7d11f 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -3,7 +3,7 @@ title: Manage Windows devices in your organization - transitioning to modern man description: This article offers strategies for deploying and managing Windows devices, including deploying Windows in a mixed environment. ms.localizationpriority: medium ms.date: 08/10/2023 -ms.topic: article +ms.topic: conceptual --- # Manage Windows devices in your organization - transitioning to modern management diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 1b811341cb..fbd255ba26 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -2,19 +2,20 @@ title: Manage Copilot in Windows description: Learn how to manage Copilot in Windows for commercial environments using MDM and group policy. Learn about the chat providers available to Copilot in Windows. ms.topic: conceptual -ms.technology: itpro-windows-copilot -ms.date: 11/06/2023 +ms.subservice: windows-copilot +ms.date: 01/22/2024 ms.author: mstewart -author: mestew +author: mestew appliesto: - ✅ Windows 11, version 22H2 or later --- # Manage Copilot in Windows + >**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). -Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to help your users get things done in Windows. Copilot in Windows can perform common tasks in Windows like changing Windows settings, which makes it different from the browser-based [Copilot in Edge](/bing-chat-enterprise/edge). However, both user experiences, Copilot in Windows and Copilot in Edge, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since it is possible for users to copy and paste sensitive information into the chat provider. +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop and is designed to help users get things done in Windows. Copilot in Windows can perform common tasks in Windows like changing Windows settings, which makes it different from the browser-based [Copilot in Edge](/copilot/edge). However, both user experiences, Copilot in Windows and Copilot in Edge, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since it's possible for users to copy and paste sensitive information into the chat. > [!Note] > - Copilot in Windows is currently available as a preview. We will continue to experiment with new ideas and methods using your feedback. @@ -39,62 +40,63 @@ Organizations that aren't ready to use Copilot in Windows can disable it until t ## Chat provider platforms for Copilot in Windows -Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat provider platform. The chat provider platform is the underlying service that Copilot in Windows uses to communicate with the user. The chat provider platform that Copilot in Windows uses is important because it is possible for users to copy and paste sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. +Copilot in Windows can use either Microsoft Copilot or Copilot with commercial data protection as its chat provider platform. The chat provider platform is the underlying service that Copilot in Windows uses to communicate with the user. The chat provider platform is important because it's possible for users to copy and paste sensitive information into the chat. Each chat provider platform has different privacy and security protections. -**Bing Chat**: +### Copilot -[Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it) is a consumer experience and if a user isn't signed in with their Microsoft account, the number of chat queries per user has a daily limit. Bing Chat doesn't offer the same commercial data protection as Bing Chat Enterprise does. The following privacy and security protections apply for Bing Chat: - - [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a) - - The privacy statement for using Bing Chat follows the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement) including the product specific guidance in the Microsoft privacy statement for **Bing** under the **Search, Microsoft Edge, and artificial intelligence** section. +Copilot is a consumer experience and has a daily limit on the number of chat queries per user when not signed in with a Microsoft account. It doesn't offer the same data protection as Copilot with commercial data protection. + +- [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a) +- The privacy statement for using Copilot follows the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement) including the product specific guidance in the Microsoft privacy statement for **Bing** under the **Search, Microsoft Edge, and artificial intelligence** section. -**Bing Chat Enterprise**: +### Copilot with commercial data protection -[Bing Chat Enterprise](/bing-chat-enterprise/overview) is intended for commercial use scenarios and offers commercial data protection. The following privacy and security protections apply for Bing Chat Enterprise: +[Copilot with commercial data protection](/copilot/overview) is intended for commercial use scenarios and offers commercial data protection. The following privacy and security protections apply for Copilot with commercial data protection: -- With [Bing Chat Enterprise](/bing-chat-enterprise/overview), user and organizational data is protected, chat data isn't saved, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. Bing Chat Enterprise is accessible from mobile browsers, including Edge mobile on iOS and Android. Review the Bing Chat Enterprise [privacy statement](/bing-chat-enterprise/privacy-and-protections). -- Bing Chat Enterprise is available, at no additional cost, for the following licenses: +- User and organizational data is protected, chat data isn't saved, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing app for iOS or Android aren't currently supported. Copilot with commercial data protection is accessible from mobile browsers, including Edge mobile on iOS and Android. Review the Copilot with commercial data protection [privacy statement](/copilot/privacy-and-protections). +- Copilot with commercial data protection is available, at no additional cost, for the following licenses: - Microsoft 365 E3 or E5 - Microsoft 365 A3 or A5 for faculty - Microsoft 365 Business Standard - Microsoft 365 Business Premium > [!Note] - > Bing Chat Enterprise and Bing Chat don't have access to Microsoft Graph, unlike [Microsoft 365 Copilot](/microsoft-365-copilot/microsoft-365-copilot-overview) which can be used in the Microsoft 365 apps. This means that Bing Chat Enterprise and Bing Chat can't access Microsoft 365 Apps data, such as email, calendar, or files. + > Copilot doesn't have access to Microsoft 365 Apps data, such as email, calendar, or files using Microsoft Graph, unlike [Copilot for Microsoft 365](/microsoft-365-copilot/microsoft-365-copilot-overview) which can be used in the Microsoft 365 apps. ## Configure the chat provider platform that Copilot in Windows uses -Configuring the correct chat provider platform for Copilot in Windows is important because it is possible for users to copy and paste sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. Once you have selected the chat provider platform that you want to use for Copilot in Windows, ensure it's configured for your organization's users. The following sections describe how to configure the chat provider platform that Copilot in Windows uses. +Configuring the correct chat provider platform for Copilot in Windows is important because it's possible for users to copy and paste sensitive information into the chat. Each chat provider platform has different privacy and security protections. Once you select the chat provider platform that you want to use for Copilot in Windows, ensure it's configured for your organization's users. The following sections describe how to configure the chat provider platform that Copilot in Windows uses. -### Bing Chat as the chat provider platform +### Microsoft Copilot as the chat provider platform -Bing Chat is used as the default chat provider platform for Copilot in Windows when any of the following conditions occur: +Copilot is used as the default chat provider platform for Copilot in Windows when any of the following conditions occur: -- Bing Chat Enterprise isn't configured for the user -- The user isn't assigned a license that includes Bing Chat Enterprise -- Bing Chat Enterprise is [turned off](/bing-chat-enterprise/manage) -- The user isn't signed in with a Microsoft Entra account that's licensed for Bing Chat Enterprise +- Commercial data protection isn't configured for the user. +- Commercial data protection is [turned off](/copilot/manage). +- The user isn't assigned a license that includes Copilot with commercial data protection. +- The user isn't signed in with a Microsoft Entra account that's licensed for Copilot with commercial data protection. -### Bing Chat Enterprise as the chat provider platform (recommended for commercial environments) +### Copilot with commercial data protection as the chat provider platform (recommended for commercial environments) -To verify that Bing Chat Enterprise is enabled for the user as the chat provider platform for Copilot in Windows, use the following instructions: +To verify that Copilot with commercial data protection is enabled for the user as the chat provider platform for Copilot in Windows, use the following instructions: 1. Sign into the [Microsoft 365 admin center](https://admin.microsoft.com/). -1. In the admin center, select **Users** > **Active users** and verify that users are assigned a license that includes Bing Chat Enterprise. Bing Chat Enterprise is included and enabled by default for users that are assigned one of the following licenses: +1. In the admin center, select **Users** > **Active users** and verify that users are assigned a license that includes **Copilot**. Copilot with commercial data protection is included and enabled by default for users that are assigned one of the following licenses: - Microsoft 365 E3 or E5 - Microsoft 365 A3 or A5 for faculty - - Currently, Microsoft 365 A3 and A5 for faculty requires additional configuration. For more information, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage). + - Currently, Microsoft 365 A3 and A5 for faculty requires additional configuration. For more information, see [Manage Copilot](/copilot/manage). - Microsoft 365 Business Standard - Microsoft 365 Business Premium -1. To verify that Bing Chat Enterprise is enabled for the user, select the user's **Display name** to open the flyout menu. +1. To verify that commercial data protection is enabled for the user, select the user's **Display name** to open the flyout menu. 1. In the flyout, select the **Licenses & apps** tab, then expand the **Apps** list. -1. Verify that **Bing Chat Enterprise** is enabled for the user. -1. If you prefer to view a user's licenses from the [Azure portal](https://portal.azure.com), you will find it under **Microsoft Entra ID** > **Users**. Select the user's name, then **Licenses**. Select a license that includes Bing Chat Enterprise, and verify that it's listed as **On**. +1. Verify that **Copilot** is enabled for the user. +1. If you prefer to view a user's licenses from the [Azure portal](https://portal.azure.com), you'll find it under **Microsoft Entra ID** > **Users**. Select the user's name, then **Licenses**. Select a license that includes **Copilot**, and verify that it's listed as **On**. > [!Note] - > If you previously disabled Bing Chat Enterprise using the URL, `https://aka.ms/TurnOffBCE`, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage) for verifying that Bing Chat Enterprise is enabled for your users. + > If you previously disabled Copilot with commercial data protection (formerly Bing Chat Enterprise) using the URL, `https://aka.ms/TurnOffBCE`, see [Manage Copilot](/copilot/manage) for verifying that commercial data protection is enabled for your users. -The following sample PowerShell script connects to Microsoft Graph and lists which users that have Bing Chat Enterprise enabled and disabled: +The following sample PowerShell script connects to Microsoft Graph and lists which users that have Copilot with commercial data protection enabled and disabled: ```powershell # Install Microsoft Graph module @@ -108,20 +110,20 @@ Connect-MgGraph -Scopes 'User.Read.All' # Get all users $users = Get-MgUser -All -ConsistencyLevel eventual -Property Id, DisplayName, Mail, UserPrincipalName, AssignedPlans -# Users with Bing Chat Enterprise enabled +# Users with Copilot with commercial data protection enabled $users | Where-Object { $_.AssignedPlans -and $_.AssignedPlans.Service -eq "Bing" -and $_.AssignedPlans.CapabilityStatus -eq "Enabled" } | Format-Table -# Users without Bing Chat Enterprise enabled +# Users without Copilot with commercial data protection enabled $users | Where-Object { -not $_.AssignedPlans -or ($_.AssignedPlans.Service -eq "Bing" -and $_.AssignedPlans.CapabilityStatus -ne "Enabled") } | Format-Table ``` -When Bing Chat Enterprise is the chat provider platform, the user experience clearly states that **Your personal and company data are protected in this chat**. There's also a shield symbol labeled **Protected** at the top of the Copilot in Windows sidebar and the provider is listed under the Copilot logo when the sidebar is first opened. The following image shows the message that's displayed when Bing Chat Enterprise is the chat provider platform for Copilot in Windows: +When Copilot with commercial data protection is the chat provider platform, the user experience clearly states that **Your personal and company data are protected in this chat**. There's also a shield symbol labeled **Protected** at the top of the Copilot in Windows sidebar and the provider is listed under the Copilot logo when the sidebar is first opened. The following image shows the message that's displayed in this scenario: -:::image type="content" source="images/bing-chat-enterprise-chat-provider.png" alt-text="Screenshot of the Copilot in Windows user experience when Bing Chat Enterprise is the chat provider." lightbox="images/bing-chat-enterprise-chat-provider.png"::: +:::image type="content" source="images/bing-chat-enterprise-chat-provider.png" alt-text="Screenshot of the Copilot in Windows user experience when Copilot with commercial data protection is the chat provider." lightbox="images/bing-chat-enterprise-chat-provider.png"::: ## Ensure the Copilot in Windows user experience is enabled -Once you've configured the chat provider platform that Copilot in Windows uses, you need to ensure that the Copilot in Windows user experience is enabled. Ensuring the Copilot in Windows user experience is enabled varies by the Windows version. +Once you've configured the chat provider platform that Copilot in Windows uses, you need to ensure that the Copilot in Windows user experience is enabled. Ensuring the Copilot in Windows user experience is enabled varies by the Windows version. ### Enable the Copilot in Windows user experience for Windows 11, version 22H2 clients @@ -130,7 +132,7 @@ Copilot in Windows isn't technically enabled by default for managed Windows 11, To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you need to enable features under temporary enterprise control for these devices. Since enabling features behind [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) can be impactful, you should test this change before deploying it broadly. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: 1. Verify that the user accounts have the correct chat provider platform configured for Copilot in Windows. For more information, see the [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) section. -1. Apply a policy to enable features under temporary enterprise control for managed clients. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: +1. Apply a policy to enable features under temporary enterprise control for managed clients. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\\**Enable features introduced via servicing that are off by default** - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol) @@ -142,7 +144,7 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Windows Update for Business\\**Allow updates to Windows optional features** - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowOptionalUpdates](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalupdates) - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow optional updates** under the **Windows Update for Business** category. - + The optional updates policy applies to Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later. When setting policy for [optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates), ensure you select one of the following options that includes CFRs: - Automatically receive optional updates (including CFRs) - This selection places devices into an early CFR phase @@ -152,9 +154,9 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n ### Enable the Copilot in Windows user experience for Windows 11, version 23H2 clients -Once a managed device installs the version 23H2 update, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows will be removed. This means that Copilot in Windows will be enabled by default for these devices. +Once a managed device installs the version 23H2 update, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows is removed. This means that Copilot in Windows is enabled by default for these devices. -While the user experience for Copilot in Windows is enabled by default, you still need to verify that the correct chat provider platform configured for Copilot in Windows. While every effort has been made to ensure that Bing Chat Enterprise is the default chat provider for commercial organizations, it's still possible that Bing Chat might still be used if the configuration is incorrect, or if other settings are affecting Copilot in Windows. For more information, see: +While the user experience for Copilot in Windows is enabled by default, you still need to verify that the correct chat provider platform configured for Copilot in Windows. While every effort is made to ensure that Copilot with commercial data protection is the default chat provider for commercial organizations, it's still possible that Copilot might still be used if the configuration is incorrect, or if other settings are affecting Copilot in Windows. For more information, see: - [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) - [Other settings that might affect Copilot in Windows and its underlying chat provider](#other-settings-that-might-affect-copilot-in-windows-and-its-underlying-chat-provider) @@ -165,25 +167,26 @@ Organizations that aren't ready to use Copilot in Windows can disable it until t ## Other settings that might affect Copilot in Windows and its underlying chat provider -Copilot in Windows and [Copilot in Edge](/bing-chat-enterprise/edge), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and Copilot in Edge can also affect Copilot in Windows. The following common settings might affect Copilot in Windows and its underlying chat provider: +Copilot in Windows and [Copilot in Edge](/copilot/edge), can share the same underlying chat provider platform. This also means that some settings that affect Copilot, Copilot with commercial data protection, and Copilot in Edge can also affect Copilot in Windows. The following common settings might affect Copilot in Windows and its underlying chat provider: ### Bing settings -- If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it can block chat providers for Copilot in Windows. The following network changes block the chat providers for Copilot in Windows and Copilot in Edge: - - mapping `www.bing.com` to `strict.bing.com` - - mapping `edgeservices.bing.com` to `strict.bing.com` - - blocking `bing.com` +- If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it can block chat providers for Copilot in Windows. The following network changes block the chat providers for Copilot in Windows and Edge: -- If Bing Chat Enterprise is turned on for your organization, users will be able to access it through Edge mobile when signed in with their work account. If you would like to remove the Bing Chat button from the Edge mobile interface, you can use an [Intune Mobile Application Management (MAM) policy for Microsoft Edge](/mem/intune/apps/manage-microsoft-edge) to remove it: + - Mapping `www.bing.com` to `strict.bing.com` + - Mapping `edgeservices.bing.com` to `strict.bing.com` + - Blocking `bing.com` - |Key |Value | - |:---------|:------------| - |com.microsoft.intune.mam.managedbrowser.Chat| **true** (default) shows the interface
**false** hides the interface | +- If Copilot with commercial data protection is turned on for your organization, users can access it through Edge mobile when signed in with their work account. If you would like to remove the Bing Chat button from the Edge mobile interface, you can use an [Intune Mobile Application Management (MAM) policy for Microsoft Edge](/mem/intune/apps/manage-microsoft-edge) to remove it: + + | Key | Value | + |:---------------------------------------------|:---------------------------------------------------------------------------| + | com.microsoft.intune.mam.managedbrowser.Chat | **true** (default) shows the interface
**false** hides the interface | ### Microsoft Edge policies - If [HubsSidebarEnabled](/deployedge/microsoft-edge-policies#hubssidebarenabled) is set to `disabled`, it blocks Copilot in Edge from being displayed. -- If [DiscoverPageContextEnabled](/deployedge/microsoft-edge-policies#discoverpagecontextenabled) is set to `disabled`, it blocks Bing Chat and Bing Chat Enterprise from reading the current webpage context. The chat providers need access to the current webpage context for providing page summarizations and sending user selected strings from the webpage into the chat provider. +- If [DiscoverPageContextEnabled](/deployedge/microsoft-edge-policies#discoverpagecontextenabled) is set to `disabled`, it blocks Copilot from reading the current webpage context. The chat providers need access to the current webpage context for providing page summarizations and sending user selected strings from the webpage into the chat provider. ### Search settings diff --git a/windows/client-management/mdm-collect-logs.md b/windows/client-management/mdm-collect-logs.md index 5756913331..bc39a4ceb7 100644 --- a/windows/client-management/mdm-collect-logs.md +++ b/windows/client-management/mdm-collect-logs.md @@ -1,7 +1,7 @@ --- title: Collect MDM logs description: Learn how to collect MDM logs. Examining these logs can help diagnose enrollment or device management issues in Windows devices managed by an MDM server. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 ms.collection: - highpri diff --git a/windows/client-management/mdm-diagnose-enrollment.md b/windows/client-management/mdm-diagnose-enrollment.md index c3dd757bb5..1d2c92bd1f 100644 --- a/windows/client-management/mdm-diagnose-enrollment.md +++ b/windows/client-management/mdm-diagnose-enrollment.md @@ -1,7 +1,7 @@ --- title: Diagnose MDM enrollment failures description: Learn how to diagnose enrollment failures for Windows devices -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm-enrollment-of-windows-devices.md index ef09eea68f..c3140fd86d 100644 --- a/windows/client-management/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm-enrollment-of-windows-devices.md @@ -1,7 +1,7 @@ --- title: MDM enrollment of Windows devices description: Learn about mobile device management (MDM) enrollment of Windows devices to simplify access to your organization's resources. -ms.topic: article +ms.topic: conceptual ms.collection: - highpri - tier2 diff --git a/windows/client-management/mdm-known-issues.md b/windows/client-management/mdm-known-issues.md index 3b715665e0..10bd7ebaa1 100644 --- a/windows/client-management/mdm-known-issues.md +++ b/windows/client-management/mdm-known-issues.md @@ -1,7 +1,7 @@ --- title: Known issues in MDM description: Learn about known issues for Windows devices in MDM -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/mdm-overview.md b/windows/client-management/mdm-overview.md index 4777c1d28c..7b31fe006a 100644 --- a/windows/client-management/mdm-overview.md +++ b/windows/client-management/mdm-overview.md @@ -2,7 +2,7 @@ title: Mobile Device Management overview description: Windows provides an enterprise-level solution to mobile management, to help IT pros comply with security policies while avoiding compromise of user's privacy. ms.date: 08/10/2023 -ms.topic: article +ms.topic: conceptual ms.localizationpriority: medium ms.collection: - highpri diff --git a/windows/client-management/mdm/Language-pack-management-csp.md b/windows/client-management/mdm/Language-pack-management-csp.md index 25ff8939c4..f4e01b842c 100644 --- a/windows/client-management/mdm/Language-pack-management-csp.md +++ b/windows/client-management/mdm/Language-pack-management-csp.md @@ -1,14 +1,7 @@ --- title: LanguagePackManagement CSP description: Learn more about the LanguagePackManagement CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/accountmanagement-csp.md b/windows/client-management/mdm/accountmanagement-csp.md index 4fdc019a91..55180da611 100644 --- a/windows/client-management/mdm/accountmanagement-csp.md +++ b/windows/client-management/mdm/accountmanagement-csp.md @@ -1,14 +1,7 @@ --- title: AccountManagement CSP description: Learn more about the AccountManagement CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/29/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/accountmanagement-ddf.md b/windows/client-management/mdm/accountmanagement-ddf.md index 7589b07ab4..06093b49ae 100644 --- a/windows/client-management/mdm/accountmanagement-ddf.md +++ b/windows/client-management/mdm/accountmanagement-ddf.md @@ -1,14 +1,7 @@ --- title: AccountManagement DDF file description: View the XML file containing the device description framework (DDF) for the AccountManagement configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/29/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/accounts-csp.md b/windows/client-management/mdm/accounts-csp.md index 86ff222dcc..e32ee78e33 100644 --- a/windows/client-management/mdm/accounts-csp.md +++ b/windows/client-management/mdm/accounts-csp.md @@ -1,14 +1,7 @@ --- title: Accounts CSP description: The Accounts configuration service provider (CSP) is used by the enterprise to rename devices, and create local Windows accounts & join them to a group. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 03/27/2020 -ms.reviewer: -manager: aaroncz --- # Accounts CSP diff --git a/windows/client-management/mdm/accounts-ddf-file.md b/windows/client-management/mdm/accounts-ddf-file.md index 330218b819..9fb71bd404 100644 --- a/windows/client-management/mdm/accounts-ddf-file.md +++ b/windows/client-management/mdm/accounts-ddf-file.md @@ -1,14 +1,7 @@ --- title: Accounts DDF file description: View the XML file containing the device description framework (DDF) for the Accounts configuration service provider. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 04/17/2018 -ms.reviewer: -manager: aaroncz --- # Accounts DDF file diff --git a/windows/client-management/mdm/activesync-csp.md b/windows/client-management/mdm/activesync-csp.md index 842d9225c2..8d862c057a 100644 --- a/windows/client-management/mdm/activesync-csp.md +++ b/windows/client-management/mdm/activesync-csp.md @@ -1,14 +1,7 @@ --- title: ActiveSync CSP description: Learn more about the ActiveSync CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/activesync-ddf-file.md b/windows/client-management/mdm/activesync-ddf-file.md index 06f77c27b9..b32ae659db 100644 --- a/windows/client-management/mdm/activesync-ddf-file.md +++ b/windows/client-management/mdm/activesync-ddf-file.md @@ -1,14 +1,7 @@ --- title: ActiveSync DDF file description: View the XML file containing the device description framework (DDF) for the ActiveSync configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 07/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the A 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/alljoynmanagement-csp.md b/windows/client-management/mdm/alljoynmanagement-csp.md index c87f85294d..a7df16f516 100644 --- a/windows/client-management/mdm/alljoynmanagement-csp.md +++ b/windows/client-management/mdm/alljoynmanagement-csp.md @@ -1,13 +1,6 @@ --- title: AllJoynManagement CSP description: The AllJoynManagement configuration service provider (CSP) allows an IT administrator to enumerate the AllJoyn devices that are connected to the AllJoyn bus. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/alljoynmanagement-ddf.md b/windows/client-management/mdm/alljoynmanagement-ddf.md index 32030275e8..a3ef6dc003 100644 --- a/windows/client-management/mdm/alljoynmanagement-ddf.md +++ b/windows/client-management/mdm/alljoynmanagement-ddf.md @@ -1,13 +1,6 @@ --- title: AllJoynManagement DDF description: Learn the OMA DM device description framework (DDF) for the AllJoynManagement configuration service provider. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/application-csp.md b/windows/client-management/mdm/application-csp.md index c53a080791..b20e289a43 100644 --- a/windows/client-management/mdm/application-csp.md +++ b/windows/client-management/mdm/application-csp.md @@ -1,13 +1,6 @@ --- title: APPLICATION CSP description: Learn how the APPLICATION configuration service provider is used to configure an application transport using Open Mobile Alliance (OMA) Client Provisioning. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/applicationcontrol-csp-ddf.md b/windows/client-management/mdm/applicationcontrol-csp-ddf.md index 199adf8620..38de53b868 100644 --- a/windows/client-management/mdm/applicationcontrol-csp-ddf.md +++ b/windows/client-management/mdm/applicationcontrol-csp-ddf.md @@ -1,14 +1,7 @@ --- title: ApplicationControl DDF file description: View the XML file containing the device description framework (DDF) for the ApplicationControl configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the A 10.0.18362 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md index 9c5875b5a4..76a6d9a68a 100644 --- a/windows/client-management/mdm/applicationcontrol-csp.md +++ b/windows/client-management/mdm/applicationcontrol-csp.md @@ -1,14 +1,7 @@ --- title: ApplicationControl CSP description: Learn more about the ApplicationControl CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/applocker-csp.md b/windows/client-management/mdm/applocker-csp.md index e7b2417319..b7c198fd13 100644 --- a/windows/client-management/mdm/applocker-csp.md +++ b/windows/client-management/mdm/applocker-csp.md @@ -1,14 +1,7 @@ --- title: AppLocker CSP description: Learn more about the AppLocker CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/applocker-ddf-file.md b/windows/client-management/mdm/applocker-ddf-file.md index 9ffbf897b8..11f10bf906 100644 --- a/windows/client-management/mdm/applocker-ddf-file.md +++ b/windows/client-management/mdm/applocker-ddf-file.md @@ -1,14 +1,7 @@ --- title: AppLocker DDF file description: View the XML file containing the device description framework (DDF) for the AppLocker configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the A 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index 6aea2cc955..85fa624e4a 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -1,14 +1,7 @@ --- title: AssignedAccess CSP description: Learn more about the AssignedAccess CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/assignedaccess-ddf.md b/windows/client-management/mdm/assignedaccess-ddf.md index 5ef69490c0..4c003123f7 100644 --- a/windows/client-management/mdm/assignedaccess-ddf.md +++ b/windows/client-management/mdm/assignedaccess-ddf.md @@ -1,14 +1,7 @@ --- title: AssignedAccess DDF file description: View the XML file containing the device description framework (DDF) for the AssignedAccess configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the A 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index ab201e6028..d9cf189c9a 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -1,14 +1,7 @@ --- title: BitLocker CSP description: Learn more about the BitLocker CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/bitlocker-ddf-file.md b/windows/client-management/mdm/bitlocker-ddf-file.md index fb912358e4..ea131ee762 100644 --- a/windows/client-management/mdm/bitlocker-ddf-file.md +++ b/windows/client-management/mdm/bitlocker-ddf-file.md @@ -1,14 +1,7 @@ --- title: BitLocker DDF file description: View the XML file containing the device description framework (DDF) for the BitLocker configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the B 10.0.15063 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/cellularsettings-csp.md b/windows/client-management/mdm/cellularsettings-csp.md index 629021dd17..993b08f2bf 100644 --- a/windows/client-management/mdm/cellularsettings-csp.md +++ b/windows/client-management/mdm/cellularsettings-csp.md @@ -1,13 +1,6 @@ --- title: CellularSettings CSP description: Learn how the CellularSettings configuration service provider is used to configure cellular settings on a mobile device. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- @@ -42,8 +35,8 @@ CellularSettings |Value|Setting| |--- |--- | -|0|Don’t roam| -|1|Don’t roam (or Domestic roaming if applicable)| +|0|Don't roam| +|1|Don't roam (or Domestic roaming if applicable)| |2|Roam| ## Related topics diff --git a/windows/client-management/mdm/certificatestore-csp.md b/windows/client-management/mdm/certificatestore-csp.md index cc17da3674..63ccb20661 100644 --- a/windows/client-management/mdm/certificatestore-csp.md +++ b/windows/client-management/mdm/certificatestore-csp.md @@ -1,14 +1,7 @@ --- title: CertificateStore CSP description: Learn more about the CertificateStore CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/certificatestore-ddf-file.md b/windows/client-management/mdm/certificatestore-ddf-file.md index 5c819f96bc..795e288f4d 100644 --- a/windows/client-management/mdm/certificatestore-ddf-file.md +++ b/windows/client-management/mdm/certificatestore-ddf-file.md @@ -1,14 +1,7 @@ --- title: CertificateStore DDF file description: View the XML file containing the device description framework (DDF) for the CertificateStore configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -49,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the C 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/cleanpc-csp.md b/windows/client-management/mdm/cleanpc-csp.md index a1b634ff45..1f90bd010d 100644 --- a/windows/client-management/mdm/cleanpc-csp.md +++ b/windows/client-management/mdm/cleanpc-csp.md @@ -1,14 +1,7 @@ --- title: CleanPC CSP description: The CleanPC configuration service provider (CSP) allows you to remove user-installed and pre-installed applications, with the option to persist user data. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 -ms.reviewer: -manager: aaroncz --- # CleanPC CSP diff --git a/windows/client-management/mdm/cleanpc-ddf.md b/windows/client-management/mdm/cleanpc-ddf.md index 1bc37c5325..40c8fdba74 100644 --- a/windows/client-management/mdm/cleanpc-ddf.md +++ b/windows/client-management/mdm/cleanpc-ddf.md @@ -1,13 +1,6 @@ --- title: CleanPC DDF description: Learn about the OMA DM device description framework (DDF) for the CleanPC configuration service provider. DDF files are used only with OMA DM provisioning XML. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/clientcertificateinstall-csp.md b/windows/client-management/mdm/clientcertificateinstall-csp.md index a1936f909b..8b4c0ff283 100644 --- a/windows/client-management/mdm/clientcertificateinstall-csp.md +++ b/windows/client-management/mdm/clientcertificateinstall-csp.md @@ -1,14 +1,7 @@ --- title: ClientCertificateInstall CSP description: Learn more about the ClientCertificateInstall CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/24/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md index c5b24365ff..f0fb439bfa 100644 --- a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md +++ b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md @@ -1,14 +1,7 @@ --- title: ClientCertificateInstall DDF file description: View the XML file containing the device description framework (DDF) for the ClientCertificateInstall configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the C 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -1129,7 +1122,7 @@ Valid values are: 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/clouddesktop-csp.md b/windows/client-management/mdm/clouddesktop-csp.md index b8a0a69fad..8e70090f67 100644 --- a/windows/client-management/mdm/clouddesktop-csp.md +++ b/windows/client-management/mdm/clouddesktop-csp.md @@ -1,14 +1,7 @@ --- title: CloudDesktop CSP description: Learn more about the CloudDesktop CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/25/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following list shows the CloudDesktop configuration service provider nodes: -This node allows to configure different kinds of Boot to Cloud mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. For using this feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned. This node supports the below options: 0. Not Configured. 1. Enable Boot to Cloud Shared PC Mode: Boot to Cloud Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. 2. Enable Boot to Cloud Personal Mode (Cloud only): Personal mode allows user to sign-in on the device using various authentication mechanism configured by their organization (For ex. PIN, Biometrics etc). This mode preserves user personalization, including their profile picture and username in local machine, and facilitates fast account switching. +This node allows to configure different kinds of Boot to Cloud mode. Boot to cloud mode enables users to seamlessly sign-in to a Cloud PC. For using this feature, Cloud Provider application must be installed on the PC and the user must have a Cloud PC provisioned. This node supports the below options: 0. Not Configured. 1. Enable Boot to Cloud Shared PC Mode: Boot to Cloud Shared PC mode allows multiple users to sign-in on the device and use for shared purpose. 2. Enable Boot to Cloud Dedicated Mode (Cloud only): Dedicated mode allows user to sign-in on the device using various authentication mechanism configured by their organization (For ex. PIN, Biometrics etc). This mode preserves user personalization, including their profile picture and username in local machine, and facilitates fast account switching. @@ -73,7 +66,7 @@ This node allows to configure different kinds of Boot to Cloud mode. Boot to clo |:--|:--| | 0 (Default) | Not Configured. | | 1 | Enable Boot to Cloud Shared PC Mode. | -| 2 | Enable Boot to Cloud Personal Mode (Cloud only). | +| 2 | Enable Boot to Cloud Dedicated Mode (Cloud only). | @@ -140,10 +133,10 @@ Setting this node to "true" configures boot to cloud for Shared PC mode. Boot to ## BootToCloudPCEnhanced technical reference -BootToCloudPCEnhanced is the setting used to configure **Boot to Cloud** feature either for shared mode or personal mode. When you enable this setting, multiple policies are applied to achieve the intended behavior. If you wish to customize the **Boot to Cloud** experience, you can utilize the [BootToCloudMode](policy-csp-clouddesktop.md#boottocloudmode) policy, which provides the flexibility to tailor the experience according to your requirements. +BootToCloudPCEnhanced is the setting used to configure **Boot to Cloud** feature either for shared mode or dedicated mode. When you enable this setting, multiple policies are applied to achieve the intended behavior. If you wish to customize the **Boot to Cloud** experience, you can utilize the [BootToCloudMode](policy-csp-clouddesktop.md#boottocloudmode) policy, which provides the flexibility to tailor the experience according to your requirements. > [!NOTE] -> It is recommended not to set any of the policies enforced by this setting to different values, as these policies help provide a smooth UX experience for the **Boot to Cloud** feature for shared and personal mode. +> It is recommended not to set any of the policies enforced by this setting to different values, as these policies help provide a smooth UX experience for the **Boot to Cloud** feature for shared and dedicated mode. ### Boot to Cloud Shared PC Mode @@ -189,6 +182,7 @@ When the Shared PC mode is enabled by setting BootToCloudPCEnhanced value to 1: | Start Menu and Taskbar/Notifications/Turn off toast notifications | Enabled | | Start Menu and Taskbar/Notifications/Remove Notifications and Action Center | Enabled | | System/Logon/Do not process the legacy run list | Enabled | + | Windows Components/Windows Copilot/Turn off Windows Copilot | Enabled | - Following registry changes are performed: @@ -197,9 +191,9 @@ When the Shared PC mode is enabled by setting BootToCloudPCEnhanced value to 1: | Software\Policies\Microsoft\PassportForWork\Remote\Enabled (Phone sign-in/Use phone sign-in) | 0 | | Software\Policies\Microsoft\PassportForWork\Enabled (Use Microsoft Passport for Work) | 0 | -### Boot to Cloud Personal Mode +### Boot to Cloud Dedicated Mode -When the Personal mode is enabled by setting BootToCloudPCEnhanced value to 2: +When the Dedicated mode is enabled by setting BootToCloudPCEnhanced value to 2: - Following MDM policies are applied for the Device scope (all users): @@ -218,6 +212,7 @@ When the Personal mode is enabled by setting BootToCloudPCEnhanced value to 2: | Start Menu and Taskbar/Notifications/Turn off toast notifications | Enabled | | Start Menu and Taskbar/Notifications/Remove Notifications and Action Center | Enabled | | System/Logon/Do not process the legacy run list | Enabled | + | Windows Components/Windows Copilot/Turn off Windows Copilot | Enabled | diff --git a/windows/client-management/mdm/clouddesktop-ddf-file.md b/windows/client-management/mdm/clouddesktop-ddf-file.md index daaccf8c6c..836c999eeb 100644 --- a/windows/client-management/mdm/clouddesktop-ddf-file.md +++ b/windows/client-management/mdm/clouddesktop-ddf-file.md @@ -1,14 +1,7 @@ --- title: CloudDesktop DDF file description: View the XML file containing the device description framework (DDF) for the CloudDesktop configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/25/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the C 99.9.99999 9.9 - 0x4;0x30;0x31;0x7E;0x87;0x88;0x88*;0xA1;0xA2;0xA4;0xA5;0xB4;0xBC;0xBD;0xBF; + 0x4;0x30;0x31;0x7E;0x88;0xA1;0xA2;0xA4;0xA5;0xBC;0xBF;0xCD; diff --git a/windows/client-management/mdm/cm-cellularentries-csp.md b/windows/client-management/mdm/cm-cellularentries-csp.md index 1997c7878c..4051454ae5 100644 --- a/windows/client-management/mdm/cm-cellularentries-csp.md +++ b/windows/client-management/mdm/cm-cellularentries-csp.md @@ -1,13 +1,6 @@ --- title: CM\_CellularEntries CSP description: Learn how to configure the General Packet Radio Service (GPRS) entries using the CM\_CellularEntries CSP. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 08/02/2017 --- diff --git a/windows/client-management/mdm/cmpolicy-csp.md b/windows/client-management/mdm/cmpolicy-csp.md index caf0856091..af8c1facf4 100644 --- a/windows/client-management/mdm/cmpolicy-csp.md +++ b/windows/client-management/mdm/cmpolicy-csp.md @@ -1,13 +1,6 @@ --- title: CMPolicy CSP description: Learn how the CMPolicy configuration service provider (CSP) is used to define rules that the Connection Manager uses to identify correct connections. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- @@ -33,7 +26,7 @@ Each policy entry identifies one or more applications in combination with a host **Policy Ordering**: There's no explicit ordering of policies. The general rule is that the most concrete or specific policy mappings take a higher precedence. -**Default Policies**: Policies are applied in order of their scope with the most specific policies considered before the more general policies. The phone’s default behavior applies to all applications and all domains and is only used when no other, more specific policy is available. The default policy is to use any available Wi-Fi network first and then any available APN. +**Default Policies**: Policies are applied in order of their scope with the most specific policies considered before the more general policies. The phone's default behavior applies to all applications and all domains and is only used when no other, more specific policy is available. The default policy is to use any available Wi-Fi network first and then any available APN. The following shows the CMPolicy configuration service provider management object in tree format as used by both Open Mobile Alliance (OMA) Client Provisioning and OMA Device Management. @@ -88,7 +81,7 @@ Enumerates the connections associated with the policy. Element names begin with **ConnectionID** Specifies a unique identifier for a connection within a group of connections. The exact value is based on the Type parameter. -For `CMST_CONNECTION_NAME`, specify the connection name. For example, if you have a connection configured by using the CM\_CellularEntries configuration service provider, the connection name could be the name of the connection. If you have a NAP configured with the NAPID set to “GPRS1”, the connection name could be “GPRS1@WAP”. +For `CMST_CONNECTION_NAME`, specify the connection name. For example, if you have a connection configured by using the CM\_CellularEntries configuration service provider, the connection name could be the name of the connection. If you have a NAP configured with the NAPID set to "GPRS1", the connection name could be "GPRS1@WAP". For `CMST_CONNECTION_TYPE`, specify the GUID for the desired connection type. The curly brackets {} around the GUID are required. The following connection types are available: @@ -142,7 +135,7 @@ Specifies the type of connection being referenced. The following list describes ## OMA client provisioning examples -Adding an application-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. +Adding an application-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection ("GPRSConn1") that is configured with the CM\_CellularEntries configuration service provider. ```xml @@ -189,7 +182,7 @@ Adding an application-based mapping policy. In this example, the ConnectionId fo Adding a host-based mapping policy: -In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. +In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection ("GPRSConn1") that is configured with the CM\_CellularEntries configuration service provider. ```xml diff --git a/windows/client-management/mdm/cmpolicyenterprise-csp.md b/windows/client-management/mdm/cmpolicyenterprise-csp.md index 72db3fe0f1..eee6f8d4b1 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-csp.md +++ b/windows/client-management/mdm/cmpolicyenterprise-csp.md @@ -1,13 +1,6 @@ --- title: CMPolicyEnterprise CSP description: Learn how the CMPolicyEnterprise CSP is used to define rules that the Connection Manager uses to identify the correct connection for a connection request. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- @@ -36,7 +29,7 @@ Each policy entry identifies one or more applications in combination with a host **Policy Ordering**: There's no explicit ordering of policies. The general rule is that the most concrete or specific policy mappings take a higher precedence. -**Default Policies**: Policies are applied in the order of their scope with the most specific policies considered before the more general policies. The phone’s default behavior applies to all applications and all domains and is only used when no other, more specific policy is available. The default policy is to use any available Wi-Fi network first and then any available APN. +**Default Policies**: Policies are applied in the order of their scope with the most specific policies considered before the more general policies. The phone's default behavior applies to all applications and all domains and is only used when no other, more specific policy is available. The default policy is to use any available Wi-Fi network first and then any available APN. The following shows the CMPolicyEnterprise configuration service provider management object in tree format as used by both Open Mobile Alliance (OMA) Client Provisioning and OMA Device Management. @@ -91,7 +84,7 @@ Enumerates the connections associated with the policy. Element names begin with **ConnectionID** Specifies a unique identifier for a connection within a group of connections. The exact value is based on the Type parameter. -For `CMST_CONNECTION_NAME`, specify the connection name. For example, if you have a connection configured by using the CM\_CellularEntries configuration service provider, the connection name could be the name of the connection. If you have a NAP configured with the NAPID set to “GPRS1”, the connection name could be “GPRS1@WAP”. +For `CMST_CONNECTION_NAME`, specify the connection name. For example, if you have a connection configured by using the CM\_CellularEntries configuration service provider, the connection name could be the name of the connection. If you have a NAP configured with the NAPID set to "GPRS1", the connection name could be "GPRS1@WAP". For `CMST_CONNECTION_TYPE`, specify the GUID for the desired connection type. The curly brackets {} around the GUID are required. The following connection types are available: @@ -146,7 +139,7 @@ Specifies the type of connection being referenced. The following list describes ## OMA client provisioning examples -Adding an application-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. +Adding an application-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection ("GPRSConn1") that is configured with the CM\_CellularEntries configuration service provider. ```xml @@ -191,7 +184,7 @@ Adding an application-based mapping policy. In this example, the ConnectionId fo ``` -Adding a host-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection (“GPRSConn1”) that is configured with the CM\_CellularEntries configuration service provider. +Adding a host-based mapping policy. In this example, the ConnectionId for type CMST\_CONNECTION\_NAME is set to the name of the connection ("GPRSConn1") that is configured with the CM\_CellularEntries configuration service provider. ```xml diff --git a/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md b/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md index 15d65b1bc8..c452430808 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md +++ b/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md @@ -1,13 +1,6 @@ --- title: CMPolicyEnterprise DDF file description: Learn about the OMA DM device description framework (DDF) for the CMPolicyEnterprise configuration service provider. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/configuration-service-provider-ddf.md b/windows/client-management/mdm/configuration-service-provider-ddf.md index ad995b441b..dbb6d25b17 100644 --- a/windows/client-management/mdm/configuration-service-provider-ddf.md +++ b/windows/client-management/mdm/configuration-service-provider-ddf.md @@ -1,13 +1,6 @@ --- title: Configuration service provider DDF files description: Learn more about the OMA DM device description framework (DDF) for various configuration service providers -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 09/18/2020 ms.collection: - highpri diff --git a/windows/client-management/mdm/configuration-service-provider-support.md b/windows/client-management/mdm/configuration-service-provider-support.md index 84472ed120..161a1ac596 100644 --- a/windows/client-management/mdm/configuration-service-provider-support.md +++ b/windows/client-management/mdm/configuration-service-provider-support.md @@ -1,13 +1,6 @@ --- title: Configuration service provider support description: Learn more about configuration service provider (CSP) supported scenarios. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 09/18/2020 ms.collection: - highpri diff --git a/windows/client-management/mdm/contribute-csp-reference.md b/windows/client-management/mdm/contribute-csp-reference.md index 4f2f637895..b31178f974 100644 --- a/windows/client-management/mdm/contribute-csp-reference.md +++ b/windows/client-management/mdm/contribute-csp-reference.md @@ -1,14 +1,9 @@ --- title: Contributing to CSP reference articles description: Learn more about contributing to the CSP reference articles. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa ms.date: 07/18/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage ms.topic: reference +ms.localizationpriority: medium --- # Contributing to the CSP reference articles diff --git a/windows/client-management/mdm/customdeviceui-csp.md b/windows/client-management/mdm/customdeviceui-csp.md index 7e206209d2..aec5c878b5 100644 --- a/windows/client-management/mdm/customdeviceui-csp.md +++ b/windows/client-management/mdm/customdeviceui-csp.md @@ -1,13 +1,6 @@ --- title: CustomDeviceUI CSP description: Learn how the CustomDeviceUI configuration service provider (CSP) allows OEMs to implement their custom foreground application. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/customdeviceui-ddf.md b/windows/client-management/mdm/customdeviceui-ddf.md index 78d4037e82..e5b3f90423 100644 --- a/windows/client-management/mdm/customdeviceui-ddf.md +++ b/windows/client-management/mdm/customdeviceui-ddf.md @@ -1,13 +1,6 @@ --- title: CustomDeviceUI DDF description: Learn about the OMA DM device description framework (DDF) for the CustomDeviceUI configuration service provider. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/declaredconfiguration-csp.md b/windows/client-management/mdm/declaredconfiguration-csp.md index 64297f2f14..5614e38ee4 100644 --- a/windows/client-management/mdm/declaredconfiguration-csp.md +++ b/windows/client-management/mdm/declaredconfiguration-csp.md @@ -1,14 +1,7 @@ --- title: DeclaredConfiguration CSP description: Learn more about the DeclaredConfiguration CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/declaredconfiguration-ddf-file.md b/windows/client-management/mdm/declaredconfiguration-ddf-file.md index a60936f654..22f6c58926 100644 --- a/windows/client-management/mdm/declaredconfiguration-ddf-file.md +++ b/windows/client-management/mdm/declaredconfiguration-ddf-file.md @@ -1,14 +1,7 @@ --- title: DeclaredConfiguration DDF file description: View the XML file containing the device description framework (DDF) for the DeclaredConfiguration configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D 99.9.99999 9.9 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index ee424411b4..a8de02da0d 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -1,14 +1,7 @@ --- title: Defender CSP description: Learn more about the Defender CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -80,6 +73,8 @@ The following list shows the Defender configuration service provider nodes: - [RandomizeScheduleTaskTimes](#configurationrandomizescheduletasktimes) - [ScanOnlyIfIdleEnabled](#configurationscanonlyifidleenabled) - [SchedulerRandomizationTime](#configurationschedulerrandomizationtime) + - [ScheduleSecurityIntelligenceUpdateDay](#configurationschedulesecurityintelligenceupdateday) + - [ScheduleSecurityIntelligenceUpdateTime](#configurationschedulesecurityintelligenceupdatetime) - [SecuredDevicesConfiguration](#configurationsecureddevicesconfiguration) - [SecurityIntelligenceLocationUpdateAtScheduledTimeOnly](#configurationsecurityintelligencelocationupdateatscheduledtimeonly) - [SecurityIntelligenceUpdatesChannel](#configurationsecurityintelligenceupdateschannel) @@ -101,6 +96,8 @@ The following list shows the Defender configuration service provider nodes: - [ComputerState](#healthcomputerstate) - [DefenderEnabled](#healthdefenderenabled) - [DefenderVersion](#healthdefenderversion) + - [DeviceControl](#healthdevicecontrol) + - [State](#healthdevicecontrolstate) - [EngineVersion](#healthengineversion) - [FullScanOverdue](#healthfullscanoverdue) - [FullScanRequired](#healthfullscanrequired) @@ -350,7 +347,7 @@ Control whether network protection can improve performance by switching from rea | Value | Description | |:--|:--| | 1 | Allow switching to asynchronous inspection. | -| 0 (Default) | Don't allow asynchronous inspection. | +| 0 (Default) | Don’t allow asynchronous inspection. | @@ -1980,7 +1977,7 @@ Allows an administrator to explicitly disable network packet inspection made by |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: `|`) | +| Allowed Values | Regular Expression: `^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$|^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}$|^[0-9a-fA-F]{1,4}(?::[0-9a-fA-F]{1,4}){1,6}$|^::1$|^::$` | @@ -2470,7 +2467,7 @@ This setting allows you to scan excluded files and directories during quick scan | Value | Description | |:--|:--| | 0 (Default) | If you set this setting to 0 or don't configure it, exclusions aren't scanned during quick scans. | -| 1 | If you set this setting to 1, all files and directories that are excluded from real-time protection using contextual exclusions are scanned during a quick scan. Exclusions that contain wildcards aren't supported and aren't scanned. | +| 1 | If you set this setting to 1, all files and directories that are excluded from real-time protection using contextual exclusions are scanned during a quick scan. | @@ -2618,6 +2615,103 @@ This setting allows you to configure the scheduler randomization in hours. The r + +### Configuration/ScheduleSecurityIntelligenceUpdateDay + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/ScheduleSecurityIntelligenceUpdateDay +``` + + + + +This setting allows you to specify the day of the week on which to check for security intelligence updates. By default, this setting is configured to never check for security intelligence updates. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 8 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Daily. | +| 1 | Sunday. | +| 2 | Monday. | +| 3 | Tuesday. | +| 4 | Wednesday. | +| 5 | Thursday. | +| 6 | Friday. | +| 7 | Saturday. | +| 8 (Default) | Never. | + + + + + + + + + +### Configuration/ScheduleSecurityIntelligenceUpdateTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/ScheduleSecurityIntelligenceUpdateTime +``` + + + + +This setting allows you to specify the time of day at which to check for security intelligence updates. The time value is represented as the number of minutes past midnight (00:00). For example, 120 is equivalent to 02:00 AM. By default, this setting is configured to check for security intelligence updates 15 minutes before the scheduled scan time. The schedule is based on local time on the computer where the check is occurring. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-1439]` | +| Default Value | 105 | + + + + + + + + ### Configuration/SecuredDevicesConfiguration @@ -2635,7 +2729,7 @@ This setting allows you to configure the scheduler randomization in hours. The r -Defines what are the devices primary ids that should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration isn't set the default value will be applied, meaning all of the supported devices will be secured. +Defines which device's primary ids should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration isn't set the default value will be applied, meaning all supported devices will be secured. Currently supported primary ids are: RemovableMediaDevices, CdRomDevices, WpdDevices, PrinterDevices. @@ -2649,7 +2743,7 @@ Defines what are the devices primary ids that should be secured by Defender Devi |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | -| Allowed Values | List (Delimiter: `|`) | +| Allowed Values | Regular Expression: `^RemovableMediaDevices|CdRomDevices|WpdDevices|PrinterDevices$` | @@ -3645,6 +3739,84 @@ Version number of Windows Defender on the device. + +### Health/DeviceControl + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/DeviceControl +``` + + + + +An interior node to group information about Device Cotrol health status. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Get | + + + + + + + + + +#### Health/DeviceControl/State + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/DeviceControl/State +``` + + + + +Provide the current state of the Device Control. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Get | + + + + + + + + ### Health/EngineVersion diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md index 60fd484a13..3b43ffb12a 100644 --- a/windows/client-management/mdm/defender-ddf.md +++ b/windows/client-management/mdm/defender-ddf.md @@ -1,14 +1,7 @@ --- title: Defender DDF file description: View the XML file containing the device description framework (DDF) for the Defender configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -305,6 +298,52 @@ The following XML file contains the device description framework (DDF) for the D + + DeviceControl + + + + + An interior node to group information about Device Cotrol health status. + + + + + + + + + + + + + + + State + + + + + + + + + + + + + + + + + + + 10.0.17763 + 1.3 + + + + ProductStatus @@ -1059,7 +1098,8 @@ The following XML file contains the device description framework (DDF) for the D 10.0.14393 1.3 - + + ^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$|^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}$|^(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}$|^(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}$|^[0-9a-fA-F]{1,4}(?::[0-9a-fA-F]{1,4}){1,6}$|^::1$|^::$ @@ -2141,7 +2181,7 @@ The following XML file contains the device description framework (DDF) for the D 1 - If you set this setting to 1, all files and directories that are excluded from real-time protection using contextual exclusions are scanned during a quick scan. Exclusions that contain wildcards are not supported and are not scanned. + If you set this setting to 1, all files and directories that are excluded from real-time protection using contextual exclusions are scanned during a quick scan. @@ -2185,6 +2225,105 @@ The following XML file contains the device description framework (DDF) for the D + + ScheduleSecurityIntelligenceUpdateTime + + + + + + + + 105 + This setting allows you to specify the time of day at which to check for security intelligence updates. The time value is represented as the number of minutes past midnight (00:00). For example, 120 is equivalent to 02:00 AM. By default, this setting is configured to check for security intelligence updates 15 minutes before the scheduled scan time. The schedule is based on local time on the computer where the check is occurring. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + [0-1439] + + + + + ScheduleSecurityIntelligenceUpdateDay + + + + + + + + 8 + This setting allows you to specify the day of the week on which to check for security intelligence updates. By default, this setting is configured to never check for security intelligence updates. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 0 + Daily + + + 1 + Sunday + + + 2 + Monday + + + 3 + Tuesday + + + 4 + Wednesday + + + 5 + Thursday + + + 6 + Friday + + + 7 + Saturday + + + 8 + Never + + + + ThrottleForScheduledScanOnly @@ -2355,7 +2494,7 @@ The following XML file contains the device description framework (DDF) for the D - Defines what are the devices primary ids that should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration is not set the default value will be applied, meaning all of the supported devices will be secured. + Defines which device's primary ids should be secured by Defender Device Control. The primary id values should be pipe (|) separated. Example: RemovableMediaDevices|CdRomDevices. If this configuration is not set the default value will be applied, meaning all supported devices will be secured. Currently supported primary ids are: RemovableMediaDevices, CdRomDevices, WpdDevices, PrinterDevices. @@ -2372,7 +2511,8 @@ The following XML file contains the device description framework (DDF) for the D 10.0.17763 1.3 - + + ^RemovableMediaDevices|CdRomDevices|WpdDevices|PrinterDevices$ diff --git a/windows/client-management/mdm/devdetail-csp.md b/windows/client-management/mdm/devdetail-csp.md index de6aaa2a90..43fa16e588 100644 --- a/windows/client-management/mdm/devdetail-csp.md +++ b/windows/client-management/mdm/devdetail-csp.md @@ -1,14 +1,7 @@ --- title: DevDetail CSP description: Learn more about the DevDetail CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/devdetail-ddf-file.md b/windows/client-management/mdm/devdetail-ddf-file.md index 542ddf9b2d..d51d3417ab 100644 --- a/windows/client-management/mdm/devdetail-ddf-file.md +++ b/windows/client-management/mdm/devdetail-ddf-file.md @@ -1,14 +1,7 @@ --- title: DevDetail DDF file description: View the XML file containing the device description framework (DDF) for the DevDetail configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/developersetup-csp.md b/windows/client-management/mdm/developersetup-csp.md index 55b326e83b..defb0f5945 100644 --- a/windows/client-management/mdm/developersetup-csp.md +++ b/windows/client-management/mdm/developersetup-csp.md @@ -1,13 +1,6 @@ --- title: DeveloperSetup CSP description: The DeveloperSetup configuration service provider (CSP) is used to configure developer mode on the device. This CSP was added in the Windows 10, version 1703. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2018 --- diff --git a/windows/client-management/mdm/developersetup-ddf.md b/windows/client-management/mdm/developersetup-ddf.md index daa6a0b7f9..ed60d67574 100644 --- a/windows/client-management/mdm/developersetup-ddf.md +++ b/windows/client-management/mdm/developersetup-ddf.md @@ -1,13 +1,6 @@ --- title: DeveloperSetup DDF file description: This topic shows the OMA DM device description framework (DDF) for the DeveloperSetup configuration service provider. This CSP was added in Windows 10, version 1703. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/devicelock-csp.md b/windows/client-management/mdm/devicelock-csp.md index ab39986c26..652574980b 100644 --- a/windows/client-management/mdm/devicelock-csp.md +++ b/windows/client-management/mdm/devicelock-csp.md @@ -1,13 +1,6 @@ --- title: DeviceLock CSP description: Learn how the DeviceLock configuration service provider (CSP) is used by the enterprise management server to configure device lock related policies. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/devicelock-ddf-file.md b/windows/client-management/mdm/devicelock-ddf-file.md index 03f27aef68..57ffe9c63b 100644 --- a/windows/client-management/mdm/devicelock-ddf-file.md +++ b/windows/client-management/mdm/devicelock-ddf-file.md @@ -1,13 +1,6 @@ --- title: DeviceLock DDF file description: Learn about the OMA DM device description framework (DDF) for the DeviceLock configuration service provider (CSP). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/devicemanageability-csp.md b/windows/client-management/mdm/devicemanageability-csp.md index 38250ba79f..ff94b7f4b8 100644 --- a/windows/client-management/mdm/devicemanageability-csp.md +++ b/windows/client-management/mdm/devicemanageability-csp.md @@ -1,14 +1,7 @@ --- title: DeviceManageability CSP description: Learn more about the DeviceManageability CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/devicemanageability-ddf.md b/windows/client-management/mdm/devicemanageability-ddf.md index 9c0d424446..e8d4b8243d 100644 --- a/windows/client-management/mdm/devicemanageability-ddf.md +++ b/windows/client-management/mdm/devicemanageability-ddf.md @@ -1,14 +1,7 @@ --- title: DeviceManageability DDF file description: View the XML file containing the device description framework (DDF) for the DeviceManageability configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -49,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.14393 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/devicepreparation-csp.md b/windows/client-management/mdm/devicepreparation-csp.md index 1998989619..b079b123ed 100644 --- a/windows/client-management/mdm/devicepreparation-csp.md +++ b/windows/client-management/mdm/devicepreparation-csp.md @@ -1,14 +1,7 @@ --- title: DevicePreparation CSP description: Learn more about the DevicePreparation CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/devicepreparation-ddf-file.md b/windows/client-management/mdm/devicepreparation-ddf-file.md index ed2c59bec4..83f0c990f2 100644 --- a/windows/client-management/mdm/devicepreparation-ddf-file.md +++ b/windows/client-management/mdm/devicepreparation-ddf-file.md @@ -1,14 +1,7 @@ --- title: DevicePreparation DDF file description: View the XML file containing the device description framework (DDF) for the DevicePreparation configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D 99.9.99999 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/devicestatus-csp.md b/windows/client-management/mdm/devicestatus-csp.md index f9d45fdc5e..ad6ab08164 100644 --- a/windows/client-management/mdm/devicestatus-csp.md +++ b/windows/client-management/mdm/devicestatus-csp.md @@ -1,14 +1,7 @@ --- title: DeviceStatus CSP description: Learn more about the DeviceStatus CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/devicestatus-ddf.md b/windows/client-management/mdm/devicestatus-ddf.md index 231f3f5a26..5ddde61818 100644 --- a/windows/client-management/mdm/devicestatus-ddf.md +++ b/windows/client-management/mdm/devicestatus-ddf.md @@ -1,14 +1,7 @@ --- title: DeviceStatus DDF file description: View the XML file containing the device description framework (DDF) for the DeviceStatus configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/devinfo-csp.md b/windows/client-management/mdm/devinfo-csp.md index 1a9e74c3a2..348fd292dc 100644 --- a/windows/client-management/mdm/devinfo-csp.md +++ b/windows/client-management/mdm/devinfo-csp.md @@ -1,14 +1,7 @@ --- title: DevInfo CSP description: Learn more about the DevInfo CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/devinfo-ddf-file.md b/windows/client-management/mdm/devinfo-ddf-file.md index f28018452e..37290dd8ca 100644 --- a/windows/client-management/mdm/devinfo-ddf-file.md +++ b/windows/client-management/mdm/devinfo-ddf-file.md @@ -1,14 +1,7 @@ --- title: DevInfo DDF file description: View the XML file containing the device description framework (DDF) for the DevInfo configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -48,7 +41,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index baa3ca8990..01c937ef35 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -1,14 +1,7 @@ --- title: DiagnosticLog CSP description: Learn more about the DiagnosticLog CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/diagnosticlog-ddf.md b/windows/client-management/mdm/diagnosticlog-ddf.md index 3308eaf8c9..4b7a116020 100644 --- a/windows/client-management/mdm/diagnosticlog-ddf.md +++ b/windows/client-management/mdm/diagnosticlog-ddf.md @@ -1,14 +1,7 @@ --- title: DiagnosticLog DDF file description: View the XML file containing the device description framework (DDF) for the DiagnosticLog configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.2 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/dmacc-csp.md b/windows/client-management/mdm/dmacc-csp.md index 91624a95d6..ab7d234d40 100644 --- a/windows/client-management/mdm/dmacc-csp.md +++ b/windows/client-management/mdm/dmacc-csp.md @@ -1,14 +1,7 @@ --- title: DMAcc CSP description: Learn more about the DMAcc CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/dmacc-ddf-file.md b/windows/client-management/mdm/dmacc-ddf-file.md index 8f0a89e31b..f27382fcdb 100644 --- a/windows/client-management/mdm/dmacc-ddf-file.md +++ b/windows/client-management/mdm/dmacc-ddf-file.md @@ -1,14 +1,7 @@ --- title: DMAcc DDF file description: View the XML file containing the device description framework (DDF) for the DMAcc configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/dmclient-csp.md b/windows/client-management/mdm/dmclient-csp.md index e1447e368b..f32ff8f609 100644 --- a/windows/client-management/mdm/dmclient-csp.md +++ b/windows/client-management/mdm/dmclient-csp.md @@ -1,14 +1,7 @@ --- title: DMClient CSP description: Learn more about the DMClient CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/dmclient-ddf-file.md b/windows/client-management/mdm/dmclient-ddf-file.md index 8ab416c84b..64dd766397 100644 --- a/windows/client-management/mdm/dmclient-ddf-file.md +++ b/windows/client-management/mdm/dmclient-ddf-file.md @@ -1,14 +1,7 @@ --- title: DMClient DDF file description: View the XML file containing the device description framework (DDF) for the DMClient configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -484,7 +477,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/dmsessionactions-csp.md b/windows/client-management/mdm/dmsessionactions-csp.md index cb1f8535c4..c34c69e898 100644 --- a/windows/client-management/mdm/dmsessionactions-csp.md +++ b/windows/client-management/mdm/dmsessionactions-csp.md @@ -1,14 +1,7 @@ --- title: DMSessionActions CSP description: Learn how the DMSessionActions configuration service provider (CSP) is used to manage the number of sessions the client skips if the device is in a low-power state. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 -ms.reviewer: -manager: aaroncz --- # DMSessionActions CSP diff --git a/windows/client-management/mdm/dmsessionactions-ddf.md b/windows/client-management/mdm/dmsessionactions-ddf.md index 3fd2404a22..07079210a8 100644 --- a/windows/client-management/mdm/dmsessionactions-ddf.md +++ b/windows/client-management/mdm/dmsessionactions-ddf.md @@ -1,14 +1,7 @@ --- title: DMSessionActions DDF file description: Learn about the OMA DM device description framework (DDF) for the DMSessionActions configuration service provider (CSP). -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 -ms.reviewer: -manager: aaroncz --- # DMSessionActions DDF file diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md index d4eb392f33..72019eaa9f 100644 --- a/windows/client-management/mdm/dynamicmanagement-csp.md +++ b/windows/client-management/mdm/dynamicmanagement-csp.md @@ -1,14 +1,7 @@ --- title: DynamicManagement CSP description: Learn how the Dynamic Management configuration service provider (CSP) enables configuration of policies that change how the device is managed. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 -ms.reviewer: -manager: aaroncz --- # DynamicManagement CSP @@ -24,7 +17,7 @@ The table below shows the applicability of Windows: |Enterprise|Yes|Yes| |Education|Yes|Yes| -Windows 10 or Windows 11 allows you to manage devices differently depending on location, network, or time.  Added in Windows 10, version 1703, the focus is on the most common areas of concern expressed by organizations. For example, managed devices can have cameras disabled when at a work location, the cellular service can be disabled when outside the country/region to avoid roaming charges, or the wireless network can be disabled when the device isn't within the corporate building or campus. Once configured, these settings will be enforced even if the device can’t reach the management server when the location or network changes. The Dynamic Management CSP enables configuration of policies that change how the device is managed in addition to setting the conditions on which the change occurs. +Windows 10 or Windows 11 allows you to manage devices differently depending on location, network, or time.  Added in Windows 10, version 1703, the focus is on the most common areas of concern expressed by organizations. For example, managed devices can have cameras disabled when at a work location, the cellular service can be disabled when outside the country/region to avoid roaming charges, or the wireless network can be disabled when the device isn't within the corporate building or campus. Once configured, these settings will be enforced even if the device can't reach the management server when the location or network changes. The Dynamic Management CSP enables configuration of policies that change how the device is managed in addition to setting the conditions on which the change occurs. This CSP was added in Windows 10, version 1703. diff --git a/windows/client-management/mdm/dynamicmanagement-ddf.md b/windows/client-management/mdm/dynamicmanagement-ddf.md index a5456ee32d..4114467551 100644 --- a/windows/client-management/mdm/dynamicmanagement-ddf.md +++ b/windows/client-management/mdm/dynamicmanagement-ddf.md @@ -1,13 +1,6 @@ --- title: DynamicManagement DDF file description: Learn about the OMA DM device description framework (DDF) for the DynamicManagement configuration service provider (CSP). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index 926d63ac80..cb42cb7572 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -1,13 +1,6 @@ --- title: EAP configuration description: Learn how to create an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, including details about EAP certificate filtering in Windows 10. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/email2-csp.md b/windows/client-management/mdm/email2-csp.md index c2b25eca83..cb09b51a30 100644 --- a/windows/client-management/mdm/email2-csp.md +++ b/windows/client-management/mdm/email2-csp.md @@ -1,14 +1,7 @@ --- title: EMAIL2 CSP description: Learn more about the EMAIL2 CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/email2-ddf-file.md b/windows/client-management/mdm/email2-ddf-file.md index fd201ec09e..2b9763c045 100644 --- a/windows/client-management/mdm/email2-ddf-file.md +++ b/windows/client-management/mdm/email2-ddf-file.md @@ -1,14 +1,7 @@ --- title: EMAIL2 DDF file description: View the XML file containing the device description framework (DDF) for the EMAIL2 configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the E 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md index 35513a778a..cb401d29af 100644 --- a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md +++ b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md @@ -1,11 +1,6 @@ --- title: EnrollmentStatusTracking DDF description: View the OMA DM DDF for the EnrollmentStatusTracking configuration service provider. DDF files are used only with OMA DM provisioning XML. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 05/17/2019 --- diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp.md b/windows/client-management/mdm/enrollmentstatustracking-csp.md index d3c9c60797..94d3e0c6ef 100644 --- a/windows/client-management/mdm/enrollmentstatustracking-csp.md +++ b/windows/client-management/mdm/enrollmentstatustracking-csp.md @@ -1,11 +1,6 @@ --- title: EnrollmentStatusTracking CSP description: Learn how to execute a hybrid certificate trust deployment of Windows Hello for Business, for systems with no previous installations. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 05/21/2019 --- diff --git a/windows/client-management/mdm/enterpriseapn-csp.md b/windows/client-management/mdm/enterpriseapn-csp.md index 2c93f02a94..0b89ef1f01 100644 --- a/windows/client-management/mdm/enterpriseapn-csp.md +++ b/windows/client-management/mdm/enterpriseapn-csp.md @@ -1,13 +1,6 @@ --- title: EnterpriseAPN CSP description: The EnterpriseAPN configuration service provider is used by the enterprise to provision an APN for the Internet. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 09/22/2017 --- diff --git a/windows/client-management/mdm/enterpriseapn-ddf.md b/windows/client-management/mdm/enterpriseapn-ddf.md index 665a9234c3..5b6c2efba6 100644 --- a/windows/client-management/mdm/enterpriseapn-ddf.md +++ b/windows/client-management/mdm/enterpriseapn-ddf.md @@ -1,13 +1,6 @@ --- title: EnterpriseAPN DDF description: Learn about the OMA DM device description framework (DDF) for the EnterpriseAPN configuration service provider (CSP). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/enterpriseappvmanagement-csp.md b/windows/client-management/mdm/enterpriseappvmanagement-csp.md index c6ad92193c..0a895f7562 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-csp.md @@ -1,14 +1,7 @@ --- title: EnterpriseAppVManagement CSP description: Examine the tree format for EnterpriseAppVManagement CSP to manage virtual applications in Windows 10 or Windows 11 PCs. (Enterprise and Education editions). -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 -ms.reviewer: -manager: aaroncz --- # EnterpriseAppVManagement CSP diff --git a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md index fa2e075e71..f9e425652e 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md @@ -1,14 +1,7 @@ --- title: EnterpriseAppVManagement DDF file description: Learn about the OMA DM device description framework (DDF) for the EnterpriseAppVManagement configuration service provider (CSP). -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 -ms.reviewer: -manager: aaroncz --- # EnterpriseAppVManagement DDF file diff --git a/windows/client-management/mdm/enterprisedataprotection-csp.md b/windows/client-management/mdm/enterprisedataprotection-csp.md index a6c2a4662b..0b411fed30 100644 --- a/windows/client-management/mdm/enterprisedataprotection-csp.md +++ b/windows/client-management/mdm/enterprisedataprotection-csp.md @@ -2,13 +2,6 @@ title: EnterpriseDataProtection CSP description: Learn how the EnterpriseDataProtection configuration service provider (CSP) configures Windows Information Protection (formerly, Enterprise Data Protection) settings. ms.assetid: E2D4467F-A154-4C00-9208-7798EF3E25B3 -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 08/09/2017 --- diff --git a/windows/client-management/mdm/enterprisedataprotection-ddf-file.md b/windows/client-management/mdm/enterprisedataprotection-ddf-file.md index 73469ecfa7..5700376c37 100644 --- a/windows/client-management/mdm/enterprisedataprotection-ddf-file.md +++ b/windows/client-management/mdm/enterprisedataprotection-ddf-file.md @@ -1,13 +1,6 @@ --- title: EnterpriseDataProtection DDF file description: The following topic shows the OMA DM device description framework (DDF) for the EnterpriseDataProtection configuration service provider. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md index 02e11e7496..4c2b45f8d4 100644 --- a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md @@ -1,14 +1,7 @@ --- title: EnterpriseDesktopAppManagement CSP description: Learn more about the EnterpriseDesktopAppManagement CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md b/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md index b20f68bf7f..3392fcb317 100644 --- a/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md +++ b/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md @@ -1,14 +1,7 @@ --- title: EnterpriseDesktopAppManagement DDF file description: View the XML file containing the device description framework (DDF) for the EnterpriseDesktopAppManagement configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the E 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -407,7 +400,7 @@ The following XML file contains the device description framework (DDF) for the E 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md index 4d1e964bfc..4369995a2e 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md @@ -1,14 +1,7 @@ --- title: EnterpriseModernAppManagement CSP description: Learn more about the EnterpriseModernAppManagement CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md index 9067ae0893..6afb253277 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md @@ -1,14 +1,7 @@ --- title: EnterpriseModernAppManagement DDF file description: View the XML file containing the device description framework (DDF) for the EnterpriseModernAppManagement configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the E 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -2594,7 +2587,7 @@ The following XML file contains the device description framework (DDF) for the E 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/euiccs-csp.md b/windows/client-management/mdm/euiccs-csp.md index 3933d2fb17..a4af4d0697 100644 --- a/windows/client-management/mdm/euiccs-csp.md +++ b/windows/client-management/mdm/euiccs-csp.md @@ -1,14 +1,7 @@ --- title: eUICCs CSP description: Learn more about the eUICCs CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/29/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/euiccs-ddf-file.md b/windows/client-management/mdm/euiccs-ddf-file.md index 5a070577f7..62059a7c7d 100644 --- a/windows/client-management/mdm/euiccs-ddf-file.md +++ b/windows/client-management/mdm/euiccs-ddf-file.md @@ -1,14 +1,7 @@ --- title: eUICCs DDF file description: View the XML file containing the device description framework (DDF) for the eUICCs configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/29/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -50,7 +43,7 @@ The following XML file contains the device description framework (DDF) for the e 10.0.16299 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/firewall-csp.md b/windows/client-management/mdm/firewall-csp.md index 9fb784e982..53b060e0f5 100644 --- a/windows/client-management/mdm/firewall-csp.md +++ b/windows/client-management/mdm/firewall-csp.md @@ -1,14 +1,7 @@ --- title: Firewall CSP description: Learn more about the Firewall CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/firewall-ddf-file.md b/windows/client-management/mdm/firewall-ddf-file.md index 1d38c29221..580516ab56 100644 --- a/windows/client-management/mdm/firewall-ddf-file.md +++ b/windows/client-management/mdm/firewall-ddf-file.md @@ -1,14 +1,7 @@ --- title: Firewall DDF file description: View the XML file containing the device description framework (DDF) for the Firewall configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/03/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the F 10.0.16299 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index befe9471cc..b3944647b7 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -1,14 +1,7 @@ --- title: HealthAttestation CSP description: Learn more about the HealthAttestation CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/healthattestation-ddf.md b/windows/client-management/mdm/healthattestation-ddf.md index 7207f7cd68..0f4afae56f 100644 --- a/windows/client-management/mdm/healthattestation-ddf.md +++ b/windows/client-management/mdm/healthattestation-ddf.md @@ -1,14 +1,7 @@ --- title: HealthAttestation DDF file description: View the XML file containing the device description framework (DDF) for the HealthAttestation configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the H 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/images/insider.png b/windows/client-management/mdm/images/insider.png new file mode 100644 index 0000000000..dbe00408cb Binary files /dev/null and b/windows/client-management/mdm/images/insider.png differ diff --git a/windows/client-management/mdm/includes/mdm-insider-csp-note.md b/windows/client-management/mdm/includes/mdm-insider-csp-note.md index bc1fc814b6..7e0d214867 100644 --- a/windows/client-management/mdm/includes/mdm-insider-csp-note.md +++ b/windows/client-management/mdm/includes/mdm-insider-csp-note.md @@ -6,5 +6,12 @@ ms.topic: include ms.date: 05/09/2023 --- +:::row::: +:::column span="1"::: +:::image type="content" source="../images/insider.png" alt-text="Logo of Windows Insider." border="false"::: +:::column-end::: +:::column span="3"::: > [!IMPORTANT] -> This CSP contains some settings that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These settings are subject to change and may have dependencies on other features or services in preview. +>This CSP contains some settings that are under development and only applicable for [Windows Insider Preview builds](/windows-insider/). These settings are subject to change and may have dependencies on other features or services in preview. +:::column-end::: +:::row-end::: diff --git a/windows/client-management/mdm/index.yml b/windows/client-management/mdm/index.yml index 7944d29d03..cfa99b1a5f 100644 --- a/windows/client-management/mdm/index.yml +++ b/windows/client-management/mdm/index.yml @@ -7,13 +7,8 @@ metadata: title: Configuration Service Provider # Required; page title displayed in search results. Include the brand. < 60 chars. description: Learn more about the configuration service provider (CSP) policies available on Windows devices. # Required; article description that is displayed in search results. < 160 chars. ms.topic: landing-page - ms.technology: itpro-manage - ms.prod: windows-client ms.collection: - tier1 - author: vinaypamnani-msft - ms.author: vinpa - manager: aaroncz ms.date: 10/25/2023 localization_priority: medium diff --git a/windows/client-management/mdm/language-pack-management-ddf-file.md b/windows/client-management/mdm/language-pack-management-ddf-file.md index 5c5c679379..d2589cc4a8 100644 --- a/windows/client-management/mdm/language-pack-management-ddf-file.md +++ b/windows/client-management/mdm/language-pack-management-ddf-file.md @@ -1,14 +1,7 @@ --- title: LanguagePackManagement DDF file description: View the XML file containing the device description framework (DDF) for the LanguagePackManagement configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -49,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the L 99.9.9999 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/laps-csp.md b/windows/client-management/mdm/laps-csp.md index a010675895..0bcdee4870 100644 --- a/windows/client-management/mdm/laps-csp.md +++ b/windows/client-management/mdm/laps-csp.md @@ -1,14 +1,7 @@ --- title: LAPS CSP description: Learn more about the LAPS CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/24/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/laps-ddf-file.md b/windows/client-management/mdm/laps-ddf-file.md index d9f29bb7d6..9b5d989db8 100644 --- a/windows/client-management/mdm/laps-ddf-file.md +++ b/windows/client-management/mdm/laps-ddf-file.md @@ -1,14 +1,7 @@ --- title: LAPS DDF file description: View the XML file containing the device description framework (DDF) for the LAPS configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 04/07/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/multisim-csp.md b/windows/client-management/mdm/multisim-csp.md index b225f2f4c3..d7d8d8d642 100644 --- a/windows/client-management/mdm/multisim-csp.md +++ b/windows/client-management/mdm/multisim-csp.md @@ -1,14 +1,7 @@ --- title: MultiSIM CSP description: MultiSIM configuration service provider (CSP) allows the enterprise to manage devices with dual SIM single active configuration. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 03/22/2018 -ms.reviewer: -manager: aaroncz --- # MultiSIM CSP diff --git a/windows/client-management/mdm/multisim-ddf.md b/windows/client-management/mdm/multisim-ddf.md index 55f8ef2b32..435a597cc4 100644 --- a/windows/client-management/mdm/multisim-ddf.md +++ b/windows/client-management/mdm/multisim-ddf.md @@ -1,14 +1,7 @@ --- title: MultiSIM DDF file description: XML file containing the device description framework for the MultiSIM configuration service provider. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 02/27/2018 -ms.reviewer: -manager: aaroncz --- # MultiSIM DDF diff --git a/windows/client-management/mdm/nap-csp.md b/windows/client-management/mdm/nap-csp.md index 801f6fc15d..c8a4ac849f 100644 --- a/windows/client-management/mdm/nap-csp.md +++ b/windows/client-management/mdm/nap-csp.md @@ -1,13 +1,6 @@ --- title: NAP CSP description: Learn how the Network Access Point (NAP) configuration service provider (CSP) is used to manage and query GPRS and CDMA connections. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/napdef-csp.md b/windows/client-management/mdm/napdef-csp.md index 4af7ac6717..06d4684e7a 100644 --- a/windows/client-management/mdm/napdef-csp.md +++ b/windows/client-management/mdm/napdef-csp.md @@ -1,13 +1,6 @@ --- title: NAPDEF CSP description: Learn how the NAPDEF configuration service provider (CSP) is used to add, modify, or delete WAP network access points (NAPs). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/networkproxy-csp.md b/windows/client-management/mdm/networkproxy-csp.md index 57294de0a0..8eba61aa61 100644 --- a/windows/client-management/mdm/networkproxy-csp.md +++ b/windows/client-management/mdm/networkproxy-csp.md @@ -1,14 +1,7 @@ --- title: NetworkProxy CSP description: Learn more about the NetworkProxy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/networkproxy-ddf.md b/windows/client-management/mdm/networkproxy-ddf.md index 72d1c7936d..a7ee14b7ab 100644 --- a/windows/client-management/mdm/networkproxy-ddf.md +++ b/windows/client-management/mdm/networkproxy-ddf.md @@ -1,14 +1,7 @@ --- title: NetworkProxy DDF file description: View the XML file containing the device description framework (DDF) for the NetworkProxy configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the N 10.0.15063 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/networkqospolicy-csp.md b/windows/client-management/mdm/networkqospolicy-csp.md index cc5a8c8ada..cc42fe0b09 100644 --- a/windows/client-management/mdm/networkqospolicy-csp.md +++ b/windows/client-management/mdm/networkqospolicy-csp.md @@ -1,14 +1,7 @@ --- title: NetworkQoSPolicy CSP description: Learn more about the NetworkQoSPolicy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/networkqospolicy-ddf.md b/windows/client-management/mdm/networkqospolicy-ddf.md index 170cfe0fae..16220bc01f 100644 --- a/windows/client-management/mdm/networkqospolicy-ddf.md +++ b/windows/client-management/mdm/networkqospolicy-ddf.md @@ -1,14 +1,7 @@ --- title: NetworkQoSPolicy DDF file description: View the XML file containing the device description framework (DDF) for the NetworkQoSPolicy configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the N 10.0.19042 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/nodecache-csp.md b/windows/client-management/mdm/nodecache-csp.md index dea68d13f0..53c5f2e391 100644 --- a/windows/client-management/mdm/nodecache-csp.md +++ b/windows/client-management/mdm/nodecache-csp.md @@ -1,14 +1,7 @@ --- title: NodeCache CSP description: Learn more about the NodeCache CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/nodecache-ddf-file.md b/windows/client-management/mdm/nodecache-ddf-file.md index e2d509178e..0dd13ab94a 100644 --- a/windows/client-management/mdm/nodecache-ddf-file.md +++ b/windows/client-management/mdm/nodecache-ddf-file.md @@ -1,14 +1,7 @@ --- title: NodeCache DDF file description: View the XML file containing the device description framework (DDF) for the NodeCache configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the N 10.0.15063 1.1 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -301,7 +294,7 @@ The following XML file contains the device description framework (DDF) for the N 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/office-csp.md b/windows/client-management/mdm/office-csp.md index a5fd7fb004..70692efc8b 100644 --- a/windows/client-management/mdm/office-csp.md +++ b/windows/client-management/mdm/office-csp.md @@ -1,14 +1,7 @@ --- title: Office CSP description: Learn more about the Office CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/office-ddf.md b/windows/client-management/mdm/office-ddf.md index e3301499dc..1453b24f55 100644 --- a/windows/client-management/mdm/office-ddf.md +++ b/windows/client-management/mdm/office-ddf.md @@ -1,14 +1,7 @@ --- title: Office DDF file description: View the XML file containing the device description framework (DDF) for the Office configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the O 10.0.15063 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -218,7 +211,7 @@ The following XML file contains the device description framework (DDF) for the O 10.0.15063 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index 14c84143e8..6c581a7335 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -1,14 +1,7 @@ --- title: PassportForWork CSP description: Learn more about the PassportForWork CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/passportforwork-ddf.md b/windows/client-management/mdm/passportforwork-ddf.md index fa9e278d82..8c1832dac1 100644 --- a/windows/client-management/mdm/passportforwork-ddf.md +++ b/windows/client-management/mdm/passportforwork-ddf.md @@ -1,14 +1,7 @@ --- title: PassportForWork DDF file description: View the XML file containing the device description framework (DDF) for the PassportForWork configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the P 10.0.10586 1.2 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -572,7 +565,7 @@ If you do not configure this policy setting, Windows Hello for Business requires 10.0.10586 1.2 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/personaldataencryption-csp.md b/windows/client-management/mdm/personaldataencryption-csp.md index 6c8eb48c1b..2a4648393a 100644 --- a/windows/client-management/mdm/personaldataencryption-csp.md +++ b/windows/client-management/mdm/personaldataencryption-csp.md @@ -1,14 +1,7 @@ --- title: PDE CSP description: Learn more about the PDE CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/personaldataencryption-ddf-file.md b/windows/client-management/mdm/personaldataencryption-ddf-file.md index b2f9432892..8cd2a70919 100644 --- a/windows/client-management/mdm/personaldataencryption-ddf-file.md +++ b/windows/client-management/mdm/personaldataencryption-ddf-file.md @@ -1,14 +1,7 @@ --- title: PDE DDF file description: View the XML file containing the device description framework (DDF) for the PDE configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the P 10.0.22621 1.0 - 0x4;0x1B;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0xAB;0xAC;0xBC;0xBF;0xCD; + 0x4;0x1B;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0xAB;0xAC;0xBC;0xBF;0xCD;0xCF; diff --git a/windows/client-management/mdm/personalization-csp.md b/windows/client-management/mdm/personalization-csp.md index 6625fb8a84..4bd6d9078f 100644 --- a/windows/client-management/mdm/personalization-csp.md +++ b/windows/client-management/mdm/personalization-csp.md @@ -1,14 +1,7 @@ --- title: Personalization CSP description: Learn more about the Personalization CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/26/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/personalization-ddf.md b/windows/client-management/mdm/personalization-ddf.md index d9f8bf627c..7b107ab37d 100644 --- a/windows/client-management/mdm/personalization-ddf.md +++ b/windows/client-management/mdm/personalization-ddf.md @@ -1,14 +1,7 @@ --- title: Personalization DDF file description: View the XML file containing the device description framework (DDF) for the Personalization configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/25/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -49,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the P 10.0.16299 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 8ca51cb2f9..c5d045a584 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -1,14 +1,7 @@ --- title: ADMX-backed policies in Policy CSP description: Learn about the ADMX-backed policies in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -2541,6 +2534,8 @@ This article lists the ADMX-backed policies in Policy CSP. - [RequireSecureRPCCommunication](policy-csp-remotedesktopservices.md) - [ClientConnectionEncryptionLevel](policy-csp-remotedesktopservices.md) - [DoNotAllowWebAuthnRedirection](policy-csp-remotedesktopservices.md) +- [DisconnectOnLockBasicAuthn](policy-csp-remotedesktopservices.md) +- [DisconnectOnLockWebAccountAuthn](policy-csp-remotedesktopservices.md) ## RemoteManagement diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md index aec0cd363b..bb35612d0e 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -1,14 +1,7 @@ --- title: Policies in Policy CSP supported by Group Policy description: Learn about the policies in Policy CSP supported by Group Policy. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -390,6 +383,9 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [DomainMember_DisableMachineAccountPasswordChanges](policy-csp-localpoliciessecurityoptions.md) - [DomainMember_MaximumMachineAccountPasswordAge](policy-csp-localpoliciessecurityoptions.md) - [DomainMember_RequireStrongSessionKey](policy-csp-localpoliciessecurityoptions.md) +- [MinimumPasswordLength](policy-csp-localpoliciessecurityoptions.md) +- [MinimumPasswordLengthAudit](policy-csp-localpoliciessecurityoptions.md) +- [RelaxMinimumPasswordLengthLimits](policy-csp-localpoliciessecurityoptions.md) - [InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked](policy-csp-localpoliciessecurityoptions.md) - [InteractiveLogon_DoNotRequireCTRLALTDEL](policy-csp-localpoliciessecurityoptions.md) - [InteractiveLogon_DoNotDisplayLastSignedIn](policy-csp-localpoliciessecurityoptions.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md index 2329114e1b..c4376598c8 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md @@ -1,13 +1,6 @@ --- title: Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite description: Learn the policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.localizationpriority: medium ms.date: 09/17/2019 --- diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md index 631059455e..dee1ed9c6b 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md @@ -1,13 +1,6 @@ --- title: Policies in Policy CSP supported by HoloLens (1st gen) Development Edition description: Learn about the policies in Policy CSP supported by HoloLens (1st gen) Development Edition. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.localizationpriority: medium ms.date: 07/18/2019 --- diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md index e45320b0b7..8a1244f15d 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md @@ -1,13 +1,6 @@ --- title: Policies in Policy CSP supported by HoloLens 2 description: Learn about the policies in Policy CSP supported by HoloLens 2. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.localizationpriority: medium ms.date: 02/03/2023 --- diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md index 7e755cbccd..17bb6fddc6 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -1,14 +1,7 @@ --- title: Policies in Policy CSP supported by Windows 10 Team description: Learn about the policies in Policy CSP supported by Windows 10 Team. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 09/25/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md b/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md index b2cb734aa7..2cb5d252a7 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md +++ b/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md @@ -1,13 +1,6 @@ --- title: Policies in Policy CSP that can be set using Exchange Active Sync (EAS) description: Learn about the policies in Policy CSP that can be set using Exchange Active Sync (EAS). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.localizationpriority: medium ms.date: 07/18/2019 --- diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index f7695f6a8a..da8784e014 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1,14 +1,7 @@ --- title: Policy CSP description: Learn more about the Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/29/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index 44d02d34ed..0c304bbebb 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -1,14 +1,7 @@ --- title: AboveLock Policy CSP description: Learn more about the AboveLock Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index 58df4beaf2..472fa8e6dc 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -1,14 +1,7 @@ --- title: Accounts Policy CSP description: Learn more about the Accounts Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -230,7 +223,7 @@ Allows IT Admins the ability to disable the Microsoft Account Sign-In Assistant - + This setting determines whether to only allow enterprise device authentication for the Microsoft Account Sign-in Assistant service (wlidsvc). By default, this setting is disabled and allows both user and device authentication. When the value is set to 1, only allow device authentication, and block user authentication. @@ -263,8 +256,13 @@ Most restricted value is 1. | Name | Value | |:--|:--| -| Name | MicrosoftAccount_RestrictToDeviceAuthenticationOnly | -| Path | MSAPolicy > AT > WindowsComponents > MicrosoftAccountCategory | +| Name | MicrosoftAccount_RestrictToEnterpriseDeviceAuthenticationOnly | +| Friendly Name | Only allow device authentication for the Microsoft Account Sign-In Assistant | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft account | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System | +| Registry Value Name | EnterpriseDeviceAuthOnly | +| ADMX File Name | MSAPolicy.admx | diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index fce92f8dff..7fe5d7be45 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -1,14 +1,7 @@ --- title: ActiveXControls Policy CSP description: Learn more about the ActiveXControls Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md index 0055dc812c..5a3a8d415b 100644 --- a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md +++ b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md @@ -1,14 +1,7 @@ --- title: ADMX_ActiveXInstallService Policy CSP description: Learn more about the ADMX_ActiveXInstallService Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md index 10196c3390..481aefeb0c 100644 --- a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md +++ b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md @@ -1,14 +1,7 @@ --- title: ADMX_AddRemovePrograms Policy CSP description: Learn more about the ADMX_AddRemovePrograms Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-admpwd.md b/windows/client-management/mdm/policy-csp-admx-admpwd.md index a1bcc9f18b..24516f1874 100644 --- a/windows/client-management/mdm/policy-csp-admx-admpwd.md +++ b/windows/client-management/mdm/policy-csp-admx-admpwd.md @@ -1,14 +1,7 @@ --- title: ADMX_AdmPwd Policy CSP description: Learn more about the ADMX_AdmPwd Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-appcompat.md b/windows/client-management/mdm/policy-csp-admx-appcompat.md index 7899515d31..db2d8555a0 100644 --- a/windows/client-management/mdm/policy-csp-admx-appcompat.md +++ b/windows/client-management/mdm/policy-csp-admx-appcompat.md @@ -1,14 +1,7 @@ --- title: ADMX_AppCompat Policy CSP description: Learn more about the ADMX_AppCompat Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md index 029e7784ba..afc5924f0e 100644 --- a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md +++ b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md @@ -1,14 +1,7 @@ --- title: ADMX_AppxPackageManager Policy CSP description: Learn more about the ADMX_AppxPackageManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-appxruntime.md b/windows/client-management/mdm/policy-csp-admx-appxruntime.md index 749ee6afce..8c3e3054f5 100644 --- a/windows/client-management/mdm/policy-csp-admx-appxruntime.md +++ b/windows/client-management/mdm/policy-csp-admx-appxruntime.md @@ -1,14 +1,7 @@ --- title: ADMX_AppXRuntime Policy CSP description: Learn more about the ADMX_AppXRuntime Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md index eed1a52c46..43b3293b3c 100644 --- a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md @@ -1,14 +1,7 @@ --- title: ADMX_AttachmentManager Policy CSP description: Learn more about the ADMX_AttachmentManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-auditsettings.md b/windows/client-management/mdm/policy-csp-admx-auditsettings.md index ff33c79687..255926912f 100644 --- a/windows/client-management/mdm/policy-csp-admx-auditsettings.md +++ b/windows/client-management/mdm/policy-csp-admx-auditsettings.md @@ -1,14 +1,7 @@ --- title: ADMX_AuditSettings Policy CSP description: Learn more about the ADMX_AuditSettings Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-bits.md b/windows/client-management/mdm/policy-csp-admx-bits.md index 311e65ddc9..7762c0431d 100644 --- a/windows/client-management/mdm/policy-csp-admx-bits.md +++ b/windows/client-management/mdm/policy-csp-admx-bits.md @@ -1,14 +1,7 @@ --- title: ADMX_Bits Policy CSP description: Learn more about the ADMX_Bits Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md index f7e094a272..c2810e7ba4 100644 --- a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md +++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md @@ -1,14 +1,7 @@ --- title: ADMX_CipherSuiteOrder Policy CSP description: Learn more about the ADMX_CipherSuiteOrder Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-com.md b/windows/client-management/mdm/policy-csp-admx-com.md index a5997f9c3f..3497e521fa 100644 --- a/windows/client-management/mdm/policy-csp-admx-com.md +++ b/windows/client-management/mdm/policy-csp-admx-com.md @@ -1,14 +1,7 @@ --- title: ADMX_COM Policy CSP description: Learn more about the ADMX_COM Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-controlpanel.md b/windows/client-management/mdm/policy-csp-admx-controlpanel.md index 488996e8fd..a94e04af2d 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpanel.md @@ -1,14 +1,7 @@ --- title: ADMX_ControlPanel Policy CSP description: Learn more about the ADMX_ControlPanel Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md index 8b6ce4783f..bb5edcf621 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md @@ -1,14 +1,7 @@ --- title: ADMX_ControlPanelDisplay Policy CSP description: Learn more about the ADMX_ControlPanelDisplay Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-cpls.md b/windows/client-management/mdm/policy-csp-admx-cpls.md index 65be5aa708..b9744965b8 100644 --- a/windows/client-management/mdm/policy-csp-admx-cpls.md +++ b/windows/client-management/mdm/policy-csp-admx-cpls.md @@ -1,14 +1,7 @@ --- title: ADMX_Cpls Policy CSP description: Learn more about the ADMX_Cpls Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md index 099494bfad..6d4b3184a0 100644 --- a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md @@ -1,14 +1,7 @@ --- title: ADMX_CredentialProviders Policy CSP description: Learn more about the ADMX_CredentialProviders Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md index 44ad3d65e5..a33e0f4837 100644 --- a/windows/client-management/mdm/policy-csp-admx-credssp.md +++ b/windows/client-management/mdm/policy-csp-admx-credssp.md @@ -1,14 +1,7 @@ --- title: ADMX_CredSsp Policy CSP description: Learn more about the ADMX_CredSsp Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-credui.md b/windows/client-management/mdm/policy-csp-admx-credui.md index b31b580c8b..d173ccb390 100644 --- a/windows/client-management/mdm/policy-csp-admx-credui.md +++ b/windows/client-management/mdm/policy-csp-admx-credui.md @@ -1,14 +1,7 @@ --- title: ADMX_CredUI Policy CSP description: Learn more about the ADMX_CredUI Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md index 54ad86715e..fb39f06a22 100644 --- a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md +++ b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md @@ -1,14 +1,7 @@ --- title: ADMX_CtrlAltDel Policy CSP description: Learn more about the ADMX_CtrlAltDel Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-datacollection.md b/windows/client-management/mdm/policy-csp-admx-datacollection.md index e1194939bb..88352e9758 100644 --- a/windows/client-management/mdm/policy-csp-admx-datacollection.md +++ b/windows/client-management/mdm/policy-csp-admx-datacollection.md @@ -1,14 +1,7 @@ --- title: ADMX_DataCollection Policy CSP description: Learn more about the ADMX_DataCollection Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-dcom.md b/windows/client-management/mdm/policy-csp-admx-dcom.md index c85d5737b3..5243e0bdb3 100644 --- a/windows/client-management/mdm/policy-csp-admx-dcom.md +++ b/windows/client-management/mdm/policy-csp-admx-dcom.md @@ -1,14 +1,7 @@ --- title: ADMX_DCOM Policy CSP description: Learn more about the ADMX_DCOM Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-desktop.md b/windows/client-management/mdm/policy-csp-admx-desktop.md index 0a0280c52c..74cb4bd0e0 100644 --- a/windows/client-management/mdm/policy-csp-admx-desktop.md +++ b/windows/client-management/mdm/policy-csp-admx-desktop.md @@ -1,14 +1,7 @@ --- title: ADMX_Desktop Policy CSP description: Learn more about the ADMX_Desktop Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-devicecompat.md b/windows/client-management/mdm/policy-csp-admx-devicecompat.md index bc8976cc58..0992bb4dbb 100644 --- a/windows/client-management/mdm/policy-csp-admx-devicecompat.md +++ b/windows/client-management/mdm/policy-csp-admx-devicecompat.md @@ -1,14 +1,7 @@ --- title: ADMX_DeviceCompat Policy CSP description: Learn more about the ADMX_DeviceCompat Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-deviceguard.md b/windows/client-management/mdm/policy-csp-admx-deviceguard.md index 7afb0273de..3873ad69da 100644 --- a/windows/client-management/mdm/policy-csp-admx-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-admx-deviceguard.md @@ -1,14 +1,7 @@ --- title: ADMX_DeviceGuard Policy CSP description: Learn more about the ADMX_DeviceGuard Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md index c8e2319400..2fb1234e02 100644 --- a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md @@ -1,14 +1,7 @@ --- title: ADMX_DeviceInstallation Policy CSP description: Learn more about the ADMX_DeviceInstallation Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-devicesetup.md b/windows/client-management/mdm/policy-csp-admx-devicesetup.md index b6fcaa1949..d298ee4f28 100644 --- a/windows/client-management/mdm/policy-csp-admx-devicesetup.md +++ b/windows/client-management/mdm/policy-csp-admx-devicesetup.md @@ -1,14 +1,7 @@ --- title: ADMX_DeviceSetup Policy CSP description: Learn more about the ADMX_DeviceSetup Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-dfs.md b/windows/client-management/mdm/policy-csp-admx-dfs.md index bf9c77582b..8b8a9fd98e 100644 --- a/windows/client-management/mdm/policy-csp-admx-dfs.md +++ b/windows/client-management/mdm/policy-csp-admx-dfs.md @@ -1,14 +1,7 @@ --- title: ADMX_DFS Policy CSP description: Learn more about the ADMX_DFS Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-digitallocker.md b/windows/client-management/mdm/policy-csp-admx-digitallocker.md index 1cbc73ac60..b9cab4363f 100644 --- a/windows/client-management/mdm/policy-csp-admx-digitallocker.md +++ b/windows/client-management/mdm/policy-csp-admx-digitallocker.md @@ -1,14 +1,7 @@ --- title: ADMX_DigitalLocker Policy CSP description: Learn more about the ADMX_DigitalLocker Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-diskdiagnostic.md b/windows/client-management/mdm/policy-csp-admx-diskdiagnostic.md index 56edf435ca..6fe0e41bc7 100644 --- a/windows/client-management/mdm/policy-csp-admx-diskdiagnostic.md +++ b/windows/client-management/mdm/policy-csp-admx-diskdiagnostic.md @@ -1,14 +1,7 @@ --- title: ADMX_DiskDiagnostic Policy CSP description: Learn more about the ADMX_DiskDiagnostic Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-disknvcache.md b/windows/client-management/mdm/policy-csp-admx-disknvcache.md index 65b61b43e6..7aebe11d5c 100644 --- a/windows/client-management/mdm/policy-csp-admx-disknvcache.md +++ b/windows/client-management/mdm/policy-csp-admx-disknvcache.md @@ -1,14 +1,7 @@ --- title: ADMX_DiskNVCache Policy CSP description: Learn more about the ADMX_DiskNVCache Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-diskquota.md b/windows/client-management/mdm/policy-csp-admx-diskquota.md index 9e04e0f283..3822ac0264 100644 --- a/windows/client-management/mdm/policy-csp-admx-diskquota.md +++ b/windows/client-management/mdm/policy-csp-admx-diskquota.md @@ -1,14 +1,7 @@ --- title: ADMX_DiskQuota Policy CSP description: Learn more about the ADMX_DiskQuota Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md b/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md index 948283f347..10ff8682a8 100644 --- a/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md +++ b/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md @@ -1,14 +1,7 @@ --- title: ADMX_DistributedLinkTracking Policy CSP description: Learn more about the ADMX_DistributedLinkTracking Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-dnsclient.md b/windows/client-management/mdm/policy-csp-admx-dnsclient.md index 2ba7d810ae..66b65954ea 100644 --- a/windows/client-management/mdm/policy-csp-admx-dnsclient.md +++ b/windows/client-management/mdm/policy-csp-admx-dnsclient.md @@ -1,14 +1,7 @@ --- title: ADMX_DnsClient Policy CSP description: Learn more about the ADMX_DnsClient Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-dwm.md b/windows/client-management/mdm/policy-csp-admx-dwm.md index 22f1c4afd7..d44012983a 100644 --- a/windows/client-management/mdm/policy-csp-admx-dwm.md +++ b/windows/client-management/mdm/policy-csp-admx-dwm.md @@ -1,14 +1,7 @@ --- title: ADMX_DWM Policy CSP description: Learn more about the ADMX_DWM Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-eaime.md b/windows/client-management/mdm/policy-csp-admx-eaime.md index 0008cdb700..f7038edb13 100644 --- a/windows/client-management/mdm/policy-csp-admx-eaime.md +++ b/windows/client-management/mdm/policy-csp-admx-eaime.md @@ -1,14 +1,7 @@ --- title: ADMX_EAIME Policy CSP description: Learn more about the ADMX_EAIME Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md b/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md index 47de0a1e19..7e4e793bf7 100644 --- a/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md +++ b/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md @@ -1,14 +1,7 @@ --- title: ADMX_EncryptFilesonMove Policy CSP description: Learn more about the ADMX_EncryptFilesonMove Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md index 8f8c2edfae..899f863d68 100644 --- a/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md +++ b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md @@ -1,14 +1,7 @@ --- title: ADMX_EnhancedStorage Policy CSP description: Learn more about the ADMX_EnhancedStorage Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-errorreporting.md b/windows/client-management/mdm/policy-csp-admx-errorreporting.md index 9cff3290ef..4d1b6c454d 100644 --- a/windows/client-management/mdm/policy-csp-admx-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-admx-errorreporting.md @@ -1,14 +1,7 @@ --- title: ADMX_ErrorReporting Policy CSP description: Learn more about the ADMX_ErrorReporting Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-eventforwarding.md b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md index c795cc1b25..1f768733bc 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventforwarding.md +++ b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md @@ -1,14 +1,7 @@ --- title: ADMX_EventForwarding Policy CSP description: Learn more about the ADMX_EventForwarding Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-eventlog.md b/windows/client-management/mdm/policy-csp-admx-eventlog.md index e7ea263655..55c84c956a 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventlog.md +++ b/windows/client-management/mdm/policy-csp-admx-eventlog.md @@ -1,14 +1,7 @@ --- title: ADMX_EventLog Policy CSP description: Learn more about the ADMX_EventLog Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-eventlogging.md b/windows/client-management/mdm/policy-csp-admx-eventlogging.md index 4ab3bea921..f72a8ff776 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventlogging.md +++ b/windows/client-management/mdm/policy-csp-admx-eventlogging.md @@ -1,14 +1,7 @@ --- title: ADMX_EventLogging Policy CSP description: Learn more about the ADMX_EventLogging Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-eventviewer.md b/windows/client-management/mdm/policy-csp-admx-eventviewer.md index 5dbf8de29a..8b171fc73b 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventviewer.md +++ b/windows/client-management/mdm/policy-csp-admx-eventviewer.md @@ -1,14 +1,7 @@ --- title: ADMX_EventViewer Policy CSP description: Learn more about the ADMX_EventViewer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-explorer.md b/windows/client-management/mdm/policy-csp-admx-explorer.md index 109d2ab3e4..afe2fa4fee 100644 --- a/windows/client-management/mdm/policy-csp-admx-explorer.md +++ b/windows/client-management/mdm/policy-csp-admx-explorer.md @@ -1,14 +1,7 @@ --- title: ADMX_Explorer Policy CSP description: Learn more about the ADMX_Explorer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-externalboot.md b/windows/client-management/mdm/policy-csp-admx-externalboot.md index 0e9014753c..966421095a 100644 --- a/windows/client-management/mdm/policy-csp-admx-externalboot.md +++ b/windows/client-management/mdm/policy-csp-admx-externalboot.md @@ -1,14 +1,7 @@ --- title: ADMX_ExternalBoot Policy CSP description: Learn more about the ADMX_ExternalBoot Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-filerecovery.md b/windows/client-management/mdm/policy-csp-admx-filerecovery.md index df706d5574..6fa3f2524f 100644 --- a/windows/client-management/mdm/policy-csp-admx-filerecovery.md +++ b/windows/client-management/mdm/policy-csp-admx-filerecovery.md @@ -1,14 +1,7 @@ --- title: ADMX_FileRecovery Policy CSP description: Learn more about the ADMX_FileRecovery Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-filerevocation.md b/windows/client-management/mdm/policy-csp-admx-filerevocation.md index b4db9c6e31..4f69113a08 100644 --- a/windows/client-management/mdm/policy-csp-admx-filerevocation.md +++ b/windows/client-management/mdm/policy-csp-admx-filerevocation.md @@ -1,14 +1,7 @@ --- title: ADMX_FileRevocation Policy CSP description: Learn more about the ADMX_FileRevocation Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md b/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md index 4ef165f51b..09b719884e 100644 --- a/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md +++ b/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md @@ -1,14 +1,7 @@ --- title: ADMX_FileServerVSSProvider Policy CSP description: Learn more about the ADMX_FileServerVSSProvider Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-filesys.md b/windows/client-management/mdm/policy-csp-admx-filesys.md index 46e9b64dae..125fd2482d 100644 --- a/windows/client-management/mdm/policy-csp-admx-filesys.md +++ b/windows/client-management/mdm/policy-csp-admx-filesys.md @@ -1,14 +1,7 @@ --- title: ADMX_FileSys Policy CSP description: Learn more about the ADMX_FileSys Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-folderredirection.md b/windows/client-management/mdm/policy-csp-admx-folderredirection.md index f899fc45c3..8515f89060 100644 --- a/windows/client-management/mdm/policy-csp-admx-folderredirection.md +++ b/windows/client-management/mdm/policy-csp-admx-folderredirection.md @@ -1,14 +1,7 @@ --- title: ADMX_FolderRedirection Policy CSP description: Learn more about the ADMX_FolderRedirection Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-framepanes.md b/windows/client-management/mdm/policy-csp-admx-framepanes.md index 4879cfd377..bdc13bd323 100644 --- a/windows/client-management/mdm/policy-csp-admx-framepanes.md +++ b/windows/client-management/mdm/policy-csp-admx-framepanes.md @@ -1,14 +1,7 @@ --- title: ADMX_FramePanes Policy CSP description: Learn more about the ADMX_FramePanes Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-fthsvc.md b/windows/client-management/mdm/policy-csp-admx-fthsvc.md index 0a21d317ee..0bd737cd3c 100644 --- a/windows/client-management/mdm/policy-csp-admx-fthsvc.md +++ b/windows/client-management/mdm/policy-csp-admx-fthsvc.md @@ -1,14 +1,7 @@ --- title: ADMX_fthsvc Policy CSP description: Learn more about the ADMX_fthsvc Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-globalization.md b/windows/client-management/mdm/policy-csp-admx-globalization.md index 318b249de9..5266b42db2 100644 --- a/windows/client-management/mdm/policy-csp-admx-globalization.md +++ b/windows/client-management/mdm/policy-csp-admx-globalization.md @@ -1,14 +1,7 @@ --- title: ADMX_Globalization Policy CSP description: Learn more about the ADMX_Globalization Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md index b4e3c52267..51baad84e5 100644 --- a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md @@ -1,14 +1,7 @@ --- title: ADMX_GroupPolicy Policy CSP description: Learn more about the ADMX_GroupPolicy Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-help.md b/windows/client-management/mdm/policy-csp-admx-help.md index 3cc624b3ec..df2e037886 100644 --- a/windows/client-management/mdm/policy-csp-admx-help.md +++ b/windows/client-management/mdm/policy-csp-admx-help.md @@ -1,14 +1,7 @@ --- title: ADMX_Help Policy CSP description: Learn more about the ADMX_Help Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-helpandsupport.md b/windows/client-management/mdm/policy-csp-admx-helpandsupport.md index b207a1fdec..3d1cc2cff2 100644 --- a/windows/client-management/mdm/policy-csp-admx-helpandsupport.md +++ b/windows/client-management/mdm/policy-csp-admx-helpandsupport.md @@ -1,14 +1,7 @@ --- title: ADMX_HelpAndSupport Policy CSP description: Learn more about the ADMX_HelpAndSupport Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-hotspotauth.md b/windows/client-management/mdm/policy-csp-admx-hotspotauth.md index 97c0f896dd..731f6ed051 100644 --- a/windows/client-management/mdm/policy-csp-admx-hotspotauth.md +++ b/windows/client-management/mdm/policy-csp-admx-hotspotauth.md @@ -1,14 +1,7 @@ --- title: ADMX_hotspotauth Policy CSP description: Learn more about the ADMX_hotspotauth Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-icm.md b/windows/client-management/mdm/policy-csp-admx-icm.md index b75dbe301d..17e2fbb340 100644 --- a/windows/client-management/mdm/policy-csp-admx-icm.md +++ b/windows/client-management/mdm/policy-csp-admx-icm.md @@ -1,14 +1,7 @@ --- title: ADMX_ICM Policy CSP description: Learn more about the ADMX_ICM Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-iis.md b/windows/client-management/mdm/policy-csp-admx-iis.md index 5a1b4f8ae9..d447964117 100644 --- a/windows/client-management/mdm/policy-csp-admx-iis.md +++ b/windows/client-management/mdm/policy-csp-admx-iis.md @@ -1,14 +1,7 @@ --- title: ADMX_IIS Policy CSP description: Learn more about the ADMX_IIS Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-iscsi.md b/windows/client-management/mdm/policy-csp-admx-iscsi.md index 2bb4a2a986..2e5c716a1d 100644 --- a/windows/client-management/mdm/policy-csp-admx-iscsi.md +++ b/windows/client-management/mdm/policy-csp-admx-iscsi.md @@ -1,14 +1,7 @@ --- title: ADMX_iSCSI Policy CSP description: Learn more about the ADMX_iSCSI Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-kdc.md b/windows/client-management/mdm/policy-csp-admx-kdc.md index c9bad00bc5..f972a10971 100644 --- a/windows/client-management/mdm/policy-csp-admx-kdc.md +++ b/windows/client-management/mdm/policy-csp-admx-kdc.md @@ -1,14 +1,7 @@ --- title: ADMX_kdc Policy CSP description: Learn more about the ADMX_kdc Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-kerberos.md b/windows/client-management/mdm/policy-csp-admx-kerberos.md index 267e0d30d2..085ac4f942 100644 --- a/windows/client-management/mdm/policy-csp-admx-kerberos.md +++ b/windows/client-management/mdm/policy-csp-admx-kerberos.md @@ -1,14 +1,7 @@ --- title: ADMX_Kerberos Policy CSP description: Learn more about the ADMX_Kerberos Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-lanmanserver.md b/windows/client-management/mdm/policy-csp-admx-lanmanserver.md index 8cdab26c32..97c9ecc2d4 100644 --- a/windows/client-management/mdm/policy-csp-admx-lanmanserver.md +++ b/windows/client-management/mdm/policy-csp-admx-lanmanserver.md @@ -1,14 +1,7 @@ --- title: ADMX_LanmanServer Policy CSP description: Learn more about the ADMX_LanmanServer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md index 474035a993..b507c61a1e 100644 --- a/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md @@ -1,14 +1,7 @@ --- title: ADMX_LanmanWorkstation Policy CSP description: Learn more about the ADMX_LanmanWorkstation Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md b/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md index 10bfdf7962..067d3135e1 100644 --- a/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md +++ b/windows/client-management/mdm/policy-csp-admx-leakdiagnostic.md @@ -1,14 +1,7 @@ --- title: ADMX_LeakDiagnostic Policy CSP description: Learn more about the ADMX_LeakDiagnostic Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md b/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md index dc36ab7519..469330d891 100644 --- a/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md +++ b/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md @@ -1,14 +1,7 @@ --- title: ADMX_LinkLayerTopologyDiscovery Policy CSP description: Learn more about the ADMX_LinkLayerTopologyDiscovery Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-locationprovideradm.md b/windows/client-management/mdm/policy-csp-admx-locationprovideradm.md index c36607194b..970d6b6704 100644 --- a/windows/client-management/mdm/policy-csp-admx-locationprovideradm.md +++ b/windows/client-management/mdm/policy-csp-admx-locationprovideradm.md @@ -1,14 +1,7 @@ --- title: ADMX_LocationProviderAdm Policy CSP description: Learn more about the ADMX_LocationProviderAdm Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-logon.md b/windows/client-management/mdm/policy-csp-admx-logon.md index cf357ba833..dba5786104 100644 --- a/windows/client-management/mdm/policy-csp-admx-logon.md +++ b/windows/client-management/mdm/policy-csp-admx-logon.md @@ -1,14 +1,7 @@ --- title: ADMX_Logon Policy CSP description: Learn more about the ADMX_Logon Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -97,12 +90,7 @@ This policy prevents the user from showing account details (email address or use - -This policy setting disables the acrylic blur effect on logon background image. - -- If you enable this policy, the logon background image shows without blur. - -- If you disable or don't configure this policy, the logon background image adopts the acrylic blur effect. + diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md index 2ed270ebf6..d56fe04616 100644 --- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -1,14 +1,7 @@ --- title: ADMX_MicrosoftDefenderAntivirus Policy CSP description: Learn more about the ADMX_MicrosoftDefenderAntivirus Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-mmc.md b/windows/client-management/mdm/policy-csp-admx-mmc.md index 33ef1a700b..d127a3b726 100644 --- a/windows/client-management/mdm/policy-csp-admx-mmc.md +++ b/windows/client-management/mdm/policy-csp-admx-mmc.md @@ -1,14 +1,7 @@ --- title: ADMX_MMC Policy CSP description: Learn more about the ADMX_MMC Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md index d7e7143b0d..d854617402 100644 --- a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md +++ b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md @@ -1,14 +1,7 @@ --- title: ADMX_MMCSnapins Policy CSP description: Learn more about the ADMX_MMCSnapins Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-mobilepcmobilitycenter.md b/windows/client-management/mdm/policy-csp-admx-mobilepcmobilitycenter.md index 54c66c7309..7e94f79eac 100644 --- a/windows/client-management/mdm/policy-csp-admx-mobilepcmobilitycenter.md +++ b/windows/client-management/mdm/policy-csp-admx-mobilepcmobilitycenter.md @@ -1,14 +1,7 @@ --- title: ADMX_MobilePCMobilityCenter Policy CSP description: Learn more about the ADMX_MobilePCMobilityCenter Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-mobilepcpresentationsettings.md b/windows/client-management/mdm/policy-csp-admx-mobilepcpresentationsettings.md index bd007d95f0..7fecf79eed 100644 --- a/windows/client-management/mdm/policy-csp-admx-mobilepcpresentationsettings.md +++ b/windows/client-management/mdm/policy-csp-admx-mobilepcpresentationsettings.md @@ -1,14 +1,7 @@ --- title: ADMX_MobilePCPresentationSettings Policy CSP description: Learn more about the ADMX_MobilePCPresentationSettings Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-msapolicy.md b/windows/client-management/mdm/policy-csp-admx-msapolicy.md index 334498bf41..b253142cc0 100644 --- a/windows/client-management/mdm/policy-csp-admx-msapolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-msapolicy.md @@ -1,14 +1,7 @@ --- title: ADMX_MSAPolicy Policy CSP description: Learn more about the ADMX_MSAPolicy Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-msched.md b/windows/client-management/mdm/policy-csp-admx-msched.md index 34c9f09939..7d53cbdc2b 100644 --- a/windows/client-management/mdm/policy-csp-admx-msched.md +++ b/windows/client-management/mdm/policy-csp-admx-msched.md @@ -1,14 +1,7 @@ --- title: ADMX_msched Policy CSP description: Learn more about the ADMX_msched Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-msdt.md b/windows/client-management/mdm/policy-csp-admx-msdt.md index 61b9d77688..33e06d7063 100644 --- a/windows/client-management/mdm/policy-csp-admx-msdt.md +++ b/windows/client-management/mdm/policy-csp-admx-msdt.md @@ -1,14 +1,7 @@ --- title: ADMX_MSDT Policy CSP description: Learn more about the ADMX_MSDT Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-msi.md b/windows/client-management/mdm/policy-csp-admx-msi.md index 881922d5e8..30e507028d 100644 --- a/windows/client-management/mdm/policy-csp-admx-msi.md +++ b/windows/client-management/mdm/policy-csp-admx-msi.md @@ -1,14 +1,7 @@ --- title: ADMX_MSI Policy CSP description: Learn more about the ADMX_MSI Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-msifilerecovery.md b/windows/client-management/mdm/policy-csp-admx-msifilerecovery.md index 90a1241020..e87b0fb09d 100644 --- a/windows/client-management/mdm/policy-csp-admx-msifilerecovery.md +++ b/windows/client-management/mdm/policy-csp-admx-msifilerecovery.md @@ -1,14 +1,7 @@ --- title: ADMX_MsiFileRecovery Policy CSP description: Learn more about the ADMX_MsiFileRecovery Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-mss-legacy.md b/windows/client-management/mdm/policy-csp-admx-mss-legacy.md index c318f50ecd..27e93c1b63 100644 --- a/windows/client-management/mdm/policy-csp-admx-mss-legacy.md +++ b/windows/client-management/mdm/policy-csp-admx-mss-legacy.md @@ -1,14 +1,7 @@ --- title: ADMX_MSS-legacy Policy CSP description: Learn more about the ADMX_MSS-legacy Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-nca.md b/windows/client-management/mdm/policy-csp-admx-nca.md index 62d426d98e..8e47bcbc86 100644 --- a/windows/client-management/mdm/policy-csp-admx-nca.md +++ b/windows/client-management/mdm/policy-csp-admx-nca.md @@ -1,14 +1,7 @@ --- title: ADMX_nca Policy CSP description: Learn more about the ADMX_nca Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-ncsi.md b/windows/client-management/mdm/policy-csp-admx-ncsi.md index 19a7dcb36f..59719047b8 100644 --- a/windows/client-management/mdm/policy-csp-admx-ncsi.md +++ b/windows/client-management/mdm/policy-csp-admx-ncsi.md @@ -1,14 +1,7 @@ --- title: ADMX_NCSI Policy CSP description: Learn more about the ADMX_NCSI Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-netlogon.md b/windows/client-management/mdm/policy-csp-admx-netlogon.md index c9d7247cac..cc98c5cf2d 100644 --- a/windows/client-management/mdm/policy-csp-admx-netlogon.md +++ b/windows/client-management/mdm/policy-csp-admx-netlogon.md @@ -1,14 +1,7 @@ --- title: ADMX_Netlogon Policy CSP description: Learn more about the ADMX_Netlogon Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-networkconnections.md b/windows/client-management/mdm/policy-csp-admx-networkconnections.md index 04f22cb3cf..e65aa855ba 100644 --- a/windows/client-management/mdm/policy-csp-admx-networkconnections.md +++ b/windows/client-management/mdm/policy-csp-admx-networkconnections.md @@ -1,14 +1,7 @@ --- title: ADMX_NetworkConnections Policy CSP description: Learn more about the ADMX_NetworkConnections Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md index 6fe146e767..3f4616f1d8 100644 --- a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md +++ b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md @@ -1,14 +1,7 @@ --- title: ADMX_OfflineFiles Policy CSP description: Learn more about the ADMX_OfflineFiles Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-pca.md b/windows/client-management/mdm/policy-csp-admx-pca.md index 362d358dbb..cf28909853 100644 --- a/windows/client-management/mdm/policy-csp-admx-pca.md +++ b/windows/client-management/mdm/policy-csp-admx-pca.md @@ -1,14 +1,7 @@ --- title: ADMX_pca Policy CSP description: Learn more about the ADMX_pca Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md index d71f78c562..83ba39d5bd 100644 --- a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md +++ b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md @@ -1,14 +1,7 @@ --- title: ADMX_PeerToPeerCaching Policy CSP description: Learn more about the ADMX_PeerToPeerCaching Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-pentraining.md b/windows/client-management/mdm/policy-csp-admx-pentraining.md index f6c7cd6556..1f8f990c0e 100644 --- a/windows/client-management/mdm/policy-csp-admx-pentraining.md +++ b/windows/client-management/mdm/policy-csp-admx-pentraining.md @@ -1,14 +1,7 @@ --- title: ADMX_PenTraining Policy CSP description: Learn more about the ADMX_PenTraining Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md b/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md index 4668a2c205..510a54b8fa 100644 --- a/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md +++ b/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md @@ -1,14 +1,7 @@ --- title: ADMX_PerformanceDiagnostics Policy CSP description: Learn more about the ADMX_PerformanceDiagnostics Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-power.md b/windows/client-management/mdm/policy-csp-admx-power.md index df3ab6fb49..d329f3a34e 100644 --- a/windows/client-management/mdm/policy-csp-admx-power.md +++ b/windows/client-management/mdm/policy-csp-admx-power.md @@ -1,14 +1,7 @@ --- title: ADMX_Power Policy CSP description: Learn more about the ADMX_Power Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/23/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md b/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md index 68f10aa963..bea468e20c 100644 --- a/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md @@ -1,14 +1,7 @@ --- title: ADMX_PowerShellExecutionPolicy Policy CSP description: Learn more about the ADMX_PowerShellExecutionPolicy Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-previousversions.md b/windows/client-management/mdm/policy-csp-admx-previousversions.md index 12298c8668..f9552c2c37 100644 --- a/windows/client-management/mdm/policy-csp-admx-previousversions.md +++ b/windows/client-management/mdm/policy-csp-admx-previousversions.md @@ -1,14 +1,7 @@ --- title: ADMX_PreviousVersions Policy CSP description: Learn more about the ADMX_PreviousVersions Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-printing.md b/windows/client-management/mdm/policy-csp-admx-printing.md index 4e7b8d6bf5..712df5a4c8 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing.md +++ b/windows/client-management/mdm/policy-csp-admx-printing.md @@ -1,14 +1,7 @@ --- title: ADMX_Printing Policy CSP description: Learn more about the ADMX_Printing Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-printing2.md b/windows/client-management/mdm/policy-csp-admx-printing2.md index a30b68056b..c687d9136e 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing2.md +++ b/windows/client-management/mdm/policy-csp-admx-printing2.md @@ -1,14 +1,7 @@ --- title: ADMX_Printing2 Policy CSP description: Learn more about the ADMX_Printing2 Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-programs.md b/windows/client-management/mdm/policy-csp-admx-programs.md index ce4953e2bd..5548050a9c 100644 --- a/windows/client-management/mdm/policy-csp-admx-programs.md +++ b/windows/client-management/mdm/policy-csp-admx-programs.md @@ -1,14 +1,7 @@ --- title: ADMX_Programs Policy CSP description: Learn more about the ADMX_Programs Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md b/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md index f4c90fd2f1..806d9651ce 100644 --- a/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md +++ b/windows/client-management/mdm/policy-csp-admx-pushtoinstall.md @@ -1,14 +1,7 @@ --- title: ADMX_PushToInstall Policy CSP description: Learn more about the ADMX_PushToInstall Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-qos.md b/windows/client-management/mdm/policy-csp-admx-qos.md index 88eb3a3e85..c19234a322 100644 --- a/windows/client-management/mdm/policy-csp-admx-qos.md +++ b/windows/client-management/mdm/policy-csp-admx-qos.md @@ -1,14 +1,7 @@ --- title: ADMX_QOS Policy CSP description: Learn more about the ADMX_QOS Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-radar.md b/windows/client-management/mdm/policy-csp-admx-radar.md index 787f2686d2..2d7bb746e9 100644 --- a/windows/client-management/mdm/policy-csp-admx-radar.md +++ b/windows/client-management/mdm/policy-csp-admx-radar.md @@ -1,14 +1,7 @@ --- title: ADMX_Radar Policy CSP description: Learn more about the ADMX_Radar Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-reliability.md b/windows/client-management/mdm/policy-csp-admx-reliability.md index 0c9e9c4c91..20c59c50f0 100644 --- a/windows/client-management/mdm/policy-csp-admx-reliability.md +++ b/windows/client-management/mdm/policy-csp-admx-reliability.md @@ -1,14 +1,7 @@ --- title: ADMX_Reliability Policy CSP description: Learn more about the ADMX_Reliability Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-remoteassistance.md b/windows/client-management/mdm/policy-csp-admx-remoteassistance.md index b3b804deb2..d6b3127e2e 100644 --- a/windows/client-management/mdm/policy-csp-admx-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-admx-remoteassistance.md @@ -1,14 +1,7 @@ --- title: ADMX_RemoteAssistance Policy CSP description: Learn more about the ADMX_RemoteAssistance Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-removablestorage.md b/windows/client-management/mdm/policy-csp-admx-removablestorage.md index 3184140eb7..8e706aa2c0 100644 --- a/windows/client-management/mdm/policy-csp-admx-removablestorage.md +++ b/windows/client-management/mdm/policy-csp-admx-removablestorage.md @@ -1,14 +1,7 @@ --- title: ADMX_RemovableStorage Policy CSP description: Learn more about the ADMX_RemovableStorage Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-rpc.md b/windows/client-management/mdm/policy-csp-admx-rpc.md index 7c8406a263..613e1bb668 100644 --- a/windows/client-management/mdm/policy-csp-admx-rpc.md +++ b/windows/client-management/mdm/policy-csp-admx-rpc.md @@ -1,14 +1,7 @@ --- title: ADMX_RPC Policy CSP description: Learn more about the ADMX_RPC Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-sam.md b/windows/client-management/mdm/policy-csp-admx-sam.md index f50403b71b..1427a02daf 100644 --- a/windows/client-management/mdm/policy-csp-admx-sam.md +++ b/windows/client-management/mdm/policy-csp-admx-sam.md @@ -1,14 +1,7 @@ --- title: ADMX_sam Policy CSP description: Learn more about the ADMX_sam Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-scripts.md b/windows/client-management/mdm/policy-csp-admx-scripts.md index 787caffb91..a507a7dc14 100644 --- a/windows/client-management/mdm/policy-csp-admx-scripts.md +++ b/windows/client-management/mdm/policy-csp-admx-scripts.md @@ -1,14 +1,7 @@ --- title: ADMX_Scripts Policy CSP description: Learn more about the ADMX_Scripts Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-sdiageng.md b/windows/client-management/mdm/policy-csp-admx-sdiageng.md index 6d21f4a202..c23bf10950 100644 --- a/windows/client-management/mdm/policy-csp-admx-sdiageng.md +++ b/windows/client-management/mdm/policy-csp-admx-sdiageng.md @@ -1,14 +1,7 @@ --- title: ADMX_sdiageng Policy CSP description: Learn more about the ADMX_sdiageng Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-sdiagschd.md b/windows/client-management/mdm/policy-csp-admx-sdiagschd.md index 7fe4560ed8..a221dc34b5 100644 --- a/windows/client-management/mdm/policy-csp-admx-sdiagschd.md +++ b/windows/client-management/mdm/policy-csp-admx-sdiagschd.md @@ -1,14 +1,7 @@ --- title: ADMX_sdiagschd Policy CSP description: Learn more about the ADMX_sdiagschd Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-securitycenter.md b/windows/client-management/mdm/policy-csp-admx-securitycenter.md index b485aeaea3..fd54e1f891 100644 --- a/windows/client-management/mdm/policy-csp-admx-securitycenter.md +++ b/windows/client-management/mdm/policy-csp-admx-securitycenter.md @@ -1,14 +1,7 @@ --- title: ADMX_Securitycenter Policy CSP description: Learn more about the ADMX_Securitycenter Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-sensors.md b/windows/client-management/mdm/policy-csp-admx-sensors.md index 467b0c299b..6c890631d8 100644 --- a/windows/client-management/mdm/policy-csp-admx-sensors.md +++ b/windows/client-management/mdm/policy-csp-admx-sensors.md @@ -1,14 +1,7 @@ --- title: ADMX_Sensors Policy CSP description: Learn more about the ADMX_Sensors Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-servermanager.md b/windows/client-management/mdm/policy-csp-admx-servermanager.md index 2e0010499f..0af31e3dda 100644 --- a/windows/client-management/mdm/policy-csp-admx-servermanager.md +++ b/windows/client-management/mdm/policy-csp-admx-servermanager.md @@ -1,14 +1,7 @@ --- title: ADMX_ServerManager Policy CSP description: Learn more about the ADMX_ServerManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-servicing.md b/windows/client-management/mdm/policy-csp-admx-servicing.md index 8a4ae0fb37..a31799041a 100644 --- a/windows/client-management/mdm/policy-csp-admx-servicing.md +++ b/windows/client-management/mdm/policy-csp-admx-servicing.md @@ -1,14 +1,7 @@ --- title: ADMX_Servicing Policy CSP description: Learn more about the ADMX_Servicing Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-settingsync.md b/windows/client-management/mdm/policy-csp-admx-settingsync.md index 27aef62087..5b949ace6f 100644 --- a/windows/client-management/mdm/policy-csp-admx-settingsync.md +++ b/windows/client-management/mdm/policy-csp-admx-settingsync.md @@ -1,14 +1,7 @@ --- title: ADMX_SettingSync Policy CSP description: Learn more about the ADMX_SettingSync Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md index 78196c2803..486085f08a 100644 --- a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md +++ b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md @@ -1,14 +1,7 @@ --- title: ADMX_SharedFolders Policy CSP description: Learn more about the ADMX_SharedFolders Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-sharing.md b/windows/client-management/mdm/policy-csp-admx-sharing.md index 5af4415dfe..a83e821101 100644 --- a/windows/client-management/mdm/policy-csp-admx-sharing.md +++ b/windows/client-management/mdm/policy-csp-admx-sharing.md @@ -1,14 +1,7 @@ --- title: ADMX_Sharing Policy CSP description: Learn more about the ADMX_Sharing Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md index 97565d0fc8..228d08b694 100644 --- a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md +++ b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md @@ -1,14 +1,7 @@ --- title: ADMX_ShellCommandPromptRegEditTools Policy CSP description: Learn more about the ADMX_ShellCommandPromptRegEditTools Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-smartcard.md b/windows/client-management/mdm/policy-csp-admx-smartcard.md index a427fcd365..22338b85ad 100644 --- a/windows/client-management/mdm/policy-csp-admx-smartcard.md +++ b/windows/client-management/mdm/policy-csp-admx-smartcard.md @@ -1,14 +1,7 @@ --- title: ADMX_Smartcard Policy CSP description: Learn more about the ADMX_Smartcard Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-snmp.md b/windows/client-management/mdm/policy-csp-admx-snmp.md index 36d22a34e9..0d2382bb64 100644 --- a/windows/client-management/mdm/policy-csp-admx-snmp.md +++ b/windows/client-management/mdm/policy-csp-admx-snmp.md @@ -1,14 +1,7 @@ --- title: ADMX_Snmp Policy CSP description: Learn more about the ADMX_Snmp Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-soundrec.md b/windows/client-management/mdm/policy-csp-admx-soundrec.md index ead22da785..41cf4a6ccc 100644 --- a/windows/client-management/mdm/policy-csp-admx-soundrec.md +++ b/windows/client-management/mdm/policy-csp-admx-soundrec.md @@ -1,14 +1,7 @@ --- title: ADMX_SoundRec Policy CSP description: Learn more about the ADMX_SoundRec Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-srmfci.md b/windows/client-management/mdm/policy-csp-admx-srmfci.md index 1758b042bb..7fc90a1ff0 100644 --- a/windows/client-management/mdm/policy-csp-admx-srmfci.md +++ b/windows/client-management/mdm/policy-csp-admx-srmfci.md @@ -1,14 +1,7 @@ --- title: ADMX_srmfci Policy CSP description: Learn more about the ADMX_srmfci Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-startmenu.md b/windows/client-management/mdm/policy-csp-admx-startmenu.md index ea6c920ff9..0a223d43d0 100644 --- a/windows/client-management/mdm/policy-csp-admx-startmenu.md +++ b/windows/client-management/mdm/policy-csp-admx-startmenu.md @@ -1,14 +1,7 @@ --- title: ADMX_StartMenu Policy CSP description: Learn more about the ADMX_StartMenu Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-systemrestore.md b/windows/client-management/mdm/policy-csp-admx-systemrestore.md index c3c396e287..2e1c03774b 100644 --- a/windows/client-management/mdm/policy-csp-admx-systemrestore.md +++ b/windows/client-management/mdm/policy-csp-admx-systemrestore.md @@ -1,14 +1,7 @@ --- title: ADMX_SystemRestore Policy CSP description: Learn more about the ADMX_SystemRestore Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md b/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md index c031995861..e7b2fb7d4a 100644 --- a/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md @@ -1,14 +1,7 @@ --- title: ADMX_TabletPCInputPanel Policy CSP description: Learn more about the ADMX_TabletPCInputPanel Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-tabletshell.md b/windows/client-management/mdm/policy-csp-admx-tabletshell.md index 6682bc155c..7ee90e1830 100644 --- a/windows/client-management/mdm/policy-csp-admx-tabletshell.md +++ b/windows/client-management/mdm/policy-csp-admx-tabletshell.md @@ -1,14 +1,7 @@ --- title: ADMX_TabletShell Policy CSP description: Learn more about the ADMX_TabletShell Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-taskbar.md b/windows/client-management/mdm/policy-csp-admx-taskbar.md index 97e296b53b..176660f30b 100644 --- a/windows/client-management/mdm/policy-csp-admx-taskbar.md +++ b/windows/client-management/mdm/policy-csp-admx-taskbar.md @@ -1,14 +1,7 @@ --- title: ADMX_Taskbar Policy CSP description: Learn more about the ADMX_Taskbar Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -105,16 +98,7 @@ A reboot is required for this policy setting to take effect. - -This policy disables the functionality that converts balloons to toast notifications. - -- If you enable this policy setting, system and application notifications will render as balloons instead of toast notifications. - -Enable this policy setting if a specific app or system component that uses balloon notifications has compatibility issues with toast notifications. - -- If you disable or don't configure this policy setting, all notifications will appear as toast notifications. - -A reboot is required for this policy setting to take effect. + diff --git a/windows/client-management/mdm/policy-csp-admx-tcpip.md b/windows/client-management/mdm/policy-csp-admx-tcpip.md index efef32bb83..a394a7a264 100644 --- a/windows/client-management/mdm/policy-csp-admx-tcpip.md +++ b/windows/client-management/mdm/policy-csp-admx-tcpip.md @@ -1,14 +1,7 @@ --- title: ADMX_tcpip Policy CSP description: Learn more about the ADMX_tcpip Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-terminalserver.md b/windows/client-management/mdm/policy-csp-admx-terminalserver.md index d7950d1ff0..0b5853336a 100644 --- a/windows/client-management/mdm/policy-csp-admx-terminalserver.md +++ b/windows/client-management/mdm/policy-csp-admx-terminalserver.md @@ -1,14 +1,7 @@ --- title: ADMX_TerminalServer Policy CSP description: Learn more about the ADMX_TerminalServer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -1368,7 +1361,7 @@ Note: 1. For connections from client computers that are using Remote Desktop Protocol 7.1 or earlier versions that are connecting to computers running at least Windows 8 or Windows Server 2012, the minimum of the following values is used as the color depth format: -a. Value specified by this policy setting b. Maximum color depth supported by the client c. Value requested by the client. +a. Value specified by this policy setting b. Maximum color depth supported by the client c. Value requested by the client. If the client doesn't support at least 16 bits, the connection is terminated. @@ -2945,7 +2938,7 @@ This policy setting determines whether a user will be prompted on the client com -This policy setting specifies the default connection URL for RemoteApp and Desktop Connections. The default connection URL is a specific connection that can only be configured by using Group Policy. In addition to the capabilities that are common to all connections, the default connection URL allows document file types to be associated with RemoteApp programs. +This policy setting specifies the default connection URL for RemoteApp and Desktop Connections. In addition to the capabilities that are common to all connections, the default connection URL allows document file types to be associated with RemoteApp programs. The default connection URL must be configured in the form of< https://contoso.com/rdweb/Feed/webfeed.aspx>. diff --git a/windows/client-management/mdm/policy-csp-admx-thumbnails.md b/windows/client-management/mdm/policy-csp-admx-thumbnails.md index aa937ea978..1b7747fb27 100644 --- a/windows/client-management/mdm/policy-csp-admx-thumbnails.md +++ b/windows/client-management/mdm/policy-csp-admx-thumbnails.md @@ -1,14 +1,7 @@ --- title: ADMX_Thumbnails Policy CSP description: Learn more about the ADMX_Thumbnails Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-touchinput.md b/windows/client-management/mdm/policy-csp-admx-touchinput.md index 2442bd1a0c..90a38cf981 100644 --- a/windows/client-management/mdm/policy-csp-admx-touchinput.md +++ b/windows/client-management/mdm/policy-csp-admx-touchinput.md @@ -1,14 +1,7 @@ --- title: ADMX_TouchInput Policy CSP description: Learn more about the ADMX_TouchInput Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-tpm.md b/windows/client-management/mdm/policy-csp-admx-tpm.md index c0de908883..299bc993aa 100644 --- a/windows/client-management/mdm/policy-csp-admx-tpm.md +++ b/windows/client-management/mdm/policy-csp-admx-tpm.md @@ -1,14 +1,7 @@ --- title: ADMX_TPM Policy CSP description: Learn more about the ADMX_TPM Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md index c89a4542be..5df403b933 100644 --- a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md +++ b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md @@ -1,14 +1,7 @@ --- title: ADMX_UserExperienceVirtualization Policy CSP description: Learn more about the ADMX_UserExperienceVirtualization Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-userprofiles.md b/windows/client-management/mdm/policy-csp-admx-userprofiles.md index df2fd32ecf..adf0ccefe0 100644 --- a/windows/client-management/mdm/policy-csp-admx-userprofiles.md +++ b/windows/client-management/mdm/policy-csp-admx-userprofiles.md @@ -1,14 +1,7 @@ --- title: ADMX_UserProfiles Policy CSP description: Learn more about the ADMX_UserProfiles Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-w32time.md b/windows/client-management/mdm/policy-csp-admx-w32time.md index 4c34ddc617..3aaf1c7335 100644 --- a/windows/client-management/mdm/policy-csp-admx-w32time.md +++ b/windows/client-management/mdm/policy-csp-admx-w32time.md @@ -1,14 +1,7 @@ --- title: ADMX_W32Time Policy CSP description: Learn more about the ADMX_W32Time Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-wcm.md b/windows/client-management/mdm/policy-csp-admx-wcm.md index 2daf25532c..e6fe0c1726 100644 --- a/windows/client-management/mdm/policy-csp-admx-wcm.md +++ b/windows/client-management/mdm/policy-csp-admx-wcm.md @@ -1,14 +1,7 @@ --- title: ADMX_WCM Policy CSP description: Learn more about the ADMX_WCM Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-wdi.md b/windows/client-management/mdm/policy-csp-admx-wdi.md index 14371f71cf..df4c5846ad 100644 --- a/windows/client-management/mdm/policy-csp-admx-wdi.md +++ b/windows/client-management/mdm/policy-csp-admx-wdi.md @@ -1,14 +1,7 @@ --- title: ADMX_WDI Policy CSP description: Learn more about the ADMX_WDI Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-wincal.md b/windows/client-management/mdm/policy-csp-admx-wincal.md index 97141edb41..31833306d1 100644 --- a/windows/client-management/mdm/policy-csp-admx-wincal.md +++ b/windows/client-management/mdm/policy-csp-admx-wincal.md @@ -1,14 +1,7 @@ --- title: ADMX_WinCal Policy CSP description: Learn more about the ADMX_WinCal Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md b/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md index c7c06a9fc3..2055d516ec 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md +++ b/windows/client-management/mdm/policy-csp-admx-windowscolorsystem.md @@ -1,14 +1,7 @@ --- title: ADMX_WindowsColorSystem Policy CSP description: Learn more about the ADMX_WindowsColorSystem Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md b/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md index 10dcf61ff3..b115f7d5e2 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md @@ -1,14 +1,7 @@ --- title: ADMX_WindowsConnectNow Policy CSP description: Learn more about the ADMX_WindowsConnectNow Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md index 33ab184dc5..7fe9bd9679 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md @@ -1,14 +1,7 @@ --- title: ADMX_WindowsExplorer Policy CSP description: Learn more about the ADMX_WindowsExplorer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md b/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md index 9476a4fabb..dbd36541c4 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md @@ -1,14 +1,7 @@ --- title: ADMX_WindowsMediaDRM Policy CSP description: Learn more about the ADMX_WindowsMediaDRM Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md b/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md index 46150339f6..04df21d7a7 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md @@ -1,14 +1,7 @@ --- title: ADMX_WindowsMediaPlayer Policy CSP description: Learn more about the ADMX_WindowsMediaPlayer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md b/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md index 3a972ef92a..9feebc0561 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md @@ -1,14 +1,7 @@ --- title: ADMX_WindowsRemoteManagement Policy CSP description: Learn more about the ADMX_WindowsRemoteManagement Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-windowsstore.md b/windows/client-management/mdm/policy-csp-admx-windowsstore.md index 757279b2fc..ad9da6b96b 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsstore.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsstore.md @@ -1,14 +1,7 @@ --- title: ADMX_WindowsStore Policy CSP description: Learn more about the ADMX_WindowsStore Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-wininit.md b/windows/client-management/mdm/policy-csp-admx-wininit.md index b4561c36e3..016d00fda3 100644 --- a/windows/client-management/mdm/policy-csp-admx-wininit.md +++ b/windows/client-management/mdm/policy-csp-admx-wininit.md @@ -1,14 +1,7 @@ --- title: ADMX_WinInit Policy CSP description: Learn more about the ADMX_WinInit Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-winlogon.md b/windows/client-management/mdm/policy-csp-admx-winlogon.md index e9191d0a40..7861b20555 100644 --- a/windows/client-management/mdm/policy-csp-admx-winlogon.md +++ b/windows/client-management/mdm/policy-csp-admx-winlogon.md @@ -1,14 +1,7 @@ --- title: ADMX_WinLogon Policy CSP description: Learn more about the ADMX_WinLogon Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-winsrv.md b/windows/client-management/mdm/policy-csp-admx-winsrv.md index f92cba7883..56d9974fe2 100644 --- a/windows/client-management/mdm/policy-csp-admx-winsrv.md +++ b/windows/client-management/mdm/policy-csp-admx-winsrv.md @@ -1,14 +1,7 @@ --- title: ADMX_Winsrv Policy CSP description: Learn more about the ADMX_Winsrv Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -38,12 +31,7 @@ ms.topic: reference - -This policy setting specifies whether Windows will allow console applications and GUI applications without visible top-level windows to block or cancel shutdown. By default, such applications are automatically terminated if they attempt to cancel shutdown or block it indefinitely. - -- If you enable this setting, console applications or GUI applications without visible top-level windows that block or cancel shutdown won't be automatically terminated during shutdown. - -- If you disable or don't configure this setting, these applications will be automatically terminated during shutdown, helping to ensure that Windows can shut down faster and more smoothly. + diff --git a/windows/client-management/mdm/policy-csp-admx-wlansvc.md b/windows/client-management/mdm/policy-csp-admx-wlansvc.md index 67f7fd4932..d09a2030f0 100644 --- a/windows/client-management/mdm/policy-csp-admx-wlansvc.md +++ b/windows/client-management/mdm/policy-csp-admx-wlansvc.md @@ -1,14 +1,7 @@ --- title: ADMX_wlansvc Policy CSP description: Learn more about the ADMX_wlansvc Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-wordwheel.md b/windows/client-management/mdm/policy-csp-admx-wordwheel.md index 8217f78031..a71623c248 100644 --- a/windows/client-management/mdm/policy-csp-admx-wordwheel.md +++ b/windows/client-management/mdm/policy-csp-admx-wordwheel.md @@ -1,14 +1,7 @@ --- title: ADMX_WordWheel Policy CSP description: Learn more about the ADMX_WordWheel Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md b/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md index 90b757d7e6..f5b3d60f6b 100644 --- a/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md +++ b/windows/client-management/mdm/policy-csp-admx-workfoldersclient.md @@ -1,14 +1,7 @@ --- title: ADMX_WorkFoldersClient Policy CSP description: Learn more about the ADMX_WorkFoldersClient Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-admx-wpn.md b/windows/client-management/mdm/policy-csp-admx-wpn.md index 3a2751af33..f69b55da60 100644 --- a/windows/client-management/mdm/policy-csp-admx-wpn.md +++ b/windows/client-management/mdm/policy-csp-admx-wpn.md @@ -1,14 +1,7 @@ --- title: ADMX_WPN Policy CSP description: Learn more about the ADMX_WPN Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index f51f27e3ee..ee6da319a3 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -1,14 +1,7 @@ --- title: ApplicationDefaults Policy CSP description: Learn more about the ApplicationDefaults Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -37,7 +30,7 @@ ms.topic: reference -This policy allows an administrator to set default file type and protocol associations. When set, default associations will be applied on sign-in to the PC. The association file can be created using the DISM tool (dism /online /export-defaultappassociations:appassoc. xml), and then needs to be base64 encoded before being added to SyncML. If policy is enabled and the client machine is Microsoft Entra joined, the associations assigned in SyncML will be processed and default associations will be applied. +This policy allows an administrator to set default file type and protocol associations. When set, default associations will be applied on sign-in to the PC. The association file can be created using the DISM tool (dism /online /export-defaultappassociations:appassoc.xml). The file can be further edited by adding attributes to control how often associations are applied by the policy. The file then needs to be base64 encoded before being added to SyncML. If policy is enabled and the client machine is Microsoft Entra joined, the associations assigned in SyncML will be processed and default associations will be applied. diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 15396470d3..ba4fc8b016 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -1,14 +1,7 @@ --- title: ApplicationManagement Policy CSP description: Learn more about the ApplicationManagement Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-appruntime.md b/windows/client-management/mdm/policy-csp-appruntime.md index c80e7472b4..20cddfc183 100644 --- a/windows/client-management/mdm/policy-csp-appruntime.md +++ b/windows/client-management/mdm/policy-csp-appruntime.md @@ -1,14 +1,7 @@ --- title: AppRuntime Policy CSP description: Learn more about the AppRuntime Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index 7cfb9ef14a..6e677aa3b7 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -1,14 +1,7 @@ --- title: AppVirtualization Policy CSP description: Learn more about the AppVirtualization Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/24/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md index ad924dc539..63caf16da0 100644 --- a/windows/client-management/mdm/policy-csp-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md @@ -1,14 +1,7 @@ --- title: AttachmentManager Policy CSP description: Learn more about the AttachmentManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 174c8e6dd0..c434116039 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -1,14 +1,7 @@ --- title: Audit Policy CSP description: Learn more about the Audit Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 792538bcd5..ebc00056d8 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -1,14 +1,7 @@ --- title: Authentication Policy CSP description: Learn more about the Authentication Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/24/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -16,8 +9,6 @@ ms.topic: reference # Policy CSP - Authentication -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - @@ -402,7 +393,7 @@ This policy is intended for use on Shared PCs to enable a quick first sign-in ex | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 23H2 [10.0.22631.2506] and later | diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md index fbf76ab56a..f94c675d89 100644 --- a/windows/client-management/mdm/policy-csp-autoplay.md +++ b/windows/client-management/mdm/policy-csp-autoplay.md @@ -1,14 +1,7 @@ --- title: Autoplay Policy CSP description: Learn more about the Autoplay Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-bitlocker.md b/windows/client-management/mdm/policy-csp-bitlocker.md index bdc7ed5eee..85ba82af82 100644 --- a/windows/client-management/mdm/policy-csp-bitlocker.md +++ b/windows/client-management/mdm/policy-csp-bitlocker.md @@ -1,14 +1,7 @@ --- title: Bitlocker Policy CSP description: Learn more about the Bitlocker Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/09/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-bits.md b/windows/client-management/mdm/policy-csp-bits.md index b1d3449ae2..01dbd07987 100644 --- a/windows/client-management/mdm/policy-csp-bits.md +++ b/windows/client-management/mdm/policy-csp-bits.md @@ -1,14 +1,7 @@ --- title: BITS Policy CSP description: Learn more about the BITS Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index 03ee87d6ff..fc321bd1b1 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -1,14 +1,7 @@ --- title: Bluetooth Policy CSP description: Learn more about the Bluetooth Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index c6cf0c0b0b..0831538391 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -1,14 +1,7 @@ --- title: Browser Policy CSP description: Learn more about the Browser Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md index 3f89630a72..3882e07879 100644 --- a/windows/client-management/mdm/policy-csp-camera.md +++ b/windows/client-management/mdm/policy-csp-camera.md @@ -1,14 +1,7 @@ --- title: Camera Policy CSP description: Learn more about the Camera Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index 1e98fdc8f5..a2cfae0564 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -1,14 +1,7 @@ --- title: Cellular Policy CSP description: Learn more about the Cellular Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-clouddesktop.md b/windows/client-management/mdm/policy-csp-clouddesktop.md index 66d7fcc0ad..cb287ddd00 100644 --- a/windows/client-management/mdm/policy-csp-clouddesktop.md +++ b/windows/client-management/mdm/policy-csp-clouddesktop.md @@ -1,14 +1,7 @@ --- title: CloudDesktop Policy CSP description: Learn more about the CloudDesktop Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 09/14/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 7e0a5b1426..26b96531e8 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -1,14 +1,7 @@ --- title: Connectivity Policy CSP description: Learn more about the Connectivity Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index 4c27326f83..11a98be2e2 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -1,14 +1,7 @@ --- title: ControlPolicyConflict Policy CSP description: Learn more about the ControlPolicyConflict Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md index bf6c62f53a..d73b3ade9c 100644 --- a/windows/client-management/mdm/policy-csp-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-credentialproviders.md @@ -1,14 +1,7 @@ --- title: CredentialProviders Policy CSP description: Learn more about the CredentialProviders Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-credentialsdelegation.md b/windows/client-management/mdm/policy-csp-credentialsdelegation.md index 943113ee1d..af3cee543f 100644 --- a/windows/client-management/mdm/policy-csp-credentialsdelegation.md +++ b/windows/client-management/mdm/policy-csp-credentialsdelegation.md @@ -1,14 +1,7 @@ --- title: CredentialsDelegation Policy CSP description: Learn more about the CredentialsDelegation Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md index 2fb7881948..f6f9d847a7 100644 --- a/windows/client-management/mdm/policy-csp-credentialsui.md +++ b/windows/client-management/mdm/policy-csp-credentialsui.md @@ -1,14 +1,7 @@ --- title: CredentialsUI Policy CSP description: Learn more about the CredentialsUI Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md index a5874803b9..27aae04079 100644 --- a/windows/client-management/mdm/policy-csp-cryptography.md +++ b/windows/client-management/mdm/policy-csp-cryptography.md @@ -1,14 +1,7 @@ --- title: Cryptography Policy CSP description: Learn more about the Cryptography Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/29/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md index 591e62bd55..ed3d5d84d4 100644 --- a/windows/client-management/mdm/policy-csp-dataprotection.md +++ b/windows/client-management/mdm/policy-csp-dataprotection.md @@ -1,14 +1,7 @@ --- title: DataProtection Policy CSP description: Learn more about the DataProtection Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md index 3bb392662b..37ef82f657 100644 --- a/windows/client-management/mdm/policy-csp-datausage.md +++ b/windows/client-management/mdm/policy-csp-datausage.md @@ -1,14 +1,7 @@ --- title: DataUsage Policy CSP description: Learn more about the DataUsage Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index bca45399aa..ce5814933e 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -1,14 +1,7 @@ --- title: Defender Policy CSP description: Learn more about the Defender Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -1081,7 +1074,7 @@ This policy setting allows you to configure the maximum percentage CPU utilizati > [!NOTE] > If you enable both of the following policies, then Windows ignores the value of **AvgCPULoadFactor**: -> +> > - [ScanOnlyIfIdle](defender-csp.md#configurationscanonlyifidleenabled): Instructs the product to scan only when the computer isn't in use. > - [DisableCpuThrottleOnIdleScans](defender-csp.md#configurationdisablecputhrottleonidlescans): Instructs the product to disable CPU throttling on idle scans. @@ -1550,12 +1543,12 @@ This policy setting defines the number of days items should be kept in the Quara - + This policy setting allows you to configure catch-up scans for scheduled full scans. A catch-up scan is a scan that's initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. -- If you enable this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. +- If you disable or don't configure this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. -- If you disable or don't configure this setting, catch-up scans for scheduled full scans will be turned off. +- If you enable this setting, catch-up scans for scheduled full scans will be disabled. @@ -1616,16 +1609,16 @@ This policy setting allows you to configure catch-up scans for scheduled full sc - -This policy setting allows you to configure catch-up scans for scheduled quick scans. A catch-up scan is a scan that's initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. - -- If you enable this setting, catch-up scans for scheduled quick scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. - -- If you disable or don't configure this setting, catch-up scans for scheduled quick scans will be turned off. + +This policy setting allows you to configure catch-up scans for scheduled quick scans. A catch-up scan is a scan that's initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. + +- If you disable or don't configure this setting, catch-up scans for scheduled quick scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. + +- If you enable this setting, catch-up scans for scheduled quick scans will be disabled. diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 5e4f2838af..f9f05c2927 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -1,14 +1,7 @@ --- title: DeliveryOptimization Policy CSP description: Learn more about the DeliveryOptimization Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -18,6 +11,8 @@ ms.topic: reference [!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)] +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + @@ -507,7 +502,7 @@ The recommended value is 1 minute (60). | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2361] and later
✅ Windows Insider Preview | @@ -1687,7 +1682,7 @@ This policy allows an IT Admin to define the following details: | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2361] and later
✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index 8c7fe07a3d..60c0d9c6aa 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -1,14 +1,7 @@ --- title: Desktop Policy CSP description: Learn more about the Desktop Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-desktopappinstaller.md b/windows/client-management/mdm/policy-csp-desktopappinstaller.md index e0c33829f6..2b3fea16a4 100644 --- a/windows/client-management/mdm/policy-csp-desktopappinstaller.md +++ b/windows/client-management/mdm/policy-csp-desktopappinstaller.md @@ -1,14 +1,7 @@ --- title: DesktopAppInstaller Policy CSP description: Learn more about the DesktopAppInstaller Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index fe3ed53290..c27a142696 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -1,14 +1,7 @@ --- title: DeviceGuard Policy CSP description: Learn more about the DeviceGuard Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md index 0f7c4c5589..271866959b 100644 --- a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md +++ b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md @@ -1,14 +1,7 @@ --- title: DeviceHealthMonitoring Policy CSP description: Learn more about the DeviceHealthMonitoring Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 601453f34d..88d04325f2 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -1,14 +1,7 @@ --- title: DeviceInstallation Policy CSP description: Learn more about the DeviceInstallation Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 7b0d273a41..e066ebfeee 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -1,14 +1,7 @@ --- title: DeviceLock Policy CSP description: Learn more about the DeviceLock Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index c716b41a63..8f021f8337 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -1,14 +1,7 @@ --- title: Display Policy CSP description: Learn more about the Display Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-dmaguard.md b/windows/client-management/mdm/policy-csp-dmaguard.md index 0a9aa6d814..ed3b7b4609 100644 --- a/windows/client-management/mdm/policy-csp-dmaguard.md +++ b/windows/client-management/mdm/policy-csp-dmaguard.md @@ -1,14 +1,7 @@ --- title: DmaGuard Policy CSP description: Learn more about the DmaGuard Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-eap.md b/windows/client-management/mdm/policy-csp-eap.md index ccc75b02bf..14022fde28 100644 --- a/windows/client-management/mdm/policy-csp-eap.md +++ b/windows/client-management/mdm/policy-csp-eap.md @@ -1,14 +1,7 @@ --- title: Eap Policy CSP description: Learn more about the Eap Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index 4ec2cef651..cfd49a1bf0 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -1,14 +1,7 @@ --- title: Education Policy CSP description: Learn more about the Education Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md index 4005e29555..f0c354b20c 100644 --- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md +++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md @@ -1,14 +1,7 @@ --- title: EnterpriseCloudPrint Policy CSP description: Learn more about the EnterpriseCloudPrint Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-errorreporting.md b/windows/client-management/mdm/policy-csp-errorreporting.md index e97461a682..50e401227e 100644 --- a/windows/client-management/mdm/policy-csp-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-errorreporting.md @@ -1,14 +1,7 @@ --- title: ErrorReporting Policy CSP description: Learn more about the ErrorReporting Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md index ce940b762e..83a5c6c350 100644 --- a/windows/client-management/mdm/policy-csp-eventlogservice.md +++ b/windows/client-management/mdm/policy-csp-eventlogservice.md @@ -1,14 +1,7 @@ --- title: EventLogService Policy CSP description: Learn more about the EventLogService Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index 3fbecc7fbe..f7ecf4bf2a 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -1,14 +1,7 @@ --- title: Experience Policy CSP description: Learn more about the Experience Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md index 089a7066d9..6d947b5cd3 100644 --- a/windows/client-management/mdm/policy-csp-exploitguard.md +++ b/windows/client-management/mdm/policy-csp-exploitguard.md @@ -1,14 +1,7 @@ --- title: ExploitGuard Policy CSP description: Learn more about the ExploitGuard Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-federatedauthentication.md b/windows/client-management/mdm/policy-csp-federatedauthentication.md index 18426abce1..4b4de43f51 100644 --- a/windows/client-management/mdm/policy-csp-federatedauthentication.md +++ b/windows/client-management/mdm/policy-csp-federatedauthentication.md @@ -1,14 +1,7 @@ --- title: FederatedAuthentication Policy CSP description: Learn more about the FederatedAuthentication Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/23/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-feeds.md b/windows/client-management/mdm/policy-csp-feeds.md index a8a7ae5f57..98a8e70629 100644 --- a/windows/client-management/mdm/policy-csp-feeds.md +++ b/windows/client-management/mdm/policy-csp-feeds.md @@ -1,15 +1,7 @@ --- title: Policy CSP - Feeds description: Use the Policy CSP - Feeds setting policy specifies whether news and interests is allowed on the device. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft -ms.localizationpriority: medium ms.date: 09/17/2021 -ms.reviewer: -manager: aaroncz --- # Policy CSP - Feeds diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md index 75e9fb777f..fb55df7a5d 100644 --- a/windows/client-management/mdm/policy-csp-fileexplorer.md +++ b/windows/client-management/mdm/policy-csp-fileexplorer.md @@ -1,14 +1,7 @@ --- title: FileExplorer Policy CSP description: Learn more about the FileExplorer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/30/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-filesystem.md b/windows/client-management/mdm/policy-csp-filesystem.md index 57ec3f91e0..f1d4135999 100644 --- a/windows/client-management/mdm/policy-csp-filesystem.md +++ b/windows/client-management/mdm/policy-csp-filesystem.md @@ -1,14 +1,7 @@ --- title: FileSystem Policy CSP description: Learn more about the FileSystem Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/30/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -30,7 +23,7 @@ ms.topic: reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2338] and later
✅ Windows Insider Preview | @@ -86,7 +79,7 @@ A reboot is required for this setting to take effect. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2338] and later
✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/policy-csp-games.md b/windows/client-management/mdm/policy-csp-games.md index 7be1ae616e..d16bea4048 100644 --- a/windows/client-management/mdm/policy-csp-games.md +++ b/windows/client-management/mdm/policy-csp-games.md @@ -1,14 +1,7 @@ --- title: Games Policy CSP description: Learn more about the Games Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md index 941b6ab1ce..6cd40803bd 100644 --- a/windows/client-management/mdm/policy-csp-handwriting.md +++ b/windows/client-management/mdm/policy-csp-handwriting.md @@ -1,14 +1,7 @@ --- title: Handwriting Policy CSP description: Learn more about the Handwriting Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-humanpresence.md b/windows/client-management/mdm/policy-csp-humanpresence.md index 6584e6372b..3ef891ed68 100644 --- a/windows/client-management/mdm/policy-csp-humanpresence.md +++ b/windows/client-management/mdm/policy-csp-humanpresence.md @@ -1,14 +1,7 @@ --- title: HumanPresence Policy CSP description: Learn more about the HumanPresence Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/30/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index d707b4af93..a6efb038f9 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -1,14 +1,7 @@ --- title: InternetExplorer Policy CSP description: Learn more about the InternetExplorer Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/03/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -3666,17 +3659,7 @@ If you disable, or don't configure this policy, all sites are opened using the c - -This policy setting determines whether Internet Explorer 11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows. - -> [!IMPORTANT] -> Some ActiveX controls and toolbars may not be available when 64-bit processes are used. - -- If you enable this policy setting, Internet Explorer 11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows. - -- If you disable this policy setting, Internet Explorer 11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows. - -- If you don't configure this policy setting, users can turn this feature on or off using Internet Explorer settings. This feature is turned off by default. + diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index ed58ffd639..51c1950d55 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -1,14 +1,7 @@ --- title: Kerberos Policy CSP description: Learn more about the Kerberos Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/23/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index 957c1a280e..ab923304b0 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -1,14 +1,7 @@ --- title: KioskBrowser Policy CSP description: Learn more about the KioskBrowser Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-lanmanworkstation.md index 4c0d5e7b6e..b3e44fe44d 100644 --- a/windows/client-management/mdm/policy-csp-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-lanmanworkstation.md @@ -1,14 +1,7 @@ --- title: LanmanWorkstation Policy CSP description: Learn more about the LanmanWorkstation Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md index 27405e9ef7..69f8d74490 100644 --- a/windows/client-management/mdm/policy-csp-licensing.md +++ b/windows/client-management/mdm/policy-csp-licensing.md @@ -1,14 +1,7 @@ --- title: Licensing Policy CSP description: Learn more about the Licensing Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 3edee263b1..8ec2b64666 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -1,14 +1,7 @@ --- title: LocalPoliciesSecurityOptions Policy CSP description: Learn more about the LocalPoliciesSecurityOptions Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -2125,6 +2118,109 @@ Microsoft network server: Server SPN target name validation level This policy se + +## MinimumPasswordLength + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/MinimumPasswordLength +``` + + + + +This security setting determines the least number of characters that a password for a user account may contain. The maximum value for this setting depends on the value of the Relax minimum password length limits setting. If the Relax minimum password length limits setting isn't defined, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and disabled, this setting may be configured from 0 to 14. If the Relax minimum password length limits setting is defined and enabled, this setting may be configured from 0 to 128. Setting the required number of characters to 0 means that no password is required. + +> [!NOTE] +> By default, member computers follow the configuration of their domain controllers. Default values: 7 on domain controllers 0 on stand-alone servers Configuring this setting larger than 14 may affect compatibility with clients, services, and applications. We recommend that you only configure this setting larger than 14 after you use the Minimum password length audit setting to test for potential incompatibilities at the new setting. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-128]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Minimum password length | +| Path | Windows Settings > Security Settings > Account Policies > Password Policy | + + + + + + + + + +## MinimumPasswordLengthAudit + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/MinimumPasswordLengthAudit +``` + + + + +This security setting determines the minimum password length for which password length audit warning events are issued. This setting may be configured from 1 to 128. You should only enable and configure this setting when you try to determine the potential effect of increasing the minimum password length setting in your environment. If this setting isn't defined, audit events won't be issued. If this setting is defined and is less than or equal to the minimum password length setting, audit events won't be issued. If this setting is defined and is greater than the minimum password length setting, and the length of a new account password is less than this setting, an audit event will be issued. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[1-128]` | +| Default Value | 4294967295 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Minimum password length audit | +| Path | Windows Settings > Security Settings > Account Policies > Password Policy | + + + + + + + + ## NetworkAccess_AllowAnonymousSIDOrNameTranslation @@ -3569,6 +3665,64 @@ Recovery console: Allow floppy copy and access to all drives and all folders Ena + +## RelaxMinimumPasswordLengthLimits + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/RelaxMinimumPasswordLengthLimits +``` + + + + +This setting controls whether the minimum password length setting can be increased beyond the legacy limit of 14. If this setting isn't defined, minimum password length may be configured to no more than 14. If this setting is defined and disabled, minimum password length may be configured to no more than 14. If this setting is defined and enabled, minimum password length may be configured more than 14. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Relax minimum password length | +| Path | Windows Settings > Security Settings > Account Policies > Password Policy | + + + + + + + + ## Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn diff --git a/windows/client-management/mdm/policy-csp-localusersandgroups.md b/windows/client-management/mdm/policy-csp-localusersandgroups.md index 1ae1768b2e..7dc4364747 100644 --- a/windows/client-management/mdm/policy-csp-localusersandgroups.md +++ b/windows/client-management/mdm/policy-csp-localusersandgroups.md @@ -1,14 +1,7 @@ --- title: LocalUsersAndGroups Policy CSP description: Learn more about the LocalUsersAndGroups Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index f7afb94964..95f4c33c50 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -1,14 +1,7 @@ --- title: LockDown Policy CSP description: Learn more about the LockDown Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-lsa.md b/windows/client-management/mdm/policy-csp-lsa.md index 3359d00d6a..d4773d4c5d 100644 --- a/windows/client-management/mdm/policy-csp-lsa.md +++ b/windows/client-management/mdm/policy-csp-lsa.md @@ -1,14 +1,7 @@ --- title: LocalSecurityAuthority Policy CSP description: Learn more about the LocalSecurityAuthority Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-maps.md b/windows/client-management/mdm/policy-csp-maps.md index e3a20f4341..7dc52aed91 100644 --- a/windows/client-management/mdm/policy-csp-maps.md +++ b/windows/client-management/mdm/policy-csp-maps.md @@ -1,14 +1,7 @@ --- title: Maps Policy CSP description: Learn more about the Maps Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-memorydump.md b/windows/client-management/mdm/policy-csp-memorydump.md index 5c6eedf729..d6550053a3 100644 --- a/windows/client-management/mdm/policy-csp-memorydump.md +++ b/windows/client-management/mdm/policy-csp-memorydump.md @@ -1,14 +1,7 @@ --- title: MemoryDump Policy CSP description: Learn more about the MemoryDump Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md index f0b04e92b7..30117ff84d 100644 --- a/windows/client-management/mdm/policy-csp-messaging.md +++ b/windows/client-management/mdm/policy-csp-messaging.md @@ -1,14 +1,7 @@ --- title: Messaging Policy CSP description: Learn more about the Messaging Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-mixedreality.md b/windows/client-management/mdm/policy-csp-mixedreality.md index 79b92833b7..e8a936acdc 100644 --- a/windows/client-management/mdm/policy-csp-mixedreality.md +++ b/windows/client-management/mdm/policy-csp-mixedreality.md @@ -1,14 +1,7 @@ --- title: MixedReality Policy CSP description: Learn more about the MixedReality Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/29/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-mssecurityguide.md b/windows/client-management/mdm/policy-csp-mssecurityguide.md index 9d94c49836..b6562fb871 100644 --- a/windows/client-management/mdm/policy-csp-mssecurityguide.md +++ b/windows/client-management/mdm/policy-csp-mssecurityguide.md @@ -1,14 +1,7 @@ --- title: MSSecurityGuide Policy CSP description: Learn more about the MSSecurityGuide Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md index a34a41ff94..6e60b0d9dd 100644 --- a/windows/client-management/mdm/policy-csp-msslegacy.md +++ b/windows/client-management/mdm/policy-csp-msslegacy.md @@ -1,14 +1,7 @@ --- title: MSSLegacy Policy CSP description: Learn more about the MSSLegacy Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-multitasking.md b/windows/client-management/mdm/policy-csp-multitasking.md index c12b74e90f..84df0472de 100644 --- a/windows/client-management/mdm/policy-csp-multitasking.md +++ b/windows/client-management/mdm/policy-csp-multitasking.md @@ -1,14 +1,7 @@ --- title: Multitasking Policy CSP description: Learn more about the Multitasking Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/30/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md index dd7b76de61..14633df6c8 100644 --- a/windows/client-management/mdm/policy-csp-networkisolation.md +++ b/windows/client-management/mdm/policy-csp-networkisolation.md @@ -1,14 +1,7 @@ --- title: NetworkIsolation Policy CSP description: Learn more about the NetworkIsolation Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md index ecc77167b9..9741bc0df7 100644 --- a/windows/client-management/mdm/policy-csp-networklistmanager.md +++ b/windows/client-management/mdm/policy-csp-networklistmanager.md @@ -1,14 +1,7 @@ --- title: NetworkListManager Policy CSP description: Learn more about the NetworkListManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -20,6 +13,153 @@ ms.topic: reference + +## AllNetworks_NetworkIcon + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/NetworkListManager/AllNetworks_NetworkIcon +``` + + + + +This policy setting allows you to specify whether users can change the network icon for all networks to which the user connects. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | User can change icon. | +| 1 | User can't change icon. | + + + + + + + + + +## AllNetworks_NetworkLocation + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/NetworkListManager/AllNetworks_NetworkLocation +``` + + + + +This policy setting allows you to specify whether users can change the network location for all networks to which the user connects. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | User can change location. | +| 1 | User can't change location. | + + + + + + + + + +## AllNetworks_NetworkName + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/NetworkListManager/AllNetworks_NetworkName +``` + + + + +This policy setting allows you to specify whether users can change the network name for all networks to which the user connects. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | User can change name. | +| 1 | User can't change name. | + + + + + + + + ## AllowedTlsAuthenticationEndpoints @@ -114,6 +254,153 @@ This policy setting provides the string that names a network. If this setting is + +## IdentifyingNetworks_LocationType + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/NetworkListManager/IdentifyingNetworks_LocationType +``` + + + + +This policy setting allows you to configure the Network Location for networks that are in a temporary state while Windows works to identify the network and location type. A network location identifies the type of network that a computer is connected to and automatically sets the appropriate firewall settings for that location. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Public. | +| 1 | Private. | + + + + + + + + + +## UnidentifiedNetworks_LocationType + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/NetworkListManager/UnidentifiedNetworks_LocationType +``` + + + + +This policy setting allows you to configure the Network Location type for networks that Windows can't identify due to a network issue or a lack of identifiable characters in the network information received by the operating system from the network. A network location identifies the type of network that a computer is connected to and automatically sets the appropriate firewall settings for that location. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Public. | +| 1 | Private. | + + + + + + + + + +## UnidentifiedNetworks_UserPermissions + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/NetworkListManager/UnidentifiedNetworks_UserPermissions +``` + + + + +This policy setting allows you to configure the Network Location user permissions for networks that Windows can't identify due to a network issue or a lack of identifiable characters in the network information received by the operating system from the network. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | User can change location. | +| 1 | User can't change location. | + + + + + + + + diff --git a/windows/client-management/mdm/policy-csp-newsandinterests.md b/windows/client-management/mdm/policy-csp-newsandinterests.md index c22d8a9bfa..16fabdc822 100644 --- a/windows/client-management/mdm/policy-csp-newsandinterests.md +++ b/windows/client-management/mdm/policy-csp-newsandinterests.md @@ -1,14 +1,7 @@ --- title: NewsAndInterests Policy CSP description: Learn more about the NewsAndInterests Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index 1f7b42377a..65d5cb42bc 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -1,14 +1,7 @@ --- title: Notifications Policy CSP description: Learn more about the Notifications Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/30/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 68c365431c..e1e5083184 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -1,14 +1,7 @@ --- title: Power Policy CSP description: Learn more about the Power Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/24/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index 10b73e98be..e98acdec75 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -1,14 +1,7 @@ --- title: Printers Policy CSP description: Learn more about the Printers Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index f96c5acb6a..5094419e31 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -1,14 +1,7 @@ --- title: Privacy Policy CSP description: Learn more about the Privacy Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/30/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md index fa85c9cec4..1e190204ac 100644 --- a/windows/client-management/mdm/policy-csp-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-remoteassistance.md @@ -1,14 +1,7 @@ --- title: RemoteAssistance Policy CSP description: Learn more about the RemoteAssistance Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-remotedesktop.md b/windows/client-management/mdm/policy-csp-remotedesktop.md index e112f3b6d8..caa589b6f9 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktop.md +++ b/windows/client-management/mdm/policy-csp-remotedesktop.md @@ -1,14 +1,7 @@ --- title: RemoteDesktop Policy CSP description: Learn more about the RemoteDesktop Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md index a2eceff277..2e7833047e 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md +++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md @@ -1,14 +1,7 @@ --- title: RemoteDesktopServices Policy CSP description: Learn more about the RemoteDesktopServices Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -157,6 +150,106 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp + +## DisconnectOnLockBasicAuthn + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/RemoteDesktopServices/DisconnectOnLockBasicAuthn +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | TS_DISCONNECT_ON_LOCK_POLICY | +| ADMX File Name | terminalserver.admx | + + + + + + + + + +## DisconnectOnLockWebAccountAuthn + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/RemoteDesktopServices/DisconnectOnLockWebAccountAuthn +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | + + + + +[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | TS_DISCONNECT_ON_LOCK_AAD_POLICY | +| ADMX File Name | terminalserver.admx | + + + + + + + + ## DoNotAllowDriveRedirection diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md index 1a0bbae405..0f19f54970 100644 --- a/windows/client-management/mdm/policy-csp-remotemanagement.md +++ b/windows/client-management/mdm/policy-csp-remotemanagement.md @@ -1,14 +1,7 @@ --- title: RemoteManagement Policy CSP description: Learn more about the RemoteManagement Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md index c939be5ef0..1def7d700f 100644 --- a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md +++ b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md @@ -1,14 +1,7 @@ --- title: RemoteProcedureCall Policy CSP description: Learn more about the RemoteProcedureCall Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md index 95deedc15b..e7c0d076a7 100644 --- a/windows/client-management/mdm/policy-csp-remoteshell.md +++ b/windows/client-management/mdm/policy-csp-remoteshell.md @@ -1,14 +1,7 @@ --- title: RemoteShell Policy CSP description: Learn more about the RemoteShell Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 83c65f6386..6c8af25f6a 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -1,14 +1,7 @@ --- title: RestrictedGroups Policy CSP description: Learn more about the RestrictedGroups Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 624d6566b7..f981a81cc0 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -1,14 +1,7 @@ --- title: Search Policy CSP description: Learn more about the Search Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/24/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index ef1082ff7d..b1093ffddc 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -1,14 +1,7 @@ --- title: Security Policy CSP description: Learn more about the Security Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index 73dbb1343a..46c10a8e9a 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -1,14 +1,7 @@ --- title: ServiceControlManager Policy CSP description: Learn more about the ServiceControlManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index 9f5437e695..eeb0d6f1ba 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -1,14 +1,7 @@ --- title: Settings Policy CSP description: Learn more about the Settings Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-settingssync.md b/windows/client-management/mdm/policy-csp-settingssync.md index 954bbaeaf2..39e032a8b4 100644 --- a/windows/client-management/mdm/policy-csp-settingssync.md +++ b/windows/client-management/mdm/policy-csp-settingssync.md @@ -1,14 +1,7 @@ --- title: SettingsSync Policy CSP description: Learn more about the SettingsSync Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/30/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index a59c0981e8..fce90a0f5b 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -1,14 +1,7 @@ --- title: SmartScreen Policy CSP description: Learn more about the SmartScreen Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index bf6e6f78d4..437f917212 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -1,14 +1,7 @@ --- title: Speech Policy CSP description: Learn more about the Speech Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index 838e2faf41..8ae3504c72 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -1,14 +1,7 @@ --- title: Start Policy CSP description: Learn more about the Start Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 09/25/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-stickers.md b/windows/client-management/mdm/policy-csp-stickers.md index 9f2e6a4f60..34b5c89385 100644 --- a/windows/client-management/mdm/policy-csp-stickers.md +++ b/windows/client-management/mdm/policy-csp-stickers.md @@ -1,14 +1,7 @@ --- title: Stickers Policy CSP description: Learn more about the Stickers Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 3e241acee7..78f789eba8 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -1,14 +1,7 @@ --- title: Storage Policy CSP description: Learn more about the Storage Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 22ff8ce8ea..337e3987e3 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -1,14 +1,7 @@ --- title: System Policy CSP description: Learn more about the System Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index b0e97a7454..b08d9a0c2d 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -1,14 +1,7 @@ --- title: SystemServices Policy CSP description: Learn more about the SystemServices Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-taskmanager.md b/windows/client-management/mdm/policy-csp-taskmanager.md index 9882cd2083..439cfdb8d3 100644 --- a/windows/client-management/mdm/policy-csp-taskmanager.md +++ b/windows/client-management/mdm/policy-csp-taskmanager.md @@ -1,14 +1,7 @@ --- title: TaskManager Policy CSP description: Learn more about the TaskManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md index 61603da719..a847cb3ec9 100644 --- a/windows/client-management/mdm/policy-csp-taskscheduler.md +++ b/windows/client-management/mdm/policy-csp-taskscheduler.md @@ -1,14 +1,7 @@ --- title: TaskScheduler Policy CSP description: Learn more about the TaskScheduler Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md b/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md index 32c6595782..6c9181ab8c 100644 --- a/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md +++ b/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md @@ -1,14 +1,7 @@ --- title: TenantDefinedTelemetry Policy CSP description: Learn more about the TenantDefinedTelemetry Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-tenantrestrictions.md b/windows/client-management/mdm/policy-csp-tenantrestrictions.md index 62451125d8..b0838899b1 100644 --- a/windows/client-management/mdm/policy-csp-tenantrestrictions.md +++ b/windows/client-management/mdm/policy-csp-tenantrestrictions.md @@ -1,14 +1,7 @@ --- title: TenantRestrictions Policy CSP description: Learn more about the TenantRestrictions Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 49037f5600..359c78a5c8 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -1,14 +1,7 @@ --- title: TextInput Policy CSP description: Learn more about the TextInput Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md index 216139ba2a..ec0faa2924 100644 --- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md +++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md @@ -1,14 +1,7 @@ --- title: TimeLanguageSettings Policy CSP description: Learn more about the TimeLanguageSettings Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md index 96e90c4433..4e27dcdaee 100644 --- a/windows/client-management/mdm/policy-csp-troubleshooting.md +++ b/windows/client-management/mdm/policy-csp-troubleshooting.md @@ -1,14 +1,7 @@ --- title: Troubleshooting Policy CSP description: Learn more about the Troubleshooting Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 5232cbd5a3..f4e6909c22 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -1,14 +1,7 @@ --- title: Update Policy CSP description: Learn more about the Update Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index 39a023b122..dc226ea336 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -1,14 +1,7 @@ --- title: UserRights Policy CSP description: Learn more about the UserRights Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md b/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md index 5c2fd4615b..bfea6628c8 100644 --- a/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md +++ b/windows/client-management/mdm/policy-csp-virtualizationbasedtechnology.md @@ -1,14 +1,7 @@ --- title: VirtualizationBasedTechnology Policy CSP description: Learn more about the VirtualizationBasedTechnology Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-webthreatdefense.md b/windows/client-management/mdm/policy-csp-webthreatdefense.md index e415fba8e2..09fbed9c20 100644 --- a/windows/client-management/mdm/policy-csp-webthreatdefense.md +++ b/windows/client-management/mdm/policy-csp-webthreatdefense.md @@ -1,14 +1,7 @@ --- title: WebThreatDefense Policy CSP description: Learn more about the WebThreatDefense Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index 0eb72b28a0..acb1356f98 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -1,14 +1,7 @@ --- title: Wifi Policy CSP description: Learn more about the Wifi Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-windowsai.md b/windows/client-management/mdm/policy-csp-windowsai.md index bf5ad5e22a..ed3cc9b463 100644 --- a/windows/client-management/mdm/policy-csp-windowsai.md +++ b/windows/client-management/mdm/policy-csp-windowsai.md @@ -1,14 +1,7 @@ --- title: WindowsAI Policy CSP description: Learn more about the WindowsAI Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -26,7 +19,7 @@ ms.topic: reference | Scope | Editions | Applicable OS | |:--|:--|:--| -| ❌ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.2360] and later
✅ Windows 11, version 23H2 [10.0.22631] and later | +| ❌ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 22H2 [10.0.19045.3758] and later
✅ Windows 11, version 22H2 [10.0.22621.2361] and later
✅ Windows 11, version 23H2 [10.0.22631] and later | diff --git a/windows/client-management/mdm/policy-csp-windowsautopilot.md b/windows/client-management/mdm/policy-csp-windowsautopilot.md index 6fc277fe8f..1e3b68c37a 100644 --- a/windows/client-management/mdm/policy-csp-windowsautopilot.md +++ b/windows/client-management/mdm/policy-csp-windowsautopilot.md @@ -1,14 +1,7 @@ --- title: WindowsAutopilot Policy CSP description: Learn more about the WindowsAutopilot Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md index 3b1491564f..ae7bafe0cf 100644 --- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -1,14 +1,7 @@ --- title: WindowsConnectionManager Policy CSP description: Learn more about the WindowsConnectionManager Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index 44ed4083ba..bc665f2973 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -1,14 +1,7 @@ --- title: WindowsDefenderSecurityCenter Policy CSP description: Learn more about the WindowsDefenderSecurityCenter Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index a2608dd9a9..c84c0bded7 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -1,14 +1,7 @@ --- title: WindowsInkWorkspace Policy CSP description: Learn more about the WindowsInkWorkspace Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index 7f43647495..0c07ef2d66 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -1,14 +1,7 @@ --- title: WindowsLogon Policy CSP description: Learn more about the WindowsLogon Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/24/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md index 2a3b6be557..9e4a87efb2 100644 --- a/windows/client-management/mdm/policy-csp-windowspowershell.md +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -1,14 +1,7 @@ --- title: WindowsPowerShell Policy CSP description: Learn more about the WindowsPowerShell Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-windowssandbox.md b/windows/client-management/mdm/policy-csp-windowssandbox.md index be6709c49c..ffa94e847a 100644 --- a/windows/client-management/mdm/policy-csp-windowssandbox.md +++ b/windows/client-management/mdm/policy-csp-windowssandbox.md @@ -1,14 +1,7 @@ --- title: WindowsSandbox Policy CSP description: Learn more about the WindowsSandbox Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 11/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index 2d101d6563..70e8e67fba 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -1,14 +1,7 @@ --- title: WirelessDisplay Policy CSP description: Learn more about the WirelessDisplay Area in Policy CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/printerprovisioning-csp.md b/windows/client-management/mdm/printerprovisioning-csp.md index bea685738c..a80ace3abb 100644 --- a/windows/client-management/mdm/printerprovisioning-csp.md +++ b/windows/client-management/mdm/printerprovisioning-csp.md @@ -1,14 +1,7 @@ --- title: PrinterProvisioning CSP description: Learn more about the PrinterProvisioning CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/printerprovisioning-ddf-file.md b/windows/client-management/mdm/printerprovisioning-ddf-file.md index d7306bda75..3c4a974d93 100644 --- a/windows/client-management/mdm/printerprovisioning-ddf-file.md +++ b/windows/client-management/mdm/printerprovisioning-ddf-file.md @@ -1,14 +1,7 @@ --- title: PrinterProvisioning DDF file description: View the XML file containing the device description framework (DDF) for the PrinterProvisioning configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the P 10.0.22000, 10.0.19044.1806, 10.0.19043.1806, 10.0.19042.1806 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/provisioning-csp.md b/windows/client-management/mdm/provisioning-csp.md index 11e636ca48..62d027c686 100644 --- a/windows/client-management/mdm/provisioning-csp.md +++ b/windows/client-management/mdm/provisioning-csp.md @@ -1,13 +1,6 @@ --- title: Provisioning CSP description: The Provisioning configuration service provider is used for bulk user enrollment to an MDM service. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/pxlogical-csp.md b/windows/client-management/mdm/pxlogical-csp.md index bfc6a262c4..b452264fde 100644 --- a/windows/client-management/mdm/pxlogical-csp.md +++ b/windows/client-management/mdm/pxlogical-csp.md @@ -1,13 +1,6 @@ --- title: PXLOGICAL configuration service provider description: The PXLOGICAL configuration service provider is used to add, remove, or modify WAP logical and physical proxies by using WAP or the standard Windows techniques. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md index f289a7e154..b095998bbd 100644 --- a/windows/client-management/mdm/reboot-csp.md +++ b/windows/client-management/mdm/reboot-csp.md @@ -1,14 +1,7 @@ --- title: Reboot CSP description: Learn more about the Reboot CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/reboot-ddf-file.md b/windows/client-management/mdm/reboot-ddf-file.md index c7de504eb0..3b86f5316c 100644 --- a/windows/client-management/mdm/reboot-ddf-file.md +++ b/windows/client-management/mdm/reboot-ddf-file.md @@ -1,14 +1,7 @@ --- title: Reboot DDF file description: View the XML file containing the device description framework (DDF) for the Reboot configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the R 10.0.14393 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/remotefind-csp.md b/windows/client-management/mdm/remotefind-csp.md index 2b3973921d..2acb98e912 100644 --- a/windows/client-management/mdm/remotefind-csp.md +++ b/windows/client-management/mdm/remotefind-csp.md @@ -1,13 +1,6 @@ --- title: RemoteFind CSP description: The RemoteFind configuration service provider retrieves the location information for a particular device. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/remotefind-ddf-file.md b/windows/client-management/mdm/remotefind-ddf-file.md index e805197cf2..572d1cbf9e 100644 --- a/windows/client-management/mdm/remotefind-ddf-file.md +++ b/windows/client-management/mdm/remotefind-ddf-file.md @@ -1,13 +1,6 @@ --- title: RemoteFind DDF file description: This topic shows the OMA DM device description framework (DDF) for the RemoteFind configuration service provider. DDF files are used only with OMA DM provisioning XML. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/remotering-csp.md b/windows/client-management/mdm/remotering-csp.md index 16c44fd50b..12526066f9 100644 --- a/windows/client-management/mdm/remotering-csp.md +++ b/windows/client-management/mdm/remotering-csp.md @@ -1,13 +1,6 @@ --- title: RemoteRing CSP description: The RemoteRing CSP can be used to remotely trigger a device to produce an audible ringing sound regardless of the volume that's set on the device. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: article -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- @@ -17,29 +10,27 @@ ms.date: 06/26/2017 You can use the RemoteRing configuration service provider to remotely trigger a device to produce an audible ringing sound, regardless of the volume that is set on the device. The following DDF format shows the RemoteRing configuration service provider in tree format. + ``` ./User/Vendor/MSFT RemoteRing ----Ring - ./Device/Vendor/MSFT Root - ./User/Vendor/MSFT ./Device/Vendor/MSFT RemoteRing ----Ring ``` -**Ring** -Required. The node accepts requests to ring the device. -The supported operation is Exec. +## Ring + +Required. The node accepts requests to ring the device. The supported operation is Exec. ## Examples - The following sample shows how to initiate a remote ring on the device. ```xml @@ -52,13 +43,3 @@ The following sample shows how to initiate a remote ring on the device. ``` - -  - -  - - - - - - diff --git a/windows/client-management/mdm/remotewipe-csp.md b/windows/client-management/mdm/remotewipe-csp.md index d0ae5d1f19..1c0afff55f 100644 --- a/windows/client-management/mdm/remotewipe-csp.md +++ b/windows/client-management/mdm/remotewipe-csp.md @@ -1,14 +1,7 @@ --- title: RemoteWipe CSP description: Learn more about the RemoteWipe CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/remotewipe-ddf-file.md b/windows/client-management/mdm/remotewipe-ddf-file.md index 1bc56998aa..6ec9d27e89 100644 --- a/windows/client-management/mdm/remotewipe-ddf-file.md +++ b/windows/client-management/mdm/remotewipe-ddf-file.md @@ -1,14 +1,7 @@ --- title: RemoteWipe DDF file description: View the XML file containing the device description framework (DDF) for the RemoteWipe configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 02/17/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/reporting-csp.md b/windows/client-management/mdm/reporting-csp.md index a6ff79d5e1..b8b1422494 100644 --- a/windows/client-management/mdm/reporting-csp.md +++ b/windows/client-management/mdm/reporting-csp.md @@ -1,13 +1,6 @@ --- title: Reporting CSP description: The Reporting configuration service provider is used to retrieve Windows Information Protection (formerly known as Enterprise Data Protection) and security auditing logs. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/reporting-ddf-file.md b/windows/client-management/mdm/reporting-ddf-file.md index 71c1e4a728..b04625ed11 100644 --- a/windows/client-management/mdm/reporting-ddf-file.md +++ b/windows/client-management/mdm/reporting-ddf-file.md @@ -1,13 +1,6 @@ --- title: Reporting DDF file description: View the OMA DM device description framework (DDF) for the Reporting configuration service provider. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/rootcacertificates-csp.md b/windows/client-management/mdm/rootcacertificates-csp.md index 67664ef793..6445586c10 100644 --- a/windows/client-management/mdm/rootcacertificates-csp.md +++ b/windows/client-management/mdm/rootcacertificates-csp.md @@ -1,14 +1,7 @@ --- title: RootCATrustedCertificates CSP description: Learn more about the RootCATrustedCertificates CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md index bf1c7db754..d5a746496d 100644 --- a/windows/client-management/mdm/rootcacertificates-ddf-file.md +++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md @@ -1,14 +1,7 @@ --- title: RootCATrustedCertificates DDF file description: View the XML file containing the device description framework (DDF) for the RootCATrustedCertificates configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the R 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -1074,7 +1067,7 @@ The following XML file contains the device description framework (DDF) for the R 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/secureassessment-csp.md b/windows/client-management/mdm/secureassessment-csp.md index 1ccd2b55b5..172e2ef819 100644 --- a/windows/client-management/mdm/secureassessment-csp.md +++ b/windows/client-management/mdm/secureassessment-csp.md @@ -1,14 +1,7 @@ --- title: SecureAssessment CSP description: Learn more about the SecureAssessment CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 10/23/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/secureassessment-ddf-file.md b/windows/client-management/mdm/secureassessment-ddf-file.md index b7e824c5f7..ef8d526873 100644 --- a/windows/client-management/mdm/secureassessment-ddf-file.md +++ b/windows/client-management/mdm/secureassessment-ddf-file.md @@ -1,14 +1,7 @@ --- title: SecureAssessment DDF file description: View the XML file containing the device description framework (DDF) for the SecureAssessment configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 07/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the S 10.0.15063 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/securitypolicy-csp.md b/windows/client-management/mdm/securitypolicy-csp.md index 49390c0ef7..c35bb9bfe7 100644 --- a/windows/client-management/mdm/securitypolicy-csp.md +++ b/windows/client-management/mdm/securitypolicy-csp.md @@ -1,13 +1,6 @@ --- title: SecurityPolicy CSP description: The SecurityPolicy CSP is used to configure security policy settings for WAP push, OMA DM, Service Indication (SI), Service Loading (SL), and MMS. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/sharedpc-csp.md b/windows/client-management/mdm/sharedpc-csp.md index f2446290ae..bdff7ac7bd 100644 --- a/windows/client-management/mdm/sharedpc-csp.md +++ b/windows/client-management/mdm/sharedpc-csp.md @@ -1,14 +1,7 @@ --- title: SharedPC CSP description: Learn more about the SharedPC CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/sharedpc-ddf-file.md b/windows/client-management/mdm/sharedpc-ddf-file.md index d04d885895..fd1f225e74 100644 --- a/windows/client-management/mdm/sharedpc-ddf-file.md +++ b/windows/client-management/mdm/sharedpc-ddf-file.md @@ -1,14 +1,7 @@ --- title: SharedPC DDF file description: View the XML file containing the device description framework (DDF) for the SharedPC configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the S 10.0.14393 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/storage-csp.md b/windows/client-management/mdm/storage-csp.md index 7593043812..3319247b9f 100644 --- a/windows/client-management/mdm/storage-csp.md +++ b/windows/client-management/mdm/storage-csp.md @@ -1,13 +1,6 @@ --- title: Storage CSP description: Learn how the Storage enterprise configuration service provider (CSP) is used to configure the storage card settings. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/storage-ddf-file.md b/windows/client-management/mdm/storage-ddf-file.md index 9b582019e9..e0797e83a5 100644 --- a/windows/client-management/mdm/storage-ddf-file.md +++ b/windows/client-management/mdm/storage-ddf-file.md @@ -1,13 +1,6 @@ --- title: Storage DDF file description: Learn about the OMA DM device description framework (DDF) for the Storage configuration service provider (CSP). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md index 90fb91e0bd..3793140f08 100644 --- a/windows/client-management/mdm/supl-csp.md +++ b/windows/client-management/mdm/supl-csp.md @@ -1,14 +1,7 @@ --- title: SUPL CSP description: Learn more about the SUPL CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index 6bb8f708d1..e489dea63b 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -1,14 +1,7 @@ --- title: SUPL DDF file description: View the XML file containing the device description framework (DDF) for the SUPL configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -49,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the S 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index 4c9892dc4c..553037a410 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -1,14 +1,7 @@ --- title: SurfaceHub CSP description: Learn more about the SurfaceHub CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/surfacehub-ddf-file.md b/windows/client-management/mdm/surfacehub-ddf-file.md index 2519ecf5d4..4bfee13fce 100644 --- a/windows/client-management/mdm/surfacehub-ddf-file.md +++ b/windows/client-management/mdm/surfacehub-ddf-file.md @@ -1,14 +1,7 @@ --- title: SurfaceHub DDF file description: View the XML file containing the device description framework (DDF) for the SurfaceHub configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/tenantlockdown-csp.md b/windows/client-management/mdm/tenantlockdown-csp.md index 97551d7680..f9abc97d80 100644 --- a/windows/client-management/mdm/tenantlockdown-csp.md +++ b/windows/client-management/mdm/tenantlockdown-csp.md @@ -1,14 +1,7 @@ --- title: TenantLockdown CSP description: To lock a device to a tenant to prevent accidental or intentional resets or wipes, use the TenantLockdown configuration service provider. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 08/13/2018 -ms.reviewer: -manager: aaroncz --- # TenantLockdown CSP diff --git a/windows/client-management/mdm/tenantlockdown-ddf.md b/windows/client-management/mdm/tenantlockdown-ddf.md index 3aa78e83a1..05bf7451c6 100644 --- a/windows/client-management/mdm/tenantlockdown-ddf.md +++ b/windows/client-management/mdm/tenantlockdown-ddf.md @@ -1,14 +1,7 @@ --- title: TenantLockdown DDF file description: XML file containing the device description framework for the TenantLockdown configuration service provider (CSP). -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 08/13/2018 -ms.reviewer: -manager: aaroncz --- # TenantLockdown DDF file diff --git a/windows/client-management/mdm/tpmpolicy-csp.md b/windows/client-management/mdm/tpmpolicy-csp.md index 5486abb6d0..299b1077a8 100644 --- a/windows/client-management/mdm/tpmpolicy-csp.md +++ b/windows/client-management/mdm/tpmpolicy-csp.md @@ -1,14 +1,7 @@ --- title: TPMPolicy CSP description: The TPMPolicy configuration service provider (CSP) provides a mechanism to enable zero-exhaust configuration on a Windows device for TPM software components. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 11/01/2017 -ms.reviewer: -manager: aaroncz --- # TPMPolicy CSP diff --git a/windows/client-management/mdm/tpmpolicy-ddf-file.md b/windows/client-management/mdm/tpmpolicy-ddf-file.md index 2987a036eb..ae8d4f38f6 100644 --- a/windows/client-management/mdm/tpmpolicy-ddf-file.md +++ b/windows/client-management/mdm/tpmpolicy-ddf-file.md @@ -1,14 +1,7 @@ --- title: TPMPolicy DDF file description: Learn about the OMA DM device description framework (DDF) for the TPMPolicy configuration service provider (CSP). -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 -ms.reviewer: -manager: aaroncz --- # TPMPolicy DDF file diff --git a/windows/client-management/mdm/uefi-csp.md b/windows/client-management/mdm/uefi-csp.md index a818eb9880..e3e130ee43 100644 --- a/windows/client-management/mdm/uefi-csp.md +++ b/windows/client-management/mdm/uefi-csp.md @@ -1,14 +1,7 @@ --- title: UEFI CSP description: The Uefi CSP interfaces to UEFI's Device Firmware Configuration Interface (DFCI) to make BIOS configuration changes. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 10/02/2018 -ms.reviewer: -manager: aaroncz --- # UEFI CSP diff --git a/windows/client-management/mdm/uefi-ddf.md b/windows/client-management/mdm/uefi-ddf.md index dde7789737..3ce949f7c8 100644 --- a/windows/client-management/mdm/uefi-ddf.md +++ b/windows/client-management/mdm/uefi-ddf.md @@ -1,14 +1,7 @@ --- title: UEFI DDF file description: Learn about the OMA DM device description framework (DDF) for the Uefi configuration service provider (CSP). -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 10/02/2018 -ms.reviewer: -manager: aaroncz --- # UEFI DDF file diff --git a/windows/client-management/mdm/unifiedwritefilter-csp.md b/windows/client-management/mdm/unifiedwritefilter-csp.md index b35a740976..1df0f1e524 100644 --- a/windows/client-management/mdm/unifiedwritefilter-csp.md +++ b/windows/client-management/mdm/unifiedwritefilter-csp.md @@ -1,13 +1,6 @@ --- title: UnifiedWriteFilter CSP description: The UnifiedWriteFilter (UWF) configuration service provider allows you to remotely manage the UWF. Understand how it helps protect physical storage media. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/unifiedwritefilter-ddf.md b/windows/client-management/mdm/unifiedwritefilter-ddf.md index ffaf61bb19..3e28dc3252 100644 --- a/windows/client-management/mdm/unifiedwritefilter-ddf.md +++ b/windows/client-management/mdm/unifiedwritefilter-ddf.md @@ -1,13 +1,6 @@ --- title: UnifiedWriteFilter DDF File description: UnifiedWriteFilter DDF File -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/universalprint-csp.md b/windows/client-management/mdm/universalprint-csp.md index cfaae48b05..183576910e 100644 --- a/windows/client-management/mdm/universalprint-csp.md +++ b/windows/client-management/mdm/universalprint-csp.md @@ -1,14 +1,8 @@ --- title: UniversalPrint CSP description: Learn how the UniversalPrint configuration service provider (CSP) is used to install printers on Windows client devices. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/02/2022 ms.reviewer: jimwu -manager: aaroncz --- # UniversalPrint CSP diff --git a/windows/client-management/mdm/universalprint-ddf-file.md b/windows/client-management/mdm/universalprint-ddf-file.md index 3d3fdc2426..e1a1037685 100644 --- a/windows/client-management/mdm/universalprint-ddf-file.md +++ b/windows/client-management/mdm/universalprint-ddf-file.md @@ -1,14 +1,8 @@ --- title: UniversalPrint DDF file description: UniversalPrint DDF file -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/02/2022 ms.reviewer: jimwu -manager: aaroncz --- # UniversalPrint DDF file diff --git a/windows/client-management/mdm/update-csp.md b/windows/client-management/mdm/update-csp.md index e825289b3c..ab540156f2 100644 --- a/windows/client-management/mdm/update-csp.md +++ b/windows/client-management/mdm/update-csp.md @@ -1,13 +1,6 @@ --- title: Update CSP description: Learn how the Update configuration service provider (CSP) enables IT administrators to manage and control the rollout of new updates. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 11/16/2023 --- diff --git a/windows/client-management/mdm/update-ddf-file.md b/windows/client-management/mdm/update-ddf-file.md index a1ba78b157..186bfc4f22 100644 --- a/windows/client-management/mdm/update-ddf-file.md +++ b/windows/client-management/mdm/update-ddf-file.md @@ -1,13 +1,6 @@ --- title: Update DDF file description: Learn about the OMA DM device description framework (DDF) for the Update configuration service provider (CSP). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 02/23/2018 --- diff --git a/windows/client-management/mdm/vpn-csp.md b/windows/client-management/mdm/vpn-csp.md index 4f43fb1e32..da946f07ea 100644 --- a/windows/client-management/mdm/vpn-csp.md +++ b/windows/client-management/mdm/vpn-csp.md @@ -1,13 +1,6 @@ --- title: VPN CSP description: Learn how the VPN configuration service provider (CSP) allows the mobile device management (MDM) server to configure the VPN profile of the device. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 04/02/2017 --- diff --git a/windows/client-management/mdm/vpn-ddf-file.md b/windows/client-management/mdm/vpn-ddf-file.md index f3df5126a9..81e88ca2b9 100644 --- a/windows/client-management/mdm/vpn-ddf-file.md +++ b/windows/client-management/mdm/vpn-ddf-file.md @@ -1,13 +1,6 @@ --- title: VPN DDF file description: Learn about the OMA DM device description framework (DDF) for the VPN configuration service provider (CSP). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md index 3e5e3a5468..58d6463c97 100644 --- a/windows/client-management/mdm/vpnv2-csp.md +++ b/windows/client-management/mdm/vpnv2-csp.md @@ -1,14 +1,7 @@ --- title: VPNv2 CSP description: Learn more about the VPNv2 CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/vpnv2-ddf-file.md b/windows/client-management/mdm/vpnv2-ddf-file.md index 2bb3347699..badf9f29e6 100644 --- a/windows/client-management/mdm/vpnv2-ddf-file.md +++ b/windows/client-management/mdm/vpnv2-ddf-file.md @@ -1,14 +1,7 @@ --- title: VPNv2 DDF file description: View the XML file containing the device description framework (DDF) for the VPNv2 configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the V 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -3272,7 +3265,7 @@ The following XML file contains the device description framework (DDF) for the V 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/w4-application-csp.md b/windows/client-management/mdm/w4-application-csp.md index 6b33ccc664..a84f2bf593 100644 --- a/windows/client-management/mdm/w4-application-csp.md +++ b/windows/client-management/mdm/w4-application-csp.md @@ -1,13 +1,6 @@ --- title: w4 APPLICATION CSP description: Use an APPLICATION configuration service provider (CSP) that has an APPID of w4 to configure Multimedia Messaging Service (MMS). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/w7-application-csp.md b/windows/client-management/mdm/w7-application-csp.md index 0c5e7f4cd5..28acb291e9 100644 --- a/windows/client-management/mdm/w7-application-csp.md +++ b/windows/client-management/mdm/w7-application-csp.md @@ -1,13 +1,6 @@ --- title: w7 APPLICATION CSP description: Learn that the APPLICATION configuration service provider (CSP) that has an APPID of w7 is used for bootstrapping a device with an OMA DM account. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index d7b549f5e8..da583b8cd9 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -1,14 +1,7 @@ --- title: WiFi CSP description: Learn more about the WiFi CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/wifi-ddf-file.md b/windows/client-management/mdm/wifi-ddf-file.md index 269f95f3c7..a0ff37f35e 100644 --- a/windows/client-management/mdm/wifi-ddf-file.md +++ b/windows/client-management/mdm/wifi-ddf-file.md @@ -1,14 +1,7 @@ --- title: WiFi DDF file description: View the XML file containing the device description framework (DDF) for the WiFi configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 07/06/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -329,7 +322,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/win32appinventory-csp.md b/windows/client-management/mdm/win32appinventory-csp.md index d76120673d..0c9cc388d4 100644 --- a/windows/client-management/mdm/win32appinventory-csp.md +++ b/windows/client-management/mdm/win32appinventory-csp.md @@ -1,13 +1,6 @@ --- title: Win32AppInventory CSP description: Learn how the Win32AppInventory configuration service provider (CSP) is used to provide an inventory of installed applications on a device. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/win32appinventory-ddf-file.md b/windows/client-management/mdm/win32appinventory-ddf-file.md index 413f6927a8..c30f6ba4a9 100644 --- a/windows/client-management/mdm/win32appinventory-ddf-file.md +++ b/windows/client-management/mdm/win32appinventory-ddf-file.md @@ -1,13 +1,6 @@ --- title: Win32AppInventory DDF file description: Learn about the OMA DM device description framework (DDF) for the Win32AppInventory configuration service provider (CSP). -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/win32compatibilityappraiser-csp.md b/windows/client-management/mdm/win32compatibilityappraiser-csp.md index 72e4dc7e0d..0e9a1dd3b8 100644 --- a/windows/client-management/mdm/win32compatibilityappraiser-csp.md +++ b/windows/client-management/mdm/win32compatibilityappraiser-csp.md @@ -1,14 +1,7 @@ --- title: Win32CompatibilityAppraiser CSP description: Learn how the Win32CompatibilityAppraiser configuration service provider enables the IT admin to query the current status of the Appraiser and UTC telemetry health. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 07/19/2018 -ms.reviewer: -manager: aaroncz --- # Win32CompatibilityAppraiser CSP diff --git a/windows/client-management/mdm/win32compatibilityappraiser-ddf.md b/windows/client-management/mdm/win32compatibilityappraiser-ddf.md index 2412d86ade..6e1017cd32 100644 --- a/windows/client-management/mdm/win32compatibilityappraiser-ddf.md +++ b/windows/client-management/mdm/win32compatibilityappraiser-ddf.md @@ -1,14 +1,7 @@ --- title: Win32CompatibilityAppraiser DDF file description: Learn about the XML file containing the device description framework for the Win32CompatibilityAppraiser configuration service provider. -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 07/19/2018 -ms.reviewer: -manager: aaroncz --- # Win32CompatibilityAppraiser DDF file diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md index ab6d3cfd03..040365664e 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md @@ -1,13 +1,6 @@ --- title: WindowsAdvancedThreatProtection CSP description: The Windows Defender Advanced Threat Protection (WDATP) CSP allows IT Admins to onboard, determine configuration and health status, and offboard endpoints for WDATP. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 11/01/2017 --- diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md index 1e3460593d..9486c07290 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md @@ -2,13 +2,6 @@ title: WindowsAdvancedThreatProtection DDF file description: Learn about the OMA DM device description framework (DDF) for the WindowsAdvancedThreatProtection configuration service provider (CSP). ms.assetid: 0C62A790-4351-48AF-89FD-7D46C42D13E0 -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 12/05/2017 --- diff --git a/windows/client-management/mdm/windowsautopilot-csp.md b/windows/client-management/mdm/windowsautopilot-csp.md index 7a34b0a995..788144001b 100644 --- a/windows/client-management/mdm/windowsautopilot-csp.md +++ b/windows/client-management/mdm/windowsautopilot-csp.md @@ -1,13 +1,6 @@ --- title: WindowsAutopilot CSP description: Learn how without the ability to mark a device as remediation required, the device will remain in a broken state, which results in security and privacy concerns in Autopilot. -ms.reviewer: -manager: aaroncz -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 05/09/2022 --- diff --git a/windows/client-management/mdm/windowsautopilot-ddf-file.md b/windows/client-management/mdm/windowsautopilot-ddf-file.md index 88313274a6..86b4d615ca 100644 --- a/windows/client-management/mdm/windowsautopilot-ddf-file.md +++ b/windows/client-management/mdm/windowsautopilot-ddf-file.md @@ -1,14 +1,7 @@ --- title: WindowsAutopilot DDF file description: Learn how, without the ability to mark a device as remediation required, the device will remain in a broken state for the WindowsAutopilot DDF file configuration service provider (CSP). -ms.author: vinpa -ms.topic: reference -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft ms.date: 02/07/2022 -ms.reviewer: -manager: aaroncz --- # WindowsAutopilot DDF file diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md index 0261c3b007..10546d7713 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md @@ -1,14 +1,7 @@ --- title: WindowsDefenderApplicationGuard CSP description: Learn more about the WindowsDefenderApplicationGuard CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md index fd77cfe61d..bdee83a712 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md @@ -1,14 +1,7 @@ --- title: WindowsDefenderApplicationGuard DDF file description: View the XML file containing the device description framework (DDF) for the WindowsDefenderApplicationGuard configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.16299 1.1 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mdm/windowslicensing-csp.md b/windows/client-management/mdm/windowslicensing-csp.md index 156b999f6d..f880dd265e 100644 --- a/windows/client-management/mdm/windowslicensing-csp.md +++ b/windows/client-management/mdm/windowslicensing-csp.md @@ -1,14 +1,7 @@ --- title: WindowsLicensing CSP description: Learn more about the WindowsLicensing CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/windowslicensing-ddf-file.md b/windows/client-management/mdm/windowslicensing-ddf-file.md index 2fc871423e..2830112994 100644 --- a/windows/client-management/mdm/windowslicensing-ddf-file.md +++ b/windows/client-management/mdm/windowslicensing-ddf-file.md @@ -1,14 +1,7 @@ --- title: WindowsLicensing DDF file description: View the XML file containing the device description framework (DDF) for the WindowsLicensing configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -47,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCD;0xCF; diff --git a/windows/client-management/mdm/wirednetwork-csp.md b/windows/client-management/mdm/wirednetwork-csp.md index a609a45d59..12bac7c750 100644 --- a/windows/client-management/mdm/wirednetwork-csp.md +++ b/windows/client-management/mdm/wirednetwork-csp.md @@ -1,14 +1,7 @@ --- title: WiredNetwork CSP description: Learn more about the WiredNetwork CSP. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 08/10/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- diff --git a/windows/client-management/mdm/wirednetwork-ddf-file.md b/windows/client-management/mdm/wirednetwork-ddf-file.md index bfe5dc35f3..ba3a3845ed 100644 --- a/windows/client-management/mdm/wirednetwork-ddf-file.md +++ b/windows/client-management/mdm/wirednetwork-ddf-file.md @@ -1,14 +1,7 @@ --- title: WiredNetwork DDF file description: View the XML file containing the device description framework (DDF) for the WiredNetwork configuration service provider. -author: vinaypamnani-msft -manager: aaroncz -ms.author: vinpa -ms.date: 06/02/2023 -ms.localizationpriority: medium -ms.prod: windows-client -ms.technology: itpro-manage -ms.topic: reference +ms.date: 01/18/2024 --- @@ -46,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.17763 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; @@ -125,7 +118,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.17763 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; diff --git a/windows/client-management/mobile-device-enrollment.md b/windows/client-management/mobile-device-enrollment.md index c69c1fb951..5d0537216a 100644 --- a/windows/client-management/mobile-device-enrollment.md +++ b/windows/client-management/mobile-device-enrollment.md @@ -1,7 +1,7 @@ --- title: Mobile device enrollment description: Learn how mobile device enrollment verifies that only authenticated and authorized devices are managed by the enterprise. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 ms.collection: - highpri diff --git a/windows/client-management/new-in-windows-mdm-enrollment-management.md b/windows/client-management/new-in-windows-mdm-enrollment-management.md index 4ed6e26aaf..dcfbdeb34b 100644 --- a/windows/client-management/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/new-in-windows-mdm-enrollment-management.md @@ -1,7 +1,7 @@ --- title: What's new in MDM enrollment and management description: Discover what's new and breaking changes in mobile device management (MDM) enrollment and management experience across all Windows devices. -ms.topic: article +ms.topic: conceptual ms.localizationpriority: medium ms.date: 08/10/2023 --- diff --git a/windows/client-management/oma-dm-protocol-support.md b/windows/client-management/oma-dm-protocol-support.md index ad62b88273..3d1ff0619c 100644 --- a/windows/client-management/oma-dm-protocol-support.md +++ b/windows/client-management/oma-dm-protocol-support.md @@ -1,7 +1,7 @@ --- title: OMA DM protocol support description: See how the OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/on-premise-authentication-device-enrollment.md b/windows/client-management/on-premise-authentication-device-enrollment.md index 39e4133d55..0d3a3b1a1d 100644 --- a/windows/client-management/on-premise-authentication-device-enrollment.md +++ b/windows/client-management/on-premise-authentication-device-enrollment.md @@ -1,7 +1,7 @@ --- title: On-premises authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/push-notification-windows-mdm.md b/windows/client-management/push-notification-windows-mdm.md index d449bbfa9f..0ac4310aab 100644 --- a/windows/client-management/push-notification-windows-mdm.md +++ b/windows/client-management/push-notification-windows-mdm.md @@ -1,7 +1,7 @@ --- title: Push notification support for device management description: The DMClient CSP supports the ability to configure push-initiated device management sessions. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/server-requirements-windows-mdm.md b/windows/client-management/server-requirements-windows-mdm.md index e3cafbd896..6b3a303e0a 100644 --- a/windows/client-management/server-requirements-windows-mdm.md +++ b/windows/client-management/server-requirements-windows-mdm.md @@ -1,7 +1,7 @@ --- title: Server requirements for using OMA DM to manage Windows devices description: Learn about the general server requirements for using OMA DM to manage Windows devices, including the supported versions of OMA DM. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/structure-of-oma-dm-provisioning-files.md b/windows/client-management/structure-of-oma-dm-provisioning-files.md index c239b9d0fd..170d213948 100644 --- a/windows/client-management/structure-of-oma-dm-provisioning-files.md +++ b/windows/client-management/structure-of-oma-dm-provisioning-files.md @@ -1,7 +1,7 @@ --- title: Structure of OMA DM provisioning files description: Learn about the structure of OMA DM provisioning files, for example how each message is composed of a header, specified by the SyncHdr element, and a message body. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/understanding-admx-backed-policies.md b/windows/client-management/understanding-admx-backed-policies.md index e7bccddb07..7b80861923 100644 --- a/windows/client-management/understanding-admx-backed-policies.md +++ b/windows/client-management/understanding-admx-backed-policies.md @@ -1,7 +1,7 @@ --- title: Understanding ADMX policies description: You can use ADMX policies for Windows mobile device management (MDM) across Windows devices. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md b/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md index 4c631e20f5..5fc0485080 100644 --- a/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md +++ b/windows/client-management/using-powershell-scripting-with-the-wmi-bridge-provider.md @@ -1,7 +1,7 @@ --- title: Using PowerShell scripting with the WMI Bridge Provider description: This article covers using PowerShell Cmdlet scripts to configure per-user and per-device policy settings, and how to invoke methods through the WMI Bridge Provider. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/win32-and-centennial-app-policy-configuration.md b/windows/client-management/win32-and-centennial-app-policy-configuration.md index 0cab615908..ff1887a640 100644 --- a/windows/client-management/win32-and-centennial-app-policy-configuration.md +++ b/windows/client-management/win32-and-centennial-app-policy-configuration.md @@ -1,7 +1,7 @@ --- title: Win32 and Desktop Bridge app ADMX policy Ingestion description: Ingest ADMX files and set ADMX policies for Win32 and Desktop Bridge apps. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/windows-mdm-enterprise-settings.md b/windows/client-management/windows-mdm-enterprise-settings.md index e3503a278f..03c28bfba7 100644 --- a/windows/client-management/windows-mdm-enterprise-settings.md +++ b/windows/client-management/windows-mdm-enterprise-settings.md @@ -1,7 +1,7 @@ --- title: Enterprise settings and policy management description: The DM client manages the interaction between a device and a server. Learn more about the client-server management workflow. -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/client-management/wmi-providers-supported-in-windows.md b/windows/client-management/wmi-providers-supported-in-windows.md index ab34b9d0c7..81c71bd5ba 100644 --- a/windows/client-management/wmi-providers-supported-in-windows.md +++ b/windows/client-management/wmi-providers-supported-in-windows.md @@ -1,7 +1,7 @@ --- title: WMI providers supported in Windows description: Manage settings and applications on devices that subscribe to the Mobile Device Management (MDM) service with Windows Management Infrastructure (WMI). -ms.topic: article +ms.topic: conceptual ms.date: 08/10/2023 --- diff --git a/windows/configuration/images/insider.png b/windows/configuration/images/insider.png new file mode 100644 index 0000000000..dbe00408cb Binary files /dev/null and b/windows/configuration/images/insider.png differ diff --git a/windows/configuration/includes/insider-note.md b/windows/configuration/includes/insider-note.md new file mode 100644 index 0000000000..a1160f8047 --- /dev/null +++ b/windows/configuration/includes/insider-note.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.topic: include +ms.date: 01/11/2024 +--- + +:::row::: +:::column span="1"::: +:::image type="content" source="../images/insider.png" alt-text="Logo of Windows Insider." border="false"::: +:::column-end::: +:::column span="3"::: +> [!IMPORTANT] +>This article describes features or settings that are under development and only applicable to [Windows Insider Preview builds](/windows-insider/). The content is subject to change and may have dependencies on other features or services in preview. +:::column-end::: +:::row-end::: diff --git a/windows/configuration/index.yml b/windows/configuration/index.yml index 6eff88270a..4bcaa16c51 100644 --- a/windows/configuration/index.yml +++ b/windows/configuration/index.yml @@ -1,7 +1,7 @@ ### YamlMime:Landing title: Configure Windows client # < 60 chars -summary: Find out how to apply custom configurations to Windows client devices. Windows provides many features and methods to help you configure or lock down specific parts of Windows client. # < 160 chars +summary: Find out how to apply custom configurations to Windows client devices. # < 160 chars metadata: title: Configure Windows client # Required; page title displayed in search results. Include the brand. < 60 chars. @@ -13,7 +13,7 @@ metadata: author: aczechowski ms.author: aaroncz manager: aaroncz - ms.date: 08/05/2021 #Required; mm/dd/yyyy format. + ms.date: 12/20/2023 localization_priority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new @@ -22,52 +22,62 @@ landingContent: # Cards and links should be based on top customer tasks or top subjects # Start card title with a verb # Card (optional) - - title: Manage Windows client settings + - title: Customize the appearance linkLists: - - linkListType: overview + - linkListType: how-to-guide links: - - text: Manage the Windows 10 Start and taskbar layout - url: windows-10-start-layout-options-and-policies.md + - text: Customize the Windows 11 Start menu layout + url: customize-start-menu-layout-windows-11.md + - text: Customize the Windows 11 taskbar + url: customize-taskbar-windows-11.md - text: Configure Windows Spotlight on the lock screen url: windows-spotlight.md - - text: Customize the Windows 10 Start and taskbar with Group Policy - url: customize-windows-10-start-screens-by-using-group-policy.md + - text: Accessibility information for IT pros + url: windows-accessibility-for-itpros.md # Card (optional) - title: Configure a Windows kiosk linkLists: - - linkListType: overview + - linkListType: how-to-guide links: - - text: Guidelines for choosing an app for assigned access - url: guidelines-for-assigned-access-app.md + - text: Configure kiosks and digital signs + url: kiosk-methods.md - text: Set up a single-app kiosk url: kiosk-single-app.md - - text: Set up a multi-app kiosk - url: lock-down-windows-10-to-specific-apps.md + - text: Set up a multi-app kiosk for Windows 11 + url: lock-down-windows-11-to-specific-apps.md + - text: Manage multi-user and guest devices + url: shared-devices-concepts.md # Card (optional) - - title: Windows client provisioning packages + - title: Use provisioning packages linkLists: - - linkListType: overview + - linkListType: how-to-guide links: + - text: Provisioning packages for Windows + url: provisioning-packages/provisioning-packages.md - text: Install Windows Configuration Designer url: provisioning-packages/provisioning-install-icd.md - - text: Provisioning packages for Windows 10 - url: provisioning-packages/provisioning-packages.md + - text: Create a provisioning package + url: provisioning-packages/provisioning-create-package.md + - text: Apply a provisioning package + url: provisioning-packages/provisioning-apply-package.md # Card (optional) - title: Use Windows Configuration Designer (WCD) linkLists: - - linkListType: overview + - linkListType: reference links: - text: Windows Configuration Designer (WCD) reference url: wcd/wcd.md - - text: WCD policies reference + - text: Policies url: wcd/wcd-policies.md - - text: WCD OOBE reference - url: wcd/wcd-oobe.md + - text: ProvisioningCommands + url: wcd/wcd-provisioningcommands.md + - text: Accounts + url: wcd/wcd-accounts.md # Card (optional) - title: Configure Cortana in Windows client diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 06776b853a..04415dfdb1 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -335,8 +335,8 @@ items: - name: Resolve upgrade errors items: - - name: Resolve Windows client upgrade errors - href: upgrade/resolve-windows-10-upgrade-errors.md + - name: Resolve Windows upgrade errors + href: upgrade/resolve-windows-upgrade-errors.md - name: Quick fixes href: /troubleshoot/windows-client/deployment/windows-10-upgrade-quick-fixes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: SetupDiag diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index d42a253d04..56049c5ea9 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -11,7 +11,7 @@ ms.topic: conceptual ms.collection: - highpri - tier2 -ms.date: 11/17/2023 +ms.date: 01/18/2024 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -21,7 +21,7 @@ appliesto: This article provides an overview of new solutions and online content related to deploying Windows client in your organization. -- For an all-up overview of new features in Windows 10, see [What's new in Windows 10](/windows/whats-new/index). +- For an all-up overview of new features in Windows, see [What's new in Windows](/windows/whats-new/). ## [Preview] Windows Autopilot diagnostics page @@ -88,9 +88,9 @@ The following Delivery Optimization policies are removed in the Windows 10, vers - **Intune console updates**: target version is now available allowing you to specify which supported version of Windows you want devices to move to. Additionally, this capability enables you to keep devices on their current version until they reach end of service. Check it out in Intune, also available as a Group Policy and Configuration Service Provider (CSP) policy. -- **Validation improvements**: To ensure devices and end users stay productive and protected, Microsoft blocks devices from updating when there are known issues that would impact that device. Also, to better enable IT administrators to validate on the latest release, a new policy is available that enables admins to opt devices out of the built-in safeguard holds. +- **Validation improvements**: To ensure devices and end users stay productive and protected, Microsoft blocks devices from updating when there are known issues affect that device. Also, to better enable IT administrators to validate on the latest release, a new policy is available that enables admins to opt devices out of the built-in safeguard holds. -- [**Automatic Restart Sign-on (ARSO)**](/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-): Windows automatically signs in as the user and locks their device in order to complete the update. This automatic sign-on ensures that when the user returns and unlocks the device, the update is completed. +- [**Automatic Restart Sign-on (ARSO)**](/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-): Windows automatically signs in as the user and locks their device in order to complete the update. Automatic sign-on ensures that when the user returns and unlocks the device, the update is completed. - [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There's now a single, common start date for phased deployments (no more SAC-T designation). In addition, there's a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. @@ -106,7 +106,7 @@ The following Delivery Optimization policies are removed in the Windows 10, vers Microsoft previously announced that we're [extending support](https://www.microsoft.com/microsoft-365/blog/2018/09/06/helping-customers-shift-to-a-modern-desktop) for Windows 10 Enterprise and Windows 10 Education editions to 30 months from the version release date. These editions include all past versions and future versions that are targeted for release in September (versions ending in 09, ex: 1809). Future releases that are targeted for release in March (versions ending in 03, ex: 1903) will continue to be supported for 18 months from their release date. All releases of Windows 10 Home, Windows 10 Pro, and Microsoft 365 Apps for enterprise will continue to be supported for 18 months (there's no change for these editions). These support policies are summarized in the following table: -![Support lifecycle.](images/support-cycle.png) +:::image type="content" alt-text="Support lifecycle." source="images/support-cycle.png"::: ## Windows 10 Enterprise upgrade @@ -158,8 +158,8 @@ Input from the community heavily influenced the development of Upgrade Readiness For more information about Upgrade Readiness, see the following articles: -- [Windows Analytics blog](https://aka.ms/blog/WindowsAnalytics/) -- [Manage Windows upgrades with Upgrade Readiness](/mem/configmgr/desktop-analytics/overview) +- [Windows Analytics blog](https://aka.ms/blog/WindowsAnalytics/). +- [Manage Windows upgrades with Upgrade Readiness](/mem/configmgr/desktop-analytics/overview). ### Update Compliance @@ -215,7 +215,7 @@ For more information, see the following guides: ## Troubleshooting guidance -[Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) was published in October of 2016 and continues to be updated with new fixes. The article provides a detailed explanation of the Windows upgrade process and instructions on how to locate, interpret, and resolve specific errors that can be encountered during the upgrade process. +[Resolve Windows upgrade errors](upgrade/resolve-windows-upgrade-errors.md) was published in October of 2016 and continues to be updated with new fixes. The article provides a detailed explanation of the Windows upgrade process and instructions on how to locate, interpret, and resolve specific errors that can be encountered during the upgrade process. ## Related articles diff --git a/windows/deployment/do/TOC.yml b/windows/deployment/do/TOC.yml index 136f9e7998..933c48b4b8 100644 --- a/windows/deployment/do/TOC.yml +++ b/windows/deployment/do/TOC.yml @@ -21,7 +21,7 @@ items: - name: Delivery Optimization reference href: waas-delivery-optimization-reference.md - - name: Delivery Optimization client-service communication + - name: Delivery Optimization workflow, privacy, security, and endpoints href: delivery-optimization-workflow.md - name: Using a proxy with Delivery Optimization href: delivery-optimization-proxy.md diff --git a/windows/deployment/do/delivery-optimization-workflow.md b/windows/deployment/do/delivery-optimization-workflow.md index b5082f4ec4..f793410037 100644 --- a/windows/deployment/do/delivery-optimization-workflow.md +++ b/windows/deployment/do/delivery-optimization-workflow.md @@ -1,6 +1,6 @@ --- -title: Delivery Optimization client-service communication -description: Details of how Delivery Optimization communicates with the server when content is requested to download. +title: Delivery Optimization workflow, privacy, security, and endpoints +description: Details of how Delivery Optimization communicates with the server when content is requested to download including privacy, security, and endpoints. ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual @@ -14,23 +14,31 @@ appliesto: - ✅ Windows 11 - ✅ Windows 10 - ✅ Delivery Optimization -ms.date: 12/31/2017 +ms.date: 01/18/2024 --- -# Delivery Optimization client-service communication explained +# Delivery Optimization workflow, privacy, security, and endpoints -Delivery Optimization is a cloud-managed solution that uses peer-to-peer (P2P) and local caching to deliver software updates and apps to Windows clients across your network. This article describes details of how Delivery Optimization communicates with the server when content is requested to download. -## Download request workflow +Delivery Optimization is a cloud-managed solution that uses peer-to-peer (P2P) and local caching to deliver software updates and apps to Windows clients across your network. This article describes details of how Delivery Optimization communicates with the server when content is requested to download and contains information about privacy, security, and endpoints. -This workflow allows Delivery Optimization to securely and efficiently deliver requested content to the calling device. Delivery Optimization uses content metadata to verify the content and to determine all available locations to pull content from. +## How we help keep your data safe + +Delivery Optimization can't be used to download or send personal content. Delivery Optimization doesn't access personal files or folders, and it doesn't change any files on the device. + +Delivery Optimization downloads the same updates and apps that you would get through [Windows Update](../update/windows-update-security.md), Microsoft Store apps, and other Microsoft updates using the same security measures. To make sure you're getting authentic updates, Delivery Optimization gets information securely from Microsoft to check the authenticity of each part of an update or app that it downloads from other PCs. The authenticity of the downloads is checked again before installing it. + +## Download request workflow + +This workflow allows Delivery Optimization to securely and efficiently deliver requested content to the calling device and explains client-service communication. Delivery Optimization uses content metadata to verify the content and to determine all available locations to pull content from. 1. When a download starts, the Delivery Optimization client attempts to get its content metadata. This content metadata is a hash file containing the SHA-256 block-level hashes of each piece in the file (typically one piece = 1 MB). 2. The authenticity of the content metadata file itself is verified prior to any content being downloaded using a hash that is obtained via an SSL channel from the Delivery Optimization service. The same channel is used to ensure the content is curated and authorized to use peer-to-peer. 3. When Delivery Optimization pulls a certain piece of the hash from another peer, it verifies the hash against the known hash in the content metadata file. 4. If a peer provides an invalid piece, that piece is discarded. When a peer sends multiple bad pieces, it's banned and will no longer be used as a source by the Delivery Optimization client performing the download. -5. If Delivery Optimization is unable to obtain the content metadata file, or if the verification of the hash file itself fails, the download will fall back to "simple mode”. Simple mode will only pull content from the HTTP source and peer-to-peer won't be allowed. +5. If Delivery Optimization is unable to obtain the content metadata file, or if the verification of the hash file itself fails, the download will fall back to simple mode. Simple mode will only pull content from the HTTP source and peer-to-peer won't be allowed. 6. Once downloading is complete, Delivery Optimization uses all retrieved pieces of the content to put the file together. At that point, the Delivery Optimization caller (for example, Windows Update) checks the entire file to verify the signature prior to installing it. + ## Delivery Optimization service endpoint and data information |Endpoint hostname | Port|Name|Description|Data sent from the computer to the endpoint diff --git a/windows/deployment/do/index.yml b/windows/deployment/do/index.yml index c886372c0f..e34d7b6de7 100644 --- a/windows/deployment/do/index.yml +++ b/windows/deployment/do/index.yml @@ -15,7 +15,7 @@ metadata: author: aczechowski ms.author: aaroncz manager: aaroncz - ms.date: 03/07/2022 #Required; mm/dd/yyyy format. + ms.date: 12/22/2023 #Required; mm/dd/yyyy format. localization_priority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new diff --git a/windows/deployment/do/mcc-enterprise-appendix.md b/windows/deployment/do/mcc-enterprise-appendix.md index 1192eaf675..fdcd659ed0 100644 --- a/windows/deployment/do/mcc-enterprise-appendix.md +++ b/windows/deployment/do/mcc-enterprise-appendix.md @@ -15,7 +15,7 @@ appliesto: - ✅ Windows 11 - ✅ Windows 10 - ✅ Microsoft Connected Cache for Enterprise and Education -ms.date: 02/06/2023 +ms.date: 11/07/2023 --- # Appendix @@ -37,10 +37,10 @@ Most customers choose to install their cache node on a Windows Server with a nes ### Installing on VMware -We've seen that Microsoft Connected Cache for Enterprise and Education can be successfully installed on VMware. To do so, there are a couple of additional configurations to be made: +Microsoft Connected Cache for Enterprise and Education can be successfully installed on VMware. To do so, there are a couple of additional configurations to be made. Ensure the VM is turned off before making the following configuration changes: 1. Ensure that you're using ESX. In the VM settings, turn on the option **Expose hardware assisted virtualization to the guest OS**. -1. Using the Hyper-V Manager, create an external switch. For the external switch to have internet connection, ensure **"Allow promiscuous mode"**, **"Allow forged transmits"**, and **"Allow MAC changes"** are all switched to **Yes**. +1. Using the Hyper-V Manager, create an external switch. For the external switch to have internet connection, ensure **"Allow promiscuous mode"** and **"Forged transmits"** are switched to **Yes**. ### Installing on Hyper-V @@ -136,4 +136,4 @@ To verify that the Delivery Optimization client can download content using MCC, - [Install Azure IoT Edge for Linux on Windows](/azure/iot-edge/how-to-provision-single-device-linux-on-windows-symmetric#install-iot-edge) - [PowerShell functions for Azure IoT Edge for Linux on Windows](/azure/iot-edge/reference-iot-edge-for-linux-on-windows-functions) - EFLOW FAQ and Support: [Support · Azure/iotedge-eflow Wiki (github.com)](https://github.com/Azure/iotedge-eflow/wiki/Support#how-can-i-apply-updates-to-eflow) -- [Now ready for Production: Linux IoT Edge Modules on Windows - YouTube](https://www.youtube.com/watch?v=pgqVCg6cxVU&ab_channel=MicrosoftIoTDevelopers) \ No newline at end of file +- [Now ready for Production: Linux IoT Edge Modules on Windows - YouTube](https://www.youtube.com/watch?v=pgqVCg6cxVU&ab_channel=MicrosoftIoTDevelopers) diff --git a/windows/deployment/do/mcc-enterprise-prerequisites.md b/windows/deployment/do/mcc-enterprise-prerequisites.md index 2fa49f91cc..ba0aaef324 100644 --- a/windows/deployment/do/mcc-enterprise-prerequisites.md +++ b/windows/deployment/do/mcc-enterprise-prerequisites.md @@ -13,7 +13,7 @@ appliesto: - ✅ Windows 11 - ✅ Windows 10 - - ✅ Microsoft Connected Cache for Enterprise and Education -ms.date: 05/01/2023 +ms.date: 11/07/2023 --- # Requirements of Microsoft Connected Cache for Enterprise and Education (early preview) @@ -34,8 +34,9 @@ ms.date: 05/01/2023 > Azure VMs are not currently supported. If you'd like to install your cache node on VMWare, see the [Appendix](mcc-enterprise-appendix.md) for a few additional configurations. **EFLOW requires Hyper-V support** - - On Windows client, enable the Hyper-V feature - - On Windows Server, install the Hyper-V role and create a default network switch + - On Windows client, enable the Hyper-V feature. + - On Windows Server, install the Hyper-V role and create a default network switch. + - For additional requirements, see [EFLOW requirements](/azure/iot-edge/iot-edge-for-linux-on-windows#prerequisites). Disk recommendations: - Using an SSD is recommended as cache read speed of SSD is superior to HDD diff --git a/windows/deployment/do/waas-delivery-optimization-monitor.md b/windows/deployment/do/waas-delivery-optimization-monitor.md index 512f9d41b7..147c3cf0e9 100644 --- a/windows/deployment/do/waas-delivery-optimization-monitor.md +++ b/windows/deployment/do/waas-delivery-optimization-monitor.md @@ -46,7 +46,7 @@ For details, see [Windows Update for Business Delivery Optimization Report](/win | TotalBytesDownloaded | The number of bytes from any source downloaded so far | | PercentPeerCaching |The percentage of bytes downloaded from peers versus over HTTP | | BytesFromPeers | Total bytes downloaded from peer devices (sum of bytes downloaded from LAN, Group, and Internet Peers) | -| BytesfromHTTP | Total number of bytes received over HTTP. This metric represents all HTTP sources, which includes BytesFromCacheServer | +| BytesfromHTTP | Total number of bytes received over HTTP. This metric represents all HTTP sources, **which includes BytesFromCacheServer** | | Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but isn't uploading yet); **Caching** (download completed successfully and is ready to upload or uploading); **Paused** (download/upload paused by caller) | | Priority | Priority of the download; values are **foreground** or **background** | | BytesFromCacheServer | Total number of bytes received from cache server (MCC) | diff --git a/windows/deployment/do/waas-delivery-optimization-reference.md b/windows/deployment/do/waas-delivery-optimization-reference.md index 2c3a28d13e..d770f57022 100644 --- a/windows/deployment/do/waas-delivery-optimization-reference.md +++ b/windows/deployment/do/waas-delivery-optimization-reference.md @@ -161,7 +161,7 @@ Starting in Windows 10, version 1803, set this policy to restrict peer selection - 4 = DNS Suffix - 5 = Starting with Windows 10, version 1903, you can use the Microsoft Entra tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. -When set, the Group ID is assigned automatically from the selected source. If you set this policy, the GroupID policy is ignored. The default behavior, when the GroupID or GroupIDSource policies aren't set, is to determine the Group ID using AD Site (1), Authenticated domain SID (2) or Microsoft Entra tenant ID (5), in that order. If GroupIDSource is set to either DHCP Option ID (3) or DNS Suffix (4) and those methods fail, the default behavior is used instead. The option set in this policy only applies to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. If you set the value to anything other than 0-5, the policy is ignored. +When set, the Group ID will be assigned automatically from the selected source. This policy is ignored if the GroupID policy is also set. The default behavior, when the GroupID or GroupIDSource policies aren't set, is to determine the Group ID using AD Site (1), Authenticated domain SID (2) or Microsoft Entra tenant ID (5), in that order. If GroupIDSource is set to either DHCP Option ID (3) or DNS Suffix (4) and those methods fail, the default behavior is used instead. The option set in this policy only applies to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. If you set the value to anything other than 0-5, the policy is ignored. ### Minimum RAM (inclusive) allowed to use Peer Caching @@ -204,7 +204,7 @@ This setting specifies the minimum content file size in MB enabled to use Peer C ### Maximum Download Bandwidth -MDM Setting: **DOMaxUploadBandwidth** +MDM Setting: **DOMaxDownloadBandwidth** Deprecated in Windows 10, version 2004. This setting specifies the maximum download bandwidth that can be used across all concurrent Delivery Optimization downloads in kilobytes per second (KB/s). **A default value of "0"** means that Delivery Optimization dynamically adjusts and optimize the maximum bandwidth used. @@ -259,7 +259,7 @@ Starting in Windows 10, version 1803, set this policy to restrict peer selection If Group mode is set, Delivery Optimization connects to locally discovered peers that are also part of the same Group (have the same Group ID). -The Local Peer Discovery (DNS-SD) option can only be set via MDM delivered policies on Windows 11 builds. This feature can be enabled in supported Windows 10 builds by setting the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DORestrictPeerSelectionBy` value to **2**. +In Windows 11, the Local Peer Discovery (DNS-SD) option can be set via MDM or Group Policy. However, in Windows 10, this feature can be enabled by setting the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DORestrictPeerSelectionBy` value to **2**. ### Delay background download from HTTP (in secs) @@ -335,7 +335,7 @@ The device can download from peers while on battery regardless of this policy. MDM Setting: **DOCacheHost** -Set this policy to designate one or more Microsoft Connected Cache servers to be used by Delivery Optimization. You can set one or more FQDNs or IP Addresses that are comma-separated, for example: myhost.somerandomhost.com,myhost2.somerandomhost.com,10.10.1.7. **By default, this policy has no value.** Delivery Optimization client will connect to the listed Microsoft Connected Cache servers in the order as they are listed. When multiple FQDNs or IP Addresses are listed, the Microsoft Connected Cache server priority order is determined based on the order as they are listed. If the first server fails, it will move the the next one. When the last server fails, it will fallback to the CDN. +Set this policy to designate one or more Microsoft Connected Cache servers to be used by Delivery Optimization. You can set one or more FQDNs or IP Addresses that are comma-separated, for example: myhost.somerandomhost.com,myhost2.somerandomhost.com,10.10.1.7. **By default, this policy has no value.** Delivery Optimization client will connect to the listed Microsoft Connected Cache servers in the order as they are listed. When multiple FQDNs or IP Addresses are listed, the Microsoft Connected Cache server priority order is determined based on the order as they are listed. If the first server fails, it will move the next one. When the last server fails, it will fallback to the CDN. >[!IMPORTANT] > Any value will signify that the policy is set. For example, an empty string ("") isn't considered empty. diff --git a/windows/deployment/images/insider.png b/windows/deployment/images/insider.png new file mode 100644 index 0000000000..dbe00408cb Binary files /dev/null and b/windows/deployment/images/insider.png differ diff --git a/windows/deployment/includes/insider-note.md b/windows/deployment/includes/insider-note.md new file mode 100644 index 0000000000..a1160f8047 --- /dev/null +++ b/windows/deployment/includes/insider-note.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.topic: include +ms.date: 01/11/2024 +--- + +:::row::: +:::column span="1"::: +:::image type="content" source="../images/insider.png" alt-text="Logo of Windows Insider." border="false"::: +:::column-end::: +:::column span="3"::: +> [!IMPORTANT] +>This article describes features or settings that are under development and only applicable to [Windows Insider Preview builds](/windows-insider/). The content is subject to change and may have dependencies on other features or services in preview. +:::column-end::: +:::row-end::: diff --git a/windows/deployment/index.yml b/windows/deployment/index.yml index b72aa8d9ad..1be2c8f637 100644 --- a/windows/deployment/index.yml +++ b/windows/deployment/index.yml @@ -1,104 +1,180 @@ -### YamlMime:Landing +### YamlMime:Hub -title: Windows client deployment resources and documentation # < 60 chars -summary: Learn about deploying and keeping Windows client devices up to date. # < 160 chars +title: Deploy and update Windows # < 60 chars; shows at top of hub page +summary: Learn about deploying and updating Windows client devices in your organization. # < 160 chars metadata: - title: Windows client deployment resources and documentation # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Learn about deploying Windows and keeping it up to date in your organization. # Required; article description that is displayed in search results. < 160 chars. - ms.topic: landing-page - ms.technology: itpro-deploy + title: Windows client deployment documentation # Required; browser tab title displayed in search results. Include the brand. < 60 chars. + description: Learn about deploying and updating Windows client devices in your organization. # Required; article description that is displayed in search results. < 160 chars. + ms.topic: hub-page ms.prod: windows-client + ms.technology: itpro-deploy ms.collection: - highpri - tier1 - author: frankroj - ms.author: frankroj + author: aczechowski + ms.author: aaroncz manager: aaroncz - ms.date: 10/31/2022 + ms.date: 01/18/2024 localization_priority: medium - -# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new -landingContent: -# Cards and links should be based on top customer tasks or top subjects -# Start card title with a verb - # Card (optional) - - title: Plan - linkLists: - - linkListType: overview - links: - - text: Create a deployment plan - url: update/create-deployment-plan.md - - text: Define readiness criteria - url: update/plan-define-readiness.md - - text: Evaluate infrastructure and tools - url: update/eval-infra-tools.md - - text: Define your servicing strategy - url: update/plan-define-strategy.md +# common graphics: https://review.learn.microsoft.com/content-production-service/internal/image-gallery?branch=main - # Card (optional) - - title: Prepare - linkLists: - - linkListType: how-to-guide +productDirectory: + title: Get started + items: + - title: Plan + imageSrc: /media/common/i_overview.svg + links: + - text: Plan for Windows 11 + url: /windows/whats-new/windows-11-plan?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + - text: Create a deployment plan + url: update/create-deployment-plan.md + - text: Define readiness criteria + url: update/plan-define-readiness.md + - text: Define your servicing strategy + url: update/plan-define-strategy.md + - text: Determine application readiness + url: update/plan-determine-app-readiness.md + - text: Plan for volume activation + url: volume-activation/plan-for-volume-activation-client.md + + - title: Prepare + imageSrc: /media/common/i_tasks.svg + links: + - text: Prepare for Windows 11 + url: /windows/whats-new/windows-11-prepare?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + - text: Prepare to deploy Windows updates + url: update/prepare-deploy-windows.md + - text: Prepare updates using Windows Update for Business + url: update/waas-manage-updates-wufb.md + - text: Evaluate and update infrastructure + url: update/update-policies.md + - text: Set up Delivery Optimization for Windows client updates + url: do/waas-delivery-optimization-setup.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + - text: Prepare for imaging with Configuration Manager + url: deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md + + - title: Deploy + imageSrc: /media/common/i_deploy.svg + links: + - text: Deploy Windows with Autopilot + url: /mem/autopilot/tutorial/autopilot-scenarios + - text: Assign devices to servicing channels + url: update/waas-servicing-channels-windows-10-updates.md + - text: Deploy updates with Intune + url: update/deploy-updates-intune.md + - text: Deploy Windows updates with Configuration Manager + url: update/deploy-updates-configmgr.md + - text: Upgrade Windows using Configuration Manager + url: deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager.md + - text: Check release health + url: update/check-release-health.md + +additionalContent: + sections: + - title: Solutions + items: + + - title: Windows Autopilot links: - - text: Prepare to deploy Windows updates - url: update/prepare-deploy-windows.md - - text: Prepare updates using Windows Update for Business + - text: Overview + url: /mem/autopilot/windows-autopilot + - text: Scenarios + url: /mem/autopilot/tutorial/autopilot-scenarios + - text: Device registration + url: /mem/autopilot/registration-overview + - text: Learn more about Windows Autopilot > + url: /mem/autopilot + + - title: Windows Autopatch + links: + - text: What is Windows Autopatch? + url: windows-autopatch/overview/windows-autopatch-overview.md + - text: Frequently asked questions (FAQ) + url: windows-autopatch/overview/windows-autopatch-faq.yml + - text: Prerequisites + url: windows-autopatch/prepare/windows-autopatch-prerequisites.md + - text: Learn more about Windows Autopatch > + url: windows-autopatch/index.yml + + - title: Windows Update for Business + links: + - text: What is Windows Update for Business? url: update/waas-manage-updates-wufb.md - - text: Prepare for Zero Touch Installation of Windows 10 with Configuration Manager - url: deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md - - text: Set up Delivery Optimization for Windows client updates + - text: Windows Update for Business deployment service + url: update/deployment-service-overview.md + - text: Manage Windows Update settings + url: update/waas-wu-settings.md + - text: Windows Update for Business reports overview + url: update/wufb-reports-overview.md + + - title: Optimize and cache content + links: + - text: What is Delivery Optimization? + url: do/waas-delivery-optimization.md + - text: What is Microsoft Connected Cache? + url: do/waas-microsoft-connected-cache.md + - text: Frequently asked questions + url: do/waas-delivery-optimization-faq.yml + - text: Learn more about Delivery Optimization > url: do/index.yml - # Card (optional) - - title: Deploy - linkLists: - - linkListType: deploy + - title: In-place upgrade and imaging links: - - text: Deploy Windows 10 with Autopilot - url: /mem/autopilot - - text: Assign devices to servicing channels - url: update/waas-servicing-channels-windows-10-updates.md - - # Card - - title: Overview - linkLists: - - linkListType: overview - links: - - text: What's new in Windows deployment - url: deploy-whats-new.md - - text: Windows 11 overview - url: /windows/whats-new/windows-11 - - text: Windows client deployment scenarios - url: windows-10-deployment-scenarios.md - - text: Basics of Windows updates, channels, and tools - url: update/get-started-updates-channels-tools.md - - text: Overview of Windows Autopilot - url: /mem/autopilot/windows-autopilot + - text: Upgrade Windows using Configuration Manager + url: deploy-windows-cm/upgrade-to-windows-10-with-configuration-manager.md + - text: Deploy a Windows image using Configuration Manager + url: deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md + - text: Convert a disk from MBR to GPT + url: mbr-to-gpt.md + - text: Resolve Windows upgrade errors + url: upgrade/resolve-windows-upgrade-errors.md - # Card - - title: Support remote work - linkLists: - - linkListType: concept + - title: Licensing and activation links: - - text: Deploy Windows 10 for a remote world - url: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/deploying-a-new-version-of-windows-10-in-a-remote-world/ba-p/1419846 - - text: Empower remote workers with Microsoft 365 - url: /microsoft-365/solutions/empower-people-to-work-remotely - - text: Top 12 tasks for security teams to support working from home - url: /microsoft-365/security/top-security-tasks-for-remote-work - - text: Support your remote workforce - url: /microsoftteams/faq-support-remote-workforce + - text: Plan for volume activation + url: volume-activation/plan-for-volume-activation-client.md + - text: Subscription activation + url: windows-10-subscription-activation.md + - text: Volume activation management tool (VAMT) + url: volume-activation/introduction-vamt.md + - text: Activate using key management service (KMS) + url: volume-activation/activate-using-key-management-service-vamt.md + - text: Windows commercial licensing overview + url: /windows/whats-new/windows-licensing - # Card (optional) - - title: Microsoft Learn training - linkLists: - - linkListType: learn + - title: More resources + items: + + - title: Release and lifecycle links: - - text: Plan to deploy updates for Windows 10 and Microsoft 365 Apps - url: /training/modules/windows-plan - - text: Prepare to deploy updates for Windows 10 and Microsoft 365 Apps - url: /training/modules/windows-prepare/ - - text: Deploy updates for Windows 10 and Microsoft 365 Apps - url: /training/modules/windows-deploy + - text: Windows release health dashboard + url: /windows/release-health + - text: Windows client features lifecycle + url: /windows/whats-new/feature-lifecycle + - text: Lifecycle FAQ - Windows + url: /lifecycle/faq/windows + + - title: Windows hardware + links: + - text: Download and install the Windows ADK + url: /windows-hardware/get-started/adk-install + - text: Deployment tools + url: /windows-hardware/manufacture/desktop/boot-and-install-windows +# - text: +# url: +# - text: +# url: + + - title: Community + links: + - text: Windows IT pro blog + url: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/bg-p/Windows10Blog + - text: Windows office hours + url: https://aka.ms/windows/officehours +# - text: +# url: +# - text: +# url: + diff --git a/windows/deployment/update/includes/wufb-reports-endpoints.md b/windows/deployment/update/includes/wufb-reports-endpoints.md index 388592c36c..88fd5d146e 100644 --- a/windows/deployment/update/includes/wufb-reports-endpoints.md +++ b/windows/deployment/update/includes/wufb-reports-endpoints.md @@ -5,10 +5,11 @@ manager: aaroncz ms.technology: itpro-updates ms.prod: windows-client ms.topic: include -ms.date: 08/21/2023 +ms.date: 12/15/2023 ms.localizationpriority: medium --- - + + Devices must be able to contact the following endpoints in order to authenticate and send diagnostic data: @@ -20,5 +21,5 @@ Devices must be able to contact the following endpoints in order to authenticate | `settings-win.data.microsoft.com` | Used by Windows components and applications to dynamically update their configuration. Required for Windows Update functionality. | | `adl.windows.com` | Required for Windows Update functionality. | | `oca.telemetry.microsoft.com` | Online Crash Analysis, used to provide device-specific recommendations and detailed errors if there are certain crashes. | -| `login.live.com` | This endpoint facilitates your Microsoft account access and is required to create the primary identifier we use for devices. Without this service, devices won't be visible in the solution. The Microsoft Account Sign-in Assistant service must also be running (wlidsvc). | -| `*.blob.core.windows.net` | Azure blob data storage.| \ No newline at end of file +| `login.live.com` | This endpoint facilitates your Microsoft account access and is required to create the primary identifier we use for devices. Without this service, devices aren't visible in the solution. The Microsoft Account Sign-in Assistant service must also be running (wlidsvc). | +| `ceuswatcab01.blob.core.windows.net`
`ceuswatcab02.blob.core.windows.net`
`eaus2watcab01.blob.core.windows.net`
`eaus2watcab02.blob.core.windows.net`
`weus2watcab01.blob.core.windows.net`
`weus2watcab02.blob.core.windows.net` | Azure blob data storage. | diff --git a/windows/deployment/update/waas-branchcache.md b/windows/deployment/update/waas-branchcache.md index 05c5f63d80..7856c98348 100644 --- a/windows/deployment/update/waas-branchcache.md +++ b/windows/deployment/update/waas-branchcache.md @@ -35,7 +35,7 @@ Whether you use BranchCache with Configuration Manager or WSUS, each client that In Windows 10, version 1607, the Windows Update Agent uses Delivery Optimization by default, even when the updates are retrieved from WSUS. When using BranchCache with Windows client, set the Delivery Optimization **Download mode** to '100' (Bypass) to allow clients to use the Background Intelligent Transfer Service (BITS) protocol with BranchCache instead. For instructions on how to use BranchCache in Distributed Cache mode with WSUS, see the section WSUS and Configuration Manager with BranchCache in Distributed Cache mode. > [!Note] -> Setting [Download mode](../do/waas-delivery-optimization-reference.md#download-mode) to '100' (Bypass) is only available in Windows 10, version 1607 and later, not in Windows 11. BranchCache isn't supported for Windows 11. +> [Bypass Download mode (100)](../do/waas-delivery-optimization-reference.md#download-mode) is only available in Windows 10 (starting in version 1607) and deprecated in Windows 11. BranchCache isn't supported for content downloaded using Delivery Optimization in Windows 11. ## Configure servers for BranchCache diff --git a/windows/deployment/update/waas-wufb-csp-mdm.md b/windows/deployment/update/waas-wufb-csp-mdm.md index cc945db4c2..c696ffee5d 100644 --- a/windows/deployment/update/waas-wufb-csp-mdm.md +++ b/windows/deployment/update/waas-wufb-csp-mdm.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium appliesto: - ✅ Windows 11 - ✅ Windows 10 -ms.date: 11/30/2023 +ms.date: 01/18/2024 --- # Walkthrough: Use CSPs and MDMs to configure Windows Update for Business @@ -202,9 +202,9 @@ The features that are turned off by default from servicing updates will be enabl You can enable these features by using [AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol). The following options are available: -- **0** (default): Allowed. All features in the latest monthly cumulative update are enabled. - - When the policy is set to **0**, all features that are currently turned off will turn on when the device next reboots -- **1** - Not allowed. Features that are shipped turned off by default will remain off +- **0** (default): Not allowed. Features that are shipped turned off by default will remain off +- **1**: Allowed. All features in the latest monthly cumulative update are enabled. + - When the policy is set to **1**, all features that are currently turned off will turn on when the device next reboots. #### I want to enable optional updates diff --git a/windows/deployment/update/wufb-reports-configuration-manual.md b/windows/deployment/update/wufb-reports-configuration-manual.md index 3f3c8c7937..7c76c5ad32 100644 --- a/windows/deployment/update/wufb-reports-configuration-manual.md +++ b/windows/deployment/update/wufb-reports-configuration-manual.md @@ -4,7 +4,7 @@ titleSuffix: Windows Update for Business reports description: How to manually configure devices for Windows Update for Business reports using a PowerShell script. ms.prod: windows-client ms.technology: itpro-updates -ms.topic: conceptual +ms.topic: how-to author: mestew ms.author: mstewart manager: aaroncz @@ -12,61 +12,60 @@ ms.localizationpriority: medium appliesto: - ✅ Windows 11 - ✅ Windows 10 -ms.date: 11/15/2022 +ms.date: 12/15/2023 --- -# Manually configuring devices for Windows Update for Business reports +# Manually configure devices for Windows Update for Business reports -There are a number of requirements to consider when manually configuring devices for Windows Update for Business reports. These requirements can potentially change with newer versions of Windows client. The [Windows Update for Business reports configuration script](wufb-reports-configuration-script.md) will be updated when any configuration requirements change so only a redeployment of the script will be required. +There are many requirements to consider when manually configuring devices for Windows Update for Business reports. These requirements can potentially change with later versions of Windows client. When any configuration requirements change, we'll update the [Windows Update for Business reports configuration script](wufb-reports-configuration-script.md). If that happens, you only need to redeploy the script. The requirements are separated into different categories: 1. Ensuring the [**required policies**](#required-policies) for Windows Update for Business reports are correctly configured. 2. Devices in every network topography must send data to the [**required endpoints**](#required-endpoints) for Windows Update for Business reports. For example, devices in both main and satellite offices, which might have different network configurations, must be able to reach the endpoints. -3. Ensure [**Required Windows services**](#required-services) are running or are scheduled to run. It's recommended all Microsoft and Windows services are set to their out-of-box defaults to ensure proper functionality. - +3. Ensure [**Required Windows services**](#required-services) are running or are scheduled to run. For proper functionality, leave Windows services set to their out-of-box default configurations. ## Required policies -Windows Update for Business reports has a number of policies that must be appropriately configured in order for devices to be processed by Microsoft and visible in Windows Update for Business reports. Thee policies are listed below, separated by whether the policies will be configured via [Mobile Device Management](/windows/client-management/mdm/) (MDM) or Group Policy. For both tables: +The Windows Update for Business reports service has several policies that you need to configure appropriately. These policies allow Microsoft to process your devices and show them in Windows Update for Business reports. The policies are listed in the following subsections, separated by [mobile device management](/windows/client-management/mdm/) (MDM) or group policy. -- **Policy** corresponds to the location and name of the policy. -- **Value** Indicates what value the policy must be set to. Windows Update for Business reports requires *at least* Basic (or Required) diagnostic data, but can function off Enhanced or Full (or Optional). -- **Function** details why the policy is required and what function it serves for Windows Update for Business reports. It will also detail a minimum version the policy is required, if any. +The following definitions apply for both tables: -### Mobile Device Management policies +- **Policy**: The location and name of the policy. +- **Value**: Set the policy to this value. Windows Update for Business reports requires at least *Required* (previously *Basic*) diagnostic data, but can function with *Enhanced* or *Optional* (previously *Full*). +- **Function**: Details for why the policy is required and what function it serves for Windows Update for Business reports. It also details a minimum version the policy requires, if any. -Each MDM Policy links to its documentation in the configuration service provider (CSP) hierarchy, providing its exact location in the hierarchy and more details. +### MDM policies -| Policy | Data type | Value | Function | Required or recommended| +Each MDM policy links to more detailed documentation in the configuration service provider (CSP) hierarchy. + +| Policy | Data type | Value | Function | Required or recommended | |---|---|---|---|---| -|**System/**[**AllowTelemetry**](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) |Integer | 1 - Basic |Configures the maximum allowed diagnostic data to be sent to Microsoft. Individual users can still set this value lower than what the policy defines. For more information, see the following policy. | Required | -|**System/**[**ConfigureTelemetryOptInSettingsUx**](/windows/client-management/mdm/policy-csp-system#system-configuretelemetryoptinsettingsux) |Integer |1 - Disable Telemetry opt-in Settings | Determines whether users of the device can adjust diagnostic data to levels lower than the level defined by AllowTelemetry. We recommend that you disable this policy or the effective diagnostic data level on devices might not be sufficient. | Recommended | -|**System/**[**AllowDeviceNameInDiagnosticData**](/windows/client-management/mdm/policy-csp-system#system-allowdevicenameindiagnosticdata) |Integer | 1 - Allowed | Allows device name to be sent for Windows Diagnostic Data. If this policy is Not Configured or set to 0 (Disabled), Device Name won't be sent and won't be visible in Windows Update for Business reports, showing `#` instead. | Recommended | -| **System/**[**ConfigureTelemetryOptInChangeNotification**](/windows/client-management/mdm/policy-csp-system#configuretelemetryoptinchangenotification) | Integer | 1 - Disabled | Disables user notifications that appear for changes to the diagnostic data level. | Recommended | +| **System/**[**AllowTelemetry**](/windows/client-management/mdm/policy-csp-system#allowtelemetry) | Integer | `1`: Basic (Required) | Configures the device to send the minimum required diagnostic data. | Required | +| **System/**[**ConfigureTelemetryOptInSettingsUx**](/windows/client-management/mdm/policy-csp-system#configuretelemetryoptinsettingsux) | Integer | `1`: Disable diagnostic data opt-in settings | Determines whether users of the device can adjust diagnostic data to levels lower than you define by the *AllowTelemetry* policy. Set the recommended value to disable opt-in settings, or users can change the effective diagnostic data level that might not be sufficient. | Recommended | +| **System/**[**AllowDeviceNameInDiagnosticData**](/windows/client-management/mdm/policy-csp-system#allowdevicenameindiagnosticdata) | Integer | `1`: Allowed | Allows the device to send its name with Windows diagnostic data. If you don't configure this policy or set it to `0`: Disabled, then the data doesn't include the device name. If the data doesn't include the device name, you can't see the device in Windows Update for Business reports. In this instance, the reports show `#` instead. | Recommended | +| **System/**[**ConfigureTelemetryOptInChangeNotification**](/windows/client-management/mdm/policy-csp-system#configuretelemetryoptinchangenotification) | Integer | `1`: Disabled | Disables user notifications that appear for changes to the diagnostic data level. | Recommended | ### Group policies -All Group policies that need to be configured for Windows Update for Business reports are under **Computer Configuration>Administrative Templates>Windows Components\Data Collection and Preview Builds**. All of these policies must be in the *Enabled* state and set to the defined *Value* below. +All group policies that you need to configure for Windows Update for Business reports are under the following path: **Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds**. All of these policies must be in the *Enabled* state and set to the defined *Value*. | Policy | Value | Function | Required or recommended| |---|---|---|---| -|**Allow Diagnostic Data** | Send required diagnostic data (minimum) | Configures the maximum allowed diagnostic data to be sent to Microsoft. Individual users can still set this value lower than what the policy defines. For more information, see the **Configure diagnostic data opt-in setting user interface**. | Required | -|**Configure diagnostic data opt-in setting user interface** | Disable diagnostic data opt in settings | Determines whether users of the device can adjust diagnostic data to levels lower than the level defined by AllowTelemetry. We recommend that you disable this policy, otherwise the effective diagnostic data level on devices might not be sufficient. | Recommended | -|**Allow device name to be sent in Windows diagnostic data** | Enabled | Allows device name to be sent for Windows Diagnostic Data. If this policy is Not Configured or Disabled, Device Name won't be sent and won't be visible in Windows Update for Business reports, showing `#` instead. | Recommended | -|**Configure diagnostic data opt-in change notifications** | Disable diagnostic data change notifications | Disables user notifications that appear for changes to the diagnostic data level. | Recommended | +| **Allow Diagnostic Data** | Send required diagnostic data | Configures the device to send the minimum required diagnostic data. | Required | +| **Configure diagnostic data opt-in setting user interface** | Disable diagnostic data opt-in settings | Determines whether users of the device can adjust diagnostic data to levels lower than you define by the *Allow Diagnostic Data* policy. Set the recommended value to disable opt-in settings, or users can change the effective diagnostic data level that might not be sufficient. | Recommended | +| **Allow device name to be sent in Windows diagnostic data** | Enabled | Allows the device to send its name with Windows diagnostic data. If you don't configure this policy or set it to *Disabled*, then the data doesn't include the device name. If the data doesn't include the device name, you can't see the device in Windows Update for Business reports. In this instance, the reports show `#` instead. | Recommended | +| **Configure diagnostic data opt-in change notifications** | Disable diagnostic data change notifications | Disables user notifications that appear for changes to the diagnostic data level. | Recommended | ## Required endpoints -To enable data sharing between devices, your network, and Microsoft's Diagnostic Data Service, configure your proxy to allow devices to contact the below endpoints. - [!INCLUDE [Endpoints for Windows Update for Business reports](./includes/wufb-reports-endpoints.md)] ## Required services -Many Windows and Microsoft services are required to ensure that not only the device can function, but Windows Update for Business reports can see device data. It's recommended that you allow all default services from the out-of-box experience to remain running. The [Windows Update for Business reports Configuration Script](wufb-reports-configuration-script.md) checks whether the majority of these services are running or are allowed to run automatically. +Many Windows services are required for Windows Update for Business reports to see device data. Allow all default services from the out-of-box experience to remain running. Use the [Windows Update for Business reports configuration script](wufb-reports-configuration-script.md) to check whether required services are running or are allowed to run automatically. ## Next steps diff --git a/windows/deployment/update/wufb-reports-prerequisites.md b/windows/deployment/update/wufb-reports-prerequisites.md index 3b3527ba45..c81cd3c96b 100644 --- a/windows/deployment/update/wufb-reports-prerequisites.md +++ b/windows/deployment/update/wufb-reports-prerequisites.md @@ -11,7 +11,7 @@ manager: aaroncz appliesto: - ✅ Windows 11 - ✅ Windows 10 -ms.date: 08/30/2023 +ms.date: 12/15/2023 --- # Windows Update for Business reports prerequisites @@ -22,12 +22,12 @@ Before you begin the process of adding Windows Update for Business reports to yo ## Azure and Microsoft Entra ID -- An Azure subscription with [Microsoft Entra ID](/azure/active-directory/) +- An Azure subscription with [Microsoft Entra ID](/azure/active-directory/). - Devices must be Microsoft Entra joined and meet the below OS, diagnostic, and endpoint access requirements. - Devices can be [Microsoft Entra joined](/azure/active-directory/devices/concept-azure-ad-join) or [Microsoft Entra hybrid joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid). -- Devices that are [Microsoft Entra registered](/azure/active-directory/devices/concept-azure-ad-register) only (Workplace joined) aren't supported with Windows Update for Business reports. -- The Log Analytics workspace must be in a [supported region](#log-analytics-regions) -- Data in the **Driver update** tab of the [workbook](wufb-reports-workbook.md) is only available for devices that receive driver and firmware updates from the [Windows Update for Business deployment service](deployment-service-overview.md) +- Devices that are [Microsoft Entra registered](/azure/active-directory/devices/concept-azure-ad-register) only (workplace joined) aren't supported with Windows Update for Business reports. +- The Log Analytics workspace must be in a [supported region](#log-analytics-regions). +- Data in the **Driver update** tab of the [workbook](wufb-reports-workbook.md) is only available for devices that receive driver and firmware updates from the [Windows Update for Business deployment service](deployment-service-overview.md). ## Permissions @@ -38,7 +38,7 @@ Before you begin the process of adding Windows Update for Business reports to yo - Windows 11 Professional, Education, Enterprise, and [Enterprise multi-session](/azure/virtual-desktop/windows-10-multisession-faq) editions - Windows 10 Professional, Education, Enterprise, and [Enterprise multi-session](/azure/virtual-desktop/windows-10-multisession-faq) editions -Windows Update for Business reports only provides data for the standard Desktop Windows client version and isn't currently compatible with Windows Server, Surface Hub, IoT, or other versions. +Windows Update for Business reports only provides data for the standard desktop Windows client version and isn't currently compatible with Windows Server, Surface Hub, IoT, or other versions. ## Windows client servicing channels @@ -49,27 +49,25 @@ Windows Update for Business reports supports Windows client devices on the follo ### Windows operating system updates -- For [Changes to Windows diagnostic data collection](/windows/privacy/changes-to-windows-diagnostic-data-collection#services-that-rely-on-enhanced-diagnostic-data), installing the January 2023 release preview cumulative update, or a later equivalent update, is recommended +For [changes to Windows diagnostic data collection](/windows/privacy/changes-to-windows-diagnostic-data-collection#services-that-rely-on-enhanced-diagnostic-data), installing the January 2023 release preview cumulative update, or a later equivalent update, is recommended. ## Diagnostic data requirements -At minimum, Windows Update for Business reports requires devices to send diagnostic data at the *Required* level (previously *Basic*). For more information about what's included in different diagnostic levels, see [Configure Windows diagnostic data in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization). +At minimum, Windows Update for Business reports requires devices to send diagnostic data at the *Required* level (previously *Basic*). For more information about what data each diagnostic level includes, see [Configure Windows diagnostic data in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization). The following levels are recommended, but not required: -- The *Enhanced* level for Windows 10 devices -- The *Optional* level for Windows 11 devices (previously *Full*) -Device names don't appear in Windows Update for Business reports unless you individually opt-in devices by using a policy. The configuration script does this for you, but when using other client configuration methods, set one of the following to display device names: +- The *Enhanced* level for Windows 10 devices. +- The *Optional* level for Windows 11 devices (previously *Full*). - - - CSP: System/[AllowDeviceNameInDiagnosticData](/windows/client-management/mdm/policy-csp-system#system-allowdevicenameindiagnosticdata) - - Group Policy: **Allow device name to be sent in Windows diagnostic data** under **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds** +Device names don't appear in Windows Update for Business reports unless you individually opt in devices by using a policy. The configuration script does this action for you, but when using other client configuration methods, set one of the following policies to display device names: +- CSP: System/[AllowDeviceNameInDiagnosticData](/windows/client-management/mdm/policy-csp-system#system-allowdevicenameindiagnosticdata) +- Group Policy: **Allow device name to be sent in Windows diagnostic data** under **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds** > [!TIP] > Windows Update for Business reports uses [services configuration](/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-svccfg), also called OneSettings. Disabling the services configuration can cause some of the client data to be incorrect or missing in reports. For more information, see the [DisableOneSettingsDownloads](/windows/client-management/mdm/policy-csp-system#disableonesettingsdownloads) policy settings. - Microsoft is committed to providing you with effective controls over your data and ongoing transparency into our data handling practices. For more information about data handling and privacy for Windows diagnostic data, see [Configure Windows diagnostic data in your organization](/windows/privacy/configure-windows-diagnostic-data-in-your-organization) and [Changes to Windows diagnostic data collection](/windows/privacy/changes-to-windows-diagnostic-data-collection#services-that-rely-on-enhanced-diagnostic-data). ## Endpoints diff --git a/windows/deployment/upgrade/log-files.md b/windows/deployment/upgrade/log-files.md index e5e5fca659..98d17e30e8 100644 --- a/windows/deployment/upgrade/log-files.md +++ b/windows/deployment/upgrade/log-files.md @@ -1,6 +1,6 @@ --- title: Log files and resolving upgrade errors -description: Learn how to interpret and analyze the log files that are generated during the Windows 10 upgrade process. +description: Learn how to interpret and analyze the log files that are generated during the Windows upgrade process. ms.prod: windows-client author: frankroj manager: aaroncz @@ -11,107 +11,103 @@ ms.collection: - highpri - tier2 ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 01/18/2024 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Windows upgrade log files -**Applies to** +> [!NOTE] +> +> This article is a 400-level article (advanced). +> +> See [Resolve Windows upgrade errors](resolve-windows-upgrade-errors.md) for a full list of articles in this section. -- Windows 10 +Several log files are created during each phase of the upgrade process. These log files are essential for troubleshooting upgrade problems. By default, the folders that contain these log files are hidden on the upgrade target computer. To view the log files, configure Windows Explorer to view hidden items, or use a tool to automatically gather these logs. The most useful log is **setupact.log**. The log files are located in a different folder depending on the Windows Setup phase. Recall that the phase can be determined from the extend code. > [!NOTE] -> This is a 400-level topic (advanced).
- -> See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. - -Several log files are created during each phase of the upgrade process. These log files are essential for troubleshooting upgrade problems. By default, the folders that contain these log files are hidden on the upgrade target computer. To view the log files, configure Windows Explorer to view hidden items, or use a tool to automatically gather these logs. The most useful log is **setupact.log**. The log files are located in a different folder depending on the Windows Setup phase. Recall that you can determine the phase from the extend code. - -> [!NOTE] -> Also see the [Windows Error Reporting](windows-error-reporting.md) section in this document for help locating error codes and log files. - -The following table describes some log files and how to use them for troubleshooting purposes: - +> +> Also see the [Windows Error Reporting](windows-error-reporting.md) article in this section for help with locating error codes and log files. +The following table describes some log files and how to use them for troubleshooting purposes: |Log file |Phase: Location |Description |When to use| |---|---|---|---| -|setupact.log|Down-Level:
$Windows.~BT\Sources\Panther|Contains information about setup actions during the downlevel phase. |All down-level failures and starting point for rollback investigations.
Setup.act is the most important log for diagnosing setup issues.| -|setupact.log|OOBE:
$Windows.~BT\Sources\Panther\UnattendGC|Contains information about actions during the OOBE phase.|Investigating rollbacks that failed during OOBE phase and operations - 0x4001C, 0x4001D, 0x4001E, 0x4001F.| -|setupact.log|Rollback:
$Windows.~BT\Sources\Rollback|Contains information about actions during rollback.|Investigating generic rollbacks - 0xC1900101.| -|setupact.log|Pre-initialization (prior to downlevel):
Windows|Contains information about initializing setup.|If setup fails to launch.| -|setupact.log|Post-upgrade (after OOBE):
Windows\Panther|Contains information about setup actions during the installation.|Investigate post-upgrade related issues.| -|setuperr.log|Same as setupact.log|Contains information about setup errors during the installation.|Review all errors encountered during the installation phase.| -|miglog.xml|Post-upgrade (after OOBE):
Windows\Panther|Contains information about what was migrated during the installation.|Identify post upgrade data migration issues.| -|BlueBox.log|Down-Level:
Windows\Logs\Mosetup|Contains information communication between `setup.exe` and Windows Update.|Use during WSUS and Windows Update down-level failures or for 0xC1900107.| -|Supplemental rollback logs:
Setupmem.dmp
setupapi.dev.log
Event logs (*.evtx)|$Windows.~BT\Sources\Rollback|Additional logs collected during rollback.|Setupmem.dmp: If OS bug checks during upgrade, setup will attempt to extract a mini-dump.
Setupapi: Device install issues - 0x30018
Event logs: Generic rollbacks (0xC1900101) or unexpected reboots.| +|**setupact.log**|Down-Level:
$Windows.~BT\Sources\Panther|Contains information about setup actions during the downlevel phase. |All down-level failures and starting point for rollback investigations.
Setup.act is the most important log for diagnosing setup issues.| +|**setupact.log**|OOBE:
$Windows.~BT\Sources\Panther\UnattendGC|Contains information about actions during the OOBE phase.|Investigating rollbacks that failed during OOBE phase and operations - 0x4001C, 0x4001D, 0x4001E, 0x4001F.| +|**setupact.log**|Rollback:
$Windows.~BT\Sources\Rollback|Contains information about actions during rollback.|Investigating generic rollbacks - 0xC1900101.| +|**setupact.log**|Pre-initialization (prior to downlevel):
Windows|Contains information about initializing setup.|If setup fails to launch.| +|**setupact.log**|Post-upgrade (after OOBE):
Windows\Panther|Contains information about setup actions during the installation.|Investigate post-upgrade related issues.| +|**setuperr.log**|Same as setupact.log|Contains information about setup errors during the installation.|Review all errors encountered during the installation phase.| +|**miglog.xml**|Post-upgrade (after OOBE):
Windows\Panther|Contains information about what was migrated during the installation.|Identify post upgrade data migration issues.| +|**BlueBox.log**|Down-Level:
Windows\Logs\Mosetup|Contains information communication between `setup.exe` and Windows Update.|Use during WSUS and Windows Update down-level failures or for 0xC1900107.| +|Supplemental rollback logs:
**Setupmem.dmp**
**setupapi.dev.log**
Event logs (*.evtx)|$Windows.~BT\Sources\Rollback|Additional logs collected during rollback.|Setupmem.dmp: If OS bug checks during upgrade, setup attempts to extract a mini-dump.
Setupapi: Device install issues - 0x30018
Event logs: Generic rollbacks (0xC1900101) or unexpected reboots.| ## Log entry structure -A setupact.log or setuperr.log entry (files are located at C:\Windows) includes the following elements: +A `setupact.log` or `setuperr.log` entry includes the following elements: -1. **The date and time** - 2016-09-08 09:20:05 +1. **The date and time** - 2023-09-08 09:20:05 +1. **The log level** - Info, Warning, Error, Fatal Error -2. **The log level** - Info, Warning, Error, Fatal Error +1. **The logging component** - CONX, MOUPG, PANTHR, SP, IBSLIB, MIG, DISM, CSI, CBS + The logging components SP (setup platform), MIG (migration engine), and CONX (compatibility information) are useful for troubleshooting Windows Setup errors. -3. **The logging component** - CONX, MOUPG, PANTHR, SP, IBSLIB, MIG, DISM, CSI, CBS - - - The logging components SP (setup platform), MIG (migration engine), and CONX (compatibility information) are useful for troubleshooting Windows Setup errors. - - -4. **The message** - Operation completed successfully. +1. **The message** - Operation completed successfully. See the following example: | Date/Time | Log level | Component | Message | |------|------------|------------|------------| -|2016-09-08 09:23:50,| Warning | MIG | Couldn't replace object C:\Users\name\Cookies. Target Object can't be removed.| +|2023-09-08 09:23:50,| Warning | MIG | Couldn't replace object C:\Users\name\Cookies. Target Object can't be removed.| ## Analyze log files -The following instructions are meant for IT professionals. Also see the [Upgrade error codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json) section in this guide to familiarize yourself with [result codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#result-codes) and [extend codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#extend-codes). +The following instructions are meant for IT professionals. Also see the [Upgrade error codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json) section in this guide to become familiar with [result codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#result-codes) and [extend codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#extend-codes). To analyze Windows Setup log files: -1. Determine the Windows Setup error code. This code should be returned by Windows Setup if it isn't successful with the upgrade process. +1. Determine the Windows Setup error code. Windows Setup should return an error code if it isn't successful with the upgrade process. -2. Based on the [extend code](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#extend-codes) portion of the error code, determine the type and location of a log file to investigate. +1. Based on the [extend code](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#extend-codes) portion of the error code, determine the type and location of a log file to investigate. -3. Open the log file in a text editor, such as notepad. +1. Open the log file in a text editor, such as notepad. -4. Using the [result code](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#result-codes) portion of the Windows Setup error code, search for the result code in the file and find the last occurrence of the code. Alternatively search for the "abort" and abandoning" text strings described in step 7 below. +1. Using the [result code](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#result-codes) portion of the Windows Setup error code, search for the result code in the file and find the last occurrence of the code. Alternatively search for the "abort" and abandoning" text strings described in step 7 below. -5. To find the last occurrence of the result code: +1. To find the last occurrence of the result code: 1. Scroll to the bottom of the file and select after the last character. - 2. Select **Edit**. - 3. Select **Find**. - 4. Type the result code. - 5. Under **Direction** select **Up**. - 6. Select **Find Next**. + 1. Select **Edit**. + 1. Select **Find**. + 1. Type the result code. + 1. Under **Direction** select **Up**. + 1. Select **Find Next**. -6. When you've located the last occurrence of the result code, scroll up a few lines from this location in the file and review the processes that failed prior to generating the result code. +1. When the last occurrence of the result code is located, scroll up a few lines from this location in the file and review the processes that failed prior to generating the result code. -7. Search for the following important text strings: +1. Search for the following important text strings: - `Shell application requested abort` - `Abandoning apply due to error for object` -8. Decode Win32 errors that appear in this section. +1. Decode Win32 errors that appear in this section. -9. Write down the timestamp for the observed errors in this section. +1. Write down the timestamp for the observed errors in this section. -10. Search other log files for additional information matching these timestamps or errors. +1. Search other log files for additional information matching these timestamps or errors. -For example, assume that the error code for an error is 0x8007042B - 0x2000D. Searching for "8007042B" reveals the following content from the setuperr.log file: +For example, assume that the error code for an error is **0x8007042B - 0x2000D**. Searching for **8007042B** reveals the following content from the `setuperr.log` file: > [!NOTE] -> Some lines in the text below are shortened to enhance readability. For example -> -> - The date and time at the start of each line (ex: 2016-10-05 15:27:08) is shortened to minutes and seconds +> +> Some lines in the following text are shortened to enhance readability. For example +> +> - The date and time at the start of each line (ex: 2023-10-05 15:27:08) is shortened to minutes and seconds > - The certificate file name, which is a long text string, is shortened to just "CN." **setuperr.log** content: @@ -127,20 +123,20 @@ For example, assume that the error code for an error is 0x8007042B - 0x2000D. Se 27:09, Error SP CSetupPlatformPrivate::Execute: Execution of operations queue failed, abandoning. Error: 0x8007042B[gle=0x000000b7] ``` -The first line indicates there was an error **0x00000570** with the file **C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]** (shown below): +The first line indicates there was an error **0x00000570** with the file **C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]**: ```console 27:08, Error SP Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570] ``` -The error 0x00000570 is a [Win32 error code](/openspecs/windows_protocols/ms-erref/18d8fbe8-a967-4f1c-ae50-99ca8e491d2d) corresponding to: ERROR_FILE_CORRUPT: The file or directory is corrupted and unreadable. +The error **0x00000570** is a [Win32 error code](/openspecs/windows_protocols/ms-erref/18d8fbe8-a967-4f1c-ae50-99ca8e491d2d) corresponding to: **ERROR_FILE_CORRUPT: The file or directory is corrupted and unreadable**. -Therefore, Windows Setup failed because it wasn't able to migrate the corrupt file **C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN]**. This file is a local system certificate and can be safely deleted. Searching the setupact.log file for more details, the phrase "Shell application requested abort" is found in a location with the same timestamp as the lines in setuperr.log. This confirms our suspicion that this file is the cause of the upgrade failure: +Therefore, Windows Setup failed because it wasn't able to migrate the corrupt file **C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN]**. This file is a local system certificate and can be safely deleted. After the `setupact.log` file is searched for more details, the phrase **Shell application requested abort** is found in a location with the same timestamp as the lines in `setuperr.log`. This analysis confirms the suspicion that this file is the cause of the upgrade failure: **setupact.log** content: ```console -27:00, Info Gather started at 10/5/2016 23:27:00 +27:00, Info Gather started at 10/5/2023 23:27:00 27:00, Info [0x080489] MIG Setting system object filter context (System) 27:00, Info [0x0803e5] MIG Not unmapping HKCU\Software\Classes; it is not mapped 27:00, Info [0x0803e5] MIG Not unmapping HKCU; it is not mapped @@ -157,7 +153,7 @@ Therefore, Windows Setup failed because it wasn't able to migrate the corrupt fi 27:08, Info MIG COutOfProcPluginFactory::LaunchSurrogateHost::CommandLine: -shortened- 27:08, Info MIG COutOfProcPluginFactory::LaunchSurrogateHost: Successfully launched host and got control object. 27:08, Error Gather failed. Last error: 0x00000000 -27:08, Info Gather ended at 10/5/2016 23:27:08 with result 44 +27:08, Info Gather ended at 10/5/2023 23:27:08 with result 44 27:08, Info Leaving MigGather method 27:08, Error SP SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C ``` @@ -166,7 +162,7 @@ Therefore, Windows Setup failed because it wasn't able to migrate the corrupt fi ```console >>> [Device Install (UpdateDriverForPlugAndPlayDevices) - PCI\VEN_8086&DEV_8C4F] ->>> Section start 2019/09/26 20:13:01.623 +>>> Section start 2023/09/26 20:13:01.623 cmd: rundll32.exe "C:\WINDOWS\Installer\MSI6E4C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_95972906 484 ChipsetWiX.CustomAction!Intel.Deployment.ChipsetWiX.CustomActions.InstallDrivers ndv: INF path: C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf ndv: Install flags: 0x00000000 @@ -250,15 +246,12 @@ Therefore, Windows Setup failed because it wasn't able to migrate the corrupt fi <<< [Exit status: FAILURE(0xC1900101)] ``` -This analysis indicates that the Windows upgrade error can be resolved by deleting the C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN] file. +This analysis indicates that the Windows upgrade error can be resolved by deleting the `C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN]` file. > [!NOTE] -> In this example, the full, unshortened file name is C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f. +> +> In this example, the full file name is `C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f`. ## Related articles -[Windows 10 FAQ for IT professionals](../planning/windows-10-enterprise-faq-itpro.yml) -
[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) -
[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
[Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors) +- [Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors). diff --git a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md deleted file mode 100644 index cf7359540a..0000000000 --- a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Resolve Windows 10 upgrade errors - Windows IT Pro -manager: aaroncz -ms.author: frankroj -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. -ms.prod: windows-client -author: frankroj -ms.localizationpriority: medium -ms.topic: article -ms.technology: itpro-deploy -ms.date: 10/28/2022 ---- - -# Resolve Windows 10 upgrade errors: Technical information for IT Pros - -**Applies to** -- Windows 10 - ->[!IMPORTANT] ->This article contains technical instructions for IT administrators. If you are not an IT administrator, try some of the [quick fixes](/troubleshoot/windows-client/deployment/windows-10-upgrade-quick-fixes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json) described in this article then contact [Microsoft Support](https://support.microsoft.com/contactus/) starting with the Virtual Agent. To talk to a person about your issue, click **Get started** to interact with the Virtual Agent, then enter "Talk to a person" two times. The Virtual Agent can also help you to resolve many Windows upgrade issues. Also see: [Get help with Windows 10 upgrade and installation errors](https://support.microsoft.com/help/10587/windows-10-get-help-with-upgrade-installation-errors) and [Submit Windows 10 upgrade errors using Feedback Hub](submit-errors.md). - -This article contains a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. - -The article has been divided into subtopics of different technical levels. Basic level provides common procedures that can resolve several types of upgrade errors. Advanced level requires some experience with detailed troubleshooting methods. - -The following four levels are assigned: - -Level 100: Basic
-Level 200: Moderate
-Level 300: Moderate advanced
-Level 400: Advanced
- -## In this guide - -See the following topics in this article: - -- [Quick fixes](/troubleshoot/windows-client/deployment/windows-10-upgrade-quick-fixes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json): \Level 100\ Steps you can take to eliminate many Windows upgrade errors.
-- [SetupDiag](setupdiag.md): \Level 300\ SetupDiag is a new tool to help you isolate the root cause of an upgrade failure. -- [Troubleshooting upgrade errors](/troubleshoot/windows-client/deployment/windows-10-upgrade-issues-troubleshooting?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json): \Level 300\ General advice and techniques for troubleshooting Windows 10 upgrade errors, and an explanation of phases used during the upgrade process.
-- [Windows Error Reporting](windows-error-reporting.md): \Level 300\ How to use Event Viewer to review details about a Windows 10 upgrade. -- [Upgrade error codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json): \Level 400\ The components of an error code are explained. - - [Result codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#result-codes): Information about result codes. - - [Extend codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#extend-codes): Information about extend codes. -- [Log files](log-files.md): \Level 400\ A list and description of log files useful for troubleshooting. - - [Log entry structure](log-files.md#log-entry-structure): The format of a log entry is described. - - [Analyze log files](log-files.md#analyze-log-files): General procedures for log file analysis, and an example. -- [Resolution procedures](/troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json): \Level 200\ Causes and mitigation procedures associated with specific error codes. - - [0xC1900101](/troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#0xc1900101): Information about the 0xC1900101 result code. - - [0x800xxxxx](/troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#0x800xxxxx): Information about result codes that start with 0x800. - - [Other result codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#other-result-codes): Additional causes and mitigation procedures are provided for some result codes. - - [Other error codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#other-error-codes): Additional causes and mitigation procedures are provided for some error codes. -- [Submit Windows 10 upgrade errors](submit-errors.md): \Level 100\ Submit upgrade errors to Microsoft for analysis. - -## Related articles - -[Windows 10 FAQ for IT professionals](../planning/windows-10-enterprise-faq-itpro.yml) -
[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) -
[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
[Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors) -
diff --git a/windows/deployment/upgrade/resolve-windows-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-upgrade-errors.md new file mode 100644 index 0000000000..fac9a7f59e --- /dev/null +++ b/windows/deployment/upgrade/resolve-windows-upgrade-errors.md @@ -0,0 +1,57 @@ +--- +title: Resolve Windows upgrade errors - Windows IT Pro +manager: aaroncz +ms.author: frankroj +description: Resolve Windows upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. +author: frankroj +ms.localizationpriority: medium +ms.topic: article +ms.prod: windows-client +ms.technology: itpro-deploy +ms.date: 01/18/2024 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 +--- + +# Resolve Windows upgrade errors: Technical information for IT Pros + +> [!IMPORTANT] +> +> This article contains technical instructions for IT administrators. The article isn't intended for non-IT administrators such as home or consumer users. + +This article contains a brief introduction to the Windows installation processes, and provides resolution procedures that IT administrators can use to resolve issues with a Windows upgrade. + +The article is divided into subtopics of different technical levels. Basic level provides common procedures that can resolve several types of upgrade errors. Advanced level requires some experience with detailed troubleshooting methods. + +The following four levels are assigned: + +- Level 100: Basic +- Level 200: Moderate +- Level 300: Moderate advanced +- Level 400: Advanced + +## In this guide + +See the following articles in this section: + +- [Quick fixes](/troubleshoot/windows-client/deployment/windows-10-upgrade-quick-fixes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json): \Level 100\ Steps to take to eliminate many Windows upgrade errors. +- [SetupDiag](setupdiag.md): \Level 300\ SetupDiag is a new tool to help isolate the root cause of an upgrade failure. +- [Troubleshooting upgrade errors](/troubleshoot/windows-client/deployment/windows-upgrade-issues-troubleshooting?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json): \Level 300\ General advice and techniques for troubleshooting Windows upgrade errors, and an explanation of phases used during the upgrade process. +- [Windows Error Reporting](windows-error-reporting.md): \Level 300\ How to use Event Viewer to review details about a Windows upgrade. +- [Upgrade error codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json): \Level 400\ The components of an error code are explained. + - [Result codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#result-codes): Information about result codes. + - [Extend codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-error-codes?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#extend-codes): Information about extend codes. +- [Log files](log-files.md): \Level 400\ A list and description of log files useful for troubleshooting. + - [Log entry structure](log-files.md#log-entry-structure): The format of a log entry is described. + - [Analyze log files](log-files.md#analyze-log-files): General procedures for log file analysis, and an example. +- [Resolution procedures](/troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json): \Level 200\ Causes and mitigation procedures associated with specific error codes. + - [0xC1900101](/troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#0xc1900101): Information about the 0xC1900101 result code. + - [0x800xxxxx](/troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#0x800xxxxx): Information about result codes that start with 0x800. + - [Other result codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#other-result-codes): Additional causes and mitigation procedures are provided for some result codes. + - [Other error codes](/troubleshoot/windows-client/deployment/windows-10-upgrade-resolution-procedures?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#other-error-codes): Additional causes and mitigation procedures are provided for some error codes. +- [Submit Windows upgrade errors](submit-errors.md): \Level 100\ Submit upgrade errors to Microsoft for analysis. + +## Related articles + +- [Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors). diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md index 3b512451f5..971b29b367 100644 --- a/windows/deployment/upgrade/setupdiag.md +++ b/windows/deployment/upgrade/setupdiag.md @@ -1,6 +1,7 @@ --- title: SetupDiag description: SetupDiag works by examining Windows Setup log files. This article shows how to use the SetupDiag tool to diagnose Windows Setup errors. +ms.reviewer: shendrix ms.prod: windows-client ms.technology: itpro-deploy author: frankroj @@ -11,34 +12,34 @@ ms.topic: troubleshooting ms.collection: - highpri - tier2 -ms.date: 10/28/2022 +ms.date: 01/18/2024 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # SetupDiag -**Applies to** -- Windows 10 +> [!NOTE] +> +> This article is a 300 level article (moderate advanced). See [Resolve Windows upgrade errors](resolve-windows-upgrade-errors.md) for a full list of articles in this section. ->[!NOTE] ->This is a 300 level topic (moderate advanced).
->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article.
- - [![Download SetupDiag.](../images/download.png)](https://go.microsoft.com/fwlink/?linkid=870142) +> [!div class="nextstepaction"] +> [Download the latest version of SetupDiag](https://go.microsoft.com/fwlink/?linkid=870142) ## About SetupDiag -Current downloadable version of SetupDiag: 1.6.2107.27002. -> Always be sure to run the most recent version of SetupDiag, so that can access new functionality and fixes to known issues. +> [!IMPORTANT] +> +> When SetupDiag is run manually, Microsoft recommends running the latest version of SetupDiag. The latest version is available via the following [download link](https://go.microsoft.com/fwlink/?linkid=870142). Running the latest version ensures the latest functionality and fixes known issues. -SetupDiag is a diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful. +SetupDiag is a diagnostic tool that can be used to obtain details about why a Windows upgrade was unsuccessful. -SetupDiag works by examining Windows Setup log files. It attempts to parse these log files to determine the root cause of a failure to update or upgrade the computer to Windows 10. SetupDiag can be run on the computer that failed to update, or you can export logs from the computer to another location and run SetupDiag in offline mode. +SetupDiag works by examining Windows Setup log files. It attempts to parse these log files to determine the root cause of a failure to update or upgrade the computer to Windows. SetupDiag can be run on the computer that failed to update. The logs can also be exported from the computer to another location and then running SetupDiag in offline mode. -## SetupDiag in Windows 10, version 2004 and later +SetupDiag is included with [Windows Setup](/windows-hardware/manufacture/desktop/deployment-troubleshooting-and-log-files#windows-setup-scenario) in all currently supported versions of Windows. -With the release of Windows 10, version 2004, SetupDiag is included with [Windows Setup](/windows-hardware/manufacture/desktop/deployment-troubleshooting-and-log-files#windows-setup-scenario). - -During the upgrade process, Windows Setup will extract all its sources files to the **%SystemDrive%\$Windows.~bt\Sources** directory. With Windows 10, version 2004 and later, **setupdiag.exe** is also installed to this directory. If there's an issue with the upgrade, SetupDiag will automatically run to determine the cause of the failure. +During the upgrade process, Windows Setup extracts all its sources files, including **SetupDiag.exe**, to the **%SystemDrive%\$Windows.~bt\Sources** directory. If there's an issue with the upgrade, SetupDiag automatically runs to determine the cause of the failure. When run by Windows Setup, the following [parameters](#parameters) are used: @@ -47,145 +48,200 @@ When run by Windows Setup, the following [parameters](#parameters) are used: - /Output:%windir%\logs\SetupDiag\SetupDiagResults.xml - /RegPath:HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupDiag\Results -The resulting SetupDiag analysis can be found at **%WinDir%\Logs\SetupDiag\SetupDiagResults.xml** and in the registry under **HKLM\SYSTEM\Setup\SetupDiag\Results**. Note that the registry path isn't the same as the default registry path when SetupDiag is run manually. When SetupDiag is run manually, and the /RegPath parameter isn't specified, data is stored in the registry at HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag. +The resulting SetupDiag analysis can be found at `%WinDir%\Logs\SetupDiag\SetupDiagResults.xml` and in the registry under `HKLM\SYSTEM\Setup\SetupDiag\Results`. + +> [!NOTE] +> +> When Windows Setup runs SetupDiag automatically, the registry path isn't the same as the default registry path when SetupDiag is run manually. When SetupDiag is run manually, and the `/RegPath` parameter isn't specified, data is stored in the registry at `HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag`. > [!IMPORTANT] +> > When SetupDiag indicates that there were multiple failures, the last failure in the log file is typically the fatal error, not the first one. -If the upgrade process proceeds normally, the **Sources** directory including **setupdiag.exe** is moved under **%SystemDrive%\Windows.Old** for cleanup. If the **Windows.old** directory is deleted later, **setupdiag.exe** will also be removed. - -## Using SetupDiag - -To quickly use SetupDiag on your current computer: -1. Verify that your system meets the [requirements](#requirements) described below. If needed, install the [.NET framework 4.6](https://www.microsoft.com/download/details.aspx?id=48137). -2. [Download SetupDiag](https://go.microsoft.com/fwlink/?linkid=870142). -3. If your web browser asks what to do with the file, choose **Save**. By default, the file will be saved to your **Downloads** folder. You can also save it to a different location if desired by using **Save As**. -4. When SetupDiag has finished downloading, open the folder where you downloaded the file. By default, this folder is the **Downloads** folder, which is displayed in File Explorer under **Quick access** in the left navigation pane. -5. Double-click the **SetupDiag** file to run it. Select **Yes** if you're asked to approve running the program. - - Double-clicking the file to run it will automatically close the command window when SetupDiag has completed its analysis. If you wish to keep this window open instead, and review the messages that you see, run the program by typing **SetupDiag** at the command prompt instead of double-clicking it. You'll need to change directories to the location of SetupDiag to run it this way. -6. A command window will open while SetupDiag diagnoses your computer. Wait for this process to finish. -7. When SetupDiag finishes, two files will be created in the same folder where you double-clicked SetupDiag. One is a configuration file, the other is a log file. -8. Use Notepad to open the log file: **SetupDiagResults.log**. -9. Review the information that is displayed. If a rule was matched, this information can tell you why the computer failed to upgrade, and potentially how to fix the problem. See the [Text log sample](#text-log-sample) below. - -For instructions on how to run the tool in offline mode and with more advanced options, see the [Parameters](#parameters) and [Examples](#examples) sections below. - -The [Release notes](#release-notes) section at the bottom of this article has information about recent updates to this tool. +If the upgrade process proceeds normally, the **Sources** directory including **SetupDiag.exe** is moved under **%SystemDrive%\Windows.Old** for cleanup. If the **Windows.old** directory is deleted later, **SetupDiag.exe** is also removed. ## Requirements -1. The destination OS must be Windows 10. -2. [.NET Framework 4.6](https://www.microsoft.com/download/details.aspx?id=48137) must be installed. If you aren't sure what version of .NET is currently installed, see [How to: Determine Which .NET Framework Versions Are Installed](/dotnet/framework/migration-guide/how-to-determine-which-versions-are-installed). You can also use the following command-line query to display the installed v4 versions: +1. The destination version of Windows must be a currently supported version of Windows. The originally installed version of Windows can be a version of Windows that's out of support as long as: + - The destination version of Windows is a currently supported version of Windows. + - Upgrade to the destination version of Windows is supported from the original installed version of Windows. + +1. [.NET Framework 4.7.2](https://go.microsoft.com/fwlink/?linkid=863265) or newer must be installed. To determine which version of .NET is preinstalled with a specific version of Windows, see [.NET Framework system requirements: Supported client operating systems](/dotnet/framework/get-started/system-requirements#supported-client-operating-systems). To determine which version of .NET is currently installed, see [How to: Determine Which .NET Framework Versions Are Installed](/dotnet/framework/migration-guide/how-to-determine-which-versions-are-installed). + + The following command-line query can be used to display the currently installed version of .NET: + + ```cmd + reg.exe query "HKLM\SOFTWARE\Microsoft\Net Framework Setup\NDP\v4" /s ``` - reg query "HKLM\SOFTWARE\Microsoft\Net Framework Setup\NDP\v4" /s - ``` + + As long as at least the required version of .NET is installed, no additional action is required, including if a newer version is installed. + +## Using SetupDiag + +To quickly use SetupDiag on the current computer: + +1. Verify that the system meets the [requirements](#requirements). + +1. [Download SetupDiag](https://go.microsoft.com/fwlink/?linkid=870142). + +1. If the web browser asks what to do with the file, choose **Save**. By default, the file is saved to the **Downloads** folder. If desired, the file can also be saved to a different location by using **Save As**. + +1. When SetupDiag finishes downloading, open the folder where the file was downloaded. By default, this folder is the **Downloads** folder, which is displayed in File Explorer under **Quick access** in the left navigation pane. + +1. Double-click the **SetupDiag** file to run it. Select **Yes** if asked to approve running the program. + + Double-clicking the file to run it automatically closes the command window when SetupDiag completes its analysis. To instead keep the window open to review the messages SetupDiag generates, run the program by typing **SetupDiag** at the command prompt instead of double-clicking it. When running from a command prompt, make sure to change directories to where SetupDiag is located. + +1. A command window opens while SetupDiag diagnoses the computer. Wait for this process to finish. + +1. When SetupDiag finishes, two files are created in the same folder where SetupDiag was run from. One is a configuration file, the other is a log file. + +1. Use Notepad to open the log file **SetupDiagResults.log**. + +1. Review the information that is displayed. If a rule was matched, this information can say why the computer failed to upgrade, and potentially how to fix the problem. See the section [Text log sample](#text-log-sample). + +For instructions on how to run the tool in offline mode and with more advanced options, see the sections [Parameters](#parameters) and [Examples](#examples). ## Parameters | Parameter | Description | | --- | --- | -| /? |
  • Displays interactive help
| -| /Output:\ |
  • This optional parameter enables you to specify the output file for results. This file is where you'll find what SetupDiag was able to determine. Only text format output is supported. UNC paths will work, provided the context under which SetupDiag runs has access to the UNC path. If the path has a space in it, you must enclose the entire path in double quotes (see the example section below).
  • Default: If not specified, SetupDiag will create the file **SetupDiagResults.log** in the same directory where SetupDiag.exe is run.
| -| /LogsPath:\ |
  • This optional parameter tells SetupDiag.exe where to find the log files for an offline analysis. These log files can be in a flat folder format, or containing multiple subdirectories. SetupDiag will recursively search all child directories.
| -| /ZipLogs:\ |
  • This optional parameter tells SetupDiag.exe to create a zip file containing the results and all the log files it parsed. The zip file is created in the same directory where SetupDiag.exe is run.
  • Default: If not specified, a value of 'true' is used.
| -| /Format:\ |
  • This optional parameter can be used to output log files in xml or JSON format. If this parameter isn't specified, text format is used by default.
| -| /Scenario:\[Recovery\] |
  • This optional parameter instructs SetupDiag.exe to look for and process reset and recovery logs and ignore setup/upgrade logs.
| -| /Verbose |
  • This optional parameter will output much more data to a log file. By default, SetupDiag will only produce a log file entry for serious errors. Using **/Verbose** will cause SetupDiag to always produce another log file with debugging details. These details can be useful when reporting a problem with SetupDiag.
| -| /NoTel |
  • This optional parameter tells SetupDiag.exe not to send diagnostic telemetry to Microsoft.
| -| /AddReg |
  • This optional parameter instructs SetupDiag.exe to add failure information to the registry in offline mode. By default, SetupDiag will add failure information to the registry in online mode only. Registry data is added to the following location on the system where SetupDiag is run: **HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag**.
| -| /RegPath |
  • This optional parameter instructs SetupDiag.exe to add failure information to the registry using the specified path. If this parameter isn't specified the default path is **HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag**. -
| +| **/?** | Displays interactive help | +| **/Output:\[Full path and file name for output log file\]** | This optional parameter specifies the name and location for the results log file. The output file contains the analysis from SetupDiag. Only text format output is supported. UNC paths work provided the context under which SetupDiag runs has access to the UNC path. If the path has a space in it, the entire path must be enclosed in double quotes (**"**). See the [Examples](#examples) sections for an example.

Default: If not specified, SetupDiag creates the file **SetupDiagResults.log** in the same directory where **SetupDiag.exe** is run. | +| **/LogsPath:\[Full path to logs\]** | This optional parameter specifies the location of logs to parse and where to find the log files for an offline analysis. These log files can be in a flat folder format, or containing multiple subdirectories. SetupDiag recursively searches all child directories. Defaults to checking the current system for logs. | +| **/ZipLogs:\[True \| False\]** | This optional parameter Tells **SetupDiag.exe** to create a zip file containing the results and all the log files that were parsed. The zip file is created in the same directory where **SetupDiag.exe** is run.

Default: If not specified, a value of 'true' is used. | +| **/Format:\[xml \| json\]** | This optional parameter specifies the output format for log files to be XML or JSON. If this parameter isn't specified, text format is used by default. | +| **/Scenario:\[Recovery \| Debug\]** | This optional parameter can do one of the following two items based on the argument used:

  • Recovery instructs **SetupDiag.exe** to look for and process reset and recovery logs and ignore setup/upgrade logs.
  • Debug instructs **SetupDiag.exe** to debug memory dumps if the requisite debug binaries are installed.
| +| **/Verbose** | This optional parameter creates a diagnostic log in the current directory, with debugging information, additional data, and details about SetupDiag. By default, SetupDiag only produces a log file entry for major errors. Using **/Verbose** causes SetupDiag to always produce another log file with debugging details. These details can be useful when reporting a problem with SetupDiag. | +| **/NoTel** | This optional parameter tells **SetupDiag.exe** not to send diagnostic telemetry to Microsoft. | +| **/RegPath** | This optional parameter Instructs **SetupDiag.exe** to add failure information to the registry under the given path. Registry paths should start with **HKEY_LOCAL_MACHINE** or **HKEY_CURRENT_USER** and be accessible at the elevation level SetupDiag is executed under. If this parameter isn't specified, the default path is **HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag**. | +| **/AddReg** | This optional parameter Instructs **SetupDiag.exe** to add failure information to the registry on the executing system in offline mode. SetupDiag by default adds failure information to the registry in Online mode only. Registry data goes to **HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup\Volatile\SetupDiag** unless otherwise specified. | -Note: The **/Mode** parameter is deprecated in version 1.4.0.0 of SetupDiag. -- In previous versions, this command was used with the LogsPath parameter to specify that SetupDiag should run in an offline manner to analyze a set of log files that were captured from a different computer. In version 1.4.0.0, when you specify /LogsPath then SetupDiag will automatically run in offline mode, therefore the /Mode parameter isn't needed. +> [!NOTE] +> +> The **/Mode** parameter is deprecated in SetupDiag. +> +> In previous versions, this command was used with the LogsPath parameter to specify that SetupDiag should run in an offline manner to analyze a set of log files that were captured from a different computer. In current versions of SetupDiag, when /LogsPath is specified then SetupDiag automatically runs in offline mode, therefore the /Mode parameter isn't needed. -### Examples: +### Examples -In the following example, SetupDiag is run with default parameters (online mode, results file is SetupDiagResults.log in the same folder where SetupDiag is run). +- In the following example, SetupDiag is run with default parameters in online mode. The results file is **SetupDiagResults.log** in the same folder where SetupDiag is run. -``` -SetupDiag.exe -``` + ```cmd + SetupDiag.exe + ``` -In the following example, SetupDiag is run in online mode (this mode is the default). It will know where to look for logs on the current (failing) system, so there's no need to gather logs ahead of time. A custom location for results is specified. +- In the following example, SetupDiag is run in online mode (this mode is the default). It knows where to look for logs on the current (failing) system, so there's no need to gather logs ahead of time. A custom location for results is specified. -``` -SetupDiag.exe /Output:C:\SetupDiag\Results.log -``` + ```cmd + SetupDiag.exe /Output:C:\SetupDiag\Results.log + ``` -The following example uses the /Output parameter to save results to a path name that contains a space: +- The following example uses the **/Output** parameter to save results to a path name that contains a space: -``` -SetupDiag /Output:"C:\Tools\SetupDiag\SetupDiag Results\Results.log" -``` + ```cmd + SetupDiag /Output:"C:\Tools\SetupDiag\SetupDiag Results\Results.log" + ``` -The following example specifies that SetupDiag is to run in offline mode, and to process the log files found in **D:\Temp\Logs\LogSet1**. +- The following example specifies that SetupDiag is to run in offline mode, and to process the log files found in **D:\Temp\Logs\LogSet1**. -``` -SetupDiag.exe /Output:C:\SetupDiag\Results.log /LogsPath:D:\Temp\Logs\LogSet1 -``` + ```cmd + SetupDiag.exe /Output:C:\SetupDiag\Results.log /LogsPath:D:\Temp\Logs\LogSet1 + ``` -The following example sets recovery scenario in offline mode. In the example, SetupDiag will search for reset/recovery logs in the specified LogsPath location and output the results to the directory specified by the /Output parameter. +- The following example sets recovery scenario in offline mode. In the example, SetupDiag searches for reset/recovery logs in the specified LogsPath location and output the results to the directory specified by the **/Output** parameter. -``` -SetupDiag.exe /Output:C:\SetupDiag\RecoveryResults.log /LogsPath:D:\Temp\Cabs\PBR_Log /Scenario:Recovery -``` + ```cmd + SetupDiag.exe /Output:C:\SetupDiag\RecoveryResults.log /LogsPath:D:\Temp\Cabs\PBR_Log /Scenario:Recovery + ``` -The following example sets recovery scenario in online mode. In the example, SetupDiag will search for reset/recovery logs on the current system and output results in XML format. +- The following example sets recovery scenario in online mode. In the example, SetupDiag searches for reset/recovery logs on the current system and output results in XML format. -``` -SetupDiag.exe /Scenario:Recovery /Format:xml -``` + ```cmd + SetupDiag.exe /Scenario:Recovery /Format:xml + ``` +- The following example is an example of Offline Mode. SetupDiag is instructed to parse setup/upgrade log files in the LogsPath directory and output the results to `C:\SetupDiag\Results.txt`. + + ```cmd + SetupDiag.exe /Output:C:\SetupDiag\Results.txt /LogsPath:D:\Temp\Logs\Logs1 /RegPath:HKEY_CURRENT_USER\SYSTEM\SetupDiag + ``` + +- The following example is an example of Online Mode. SetupDiag is instructed to look for setup/upgrade logs on the current system and output its results in XML format to `C:\SetupDiag\Results.xml`. + + ```cmd + SetupDiag.exe /Output:C:\SetupDiag\Results.xml /Format:xml + ``` + +- The following example is an example of Online Mode where no parameters are needed or used. SetupDiag is instructed to look for setup/upgrade logs on the current system and output the results to the same directory where SetupDiag is located. + + ```cmd + SetupDiag.exe + ``` + +- The following example is an example of Reset/Recovery Offline Mode. SetupDiag is instructed to look for reset/recovery logs in the specified LogsPath location. It then outputs the results to the directory specified by the **/Output** parameter. + + ```cmd + SetupDiag.exe /Output:C:\SetupDiag\RecoveryResults.log /LogsPath:D:\Temp\Cabs\PBR_Log /Scenario:Recovery + ``` + +- The following example is an example of Reset/Recovery Online Mode. SetupDiag is instructed to look for reset/recovery logs on the current system and output its results in XML format. + + ```cmd + SetupDiag.exe /Scenario:Recovery /Format:xml + ``` ## Log files -[Windows Setup Log Files and Event Logs](/windows-hardware/manufacture/desktop/windows-setup-log-files-and-event-logs) has information about where logs are created during Windows Setup. For offline processing, you should run SetupDiag against the contents of the entire folder. For example, depending on when the upgrade failed, copy one of the following folders to your offline location: +[Windows Setup Log Files and Event Logs](/windows-hardware/manufacture/desktop/windows-setup-log-files-and-event-logs) has information about where logs are created during Windows Setup. For offline processing, SetupDiag should be run against the contents of the entire folder. For example, depending on when the upgrade failed, copy one of the following folders to the offline location: -\\$Windows.~bt\sources\panther -
\\$Windows.~bt\Sources\Rollback -
\Windows\Panther -
\Windows\Panther\NewOS +- `\$Windows.~bt\sources\panther` +- `\$Windows.~bt\Sources\Rollback` +- `\Windows\Panther` +- `\Windows\Panther\NewOS` -If you copy the parent folder and all subfolders, SetupDiag will automatically search for log files in all subdirectories. +If the parent folder and all subfolders are copied, SetupDiag automatically searches for log files in all subdirectories. ## Setup bug check analysis -When Microsoft Windows encounters a condition that compromises safe system operation, the system halts. This condition is called a bug check. It's also commonly referred to as a system crash, a kernel error, a Stop error, or BSOD. Typically a hardware device, hardware driver, or related software causes this error. +When Microsoft Windows encounters a condition that compromises safe system operation, the system halts. This condition is called a bug check. This condition is also commonly referred to as a system crash, a kernel error, a Stop error, or BSOD. Typically a hardware device, hardware driver, or related software causes this error. -If crash dumps [are enabled](/windows-hardware/drivers/debugger/enabling-a-kernel-mode-dump-file) on the system, a crash dump file is created. If the bug check occurs during an upgrade, Windows Setup will extract a minidump (setupmem.dmp) file. SetupDiag can also debug these setup-related minidumps. +If crash dumps [are enabled](/windows-hardware/drivers/debugger/enabling-a-kernel-mode-dump-file) on the system, a crash dump file is created. If the bug check occurs during an upgrade, Windows Setup extracts a minidump (`setupmem.dmp`) file. SetupDiag can also debug these setup-related minidumps. + +To debug a setup-related bug check: + +- Specify the **/LogsPath** parameter. Memory dumps can't be debugged in online mode. + +- Gather the setup memory dump file (`setupmem.dmp) from the failing system. + + `Setupmem.dmp` is created in either **%SystemDrive%\$Windows.~bt\Sources\Rollback**, or in **%WinDir%\Panther\NewOS\Rollback** depending on when the bug check occurs. -To debug a setup-related bug check, you must: -- Specify the **/LogsPath** parameter. You can't debug memory dumps in online mode. -- Gather the setup memory dump file (setupmem.dmp) from the failing system. - - Setupmem.dmp will be created in either **%SystemDrive%\$Windows.~bt\Sources\Rollback**, or in **%WinDir%\Panther\NewOS\Rollback** depending on when the bug check occurs. - Install the [Windows Debugging Tools](/windows-hardware/drivers/debugger/debugger-download-tools) on the computer that runs SetupDiag. -In the following example, the **setupmem.dmp** file is copied to the **D:\Dump** directory and the Windows Debugging Tools are installed prior to running SetupDiag: +In the following example, the `setupmem.dmp` file is copied to the `D:\Dump` directory and the Windows Debugging Tools are installed prior to running SetupDiag: -``` +```cmd SetupDiag.exe /Output:C:\SetupDiag\Dumpdebug.log /LogsPath:D:\Dump ``` ## Known issues -1. Some rules can take a long time to process if the log files involved are large. - +- Some rules can take a long time to process if the log files involved are large. ## Sample output The following command is an example where SetupDiag is run in offline mode. -``` +```cmd D:\SetupDiag>SetupDiag.exe /output:c:\setupdiag\result.xml /logspath:D:\Tests\Logs\f55be736-beed-4b9b-aedf-c133536c946e /format:xml -SetupDiag v1.6.0.0 +SetupDiag v1.7.0.0 Copyright (c) Microsoft Corporation. All rights reserved. Searching for setup logs... -Found d:\tests\Logs\f55be736-beed-4b9b-aedf-c133536c946e\setupact_6.log with update date 6/12/2019 2:44:20 PM to be the correct setup log. -Found d:\tests\Logs\f55be736-beed-4b9b-aedf-c133536c946e\setupact_1.log with update date 6/12/2019 2:45:19 PM to be the correct rollback log. +Found d:\tests\Logs\f55be736-beed-4b9b-aedf-c133536c946e\setupact_6.log with update date 6/12/2023 2:44:20 PM to be the correct setup log. +Found d:\tests\Logs\f55be736-beed-4b9b-aedf-c133536c946e\setupact_1.log with update date 6/12/2023 2:45:19 PM to be the correct rollback log. Gathering baseline information from setup logs... @@ -208,241 +264,108 @@ SetupDiag found 1 matching issue. SetupDiag results were logged to: c:\setupdiag\results.xml Logs ZipFile created at: c:\setupdiag\Logs_14.zip - ``` ## Rules -When searching log files, SetupDiag uses a set of rules to match known issues. These rules are contained in the rules.xml file that is extracted when SetupDiag is run. The rules.xml file might be updated as new versions of SetupDiag are made available. For more information, see the [release notes](#release-notes) section. +When SetupDiag searches log files, it uses a set of rules to match known issues. These rules are contained in an xml file. The xml file might be updated with new and updated rules as new versions of SetupDiag are made available. -Each rule name and its associated unique rule identifier are listed with a description of the known upgrade-blocking issue. In the rule descriptions, the term "down-level" refers to the first phase of the upgrade process, which runs under the starting OS. +Each rule name and its associated unique rule identifier are listed with a description of the known upgrade-blocking issue. In the rule descriptions, the term **down-level** refers to the first phase of the upgrade process, which runs under the original OS. -1. CompatScanOnly - FFDAFD37-DB75-498A-A893-472D49A1311D - - This rule indicates that `setup.exe` was called with a specific command line parameter that indicated setup was to do a compat scan only, not an upgrade. -2. BitLockerHardblock - C30152E2-938E-44B8-915B-D1181BA635AE - - This is an upgrade block when the target OS doesn't support BitLocker, yet the host OS has BitLocker enabled. -3. VHDHardblock - D9ED1B82-4ED8-4DFD-8EC0-BE69048978CC - - This block happens when the host OS is booted to a VHD image. Upgrade isn't supported when the host OS is booted from a VHD image. -4. PortableWorkspaceHardblock - 5B0D3AB4-212A-4CE4-BDB9-37CA404BB280 - - This indicates that the host OS is booted from a Windows To-Go device (USB key). Upgrade isn't supported in the Windows To-Go environment. -5. AuditModeHardblock - A03BD71B-487B-4ACA-83A0-735B0F3F1A90 - - This block indicates that the host OS is currently booted into Audit Mode, a special mode for modifying the Windows state. Upgrade isn't supported from this state. -6. SafeModeHardblock - 404D9523-B7A8-4203-90AF-5FBB05B6579B - - This block indicates that the host OS is booted to Safe Mode, where upgrade isn't supported. -7. InsufficientSystemPartitionDiskSpaceHardblock - 3789FBF8-E177-437D-B1E3-D38B4C4269D1 - - This block is encountered when setup determines the system partition (where the boot loader files are stored) doesn't have enough space to be serviced with the newer boot files required during the upgrade process. -8. CompatBlockedApplicationAutoUninstall - BEBA5BC6-6150-413E-8ACE-5E1EC8D34DD5 - - This rule indicates there's an application that needs to be uninstalled before setup can continue. -9. CompatBlockedApplicationDismissable - EA52620B-E6A0-4BBC-882E-0686605736D9 - - When running setup in /quiet mode, there are dismissible application messages that turn into blocks unless the command line also specifies "/compat ignorewarning". This rule indicates setup was executed in /quiet mode but there's an application dismissible block message that has prevented setup from continuing. -10. CompatBlockedApplicationManualUninstall - 9E912E5F-25A5-4FC0-BEC1-CA0EA5432FF4 - - This rule indicates that an application without an Add/Remove Programs entry, is present on the system and blocking setup from continuing. This typically requires manual removal of the files associated with this application to continue. -11. HardblockDeviceOrDriver - ED3AEFA1-F3E2-4F33-8A21-184ADF215B1B - - This error indicates a device driver that is loaded on the host OS isn't compatible with the newer OS version and needs to be removed prior to the upgrade. -12. HardblockMismatchedLanguage - 60BA8449-CF23-4D92-A108-D6FCEFB95B45 - - This rule indicates the host OS and the target OS language editions don't match. -13. HardblockFlightSigning - 598F2802-3E7F-4697-BD18-7A6371C8B2F8 - - This rule indicates the target OS is a pre-release, Windows Insider build, and the target machine has Secure Boot enabled. This will block the pre-release signed build from booting if installed on the machine. -14. DiskSpaceBlockInDownLevel - 6080AFAC-892E-4903-94EA-7A17E69E549E - - This failure indicates the system ran out of disk space during the down-level operations of upgrade. -15. DiskSpaceFailure - 981DCBA5-B8D0-4BA7-A8AB-4030F7A10191 - - This failure indicates the system drive ran out of available disk space at some point after the first reboot into the upgrade. -16. DeviceInstallHang - 37BB1C3A-4D79-40E8-A556-FDA126D40BC6 - - This failure rule indicates the system hung or bug checked during the device installation phase of upgrade. -17. DebugSetupMemoryDump - C7C63D8A-C5F6-4255-8031-74597773C3C6 - - This offline only rule indicates a bug check occurred during setup. If the debugger tools are available on the system, SetupDiag will debug the memory dump and provide details. -18. DebugSetupCrash - CEEBA202-6F04-4BC3-84B8-7B99AED924B1 - - This offline only rule indicates that setup itself encountered a failure that resulted in a process memory dump. If the debugger tools are installed on the system, SetupDiag will debug the memory dump and give further details. -19. DebugMemoryDump - 505ED489-329A-43F5-B467-FCAAF6A1264C - - This offline only rule is for any memory.dmp file that resulted during the setup/upgrade operation. If the debugger tools are installed on the system, SetupDiag will debug the memory dump and give further details. -20. BootFailureDetected - 4FB446C2-D4EC-40B4-97E2-67EB19D1CFB7 - - This rule indicates a boot failure occurred during a specific phase of the update. The rule will indicate the failure code and phase for diagnostic purposes. -21. FindDebugInfoFromRollbackLog - 9600EB68-1120-4A87-9FE9-3A4A70ACFC37 - - This rule will determine and give details when a bug check occurs during the setup/upgrade process that resulted in a memory dump, but without the requirement of the debugger package being on the executing machine. -22. AdvancedInstallerFailed - 77D36C96-32BE-42A2-BB9C-AAFFE64FCADC - - Finds fatal advanced installer operations that cause setup failures. -23. FindMigApplyUnitFailure - A4232E11-4043-4A37-9BF4-5901C46FD781 - - Detects a migration unit failure that caused the update to fail. This rule will output the name of the migration plug-in and the error code it produced for diagnostic purposes. -24. FindMigGatherUnitFailure - D04C064B-CD77-4E64-96D6-D26F30B4EE29 - - Detects a migration gather unit failure that caused the update to fail. This rule will output the name of the gather unit/plug-in and the error code it produced for diagnostic purposes. -25. CriticalSafeOSDUFailure - 73566DF2-CA26-4073-B34C-C9BC70DBF043 - - This rule indicates a failure occurred while updating the SafeOS image with a critical dynamic update. It will indicate the phase and error code that occurred while attempting to update the SafeOS image for diagnostic purposes. -26. UserProfileCreationFailureDuringOnlineApply - 678117CE-F6A9-40C5-BC9F-A22575C78B14 - - Indicates there was a critical failure while creating or modifying a User Profile during the online apply phase of the update. It will indicate the operation and error code associated with the failure for diagnostic purposes. -27. WimMountFailure - BE6DF2F1-19A6-48C6-AEF8-D3B0CE3D4549 - - This rule indicates the update failed to mount a WIM file. It will show the name of the WIM file and the error message and error code associated with the failure for diagnostic purposes. -28. FindSuccessfulUpgrade - 8A0824C8-A56D-4C55-95A0-22751AB62F3E - - Determines if the given setup was a success or not based off the logs. -29. FindSetupHostReportedFailure - 6253C04F-2E4E-4F7A-B88E-95A69702F7EC - - Gives information about failures surfaced early in the upgrade process by setuphost.exe -30. FindDownlevelFailure - 716334B7-F46A-4BAA-94F2-3E31BC9EFA55 - - Gives failure information surfaced by SetupPlatform, later in the down-level phase. -31. FindAbruptDownlevelFailure - 55882B1A-DA3E-408A-9076-23B22A0472BD - - Gives last operation failure information when the system fails in the down-level, but the log just ends abruptly. -32. FindSetupPlatformFailedOperationInfo - 307A0133-F06B-4B75-AEA8-116C3B53C2D1 - - Gives last phase and error information when SetupPlatform indicates a critical failure. This rule will indicate the operation and error associated with the failure for diagnostic purposes. -33. FindRollbackFailure - 3A43C9B5-05B3-4F7C-A955-88F991BB5A48 - - Gives last operation, failure phase and error information when a rollback occurs. -34. AdvancedInstallerGenericFailure - 4019550D-4CAA-45B0-A222-349C48E86F71 - - A rule to match AdvancedInstaller read/write failures in a generic sense. Will output the executable being called as well as the error code and exit code reported. -35. OptionalComponentFailedToGetOCsFromPackage - D012E2A2-99D8-4A8C-BBB2-088B92083D78 (NOTE: This rule replaces the OptionalComponentInstallFailure rule present in v1.10. - - This matches a specific Optional Component failure when attempting to enumerate components in a package. Will output the package name and error code. -36. OptionalComponentOpenPackageFailed - 22952520-EC89-4FBD-94E0-B67DF88347F6 - - Matches a specific Optional Component failure when attempting to open an OC package. Will output the package name and error code. -37. OptionalComponentInitCBSSessionFailed - 63340812-9252-45F3-A0F2-B2A4CA5E9317 - - Matches a specific failure where the advanced installer service or components aren't operating or started on the system. Will output the error code. -38. UserProfileCreationFailureDuringFinalize - C6677BA6-2E53-4A88-B528-336D15ED1A64 - - Matches a specific User Profile creation error during the finalize phase of setup. Will output the failure code. -39. WimApplyExtractFailure - 746879E9-C9C5-488C-8D4B-0C811FF3A9A8 - - Matches a WIM apply failure during WIM extraction phases of setup. Will output the extension, path and error code. -40. UpdateAgentExpanderFailure - 66E496B3-7D19-47FA-B19B-4040B9FD17E2 - - Matches DPX expander failures in the down-level phase of update from Windows Update. Will output the package name, function, expression and error code. -41. FindFatalPluginFailure - E48E3F1C-26F6-4AFB-859B-BF637DA49636 - - Matches any plug-in failure that setupplatform decides is fatal to setup. Will output the plugin name, operation and error code. -42. AdvancedInstallerFailed - 77D36C96-32BE-42A2-BB9C-AAFFE64FCADC - - Indicates critical failure in the AdvancedInstaller while running an installer package, includes the .exe being called, the phase, mode, component and error codes. -43. MigrationAbortedDueToPluginFailure - D07A24F6-5B25-474E-B516-A730085940C9 - - Indicates a critical failure in a migration plugin that causes setup to abort the migration. Will provide the setup operation, plug-in name, plug-in action and error code. -44. DISMAddPackageFailed - 6196FF5B-E69E-4117-9EC6-9C1EAB20A3B9 - - Indicates a critical failure during a DISM add package operation. Will specify the Package Name, DISM error and add package error code. -45. PlugInComplianceBlock - D912150B-1302-4860-91B5-527907D08960 - - Detects all compat blocks from Server compliance plug-ins. Outputs the block information and remediation. -46. AdvancedInstallerGenericFailure - 4019550D-4CAA-45B0-A222-349C48E86F71 - - Triggers on advanced installer failures in a generic sense, outputting the application called, phase, mode, component and error code. -47. FindMigGatherApplyFailure - A9964E6C-A2A8-45FF-B6B5-25E0BD71428E - - Shows errors when the migration Engine fails out on a gather or apply operation. Indicates the Migration Object (file or registry path), the Migration -48. OptionalComponentFailedToGetOCsFromPackage - D012E2A2-99D8-4A8C-BBB2-088B92083D78 - - Indicates the optional component (OC) migration operation failed to enumerate optional components from an OC Package. Outputs the package name and error code. -49. OptionalComponentOpenPackageFailed - 22952520-EC89-4FBD-94E0-B67DF88347F6 - - Indicates the optional component migration operation failed to open an optional component Package. Outputs the package name and error code. -50. OptionalComponentInitCBSSessionFailed - 63340812-9252-45F3-A0F2-B2A4CA5E9317 - - Indicates corruption in the servicing stack on the down-level system. Outputs the error code encountered while trying to initialize the servicing component on the existing OS. -51. DISMproviderFailure - D76EF86F-B3F8-433F-9EBF-B4411F8141F4 - - Triggers when a DISM provider (plug-in) fails in a critical operation. Outputs the file (plug-in name), function called + error code, and error message from the provider. -52. SysPrepLaunchModuleFailure - 7905655C-F295-45F7-8873-81D6F9149BFD - - Indicates a sysPrep plug-in has failed in a critical operation. Indicates the plug-in name, operation name and error code. -53. UserProvidedDriverInjectionFailure - 2247C48A-7EE3-4037-AFAB-95B92DE1D980 - - A driver provided to setup (via command line input) has failed in some way. Outputs the driver install function and error code. -54. PlugInComplianceBlock - D912150B-1302-4860-91B5-527907D08960 - - These are for server upgrades only, will output the compliance block and remediation required. -55. PreReleaseWimMountDriverFound - 31EC76CC-27EC-4ADC-9869-66AABEDB56F0 - - Captures failures due to having an unrecognized wimmount.sys driver registered on the system. -56. WinSetupBootFilterFailure - C073BFC8-5810-4E19-B53B-4280B79E096C - - Detects failures in the kernel mode file operations. -57. WimMountDriverIssue - 565B60DD-5403-4797-AE3E-BC5CB972FBAE - - Detects failures in WimMount.sys registration on the system. -58. DISMImageSessionFailure - 61B7886B-10CD-4C98-A299-B987CB24A11C - - Captures failure information when DISM fails to start an image session successfully. -59. FindEarlyDownlevelError - A4CE4FC9-5E10-4BB1-8ECE-3B29EB9D7C52 - - Detects failures in down-level phase before setup platform is invoked. -60. FindSPFatalError - A4028172-1B09-48F8-AD3B-86CDD7D55852 - - Captures failure information when setup platform encounters a fatal error. -61. UserProfileSuffixMismatch - B4BBCCCE-F99D-43EB-9090-078213397FD8 - - Detects when a file or other object causes the migration or creation of a user profile to fail during the update. - -## Release notes - -07/27/2021 - SetupDiag v1.6.2107.27002 is released with 61 rules, as a standalone tool available in the Download Center. -- This version contains compliance updates and minor bug fixes. -- With this release and subsequent releases, the version number of the downloadable SetupDiag tool is different from the one included with Windows Setup. - -05/06/2021 - SetupDiag v1.6.1.0 is released with 61 rules, as a standalone tool available in the Download Center. -- This version of SetupDiag is included with Windows 10, version 21H1. -- A new rule is added: UserProfileSuffixMismatch. -- All outputs to the command line are now invariant culture for purposes of time/date format -- Fixed an issue with registry output in which the "no match found" result caused a corrupted REG_SZ value. - -08/08/2019 - SetupDiag v1.6.0.42 is released with 60 rules, as a standalone tool available from the Download Center. - - Log detection performance is improved. Log detection takes around 10 seconds or less where before it could take up to a minute. - - Added Setup Operation and Setup Phase information to both the results log and the registry information. - - This is the last Operation and Phase that Setup was in when the failure occurred. - - Added detailed Setup Operation and Setup Phase information (and timing) to output log when /verbose is specified. - - Note, if the issue found is a compat block, no Setup Operation or Phase info exists yet and therefore won't be available. - - Added more info to the Registry output. - - Detailed 'FailureData' info where available. Example: "AppName = MyBlockedApplication" or "DiskSpace = 6603" (in MB) - - "Key = Value" data specific to the failure found. - - Added 'UpgradeStartTime', 'UpgradeEndTime' and 'UpgradeElapsedTime' - - Added 'SetupDiagVersion', 'DateTime' (to indicate when SetupDiag was executed on the system), 'TargetOSVersion', 'HostOSVersion' and more… - - -06/19/2019 - SetupDiag v1.5.0.0 is released with 60 rules, as a standalone tool available from the Download Center. -- All date and time outputs are updated to localized format per user request. -- Added setup Operation and Phase information to /verbose log. -- Added last Setup Operation and last Setup Phase information to most rules where it makes sense (see new output below). -- Performance improvement in searching setupact.logs to determine correct log to parse. -- Added SetupDiag version number to text report (xml and json always had it). -- Added "no match" reports for xml and json per user request. -- Formatted Json output for easy readability. -- Performance improvements when searching for setup logs; this should be much faster now. -- Added seven new rules: PlugInComplianceBlock, PreReleaseWimMountDriverFound, WinSetupBootFilterFailure, WimMountDriverIssue, DISMImageSessionFailure, FindEarlyDownlevelError, and FindSPFatalError. See the [Rules](#rules) section above for more information. -- Diagnostic information is now output to the registry at **HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag** - - The **/AddReg** command was added to toggle registry output. This setting is off by default for offline mode, and on by default for online mode. The command has no effect for online mode and enables registry output for offline mode. - - This registry key is deleted as soon as SetupDiag is run a second time, and replaced with current data, so it's always up to date. - - This registry key also gets deleted when a new update instance is invoked. - - For an example, see [Sample registry key](#sample-registry-key). - -05/17/2019 - SetupDiag v1.4.1.0 is released with 53 rules, as a standalone tool available from the Download Center. -- This release dds the ability to find and diagnose reset and recovery failures (Push-Button Reset). - -12/18/2018 - SetupDiag v1.4.0.0 is released with 53 rules, as a standalone tool available from the Download Center. -- This release includes major improvements in rule processing performance: ~3x faster rule processing performance! - - The FindDownlevelFailure rule is up to 10 times faster. -- New rules have been added to analyze failures upgrading to Windows 10 version 1809. -- A new help link is available for resolving servicing stack failures on the down-level OS when the rule match indicates this type of failure. -- Removed the need to specify /Mode parameter. Now if you specify /LogsPath, it automatically assumes offline mode. -- Some functional and output improvements were made for several rules. - -07/16/2018 - SetupDiag v1.3.1 is released with 44 rules, as a standalone tool available from the Download Center. -- This release fixes a problem that can occur when running SetupDiag in online mode on a computer that produces a setupmem.dmp file, but doesn't have debugger binaries installed. - -07/10/2018 - SetupDiag v1.30 is released with 44 rules, as a standalone tool available from the Download Center. -- Bug fix for an over-matched plug-in rule. The rule will now correctly match only critical (setup failure) plug-in issues. -- New feature: Ability to output logs in JSON and XML format. - - Use "/Format:xml" or "/Format:json" command line parameters to specify the new output format. See [sample logs](#sample-logs) at the bottom of this topic. - - If the "/Format:xml" or "/Format:json" parameter is omitted, the log output format will default to text. -- New Feature: Where possible, specific instructions are now provided in rule output to repair the identified error. For example, instructions are provided to remediate known blocking issues such as uninstalling an incompatible app or freeing up space on the system drive. -- Three new rules added: AdvancedInstallerFailed, MigrationAbortedDueToPluginFailure, DISMAddPackageFailed. - -05/30/2018 - SetupDiag v1.20 is released with 41 rules, as a standalone tool available from the Download Center. -- Fixed a bug in device install failure detection in online mode. -- Changed SetupDiag to work without an instance of setupact.log. Previously, SetupDiag required at least one setupact.log to operate. This change enables the tool to analyze update failures that occur prior to calling SetupHost. -- Telemetry is refactored to only send the rule name and GUID (or "NoRuleMatched" if no rule is matched) and the Setup360 ReportId. This change assures data privacy during rule processing. - -05/02/2018 - SetupDiag v1.10 is released with 34 rules, as a standalone tool available from the Download Center. -- A performance enhancement has been added to result in faster rule processing. -- Rules output now includes links to support articles, if applicable. -- SetupDiag now provides the path and name of files that it's processing. -- You can now run SetupDiag by selecting it and then examining the output log file. -- An output log file is now always created, whether or not a rule was matched. - -03/30/2018 - SetupDiag v1.00 is released with 26 rules, as a standalone tool available from the Download Center. +| Rule Name | GUID | Description | +| --- | --- | +| **CompatScanOnly** | FFDAFD37-DB75-498A-A893-472D49A1311D | This rule indicates that `setup.exe` was called with a specific command line parameter that indicated setup was to do a compatibility scan only, not an upgrade. | +| **PlugInComplianceBlock** | D912150B-1302-4860-91B5-527907D08960 | Detects all compatibility blocks from Server compliance plug-ins. This rule is for server upgrades only. It outputs the compliance block and remediation required. | +| **BitLockerHardblock** | C30152E2-938E-44B8-915B-D1181BA635AE | This block is an upgrade block when the target OS doesn't support BitLocker, yet the host OS has BitLocker enabled. | +| **VHDHardblock** | D9ED1B82-4ED8-4DFD-8EC0-BE69048978CC | This block happens when the host OS is booted to a VHD image. Upgrade isn't supported when the host OS is booted from a VHD image. | +| **PortableWorkspaceHardblock** | 5B0D3AB4-212A-4CE4-BDB9-37CA404BB280 | This block indicates that the host OS is booted from a Windows To-Go device (USB key). Upgrade isn't supported in the Windows To-Go environment. | +| **AuditModeHardblock** | A03BD71B-487B-4ACA-83A0-735B0F3F1A90 | This block indicates that the host OS is currently booted into Audit Mode, a special mode for modifying the Windows state. Upgrade isn't supported from this state. | +| **SafeModeHardblock** | 404D9523-B7A8-4203-90AF-5FBB05B6579B | This block indicates that the host OS is booted to Safe Mode, where upgrade isn't supported. | +| **InsufficientSystemPartitionDiskSpaceHardblock** | 3789FBF8-E177-437D-B1E3-D38B4C4269D1 | This block is encountered when setup determines the system partition doesn't have enough space to be serviced with the newer boot files required during the upgrade process. The system partition is where the boot loader files are stored | +| **CompatBlockedApplicationAutoUninstall** | BEBA5BC6-6150-413E-8ACE-5E1EC8D34DD5 | This rule indicates there's an application that needs to be uninstalled before setup can continue. | +| **CompatBlockedApplicationDismissable** | EA52620B-E6A0-4BBC-882E-0686605736D9 | When setup is run in **/quiet** mode, there are dismissible application messages that turn into blocks unless the command line also specifies **/compat ignorewarning**. This rule indicates setup was executed in **/quiet** mode but there's an application dismissible block message that prevented setup from continuing. | +| **CompatBlockedFODDismissable** | 7B693C42-793E-4E9E-A10B-ED0F33D45E2A | When setup is run in **/quiet** mode, there are dismissible Feature On Demand messages that turn into blocks unless the command line also specifies **/compat ignorewarning**. This rule indicates setup was executed in **/quiet** mode but there's a Feature On Demand dismissible block message that prevented setup from continuing, usually that the target OS image is missing a Feature On Demand that is installed in the current OS. Removal of the Feature On Demand in the current OS should also resolve the issue. +| **CompatBlockedApplicationManualUninstall** | 9E912E5F-25A5-4FC0-BEC1-CA0EA5432FF4 | This rule indicates that an application without an Add/Remove Programs entry, is present on the system and blocking setup from continuing. This block typically requires manual removal of the files associated with this application to continue. | +| **GenericCompatBlock** | 511B9D95-C945-4F9B-BD63-98F1465E1CF6 | The rule indicates that system doesn't meet a hardware requirement for running Windows. For example, the device is missing a requirement for TPM 2.0. This issue can occur even when an attempt is made to bypass the hardware requirements. | +| **GatedCompatBlock** | 34A9F145-3842-4A68-987F-4622EE0FC162 | This rule indicates that the upgrade failed due to a temporary block. A temporary block is put in place when an issue is found with a specific piece of software or hardware driver and the issue has a fix pending. The block is lifted once the fix is widely available. | +| **HardblockDeviceOrDriver** | ED3AEFA1-F3E2-4F33-8A21-184ADF215B1B | This error indicates a device driver that is loaded on the host OS isn't compatible with the newer OS version. The device driver needs to be removed prior to the upgrade. | +| **HardblockMismatchedLanguage** | 60BA8449-CF23-4D92-A108-D6FCEFB95B45 | This rule indicates the host OS and the target OS language editions don't match. | +| **HardblockFlightSigning** | 598F2802-3E7F-4697-BD18-7A6371C8B2F8 | This rule indicates the target OS is a pre-release, Windows Insider build, and the target machine has Secure Boot enabled. This rule blocks the pre-release signed build from booting if installed on the machine. | +| **DiskSpaceBlockInDownLevel** | 6080AFAC-892E-4903-94EA-7A17E69E549E | This failure indicates the system ran out of disk space during the down-level operations of upgrade. | +| **DiskSpaceFailure** | 981DCBA5-B8D0-4BA7-A8AB-4030F7A10191 | This failure indicates the system drive ran out of available disk space at some point after the first reboot into the upgrade. | +| **PreReleaseWimMountDriverFound** | 31EC76CC-27EC-4ADC-9869-66AABEDB56F0 | Captures failures due to having an unrecognized `wimmount.sys` driver registered on the system. | +| **DebugSetupMemoryDump** | C7C63D8A-C5F6-4255-8031-74597773C3C6 | This offline only rule indicates a bug check occurred during setup. If the debugger tools are available on the system, SetupDiag debugs the memory dump and provide details. | +| **DebugSetupCrash** | CEEBA202-6F04-4BC3-84B8-7B99AED924B1 | This offline only rule indicates that setup itself encountered a failure that resulted in a process memory dump. If the debugger tools are installed on the system, SetupDiag debugs the memory dump and give further details. | +| **DebugMemoryDump** | 505ED489-329A-43F5-B467-FCAAF6A1264C | This offline only rule is for any memory.dmp file that resulted during the setup/upgrade operation. If the debugger tools are installed on the system, SetupDiag debugs the memory dump and give further details. | +| **DeviceInstallHang** | 37BB1C3A-4D79-40E8-A556-FDA126D40BC6 | This failure rule indicates the system hung or bug checked during the device installation phase of upgrade. | +| **DriverPackageMissingFileFailure** | 37BB1C3A-4D79-40E8-A556-FDA126D40BC6 | This rule indicates that a driver package had a missing file during device install. Updating the driver package might help resolve the issue. | +| **UnsignedDriverBootFailure** | CD270AA4-C044-4A22-886A-F34EF2E79469 | This rule indicates that an unsigned driver caused a boot failure. | +| **BootFailureDetected** | 4FB446C2-D4EC-40B4-97E2-67EB19D1CFB7 | This rule indicates a boot failure occurred during a specific phase of the update. The rule indicates the failure code and phase for diagnostic purposes. | +| **WinSetupBootFilterFailure** | C073BFC8-5810-4E19-B53B-4280B79E096C | Detects failures in the kernel mode file operations. | +| **FindDebugInfoFromRollbackLog** | 9600EB68-1120-4A87-9FE9-3A4A70ACFC37 | This rule determines and gives details when a bug check occurs during the setup/upgrade process that resulted in a memory dump. However, a debugger package isn't required on the executing machine. | +| **AdvancedInstallerFailed** | 77D36C96-32BE-42A2-BB9C-AAFFE64FCADC | Finds fatal advanced installer operations that cause setup failures. Indicates critical failure in the AdvancedInstaller while running an installer package, includes the .exe being called, the phase, mode, component and error codes. | +| **AdvancedInstallerPluginInstallFailed** | 2F784A0E-CEB1-47C5-8072-F1294C7CB4AE | This rule indicates some component that was being installed via an advanced installer (FeatureOnDemand, Language Packs, .NET packages, etc.) failed to install. The rule calls out what was being installed. If the failed component is a FeatureOnDemand, remove the Windows Feature, reboot, and try the upgrade again. If the failed component is a Language Pack, remove the additional language pack, reboot, and try the upgrade again. | +| **AdvancedInstallerGenericFailure** | 4019550D-4CAA-45B0-A222-349C48E86F71 | A rule to match AdvancedInstaller read/write failures in a generic sense. Triggers on advanced installer failures in a generic sense. It outputs the application called, phase, mode, component and error code. | +| **FindMigApplyUnitFailure** | A4232E11-4043-4A37-9BF4-5901C46FD781 | Detects a migration unit failure that caused the update to fail. This rule outputs the name of the migration plug-in and the error code it produced for diagnostic purposes. | +| **FindMigGatherUnitFailure** | D04C064B-CD77-4E64-96D6-D26F30B4EE29 | Detects a migration gather unit failure that caused the update to fail. This rule outputs the name of the gather unit/plug-in and the error code it produced for diagnostic purposes. | +| **FindMigGatherApplyFailure** | A9964E6C-A2A8-45FF-B6B5-25E0BD71428E | Shows errors when the migration Engine fails out on a gather or apply operation. Indicates the Migration Object (file or registry path), the Migration | +| **OptionalComponentFailedToGetOCsFromPackage** | D012E2A2-99D8-4A8C-BBB2-088B92083D78 | This rule matches a specific Optional Component failure when attempting to enumerate components in a package. Indicates the optional component (OC) migration operation failed to enumerate optional components from an OC Package. It outputs the package name and error code. This rule replaces the OptionalComponentInstallFailure rule present. | +| **OptionalComponentOpenPackageFailed** | 22952520-EC89-4FBD-94E0-B67DF88347F6 | Matches a specific Optional Component failure when attempting to open an OC package. It outputs the package name and error code. Indicates the optional component migration operation failed to open an optional component Package. Outputs the package name and error code. | +| **OptionalComponentInitCBSSessionFailed** | 63340812-9252-45F3-A0F2-B2A4CA5E9317 | Matches a specific failure where the advanced installer service or components aren't operating or started on the system. Indicates corruption in the servicing stack on the down-level system. Outputs the error code encountered while trying to initialize the servicing component on the existing OS. | +| **CriticalSafeOSDUFailure** | 73566DF2-CA26-4073-B34C-C9BC70DBF043 | This rule indicates a failure occurred while updating the SafeOS image with a critical dynamic update. It indicates the phase and error code that occurred while attempting to update the SafeOS image for diagnostic purposes. | +| **UserProfileCreationFailureDuringOnlineApply** | 678117CE-F6A9-40C5-BC9F-A22575C78B14 | Indicates there was a critical failure while creating or modifying a User Profile during the online apply phase of the update. It indicates the operation and error code associated with the failure for diagnostic purposes. | +| **UserProfileCreationFailureDuringFinalize** | C6677BA6-2E53-4A88-B528-336D15ED1A64 | Matches a specific User Profile creation error during the finalize phase of setup. It outputs the failure code. | +| **UserProfileSuffixMismatch** | B4BBCCCE-F99D-43EB-9090-078213397FD8 | Detects when a file or other object causes the migration or creation of a user profile to fail during the update. | +| **DuplicateUserProfileFailure** | BD7B3109-80F1-4421-8F0A-B34CD25F4B51 | This rule indicates a fatal error while migrating user profiles, usually with multiple SIDs associated with a single user profile. This error usually occurs when software creates local user accounts that aren't ever used or signed in with. The rule indicates the SID and UserName of the account that is causing the failure. To attempt to resolve the issue, first back up all the user's files for the affected user account. After the user's files are backed up, delete the account in a supported manner. Make sure that the account isn't one that is needed or is currently used to sign into the device. After deleting the account, reboot, and try the upgrade again. | +| **WimMountFailure** | BE6DF2F1-19A6-48C6-AEF8-D3B0CE3D4549 | This rule indicates the update failed to mount a WIM file. It shows the name of the WIM file and the error message and error code associated with the failure for diagnostic purposes. | +| **WimMountDriverIssue** | 565B60DD-5403-4797-AE3E-BC5CB972FBAE | Detects failures in `WimMount.sys` registration on the system. | +| **WimApplyExtractFailure** | 746879E9-C9C5-488C-8D4B-0C811FF3A9A8 | Matches a WIM apply failure during WIM extraction phases of setup. It outputs the extension, path and error code. | +| **UpdateAgentExpanderFailure** | 66E496B3-7D19-47FA-B19B-4040B9FD17E2 | Matches DPX expander failures in the down-level phase of update from Windows Update. It outputs the package name, function, expression and error code. | +| **FindFatalPluginFailure** | E48E3F1C-26F6-4AFB-859B-BF637DA49636 | Matches any plug-in failure that setupplatform decides is fatal to setup. It outputs the plugin name, operation and error code. | +| **MigrationAbortedDueToPluginFailure** | D07A24F6-5B25-474E-B516-A730085940C9 | Indicates a critical failure in a migration plugin that causes setup to abort the migration. Provides the setup operation, plug-in name, plug-in action and error code. | +| **DISMAddPackageFailed** | 6196FF5B-E69E-4117-9EC6-9C1EAB20A3B9 | Indicates a critical failure during a DISM add package operation. Specifies the Package Name, DISM error and add package error code. | +| **DISMImageSessionFailure** | 61B7886B-10CD-4C98-A299-B987CB24A11C | Captures failure information when DISM fails to start an image session successfully. | +| **DISMproviderFailure** | D76EF86F-B3F8-433F-9EBF-B4411F8141F4 | Triggers when a DISM provider (plug-in) fails in a critical operation. Outputs the file (plug-in name), function called + error code, and error message from the provider. | +| **SysPrepLaunchModuleFailure** | 7905655C-F295-45F7-8873-81D6F9149BFD | Indicates a sysPrep plug-in failed in a critical operation. Indicates the plug-in name, operation name and error code. | +| **UserProvidedDriverInjectionFailure** | 2247C48A-7EE3-4037-AFAB-95B92DE1D980 | A driver provided to setup (via command line input) failed in some way. Outputs the driver install function and error code. | +| **DriverMigrationFailure** | 9378D9E2-256E-448C-B02F-137F611F5CE3 | This rule indicates a fatal failure when migrating drivers. | +| **UnknownDriverMigrationFailure** | D7541B80-5071-42CE-AD14-FBE8C0C4F7FD | This rule indicates a bad driver package resides on the system. The driver package causes the upgrade to fail when the driver package is attempted to migrate to the new OS. The rule usually indicates the driver package name that caused the issue. The remediation is to remove the bad driver package, reboot, and try the upgrade again. If an update to this driver is available from the OEM, updating the driver package is recommended. | +| | | +| **FindSuccessfulUpgrade** | 8A0824C8-A56D-4C55-95A0-22751AB62F3E | Determines if the given setup was a success or not based off the logs. | +| **FindSetupHostReportedFailure** | 6253C04F-2E4E-4F7A-B88E-95A69702F7EC | Gives information about failures surfaced early in the upgrade process by `setuphost.exe` | +| **FindDownlevelFailure** | 716334B7-F46A-4BAA-94F2-3E31BC9EFA55 | Gives failure information surfaced by SetupPlatform, later in the down-level phase. | +| **FindAbruptDownlevelFailure** | 55882B1A-DA3E-408A-9076-23B22A0472BD | Gives last operation failure information when the system fails in the down-level, but the log just ends abruptly. | +| **FindEarlyDownlevelError** | A4CE4FC9-5E10-4BB1-8ECE-3B29EB9D7C52 | Detects failures in down-level phase before setup platform is invoked. | +| **FindSPFatalError** | A4028172-1B09-48F8-AD3B-86CDD7D55852 | Captures failure information when setup platform encounters a fatal error. | +| **FindSetupPlatformFailedOperationInfo** | 307A0133-F06B-4B75-AEA8-116C3B53C2D1 | Gives last phase and error information when SetupPlatform indicates a critical failure. This rule indicates the operation and error associated with the failure for diagnostic purposes. | +| **FindRollbackFailure** | 3A43C9B5-05B3-4F7C-A955-88F991BB5A48 | Gives last operation, failure phase and error information when a rollback occurs. | ## Sample logs ### Text log sample -``` +```txt Matching Profile found: OptionalComponentOpenPackageFailed - 22952520-EC89-4FBD-94E0-B67DF88347F6 System Information: - Machine Name = Offline - Manufacturer = MSI - Model = MS-7998 - HostOSArchitecture = x64 - FirmwareType = PCAT - BiosReleaseDate = 20160727000000.000000+000 - BiosVendor = BIOS Date: 07/27/16 10:01:46 Ver: V1.70 - BiosVersion = 1.70 - HostOSVersion = 10.0.15063 - HostOSBuildString = 15063.0.amd64fre.rs2_release.170317-1834 - TargetOSBuildString = 10.0.16299.15 (rs3_release.170928-1534) - HostOSLanguageId = 2057 - HostOSEdition = Core - RegisteredAV = Windows Defender, - FilterDrivers = WdFilter,wcifs,WIMMount,luafv,Wof,FileInfo, - UpgradeStartTime = 3/21/2018 9:47:16 PM - UpgradeEndTime = 3/21/2018 10:02:40 PM - UpgradeElapsedTime = 00:15:24 - ReportId = dd4db176-4e3f-4451-aef6-22cf46de8bde + Machine Name = Offline + Manufacturer = MSI + Model = MS-7998 + HostOSArchitecture = x64 + FirmwareType = PCAT + BiosReleaseDate = 20160727000000.000000+000 + BiosVendor = BIOS Date: 07/27/16 10:01:46 Ver: V1.70 + BiosVersion = 1.70 + HostOSVersion = 10.0.15063 + HostOSBuildString = 15063.0.amd64fre.rs2_release.170317-1834 + TargetOSBuildString = 10.0.16299.15 (rs3_release.170928-1534) + HostOSLanguageId = 2057 + HostOSEdition = Core + RegisteredAV = Windows Defender, + FilterDrivers = WdFilter,wcifs,WIMMount,luafv,Wof,FileInfo, + UpgradeStartTime = 3/21/2023 9:47:16 PM + UpgradeEndTime = 3/21/2023 10:02:40 PM + UpgradeElapsedTime = 00:15:24 + ReportId = dd4db176-4e3f-4451-aef6-22cf46de8bde Error: SetupDiag reports Optional Component installation failed to open OC Package. Package Name: Foundation, Error: 0x8007001F Recommend you check the "Windows Modules Installer" service (Trusted Installer) is started on the system and set to automatic start, reboot and try the update again. Optionally, you can check the status of optional components on the system (search for Windows Features), uninstall any unneeded optional components, reboot and try the update again. @@ -455,7 +378,7 @@ Refer to https://learn.microsoft.com/windows/deployment/upgrade/upgrade-error-co ```xml - 1.6.0.0 + 1.7.0.0 FindSPFatalError A4028172-1B09-48F8-AD3B-86CDD7D55852 @@ -474,9 +397,9 @@ Refer to https://learn.microsoft.com/windows/deployment/upgrade/upgrade-error-co Professional Windows Defender - 2019-06-06T21:19:10 + 2023-06-06T21:19:10 - 2019-06-06T22:21:49 + 2023-06-06T22:21:49 0001-01-01T00:00:00 0001-01-01T00:00:00 @@ -488,14 +411,14 @@ Refer to https://learn.microsoft.com/windows/deployment/upgrade/upgrade-error-co F21F8FB6-00FD-4349-84FB-2AC75F389E73 F21F8FB6-00FD-4349-84FB-2AC75F389E73 - 2019-06-06 21:47:11, Error SP Error converting install time 5/2/2019 to structure[gle=0x00000057] + 2023-06-06 21:47:11, Error SP Error converting install time 5/2/2023 to structure[gle=0x00000057] Error: SetupDiag reports Fatal Error. Last Setup Phase = Downlevel Last Setup Operation: Gather data, scope: EVERYTHING Error: 0x00000057 - LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5/2/2019 to structure[gle=0x00000057] - LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5/2/2019 to structure[gle=0x00000057] + LogEntry: 2023-06-06 21:47:11, Error SP Error converting install time 5/2/2023 to structure[gle=0x00000057] + LogEntry: 2023-06-06 21:47:11, Error SP Error converting install time 5/2/2023 to structure[gle=0x00000057] Refer to "https://learn.microsoft.com/windows/desktop/Debug/system-error-codes" for error information. Err = 0x00000057, LastOperation = Gather data, scope: EVERYTHING, LastPhase = Downlevel @@ -504,7 +427,7 @@ Refer to "https://learn.microsoft.com/windows/desktop/Debug/system-error-codes" ### JSON log sample -``` +```json { "Version":"1.6.0.0", "ProfileName":"FindSPFatalError", @@ -540,15 +463,15 @@ Refer to "https://learn.microsoft.com/windows/desktop/Debug/system-error-codes" "UpgradeEndTime":"\/Date(1559884909000-0700)\/", "UpgradeStartTime":"\/Date(1559881150000-0700)\/" }, - "LogErrorLine":"2019-06-06 21:47:11, Error SP Error converting install time 5\/2\/2019 to structure[ + "LogErrorLine":"2023-06-06 21:47:11, Error SP Error converting install time 5\/2\/2023 to structure[ gle=0x00000057 ]", "FailureData":[ "\u000aError: SetupDiag reports Fatal Error.\u000aLast Setup Phase = Downlevel\u000aLast Setup Operation: Gather data, scope: EVERYTHING\u000aError: 0x00000057", - "LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5\/2\/2019 to structure[ + "LogEntry: 2023-06-06 21:47:11, Error SP Error converting install time 5\/2\/2023 to structure[ gle=0x00000057 ]", - "LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5\/2\/2019 to structure[ + "LogEntry: 2023-06-06 21:47:11, Error SP Error converting install time 5\/2\/2023 to structure[ gle=0x00000057 ]", "\u000aRefer to \"https:\/\/learn.microsoft.com\/windows\/desktop\/Debug\/system-error-codes\" for error information." @@ -563,10 +486,10 @@ Refer to "https://learn.microsoft.com/windows/desktop/Debug/system-error-codes" } ``` -## Sample registry key +## Example registry key -![Example of Addreg.](./../images/addreg.png) +:::image type="content" alt-text="Example of Addreg registry key." source="../images/addreg.png"::: ## Related articles -[Resolve Windows 10 upgrade errors: Technical information for IT Pros](./resolve-windows-10-upgrade-errors.md) +- [Resolve Windows upgrade errors: Technical information for IT Pros](./resolve-windows-upgrade-errors.md). diff --git a/windows/deployment/upgrade/submit-errors.md b/windows/deployment/upgrade/submit-errors.md index 5bd00dddf7..d970501fec 100644 --- a/windows/deployment/upgrade/submit-errors.md +++ b/windows/deployment/upgrade/submit-errors.md @@ -1,72 +1,75 @@ --- -title: Submit Windows 10 upgrade errors using Feedback Hub +title: Submit Windows upgrade errors using Feedback Hub manager: aaroncz ms.author: frankroj -description: Download the Feedback Hub app, and then submit Windows 10 upgrade errors for diagnosis using feedback hub. +description: Download the Feedback Hub app, and then submit Windows upgrade errors for diagnosis using feedback hub. ms.prod: windows-client author: frankroj ms.localizationpriority: medium ms.topic: article ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 01/18/2024 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- -# Submit Windows 10 upgrade errors using Feedback Hub +# Submit Windows upgrade errors using Feedback Hub -**Applies to** -- Windows 10 +> [!NOTE] +> +> This article is a 100 level article (basic). +> +> See [Resolve Windows upgrade errors](resolve-windows-upgrade-errors.md) for a full list of articles in this section. ->[!NOTE] ->This is a 100 level topic (basic).
->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. - -## In this topic - -This topic describes how to submit problems with a Windows 10 upgrade to Microsoft using the Windows 10 Feedback Hub. +This article describes how to submit problems with a Windows upgrade to Microsoft using the Windows Feedback Hub. ## About the Feedback Hub -The Feedback Hub app lets you tell Microsoft about any problems you run in to while using Windows 10 and send suggestions to help us improve your Windows experience. Previously, you could only use the Feedback Hub if you were in the Windows Insider Program. Now anyone can use this tool. You can download the Feedback Hub app from the Microsoft Store [here](https://www.microsoft.com/store/p/feedback-hub/9nblggh4r32n?SilentAuth=1&wa=wsignin1.0). +The Feedback Hub app allows reporting to Microsoft of any problems encountered while using Windows. It also allows sending suggestions to Microsoft on how to improve the Windows experience. Previously, the Feedback Hub could only be used through the Windows Insider Program. Now anyone can use this tool. The Feedback Hub app can be downloaded from the [Microsoft Store](https://www.microsoft.com/store/p/feedback-hub/9nblggh4r32n?SilentAuth=1&wa=wsignin1.0). -The Feedback Hub requires Windows 10. If you're having problems upgrading from an older version of Windows to Windows 10, you can use the Feedback Hub to submit this information. However, you must collect the log files from the legacy operating system and then attach these files to your feedback using a device that is running Windows 10. If you're upgrading to Windows 10 from a previous version of Windows 10, the Feedback Hub will collect log files automatically. +The Feedback Hub requires a currently supported version of Windows. The Feedback Hub can be used to submit information to Microsoft if problems are encountered while upgrading Windows. If upgrading to a currently supported version of Windows from a previous version that's Windows 10 or newer, the Feedback Hub automatically collects log files. For operating systems prior to Windows 10 that don't support the Feedback Hub, the log files must be manually collected. The log files can then be attached to the feedback item using a device that is running a currently supported version of Windows that supports the Feedback Hub. ## Submit feedback -To submit feedback about a failed Windows 10 upgrade, select the following link: [Feedback Hub](feedback-hub://?referrer=resolveUpgradeErrorsPage&tabid=2&contextid=81&newFeedback=true&feedbackType=2&topic=submit-errors.md) +To submit feedback about a failed Windows upgrade, open the [Feedback Hub](feedback-hub://?referrer=resolveUpgradeErrorsPage&tabid=2&contextid=81&newFeedback=true&feedbackType=2&topic=submit-errors.md). -The Feedback Hub will open. +In the Feedback Hub, fill out all four sections with as much detail as possible: -- Under **Tell us about it**, and then under **Summarize your issue**, type **Upgrade failing**. -- Under **Give us more detail**, provide additional information about the failed upgrade, such as: - - When did the failure occur? - - Were there any reboots? - - How many times did the system reboot? - - How did the upgrade fail? - - Were any error codes visible? - - Did the computer fail to a blue screen? - - Did the computer automatically rollback or did it hang, requiring you to power cycle it before it rolled back? -- Additional details - - What type of security software is installed? - - Is the computer up to date with latest drivers and firmware? - - Are there any external devices connected? -- If you used the link above, the category and subcategory will be automatically selected. If it isn't selected, choose **Install and Update** and **Windows Installation**. +1. **Enter your feedback** +1. **Choose a category** +1. **Find similar feedback** +1. **Add more details** -You can attach a screenshot or file if desired. This is optional, but can be helpful when diagnosing your upgrade issue. The location of these files is described here: [Windows Setup log files and event logs](/windows-hardware/manufacture/desktop/windows-setup-log-files-and-event-logs). +Recommended information that can be included under the **Add more details** section include: -Select **Submit** to send your feedback. +- When did the failure occur? + - Were there any reboots? + - How many times did the system reboot? +- How did the upgrade fail? + - Were any error codes visible? + - Did the computer fail to a blue screen? + - Did the computer automatically rollback or did it hang, requiring the computer to be power cycled before it rolled back? +- What type of security software is installed? +- Is the computer up to date with latest drivers and firmware? +- Are there any external devices connected? -See the following example: +Using the **Attach a screenshot** and **Attach a file** options allows screenshots or files to be included as part of the feedback item. Attachments and screenshots are optional, but can be helpful when diagnosing the upgrade issue. For example, log files can be included as attachments to the feedback item. The location of the Windows upgrade log files is described in the article [Windows Setup log files and event logs](/windows-hardware/manufacture/desktop/windows-setup-log-files-and-event-logs). -![feedback example.](../images/feedback.png) +Finally the **Recreate my problem** option can be used to potentially send additional data and logs for Microsoft to evaluate. -After you select Submit, that's all you need to do. Microsoft will receive your feedback and begin analyzing the issue. You can check on your feedback periodically to see what solutions have been provided. +Once all the feedback items are completed, select the **Submit** button to send the feedback. Microsoft receives the feedback and begins analyzing the issue. The submitted feedback can be checked on periodically to see what solutions are provided. -## Link to your feedback +## Link to the feedback -After your feedback is submitted, you can email or post links to it by opening the Feedback Hub, clicking My feedback at the top, clicking the feedback item you submitted, clicking **Share**, then copying the short link that is displayed. +After the feedback is submitted, additional information and items can be added to the feedback item. To do so: -![share.](../images/share.jpg) +1. Open the [Feedback Hub](feedback-hub:). +1. At the top of the Feedback Hub, select **My feedback**. +1. Select the feedback item that was submitted. +1. Select **Share**. +1. Copy and then use the short link that is displayed. + +:::image type="content" alt-text="Share example." source="../images/share.jpg"::: ## Related articles - -[Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx) diff --git a/windows/deployment/upgrade/windows-error-reporting.md b/windows/deployment/upgrade/windows-error-reporting.md index 57c9590028..edc0e1a846 100644 --- a/windows/deployment/upgrade/windows-error-reporting.md +++ b/windows/deployment/upgrade/windows-error-reporting.md @@ -8,25 +8,27 @@ author: frankroj ms.localizationpriority: medium ms.topic: article ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 01/18/2024 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Windows Error Reporting -**Applies to** -- Windows 10 - > [!NOTE] -> This is a 300 level topic (moderately advanced). -> See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. +> +> This article is a 300 level article (moderately advanced). +> +> See [Resolve Windows upgrade errors](resolve-windows-upgrade-errors.md) for a full list of articles in this section. - -When Windows Setup fails, the result and extend code are recorded as an informational event in the Application log by Windows Error Reporting as event 1001. The event name is **WinSetupDiag02**. You can use Event Viewer to review this event, or you can use Windows PowerShell. +When Windows Setup fails, the result and extend code are recorded as an informational event in the Application log by Windows Error Reporting as event 1001. The event name is **WinSetupDiag02**. Event Viewer or Windows PowerShell can be used to review this event. To use Windows PowerShell, type the following commands from an elevated Windows PowerShell prompt: > [!IMPORTANT] -> The following source will be available only if you have updated from a previous version of Windows 10 to a new version. If you installed the current version and have not updated, the source named **WinSetupDiag02** will be unavailable. +> +> The following Event logs are only available if Windows was updated from a previous version of Windows to a new version of Windows. ```powershell $events = Get-WinEvent -FilterHashtable @{LogName="Application";ID="1001";Data="WinSetupDiag02"} @@ -34,37 +36,35 @@ $event = [xml]$events[0].ToXml() $event.Event.EventData.Data ``` -To use Event Viewer: +To use Event Viewer: + 1. Open Event Viewer and navigate to **Windows Logs\Application**. -2. Select **Find**, and then search for **winsetupdiag02**. -3. Double-click the event that is highlighted. +1. Select **Find**, and then search for **winsetupdiag02**. +1. Double-click the event that is highlighted. > [!NOTE] -> For legacy operating systems, the Event Name was WinSetupDiag01. +> +> For legacy operating systems, the Event Name was WinSetupDiag01. Ten parameters are listed in the event: -| Parameters | -| ------------- | -|P1: The Setup Scenario (1=Media,5=WindowsUpdate,7=Media Creation Tool) | -|P2: Setup Mode (x=default,1=Downlevel,5=Rollback) | -|P3: New OS Architecture (x=default,0=X86,9=AMD64) | -|P4: Install Result (x=default,0=Success,1=Failure,2=Cancel,3=Blocked) | -|**P5: Result Error Code** (Ex: 0xc1900101) | -|**P6: Extend Error Code** (Ex: 0x20017) | -|P7: Source OS build (Ex: 9600) | -|P8: Source OS branch (not typically available) | -|P9: New OS build (Ex: 16299} | -|P10: New OS branch (Ex: rs3_release} | +| Parameters | +| ------------- | +| P1: The Setup Scenario (1=Media,5=WindowsUpdate,7=Media Creation Tool) | +| P2: Setup Mode (x=default,1=Downlevel,5=Rollback) | +| P3: New OS Architecture (x=default,0=X86,9=AMD64) | +| P4: Install Result (x=default,0=Success,1=Failure,2=Cancel,3=Blocked) | +| **P5: Result Error Code** (Ex: 0xc1900101) | +| **P6: Extend Error Code** (Ex: 0x20017) | +| P7: Source OS build (Ex: 9600) | +| P8: Source OS branch (not typically available) | +| P9: New OS build (Ex: 16299) | +| P10: New OS branch (Ex: rs3_release) | -The event will also contain links to log files that can be used to perform a detailed diagnosis of the error. An example of this event from a successful upgrade is shown below. +The event also contains links to log files that can be used to perform a detailed diagnosis of the error. The following example is an example of this event from a successful upgrade: :::image type="content" alt-text="Windows Error Reporting." source="../images/event.png" lightbox="../images/event.png"::: ## Related articles -[Windows 10 FAQ for IT professionals](../planning/windows-10-enterprise-faq-itpro.yml) -[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) -[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -[Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors) \ No newline at end of file +- [Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors). diff --git a/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md b/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md index 9eebdd0921..2507bb5313 100644 --- a/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md +++ b/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md @@ -1,83 +1,99 @@ --- -title: User State Migration Tool (USMT) - Getting Started (Windows 10) -description: Plan, collect, and prepare your source computer for migration using the User State Migration Tool (USMT). +title: User State Migration Tool (USMT) - Getting Started +description: Plan, collect, and prepare the source computer for migration using the User State Migration Tool (USMT). +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.date: 11/01/2022 +ms.date: 01/09/2024 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Getting started with the User State Migration Tool (USMT) -This article outlines the general process that you should follow to migrate files and settings. +This article outlines the general process to follow to migrate files and settings. -## Step 1: Plan your migration +## Step 1: Plan the migration -1. [Plan Your Migration](usmt-plan-your-migration.md). Depending on whether your migration scenario is refreshing or replacing computers, you can choose an online migration or an offline migration using Windows Preinstallation Environment (WinPE) or the files in the Windows.old directory. For more information, see [Common Migration Scenarios](usmt-common-migration-scenarios.md). +1. [Plan The Migration](usmt-plan-your-migration.md). Depending on whether the migration scenario is refreshing or replacing computers, an online migration or an offline migration can be chosen. Offline migrations can use either Windows Preinstallation Environment (WinPE) or the files in the **Windows.old** directory. For more information, see [Common Migration Scenarios](usmt-common-migration-scenarios.md). -1. [Determine What to Migrate](usmt-determine-what-to-migrate.md). Data you might consider migrating includes end-user information, applications settings, operating-system settings, files, folders, and registry keys. +1. [Determine What to Migrate](usmt-determine-what-to-migrate.md). Data to consider migrating includes end-user information, applications settings, operating-system settings, files, folders, and registry keys. -1. Determine where to store data. Depending on the size of your migration store, you can store the data remotely, locally in a hard-link migration store or on a local external storage device, or directly on the destination computer. For more information, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md). +1. Determine where to store data. Depending on the size of the migration store, data can be stored in one of the following locations: -1. Use the `/GenMigXML` command-line option to determine which files will be included in your migration, and to determine whether any modifications are necessary. For more information, see [ScanState Syntax](usmt-scanstate-syntax.md) + - Remotely. + - Locally in a hard-link migration store or on a local external storage device. + - Directly on the destination computer. -1. Modify copies of the `Migration.xml` and `MigDocs.xml` files and create custom .xml files, if it's required. To modify the migration behavior, such as migrating the **Documents** folder but not the **Music** folder, you can create a custom .xml file or modify the rules in the existing migration .xml files. The document finder, or `MigXmlHelper.GenerateDocPatterns` helper function, can be used to automatically find user documents on a computer without creating extensive custom migration .xml files. + For more information, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md). + +1. Use the `/GenMigXML` command-line option to determine which files are included in the migration, and to determine whether any modifications are necessary. For more information, see [ScanState Syntax](usmt-scanstate-syntax.md) + +1. If necessary, modify copies of the `Migration.xml` and `MigDocs.xml` files and create custom **.xml** files. To modify the migration behavior, such as migrating the **Documents** folder but not the **Music** folder, custom **.xml** file can be created or modify the rules in the existing migration **.xml** files. The document finder, or `MigXmlHelper.GenerateDocPatterns` helper function, can be used to automatically find user documents on a computer without creating extensive custom migration **.xml** files. > [!IMPORTANT] - > We recommend that you always make and modify copies of the .xml files included in User State Migration Tool (USMT) 10.0. Never modify the original .xml files. + > + > Microsoft recommends to always make copies of the **.xml** files included in User State Migration Tool (USMT) and then modify the copies. Never modify the original **.xml** files. - You can use the `MigXML.xsd` file to help you write and validate the .xml files. For more information about how to modify these files, see [USMT XML Reference](usmt-xml-reference.md). + The `MigXML.xsd` file can be used to help write and validate the **.xml** files. For more information about how to modify these files, see [USMT XML Reference](usmt-xml-reference.md). + +1. Create a [Config.xml File](usmt-configxml-file.md) if to exclude any components from the migration. To create this file, run the `ScanState.exe` command with the following options: -1. Create a [Config.xml File](usmt-configxml-file.md) if you want to exclude any components from the migration. To create this file, run the `ScanState.exe` command with the following options: - [/genconfig](usmt-scanstate-syntax.md#migration-rule-options). - - [/i](usmt-scanstate-syntax.md#migration-rule-options) - as arguments specify the .xml files that you plan to use with `ScanState.exe`. - + - [/i](usmt-scanstate-syntax.md#migration-rule-options) - as arguments specify the **.xml** files that are being used with `ScanState.exe`. + For example, the following command creates a `Config.xml` file by using the `MigDocs.xml` and `MigApp.xml` files: ```cmd ScanState.exe /genconfig:Config.xml /i:MigDocs.xml /i:MigApp.xml /v:13 /l:ScanState.log ``` -1. Open the `Config.xml` that was generated in the previous step. Review the migration state of each of the components listed in the `Config.xml` file. If necessary, edit the `Config.xml` file and specify `migrate=no` for any components that you don't want to migrate. +1. Open the `Config.xml` that was generated in the previous step. Review the migration state of each of the components listed in the `Config.xml` file. If necessary, edit the `Config.xml` file and specify `migrate=no` for any components that don't need to be migrated. ## Step 2: Collect files and settings from the source computer 1. Back up the source computer. -1. Close all applications. If some applications are running when you run the `ScanState.exe` command, USMT might not migrate all of the specified data. For example, if Microsoft Office Outlook is open, USMT might not migrate PST files. +1. Close all applications. If some applications are running when the `ScanState.exe` command is run, USMT might not migrate all of the specified data. For example, if Microsoft Office Outlook is open, USMT might not migrate PST files. > [!NOTE] - > USMT will fail if it cannot migrate a file or setting unless you specify the `/C` option. When you specify the `/C` option, USMT will ignore the errors, and log an error every time that it encounters a file that is being used that USMT did not migrate. You can use the `` section in the `Config.xml` file to specify which errors should be ignored, and which should cause the migration to fail. + > + > USMT fails if it can't migrate a file or setting unless the `/c` option is specified. When the `/c` option is specified, USMT ignores the errors, and logs an error every time that it encounters a file that is being used that USMT didn't migrate. The `` section in the `Config.xml` file can be used to specify which errors should be ignored, and which should cause the migration to fail. -1. Run the `ScanState.exe` command on the source computer to collect files and settings. You should specify all of the .xml files that you want the `ScanState.exe` command to use. For example, +1. Run the `ScanState.exe` command on the source computer to collect files and settings. All of the **.xml** files that the `ScanState.exe` command needs to use should be specified. For example, ```cmd ScanState.exe \\server\migration\mystore /config:Config.xml /i:MigDocs.xml /i:MigApp.xml /v:13 /l:ScanState.log ``` > [!NOTE] - > If the source computer is running Windows 7, or Windows 8, you must run the `ScanState.exe` command in **Administrator** mode. To run in **Administrator** mode, right-click **Command Prompt**, and then select **Run As Administrator**. For more information about the how the `ScanState.exe` command processes and stores the data, see [How USMT Works](usmt-how-it-works.md). + > + > The `ScanState.exe` command must be run in **Administrator** mode on the source computer. To run in **Administrator** mode, right-click **Command Prompt**, and then select **Run As Administrator**. For more information about how the `ScanState.exe` command processes and stores the data, see [How USMT Works](usmt-how-it-works.md). -1. Run the `UsmtUtils.exe` command with the `/Verify` option to ensure that the store you created isn't corrupted. +1. Run the `UsmtUtils.exe` command with the `/Verify` option to ensure that the created store isn't corrupted. ## Step 3: Prepare the destination computer and restore files and settings 1. Install the operating system on the destination computer. -1. Install all applications that were on the source computer. Although it isn't always required, we recommend installing all applications on the destination computer before you restore the user state. This makes sure that migrated settings are preserved. +1. Install all applications that were on the source computer. Although it isn't always required, Microsoft recommends installing all applications on the destination computer before restoring the user state. Installing all applications before restoring user state makes sure that migrated settings are preserved. > [!NOTE] - > The application version that is installed on the destination computer should be the same version as the one on the source computer. USMT does not support migrating the settings for an older version of an application to a newer version. The exception to this is Microsoft Office, which USMT can migrate from an older version to a newer version. + > + > The application version that is installed on the destination computer should be the same version as the one on the source computer. USMT doesn't support migrating the settings for an older version of an application to a newer version. The exception for this rule is Microsoft Office. USMT can migrate from an older version of Microsoft Office to a newer version of Microsoft Office. -1. Close all applications. If some applications are running when you run the `LoadState.exe ` command, USMT might not migrate all of the specified data. For example, if Microsoft Office Outlook is open, USMT might not migrate PST files. +1. Close all applications. If some applications are running when the `LoadState.exe` command runs, USMT might not migrate all of the specified data. For example, if Microsoft Office Outlook is open, USMT might not migrate PST files. > [!NOTE] - > Use `/C` to continue your migration if errors are encountered, and use the `` section in the `Config.xml` file to specify which errors should be ignored, and which errors should cause the migration to fail. + > + > Use `/c` to continue the migration if errors are encountered. Use the `` section in the `Config.xml` file to specify which errors should be ignored, and which errors should cause the migration to fail. -1. Run the `LoadState.exe ` command on the destination computer. Specify the same set of .xml files that you specified when you used the `ScanState.exe` command. However, you don't have to specify the `Config.xml` file, unless you want to exclude some of the files and settings that you migrated to the store. For example, you might want to migrate the My Documents folder to the store, but not to the destination computer. To do this, modify the `Config.xml` file and specify the updated file by using the `LoadState.exe ` command. Then, the `LoadState.exe ` command will migrate only the files and settings that you want to migrate. For more information about how the `LoadState.exe ` command processes and migrates data, see [How USMT Works](usmt-how-it-works.md). +1. Run the `LoadState.exe` command on the destination computer. Specify the same set of **.xml** files that were specified when the `ScanState.exe` command was used. However, the `Config.xml` file doesn't always need to be specified. The `Config.xml` file only needs to be specified to exclude some of the files and settings that were migrated to the store. For example, the **Documents** folder was migrated to the store, but doesn't need to be migrated to the destination computer. For example, modify the `Config.xml` file and specify the updated file by using the `LoadState.exe` command. Then, the `LoadState.exe` command migrates only the files and settings that need to be migrated. For more information about how the `LoadState.exe` command processes and migrates data, see [How USMT Works](usmt-how-it-works.md). For example, the following command migrates the files and settings: @@ -86,6 +102,7 @@ This article outlines the general process that you should follow to migrate file ``` > [!NOTE] - > Run the `LoadState.exe ` command in administrator mode. To do this, right-click **Command Prompt**, and then click **Run As Administrator**. + > + > Run the `LoadState.exe` command in administrator mode. To do this, right-click **Command Prompt**, and then select **Run As Administrator**. -5. Sign out after you run the `LoadState.exe ` command. Some settings, such as fonts, wallpaper, and screen saver settings, won't take effect until the next time that the user logs on. +1. Sign out after running the `LoadState.exe` command. Some settings, such as fonts, wallpaper, and screen saver settings, won't take effect until the next time that the user logs on. diff --git a/windows/deployment/usmt/migrate-application-settings.md b/windows/deployment/usmt/migrate-application-settings.md index f8c2dded9b..939c96ca6e 100644 --- a/windows/deployment/usmt/migrate-application-settings.md +++ b/windows/deployment/usmt/migrate-application-settings.md @@ -1,36 +1,40 @@ --- -title: Migrate Application Settings (Windows 10) +title: Migrate Application Settings description: Learn how to author a custom migration .xml file that migrates the settings of an application that isn't migrated by default using MigApp.xml. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Migrate Application Settings -You can create a custom .xml file to migrate specific line-of-business application settings or to change the default migration behavior of the User State Migration Tool (USMT) 10.0. For ScanState and LoadState to use this file, you must specify the custom .xml file on both command lines. +A custom **.xml** file can be created to migrate specific line-of-business application settings or to change the default migration behavior of the User State Migration Tool (USMT). For **ScanState** and **LoadState** to use this file, the custom **.xml** file must be specified on both command lines. -This article defines how to author a custom migration .xml file that migrates the settings of an application that isn't migrated by default using `MigApp.xml`. You should migrate the settings after you install the application, but before the user runs the application for the first time. +This article defines how to author a custom migration **.xml** file that migrates the settings of an application that isn't migrated by default using `MigApp.xml`. The settings should be migrated after the application is installed, but before the user runs the application for the first time. -This article doesn't contain information about how to migrate applications that store settings in an application-specific store, only the applications that store the information in files or in the registry. It also doesn't contain information about how to migrate the data that users create using the application. For example, if the application creates .doc files using a specific template, this article doesn't discuss how to migrate the .doc files and templates themselves. +This article doesn't contain information about how to migrate applications that store settings in an application-specific store, only the applications that store the information in files or in the registry. It also doesn't contain information about how to migrate the data that users create using the application. For example, if the application creates **.doc** files using a specific template, this article doesn't discuss how to migrate the **.doc** files and templates themselves. -## Before you begin +## Before beginning -You should identify a test computer that contains the operating system of your source computers, and the application whose settings you want to migrate. For example, if you're planning on migrating from Windows 7 to Windows 10, install Windows 7 on your test computer and then install the application. +A test computer that contains the operating system of the source computers should be identified. The test computer should also have the applications whose settings need to be migrated. For example, if migrating from Windows 10 to Windows 11, install Windows 10 on the test computer and then install the applications. ## Step 1: Verify that the application is installed on the source computer, and that it's the same version as the version to be installed on the destination computer -Before USMT migrates the settings, you need it to check whether the application is installed on the source computer, and that it's the correct version. If the application isn't installed on the source computer, you probably don't want USMT to spend time searching for the application's settings. More importantly, if USMT collects settings for an application that isn't installed, it may migrate settings that will cause the destination computer to function incorrectly. You should also investigate whether there's more than one version of the application because the new version may not store the settings in the same place. Mismatched application versions may lead to unexpected results on the destination computer. +Before USMT migrates the settings, check whether the application is installed on the source computer, and that it's the correct version. If the application isn't installed on the source computer, USMT still spends time searching for the application's settings. More importantly, if USMT collects settings for an application that isn't installed, it could migrate settings that cause the destination computer to function incorrectly. Also determine whether there's more than one version of the application because the new version could store the settings in a different location. Mismatched application versions could lead to unexpected results on the destination computer. -There are many ways to detect if an application is installed. The best practice is to check for an application uninstall key in the registry, and then search the computer for the executable file that installed the application. It's important that you check for both of these items, because sometimes different versions of the same application share the same uninstall key. So even if the key is there, it may not correspond to the version of the application that you want. +There are many ways to detect if an application is installed. The best practice is to check for an application uninstall key in the registry, and then search the computer for the executable file that installed the application. It's important to check for both of these items, because sometimes different versions of the same application share the same uninstall key. Even if the key is there, it could correspond to a different version of the application that is wanted. ### Check the registry for an application uninstall key -When many applications are installed (especially those installed using the Microsoft® Windows® Installer technology), an application uninstall key is created under: +When many applications are installed (especially those installed using the Microsoft Windows Installer technology), an application uninstall key is created under: `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` @@ -38,110 +42,123 @@ For example, when Adobe Acrobat Reader 7 is installed, it creates a key named: `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall \{AC76BA86-7AD7-1033-7B44-A70000000000}` -Therefore, if a computer contains this key, then Adobe Acrobat Reader 7 is installed on the computer. You can check for the existence of a registry key using the `DoesObjectExist` helper function. +Therefore, if a computer contains this key, then Adobe Acrobat Reader 7 is installed on the computer. The existence of a registry key can be checked using the `DoesObjectExist` helper function. -Usually, you can find this key by searching under +Usually, this key can be found by searching under: `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` -for the name of the application, the name of the application executable file, or for the name of the company that makes the application. You can use the Registry Editor, `Regedit.exe` located in the `%SystemRoot%`, to search the registry. +for the name of the application, the name of the application executable file, or for the name of the company that makes the application. The Registry Editor, `Regedit.exe` located in the `%SystemRoot%`, can be used to search the registry. ### Check the file system for the application executable file -You should also check the application binaries for the executable that installed the application. To check for application binaries, you'll first need to determine where the application is installed and what the name of the executable is. Most applications store the installation location of the application binaries in the registry. You should search the registry for the name of the application, the name of the application executable, or for the name of the company that makes the application, until you find the registry value that contains the installation path. Once you've determined the path to the application executable, you can use the `DoesFileVersionMatch` helper function to check for the correct version of the application executable. For an example of how to use the `DoesFileVersionMatch` helper function, see the Windows Live™ Messenger section of the `MigApp.xml` file. +The application binaries for the executable that installed the application should also be checked. To check for application binaries, determine where the application is installed and what the name of the executable is. Most applications store the installation location of the application binaries in the registry. The registry should be searched on one of the following items until the registry value that contains the installation path is found: + +- The name of the application. +- The name of the application executable. +- The name of the company that makes the application. + +Once the path to the application executable is determined, the `DoesFileVersionMatch` helper function can be used to check for the correct version of the application executable. For an example of how to use the `DoesFileVersionMatch` helper function, see the Windows Live™ Messenger section of the `MigApp.xml` file. ## Step 2: Identify settings to collect and determine where each setting is stored on the computer -Next, you should go through the user interface and make a list of all of the available settings. You can reduce the list if there are settings that you don't want to migrate. To determine where each setting is stored, you'll need to change each setting and monitor the activity on the registry and the file system. You don't need to migrate the binary files and registry settings that are made when the application is installed because you'll need to reinstall the application onto the destination computer. You only need to migrate those settings that are customizable. +Next, go through the user interface and make a list of all of the available settings. The list can be reduced if there are settings that don't need to be migrated. To determine where each setting is stored, change the setting. As the setting is changed, monitor the activity on the registry and the file system through a tool such as [Process Monitor](/sysinternals/downloads/procmon). The binary files and registry settings that are created when the application is installed don't need to be migrated. When the application is reinstalled onto the destination computer, it recreates those settings. Only the customized settings need to be migrated. ### How to determine where each setting is stored -1. Download a file and registry monitoring tool, such as the Regmon and Filemon tools, from the [Windows Sysinternals Web site](/sysinternals/). +1. Download a file and registry monitoring tool, such as [Process Monitor (Procmon)](/sysinternals/downloads/procmon), from the [Sysinternals Web site](/sysinternals/). -2. Shut down as many applications as possible to limit the registry and file system activity on the computer. +1. Shut down as many applications as possible to limit the registry and file system activity on the computer. -3. Filter the output of the tools so it only displays changes being made by the application. +1. Filter the output of the tools so it only displays changes being made by the application. > [!NOTE] - > Most applications store their settings under the user profile. That is, the settings stored in the file system are under the `%UserProfile%` directory, and the settings stored in the registry are under the `HKEY_CURRENT_USER` hive. For these applications you can filter the output of the file and registry monitoring tools to show activity only under these locations. This will considerably reduce the amount of output that you will need to examine. + > + > Most applications store their settings under the user profile. That is, the settings stored in the file system are under the `%UserProfile%` directory, and the settings stored in the registry are under the `HKEY_CURRENT_USER` hive. For these applications, the output of the file and registry monitoring tools can be filtered to show activity only under these locations. This filtering considerably reduces the amount of output that needs to be examined. -4. Start the monitoring tool(s), change a setting, and look for registry and file system writes that occurred when you changed the setting. Make sure the changes you make actually take effect. For example, if you're changing a setting in Microsoft Word by selecting a check box in the **Options** dialog box, the change typically won't take effect until you close the dialog box by clicking **OK**. +1. Start the monitoring tool(s), change a setting, and look for registry and file system writes that occurred when the setting was changed. Make sure the changes made actually take effect. For example, if changing a setting in Microsoft Word by selecting a check box in the **Options** dialog box, the change typically doesn't take effect until the dialog box is closed by selecting **OK**. -5. When the setting is changed, note the changes to the file system and registry. There may be more than one file or registry values for each setting. You should identify the minimal set of file and registry changes that are required to change this setting. This set of files and registry keys is what you will need to migrate in order to migrate the setting. +1. When the setting is changed, note the changes to the file system and registry. There could be more than one file or registry values for each setting. The minimal set of file and registry changes that are required to change this setting should be identified. This set of files and registry keys is what needs to be migrated in order to migrate the setting. > [!NOTE] + > > Changing an application setting invariably leads to writing to registry keys. If possible, filter the output of the file and registry monitor tool to display only writes to files and registry keys/values. ## Step 3: Identify how to apply the gathered settings -If the version of the application on the source computer is the same as the one on the destination computer, then you don't have to modify the collected files and registry keys. By default, USMT migrates the files and registry keys from the source location to the corresponding location on the destination computer. For example, if a file was collected from the `C:\Documents and Settings\User1\My Documents` folder and the profile directory on the destination computer is located at `D:\Users\User1`, then USMT will automatically migrate the file to `D:\Users\User1\My Documents`. However, you may need to modify the location of some settings in the following three cases: +If the version of the application on the source computer is the same as the one on the destination computer, then the collected files and registry keys don't need to be modified. By default, USMT migrates the files and registry keys from the source location to the corresponding location on the destination computer. For example, if a file was collected from the `C:\Users\User1\Documents` folder and the profile directory on the destination computer is located at `D:\Users\User1`, then USMT automatically migrates the file to `D:\Users\User1\Documents`. However, the location of some settings might need to be modified in the following three cases: ### Case 1: The version of the application on the destination computer is newer than the one on the source computer -In this case, the newer version of the application may be able to read the settings from the source computer without modification. That is, the data collected from an older version of the application is sometimes compatible with the newer version of the application. However, you may need to modify the setting location if either of the following conditions is true: +In this case, the newer version of the application might be able to read the settings from the source computer without modification. That is, the data collected from an older version of the application is sometimes compatible with the newer version of the application. However, the setting location might need to be modified if either of the following conditions is true: -- **The newer version of the application has the ability to import settings from an older version.** This mapping usually happens the first time a user runs the newer version after the settings have been migrated. Some applications import settings automatically after settings are migrated. However, other applications will only do import settings if the application was upgraded from the older version. When the application is upgraded, a set of files and/or registry keys is installed that indicates the older version of the application was previously installed. If you perform a clean installation of the newer version (which is the case in most migrations), the computer doesn't contain this set of files and registry keys so the mapping doesn't occur. In order to trick the newer version of the application into initiating this import process, your migration script may need to create these files and/or registry keys on the destination computer. +- **The newer version of the application has the ability to import settings from an older version.** This mapping usually happens the first time a user runs the newer version after the settings are migrated. Some applications import settings automatically after settings are migrated. However, other applications only import settings if the application was upgraded from the older version. When the application is upgraded, a set of files and/or registry keys is installed that indicates the older version of the application was previously installed. If a clean installation of the newer version is performed, the computer doesn't contain these files and registry keys. If the files and registry keys aren't present, the mapping doesn't occur. In order to trick the newer version of the application into initiating this import process, the migration script might need to create these files and/or registry keys on the destination computer. - To identify which files and/or registry keys/values need to be created to cause the import, you should upgrade the older version of the application to the newer one and monitor the changes made to the file system and registry by using the same process described in [How to determine where each setting is stored](#how-to-determine-where-each-setting-is-stored). Once you know the set of files that the computer needs, you can use the **<addObjects>** element to add them to the destination computer. + To identify which files and/or registry keys/values need to be created so that the import works: -- **The newer version of the application can't read settings from the source computer and it's also unable to import the settings into the new format.** In this case, you'll need to create a mapping for each setting from the old locations to the new locations. To create the mapping, determine where the newer version stores each setting using the process described in [How to determine where each setting is stored](#how-to-determine-where-each-setting-is-stored). After you've created the mapping, apply the settings to the new location on the destination computer using the **<locationModify>** element, and the `RelativeMove` and `ExactMove` helper functions. + 1. Upgrade the older version of the application to the newer one. + 1. Monitor the changes made to the file system and registry by using the same process described in [How to determine where each setting is stored](#how-to-determine-where-each-setting-is-stored). + + Once the set of files that the computer needs is known, the **\** element can be used to add them to the destination computer. + +- **The newer version of the application can't read settings from the source computer and it's also unable to import the settings into the new format.** In this case, create a mapping for each setting from the old locations to the new locations. To create the mapping, determine where the newer version stores each setting using the process described in [How to determine where each setting is stored](#how-to-determine-where-each-setting-is-stored). After creating the mapping, apply the settings to the new location on the destination computer using the **\** element, and the `RelativeMove` and `ExactMove` helper functions. ### Case 2: The destination computer already contains settings for the application -We recommend that you migrate the settings after you install the application, but before the user runs the application for the first time. We recommend this process because this process ensures that there are no settings on the destination computer when you migrate the settings. If you must install the application before the migration, you should delete any existing settings using the **<destinationCleanup>** element. If for any reason you want to preserve the settings that are on the destination computer, you can use the **<merge>** element and `DestinationPriority` helper function. +Microsoft recommends migrating the settings after the application is installed, but before the user runs the application for the first time. Microsoft recommends this process because this process ensures that there are no settings on the destination computer when the settings are migrated. If the application must be installed before the migration, any existing settings should be deleted using the **\** element. If for any reason the settings need to be preserved that are on the destination computer, the **\** element and `DestinationPriority` helper function can be used. -### Case 3: The application overwrites settings when it's installed +### Case 3: The application overwrites settings when installed -We recommend that you migrate the settings after you install the application, but before the user runs the application for the first time. We recommend this process because this process ensures that there are no settings on the destination computer when you migrate the settings. Also, when some applications are installed, they overwrite any existing settings that are on the computer. In this scenario, if you migrated the data before you installed the application, your customized settings would be overwritten. This scenario is common for applications that store settings in locations that are outside of the user profile (typically these settings are settings that apply to all users). These universal settings are sometimes overwritten when an application is installed, and they're replaced by default values. To avoid this problem, you must install these applications before migrating the files and settings to the destination computer. By default with USMT, data from the source computer overwrites data that already exists in the same location on the destination computer. +Microsoft recommends migrating the settings after the application is installed, but before the user runs the application for the first time. Microsoft recommends this process because this process ensures that there are no settings on the destination computer when the settings are migrated. Also, when some applications are installed, they overwrite any existing settings that are on the computer. In this scenario, if the data was migrated before the application was installed, the customized settings would be overwritten. This scenario is common for applications that store settings in locations that are outside of the user profile (typically these settings are settings that apply to all users). These universal settings are sometimes overwritten when an application is installed, and they're replaced by default values. To avoid this problem, these applications must be installed before migrating the files and settings to the destination computer. By default with USMT, data from the source computer overwrites data that already exists in the same location on the destination computer. ## Step 4: Create the migration XML component for the application -After you have completed steps 1 through 3, you'll need to create a custom migration .xml file that migrates the application based on the information that you now have. You can use the `MigApp.xml` file as a model because it contains examples of many of the concepts discussed in this article. You can also see [Custom XML Examples](usmt-custom-xml-examples.md) for another sample .xml file. +After completing steps 1 through 3, create a custom migration **.xml** file that migrates the application based on the updated information. The `MigApp.xml` file can be used as a model because it contains examples of many of the concepts discussed in this article. Also see [Custom XML Examples](usmt-custom-xml-examples.md) for another sample **.xml** file. - > [!NOTE] - > We recommend that you create a separate .xml file instead of adding your script to the `MigApp.xml` file. This is because the `MigApp.xml` file is a very large file and it will be difficult to read and edit. In addition, if you reinstall USMT for some reason, the `MigApp.xml` file will be overwritten by the default version of the file and you will lose your customized version. +> [!NOTE] +> +> Microsoft recommends creating a separate **.xml** file instead of adding a script to the `MigApp.xml` file. A separate **.xml** file is recommended because the `MigApp.xml` file is a large file and it's difficult to read and edit. In addition, if USMT is reinstalled, the `MigApp.xml` file is overwritten with the default version of the file and the customized version is lost. > [!IMPORTANT] -> Some applications store information in the user profile, such as application installation paths, the computer name, etc., should not be migrated. You should make sure to exclude these files and registry keys from the migration. +> +> Some applications store information in the user profile, such as application installation paths, the computer name, etc. Application information stored in the user profile shouldn't be migrated and should be excluded from the migration. -Your script should do the following actions: +The script should do the following actions: -1. Check whether the application and correct version is installed by: +1. Check if the correct version of the application is installed: - - Searching for the installation uninstall key under `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` using the `DoesObjectExist` helper function. + - Search for the installation uninstall key under `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` using the `DoesObjectExist` helper function. - - Checking for the correct version of the application executable file using the `DoesFileVersionMatch` helper function. + - Check for the correct version of the application executable file using the `DoesFileVersionMatch` helper function. -2. If the correct version of the application is installed, then ensure that each setting is migrated to the appropriate location on the destination computer. +1. If the correct version of the application is installed, then ensure that each setting is migrated to the appropriate location on the destination computer. - - If the versions of the applications are the same on both the source and destination computers, migrate each setting using the **<include>** and **<exclude>** elements. + - If the versions of the applications are the same on both the source and destination computers, migrate each setting using the **\** and **\** elements. - - If the version of the application on the destination computer is newer than the one on the source computer, and the application can't import the settings, your script should either: - 1. Add the set of files that trigger the import using the **<addObjects>** element - 2. Create a mapping that applies the old settings to the correct location on the destination computer using the **<locationModify>** element, and the `RelativeMove` and `ExactMove` helper functions. + - If the version of the application on the destination computer is newer than the one on the source computer, and the application can't import the settings, the script should either: - - If you must install the application before migrating the settings, delete any settings that are already on the destination computer using the **<destinationCleanup>** element. + 1. Add the set of files that trigger the import using the **\** element. + 1. Create a mapping that applies the old settings to the correct location on the destination computer using the **\** element, and the `RelativeMove` and `ExactMove` helper functions. -For information about the .xml elements and helper functions, see [XML Elements Library](usmt-xml-elements-library.md). + - If the application must be installed before migrating the settings, delete any settings that are already on the destination computer using the **\** element. + +For information about the **.xml** elements and helper functions, see [XML Elements Library](usmt-xml-elements-library.md). ## Step 5: Test the application settings migration -On a test computer, install the operating system that will be installed on the destination computers. For example, if you're planning on migrating from Windows 7 to Windows 10, install Windows 10 and the application. Next, run LoadState on the test computer and verify that all settings migrate. Make corrections if necessary and repeat the process until all the necessary settings are migrated correctly. +On a test computer, install the operating system that will be installed on the destination computers. For example, if planning on migrating from Windows 10 to Windows 11, install Windows 11, and then install the application in Windows 11. Next, run **LoadState** on the test computer and verify that all settings migrate. Make corrections if necessary and repeat the process until all the necessary settings are migrated correctly. -To speed up the time it takes to collect and migrate the data, you can migrate only one user at a time, and you can exclude all other components from the migration except the application that you're testing. To specify only **User1** in the migration, enter: +To speed up the time it takes to collect and migrate the data, only one user can be migrated at a time. All other components can be excluded from the migration except the application that is being tested. To specify only **User1** in the migration, enter: ```cmd /ue:*\* /ui:user1 ``` -For more information, see the [Exclude files and settings](usmt-exclude-files-and-settings.md) article and the [User options](usmt-scanstate-syntax.md#user-options) section in the [ScanState syntax](usmt-scanstate-syntax.md) article. To troubleshoot a problem, check the progress log, and the ScanState and LoadState logs, which contain warnings and errors that may point to problems with the migration. +For more information, see the [Exclude files and settings](usmt-exclude-files-and-settings.md) article and the [User options](usmt-scanstate-syntax.md#user-options) section in the [ScanState syntax](usmt-scanstate-syntax.md) article. To troubleshoot a problem, check the progress log, the **ScanState** log, and the **LoadState** log. The logs contain warnings and errors that could point to problems with the migration. ## Related articles -[USMT XML reference](usmt-xml-reference.md) - -[Conflicts and precedence](usmt-conflicts-and-precedence.md) - -[XML elements library](usmt-xml-elements-library.md) - -[Log files](usmt-log-files.md) +- [USMT XML reference](usmt-xml-reference.md). +- [Conflicts and precedence](usmt-conflicts-and-precedence.md). +- [XML elements library](usmt-xml-elements-library.md). +- [Log files](usmt-log-files.md). diff --git a/windows/deployment/usmt/migration-store-types-overview.md b/windows/deployment/usmt/migration-store-types-overview.md index 25d04bc4c2..0465a9e2e2 100644 --- a/windows/deployment/usmt/migration-store-types-overview.md +++ b/windows/deployment/usmt/migration-store-types-overview.md @@ -1,18 +1,22 @@ --- -title: Migration Store Types Overview (Windows 10) -description: Learn about the migration store types and how to determine which migration store type best suits your needs. +title: Migration Store Types Overview +description: Learn about the migration store types and how to determine which migration store type best suits the organization's needs. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Migration Store Types Overview -When planning your migration, you should determine which migration store type best meets your needs. As part of these considerations, determine how much space is required to run the User State Migration Tool (USMT) 10.0 components on your source and destination computers. You should also determine the space needed to create and host the migration store, whether you're using a local share, network share, or storage device. +When a migration is being planned, which migration store type best meets the organization's needs should be determined. As part of these considerations, determine how much space is required to run the User State Migration Tool (USMT) components on the source and destination computers. The space needed to create and host the migration store should also be determined, whether using a local share, network share, or storage device. ## Migration store types @@ -20,7 +24,7 @@ This section describes the three migration store types available in USMT. ### Uncompressed (UNC) -The uncompressed (UNC) migration store is an uncompressed directory with a mirror image of the folder hierarchy being migrated. Each directory and file retains the same access permissions that it has on the local file system. You can use Windows Explorer to view this migration store type. Settings are stored in a catalog file that also describes how to restore files on the destination computer. +The uncompressed (UNC) migration store is an uncompressed directory with a mirror image of the folder hierarchy being migrated. Each directory and file retains the same access permissions that it has on the local file system. Windows Explorer can be used to view this migration store type. Settings are stored in a catalog file that also describes how to restore files on the destination computer. ### Compressed @@ -28,9 +32,9 @@ The compressed migration store is a single image file that contains all files be ### Hard-Link -A hard-link migration store functions as a map that defines how a collection of bits on the hard disk are "wired" into the file system. You use the new USMT hard-link migration store in the PC Refresh scenario only. You only use hard-link migration stores in Refresh scenarios because the hard-link migration store is maintained on the local computer while the old operating system is removed and the new operating system is installed. Using a hard-link migration store saves network bandwidth and minimizes the server use needed to accomplish the migration. +A hard-link migration store functions as a map that defines how a collection of bits on the hard disk are "wired" into the file system. The USMT hard-link migration store is only used in the PC Refresh scenario. Hard-link migration stores are only used in Refresh scenarios because the hard-link migration store is maintained on the local computer. The hard-link store is maintained on the computer while the old operating system is removed and the new operating system is installed. Using a hard-link migration store saves network bandwidth and minimizes the server use needed to accomplish the migration. -You use the command-line option `/hardlink` to create a hard-link migration store, which functions the same as an uncompressed migration store. Files aren't duplicated on the local computer when user state is captured, nor are they duplicated when user state is restored. For more information, see [Hard-Link Migration Store](usmt-hard-link-migration-store.md). +The command-line option `/hardlink` is used to create a hard-link migration store, which functions the same as an uncompressed migration store. Files aren't duplicated on the local computer when user state is captured. They also aren't duplicated when user state is restored. For more information, see [Hard-Link Migration Store](usmt-hard-link-migration-store.md). The following flowchart illustrates the procedural differences between a local migration store and a remote migration store. In this example, a hard-link migration store is used for the local store. @@ -38,23 +42,32 @@ The following flowchart illustrates the procedural differences between a local m ## Local store vs. remote store -If you have enough space and you're migrating the user state back to the same computer, storing data on a local device is normally the best option to reduce server storage costs and network performance issues. You can store the data locally either on a different partition or on a removable device such as a USB flash drive (UFD). Also, depending on the imaging technology that you're using, you might be able to store the data on the partition that is being re-imaged, if the data will be protected from deletion during the process. To increase performance, store the data on high-speed drives that use a high-speed network connection. It's also good practice to ensure that the migration is the only task the server is performing. +If there's enough space and the user state is being migrated back to the same computer, storing data on a local device is normally the best option to reduce server storage costs and network performance issues. The data can also be stored locally either on a different partition or on a removable device such as a USB flash drive (UFD). Also, the data might be able to be stored on the partition that is being re-imaged if the data can be protected from deletion during the imaging process. One example of an imaging technology that is capable of storing the data on the partition that is being reimaged is Microsoft Configuration Manager. To increase performance, store the data on high-speed drives that use a high-speed network connection. It's also good practice to ensure that the migration is the only task the server is performing. -If there isn't enough local disk space, or if you're moving the user state to another computer, then you must store the data remotely such as on a shared folder, on removable media, or you can store it directly on the destination computer. For example: +If there isn't enough local disk space, or if moving the user state to another computer, then the data must be stored remotely such as in one of the following destinations: -1. Create and share `C:\store` on the destination computer -2. Run the `ScanState.exe` command on the source computer and save the files and settings to `\\\store` -3. Run the `LoadState.exe ` command on the destination computer and specify `C:\Store` as the store location. +- Shared folder. +- Removable media. +- Directly on the destination computer. -By doing this process, you don't need to save the files to a server. +For example: + +1. Create and share `C:\store` on the destination computer. + +1. Run the `ScanState.exe` command on the source computer and save the files and settings to `\\\store`. + +1. Run the `LoadState.exe` command on the destination computer and specify `C:\Store` as the store location. + +By doing this process, files don't need to be stored to a server. > [!IMPORTANT] -> If possible, have users store their data within their `%UserProfile%\My Documents` and `%UserProfile%\Application Data` folders. This will reduce the chance of USMT missing critical user data that is located in a directory that USMT is not configured to check. +> +> If possible, have users store their data within their `%UserProfile%\Documents` and `%UserProfile%\Application Data` folders. Having users store their data at these locations reduces the chance of USMT missing critical user data that is located in a directory that USMT isn't configured to check. ### The /localonly command-line option -You should use this option to exclude the data from removable drives and network drives mapped on the source computer. For more information about what is excluded when you specify `/LocalOnly`, see [ScanState Syntax](usmt-scanstate-syntax.md). +This option should be used to exclude the data from removable drives and network drives mapped on the source computer. For more information about what is excluded when `/LocalOnly` is specified, see [ScanState Syntax](usmt-scanstate-syntax.md). ## Related articles -[Plan your migration](usmt-plan-your-migration.md) +- [Plan the migration](usmt-plan-your-migration.md). diff --git a/windows/deployment/usmt/offline-migration-reference.md b/windows/deployment/usmt/offline-migration-reference.md index c4c1311fb0..0b291ae30c 100644 --- a/windows/deployment/usmt/offline-migration-reference.md +++ b/windows/deployment/usmt/offline-migration-reference.md @@ -1,64 +1,71 @@ --- -title: Offline Migration Reference (Windows 10) +title: Offline Migration Reference description: Offline migration enables the ScanState tool to run inside a different Windows OS than the Windows OS from which ScanState is gathering files and settings. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Offline Migration Reference -Offline migration enables the ScanState tool to run inside a different Windows operating system than the Windows operating system from which ScanState is gathering files and settings. There are two primary offline scenarios: +Offline migration enables the **ScanState** tool to run inside a different Windows operating system than the Windows operating system from which **ScanState** is gathering files and settings. There are two primary offline scenarios: -- **Windows PE.** The ScanState tool can be run from within Windows PE, gathering files and settings from the offline Windows operating system on that machine. +- **Windows PE.** The **ScanState** tool can be run from within Windows PE, gathering files and settings from the offline Windows operating system on that machine. -- **Windows.old.** The ScanState tool can now gather files and settings from the Windows.old directory that is created during Windows installation on a partition that contains a previous installation of Windows. For example, the ScanState tool can run in Windows 10, gathering files from a previous Windows 7or Windows 8 installation contained in the Windows.old directory. +- **Windows.old.** The **ScanState** tool can gather files and settings from the **Windows.old** directory. The **Windows.old** directory is created during Windows installation on a partition that contains a previous installation of Windows. For example, the **ScanState** tool can run in Windows, gathering files from a previous Windows installation contained in the **Windows.old** directory. -When you use User State Migration Tool (USMT) 10.0 to gather and restore user state, offline migration reduces the cost of deployment by: +When using the User State Migration Tool (USMT) to gather and restore user state, offline migration reduces the cost of deployment by: -- **Reducing complexity.** In computer-refresh scenarios, migrations from the Windows.old directory reduce complexity by eliminating the need for the ScanState tool to be run before the operating system is deployed. Also, migrations from the Windows.old directory enable ScanState and LoadState to be run successively. +- **Reducing complexity.** In computer-refresh scenarios, migrations from the **Windows.old** directory reduce complexity by eliminating the need for the **ScanState** tool to be run before the operating system is deployed. Also, migrations from the **Windows.old** directory enable **ScanState** and **LoadState** to be run successively. -- **Improving performance.** When USMT runs in an offline Windows Preinstallation Environment (WinPE) environment, it has better access to the hardware resources. Running USMT in WinPE may increase performance on older machines with limited hardware resources and numerous installed software applications. +- **Improving performance.** When USMT runs in an offline Windows Preinstallation Environment (WinPE) environment, it has better access to the hardware resources. Running USMT in WinPE can increase performance on older machines with limited hardware resources and numerous installed software applications. -- **New recovery scenario.** In scenarios where a machine no longer restarts properly, it might be possible to gather user state with the ScanState tool from within WinPE. +- **New recovery scenario.** In scenarios where a machine no longer restarts properly, it might be possible to gather user state with the **ScanState** tool from within WinPE. -## What will migrate offline? +## What migrates offline? The following user data and settings migrate offline, similar to an online migration: -- Data and registry keys specified in MigXML +- Data and registry keys specified in MigXML. -- User accounts +- User accounts. -- Application settings +- Application settings. -- Limited set of operating-system settings +- Limited set of operating-system settings. -- EFS files +- EFS files. -- Internet Explorer Favorites +- Favorites. -For exceptions to what you can migrate offline, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) +For exceptions to what can be migrated offline, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) ## What offline environments are supported? +All currently supported + The following table defines the supported combination of online and offline operating systems in USMT. |Running Operating System|Offline Operating System| -|--- |--- | -|WinPE 5.0 or greater, with the MSXML library|Windows 7, Windows 8, Windows 10| -|Windows 7, Windows 8, Windows 10|Windows.old directory| +|---|---| +|Currently supported version of WinPE, with the MSXML library|Windows 7, Windows 8, Windows 10, Windows 11| +|Windows 10, Windows 11|**Windows.old** directory| > [!NOTE] -> It is possible to run the ScanState tool while the drive remains encrypted by suspending Windows BitLocker Drive Encryption before booting into WinPE. For more information, see [this Microsoft site](/previous-versions/windows/it-pro/windows-7/ee424315(v=ws.10)). +> +> It is possible to run the **ScanState** tool while the drive remains encrypted by suspending Windows BitLocker Drive Encryption before booting into WinPE. For more information, see [BitLocker operations guide: Suspend and resume](/windows/security/operating-system-security/data-protection/bitlocker/operations-guide#suspend-and-resume). If using a Microsoft Configuration Manager task sequence, see [Task sequence steps: Disable BitLocker](/mem/configmgr/osd/understand/task-sequence-steps#BKMK_DisableBitLocker). ## User-group membership and profile control -User-group membership isn't preserved during offline migrations. You must configure a **<ProfileControl>** section in the `Config.xml` file to specify the groups that the migrated users should be made members of. The following example places all migrated users into the Users group: +User-group membership isn't preserved during offline migrations. A **\** section must be configured in the `Config.xml` file to specify the groups that the migrated users should be made members of. The following example places all migrated users into the Users group: ```xml @@ -84,62 +91,90 @@ An offline migration can either be enabled by using a configuration file on the |Component|Option|Description| |--- |--- |--- | -|*ScanState.exe*|**/offline:***<path to Offline.xml>*|This command-line option enables the offline-migration mode and requires a path to an Offline.xml configuration file.| -|*ScanState.exe*|**/offlineWinDir:***<Windows directory>*|This command-line option enables the offline-migration mode and starts the migration from the location specified. It's only for use in WinPE offline scenarios where the migration is occurring from a Windows directory.| -|*ScanState.exe*|**/OfflineWinOld:***<Windows.old directory>*|This command-line option enables the offline migration mode and starts the migration from the location specified. It's only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.| +|*ScanState.exe*|**/offline:***\*|This command-line option enables the offline-migration mode and requires a path to an Offline.xml configuration file.| +|*ScanState.exe*|**/offlineWinDir:***\*|This command-line option enables the offline-migration mode and starts the migration from the location specified. It's only for use in WinPE offline scenarios where the migration is occurring from a Windows directory.| +|*ScanState.exe*|**/OfflineWinOld:***\*|This command-line option enables the offline migration mode and starts the migration from the location specified. Only use in **Windows.old** migration scenarios, where the migration is occurring from a **Windows.old** directory.| -You can use only one of the `/offline`, `/offlineWinDir`, or `/OfflineWinOld` command-line options at a time. USMT doesn't support using more than one together. +Only one of the `/offline`, `/offlineWinDir`, or `/OfflineWinOld` command-line options can be used at a time. USMT doesn't support using more than one together. ## Environment variables -The following system environment variables are necessary in the scenarios outlined below. +System environment variables are necessary in the scenarios outlined in the following table: |Variable|Value|Scenario| |--- |--- |--- | -|*USMT_WORKING_DIR*|Full path to a working directory|Required when USMT binaries are located on read-only media, which doesn't support the creation of log files or temporary storage. To set the system environment variable, at a command prompt type the following command:
Set USMT_WORKING_DIR=[path to working directory]
| -*|MIG_OFFLINE_PLATFORM_ARCH*|32 or 64|While operating offline, this environment variable defines the architecture of the offline system, if the system doesn't match the WinPE and `ScanState.exe` architecture. This environment variable enables the 32-bit ScanState application to gather data from a computer with 64-bit architecture, or the 64-bit ScanState application to gather data from a computer with 32-bit architecture. Specifying the architecture is required when auto-detection of the offline architecture doesn't function properly. For example, to set this system environment variable for a 32-bit architecture, at a command prompt type the following command:
Set MIG_OFFLINE_PLATFORM_ARCH=32
| +|**USMT_WORKING_DIR**|Full path to a working directory|Required when USMT binaries are located on read-only media, which doesn't support the creation of log files or temporary storage. To set the system environment variable, at a command prompt type the following command:

`Set USMT_WORKING_DIR=`| +|**MIG_OFFLINE_PLATFORM_ARCH**|32 or 64|While operating offline, this environment variable defines the architecture of the offline system, if the system doesn't match the WinPE and `ScanState.exe` architecture. This environment variable enables the 32-bit **ScanState** application to gather data from a computer with 64-bit architecture, or the 64-bit **ScanState** application to gather data from a computer with 32-bit architecture. Specifying the architecture is required when auto-detection of the offline architecture doesn't function properly. For example, to set this system environment variable for a 32-bit architecture, at a command prompt type the following command:

`Set MIG_OFFLINE_PLATFORM_ARCH=32`| ## Offline.xml elements -Use an `Offline.xml` file when running the ScanState tool on a computer that has multiple Windows directories. The `Offline.xml` file specifies which directories to scan for windows files. An `Offline.xml` file can be used with the `/offline` option as an alternative to specifying a single Windows directory path with the `/offlineDir` option. +Use an `Offline.xml` file when running the **ScanState** tool on a computer that has multiple Windows directories. The `Offline.xml` file specifies which directories to scan for windows files. An `Offline.xml` file can be used with the `/offline` option as an alternative to specifying a single Windows directory path with the `/offlineDir` option. -### <offline> +### \ This element contains other elements that define how an offline migration is to be performed. -Syntax: `` `` +Syntax: -### <winDir> +```xml + +``` -This element is a required child of **<offline>** and contains information about how the offline volume can be selected. The migration will be performed from the first element of **<winDir>** that contains a valid Windows system volume. +### \ -Syntax: `` `` +This element is a required child of **\** and contains information about how the offline volume can be selected. The migration is performed from the first element of **\** that contains a valid Windows system volume. -### <path> +Syntax: -This element is a required child of **<winDir>** and contains a file path pointing to a valid Windows directory. Relative paths are interpreted from the ScanState tool's working directory. +```xml + +``` -Syntax: ` C:\Windows ` +### \ --or- +This element is a required child of **\** and contains a file path pointing to a valid Windows directory. Relative paths are interpreted from the **ScanState** tool's working directory. -Syntax, when used with the **<mappings>** element: ` C:\, D:\ ` +Syntax: -### <mappings> +```xml + C:\Windows +``` -This element is an optional child of **<offline>**. When specified, the **<mappings>** element will override the automatically detected WinPE drive mappings. Each child **<path>** element will provide a mapping from one system volume to another. Additionally, mappings between folders can be provided, since an entire volume can be mounted to a specific folder. +or when used with the **\** element: -Syntax: `` `` +Syntax: -### <failOnMultipleWinDir> +```xml + C:\, D:\ +``` -This element is an optional child of **<offline>**. The **<failOnMultipleWinDir>** element allows the user to specify that the migration should fail when USMT detects that there are multiple instances of Windows installed on the source machine. When the **<failOnMultipleWinDir>** element isn't present, the default behavior is that the migration doesn't fail. +### \ -Syntax: `1` +This element is an optional child of **\**. When specified, the **\** element overrides the automatically detected WinPE drive mappings. Each child **\** element provides a mapping from one system volume to another. Additionally, mappings between folders can be provided, since an entire volume can be mounted to a specific folder. --or- +Syntax: -Syntax: `0` +```xml + +``` + +### \ + +This element is an optional child of **\**. The **\** element allows the user to specify that the migration should fail when USMT detects that there are multiple instances of Windows installed on the source machine. When the **\** element isn't present, the default behavior is that the migration doesn't fail. + +Syntax: + +```xml +1 +``` + +or + +Syntax: + +```xml +0 +``` ### Offline .xml Example @@ -158,4 +193,4 @@ The following XML example illustrates some of the elements discussed earlier in ## Related articles -[Plan your migration](usmt-plan-your-migration.md) +- [Plan the migration](usmt-plan-your-migration.md). diff --git a/windows/deployment/usmt/understanding-migration-xml-files.md b/windows/deployment/usmt/understanding-migration-xml-files.md index d39b9bf79e..76447bf7e6 100644 --- a/windows/deployment/usmt/understanding-migration-xml-files.md +++ b/windows/deployment/usmt/understanding-migration-xml-files.md @@ -1,52 +1,58 @@ --- -title: Understanding Migration XML Files (Windows 10) -description: Learn how to modify the behavior of a basic User State Migration Tool (USMT) 10.0 migration by using XML files. +title: Understanding Migration XML Files +description: Learn how to modify the behavior of a basic User State Migration Tool (USMT) migration by using XML files. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/23/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Understanding migration XML files -You can modify the behavior of a basic User State Migration Tool (USMT) 10.0 migration by using XML files; these files provide instructions on where and how the USMT tools should gather and apply files and settings. USMT includes three XML files that you can use to customize a basic migration: the `MigDocs.xml` and `MigUser.xml` files, which modify how files are discovered on the source computer, and the MigApps.xml file, which is required in order to migrate supported application settings. You can also create and edit custom XML files and a `Config.xml` file to further customize your migration. +The behavior of a basic User State Migration Tool (USMT) migration can be modified by using XML files. These files provide instructions on where and how the USMT tools should gather and apply files and settings. USMT includes three XML files that can be used to customize a basic migration: the `MigDocs.xml` and `MigUser.xml` files, which modify how files are discovered on the source computer, and the MigApps.xml file, which is required in order to migrate supported application settings. Custom XML files and a `Config.xml` file can be created and edited to further customize the migration. This article provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the `MigDocs.xml` file. The `MigDocs.xml` file uses the new `GenerateDocPatterns` function available in USMT to automatically find user documents on a source computer. ## Overview of the Config.xml file -The `Config.xml` file is the configuration file created by the `/genconfig` option of the ScanState tool; it can be used to modify which operating-system components are migrated by USMT. The `Config.xml` file can be used with other XML files, such as in the following example: +The `Config.xml` file is the configuration file created by the `/genconfig` option of the **ScanState** tool. It can be used to modify which operating-system components USMT migrates. The `Config.xml` file can be used with other XML files, such as in the following example: `ScanState.exe /i:migapps.xml /i:MigDocs.xml /genconfig:c:\myFolder\Config.xml` When used this way, the `Config.xml` file tightly controls aspects of the migration, including user profiles, data, and settings, without modifying or creating other XML files. For more information about the `Config.xml` file, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [Config.xml File](usmt-configxml-file.md). > [!NOTE] -> When modifying the XML elements in the `Config.xml` file, you should edit an element and set the **migrate** property to **no**, rather than deleting the element from the file. If you delete the element instead of setting the property, the component may still be migrated by rules in other XML files. +> +> When modifying the XML elements in the `Config.xml` file, set the **migrate** property on an element to **no** instead of deleting the element from the file. If the element is deleted instead of setting the property, rules in other XML files can still migrate the component. ## Overview of the MigApp.xml file -The `MigApp.xml` file installed with USMT includes instructions to migrate the settings for the applications listed in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md). You must include the `MigApp.xml` file when using the ScanState and LoadState tools, by using the `/i` option in order to migrate application settings. The `MigDocs.xml` and `MigUser.xml` files don't migrate application settings. You can create a custom XML file to include additional applications. For more information, see [Customize USMT XML Files](usmt-customize-xml-files.md). +The `MigApp.xml` file installed with USMT includes instructions to migrate the settings for the applications listed in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md). In order to migrate application settings, the `MigApp.xml` file must be included when using the **ScanState** and **LoadState** tools by using the `/i` option. The `MigDocs.xml` and `MigUser.xml` files don't migrate application settings. A custom XML file can be created to include additional applications. For more information, see [Customize USMT XML Files](usmt-customize-xml-files.md). > [!IMPORTANT] -> The MigApps.xml file will only detect and migrate .pst files that are linked to Microsoft Office Outlook. For more information about migrating .pst files that are not linked to Outlook, see [Sample migration rules for customized versions of XML files](#sample-migration-rules-for-customized-versions-of-xml-files). +> +> The `MigApps.xml` file only detects and migrates **.pst** files that are linked to Microsoft Office Outlook. For more information about migrating **.pst** files that aren't linked to Outlook, see [Sample migration rules for customized versions of XML files](#sample-migration-rules-for-customized-versions-of-xml-files). ## Overview of the MigDocs.xml file -The `MigDocs.xml` file uses the new `GenerateDocPatterns` helper function to create instructions for USMT to migrate files from the source computer, based on the location of the files. You can use the `MigDocs.xml` file with the ScanState and LoadState tools to perform a more targeted migration than using USMT without XML instructions. +The `MigDocs.xml` file uses the new `GenerateDocPatterns` helper function to create instructions for USMT to migrate files from the source computer, based on the location of the files. The `MigDocs.xml` file can be used with the **ScanState** and **LoadState** tools to perform a more targeted migration than using USMT without XML instructions. The default `MigDocs.xml` file migrates the following data: - All files on the root of the drive except `%WINDIR%`, `%PROGRAMFILES%`, `%PROGRAMDATA%`, or `%USERS%`. -- All folders in the root directory of all fixed drives. For example: `c:\data_mail\*[*]` +- All folders in the root directory of all fixed drives. For example: `c:\data_mail\*[*]`. -- All files from the root of the Profiles folder, except for files in the system profile. For example: `c:\users\name[mail.pst]` +- All files from the root of the Profiles folder, except for files in the system profile. For example: `c:\users\name[mail.pst]`. -- All folders from the root of the Profiles folder, except for the system-profile folders. For example: `c:\users\name\new folder\*[*]` +- All folders from the root of the Profiles folder, except for the system-profile folders. For example: `c:\users\name\new folder\*[*]`. - Standard shared folders: @@ -92,7 +98,7 @@ The default `MigDocs.xml` file migrates the following data: - FOLDERID_RecordedTV -The default `MigDocs.xml` file won't migrate the following data: +The default `MigDocs.xml` file doesn't migrate the following data: - Files tagged with both the **hidden** and **system** attributes. @@ -102,11 +108,11 @@ The default `MigDocs.xml` file won't migrate the following data: - Folders that contain installed applications. -You can also use the `/genmigxml` option with the ScanState tool to review and modify what files will be migrated. +The `/genmigxml` option can be used with the **ScanState** tool to review and modify what files are migrated. ## Overview of the MigUser.xml file -The `MigUser.xml` file includes instructions for USMT to migrate user files based on file name extensions. You can use the `MigUser.xml` file with the ScanState and LoadState tools to perform a more targeted migration than using USMT without XML instructions. The `MigUser.xml` file will gather all files from the standard user-profile folders, and any files on the computer with the specified file name extensions. +The `MigUser.xml` file includes instructions for USMT to migrate user files based on file name extensions. The `MigUser.xml` file can be used with the **ScanState** and **LoadState** tools to perform a more targeted migration than using USMT without XML instructions. The `MigUser.xml` file gathers all files from the standard user-profile folders, and any files on the computer with the specified file name extensions. The default `MigUser.xml` file migrates the following data: @@ -133,38 +139,41 @@ The default `MigUser.xml` file migrates the following data: `.accdb`, `.ch3`, `.csv`, `.dif`, `.doc*`, `.dot*`, `.dqy`, `.iqy`, `.mcw`, `.mdb*`, `.mpp`, `.one*`, `.oqy`, `.or6`, `.pot*`, `.ppa`, `.pps*`, `.ppt*`, `.pre`, `.pst`, `.pub`, `.qdf`, `.qel`, `.qph`, `.qsd`, `.rqy`, `.rtf`, `.scd`, `.sh3`, `.slk`, `.txt`, `.vl*`, `.vsd`, `.wk*`, `.wpd`, `.wps`, `.wq1`, `.wri`, `.xl*`, `.xla`, `.xlb`, `.xls*` > [!NOTE] + > > The asterisk (`*`) stands for zero or more characters. > [!NOTE] + > > The OpenDocument extensions (`*.odt`, `*.odp`, `*.ods`) that Microsoft Office applications can use aren't migrated by default. The default `MigUser.xml` file doesn't migrate the following data: - Files tagged with both the **Hidden** and **System** attributes. -- Files and folders on removable drives, +- Files and folders on removable drives. - Data from the `%WINDIR%`, `%PROGRAMFILES%`, `%PROGRAMDATA%` folders. - ACLS for files in folders outside the user profile. -You can make a copy of the `MigUser.xml` file and modify it to include or exclude standard user-profile folders and file name extensions. If you know all of the extensions for the files you want to migrate from the source computer, use the `MigUser.xml` file to move all of your relevant data, regardless of the location of the files. However, this provision may result in a migration that contains more files than intended. For example, if you choose to migrate all .jpg files, you may migrate image files such as thumbnails and logos from legacy applications that are installed on the source computer. +The `MigUser.xml` file can be copied and then the copy modified to include or exclude standard user-profile folders and file name extensions. If all of the extensions for the files that need to be migrated from the source computer are known, use the `MigUser.xml` file to move all of the relevant data, regardless of the location of the files. However, adding in all file extensions that need to be migrated to the `MigUser.xml` file can result in a migration that contains more files than intended. For example, if all **.jpg** files are migrated, it can also migrate image files such as thumbnails and logos from legacy applications that are installed on the source computer. > [!NOTE] -> Each file name extension you include in the rules within the `MigUser.xml` file increases the amount of time needed for the ScanState tool to gather the files for the migration. If you are migrating more than 300 file types, you may experience a slow migration. For more information about other ways to organize the migration of your data, see the [Using multiple XML files](#using-multiple-xml-files) section of this article. +> +> Each file name extension included in the rules within the `MigUser.xml` file increases the amount of time needed for the **ScanState** tool to gather the files for the migration. If more than 300 file types are being migrated, the migration experience can be slow. For more information about other ways to organize the migration of the data, see the [Using multiple XML files](#using-multiple-xml-files) section of this article. ## Using multiple XML files -You can use multiple XML files with the ScanState and LoadState tools. Each of the default XML files included with or generated by USMT is configured for a specific component of the migration. You can also use custom XML files to supplement these default files with more migration rules. +Multiple XML files can be used with the **ScanState** and **LoadState** tools. Each of the default XML files included with or generated by USMT is configured for a specific component of the migration. Custom XML files can also be used to supplement these default files with more migration rules. |XML migration file|Modifies the following components:| |--- |--- | -|*Config.xml file*|Operating-system components such as desktop wallpaper and background theme.
You can also overload `Config.xml` to include some application and document settings by generating the `Config.xml` file with the other default XML files. For more information, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [Config.xml File](usmt-configxml-file.md).| -|*MigApps.xml file*|Applications settings.| -|*MigUser.xml* or *MigDocs.xml* files|User files and profile settings.| -|*Custom XML files*|Application settings, user profile settings, or user files, beyond the rules contained in the other XML files.| +|**Config.xml file**|Operating-system components such as desktop wallpaper and background theme.
The `Config.xml` can also be extended to include some application and document settings by generating the `Config.xml` file with the other default XML files. For more information, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [Config.xml File](usmt-configxml-file.md).| +|**MigApps.xml file**|Applications settings.| +|**MigUser.xml** or **MigDocs.xml** files|User files and profile settings.| +|**Custom XML files**|Application settings, user profile settings, or user files, beyond the rules contained in the other XML files.| -For example, you can use all of the XML migration file types for a single migration, as in the following example: +For example, all of the XML migration file types can be used for a single migration, as in the following example: ```cmd ScanState.exe /config:c:\myFolder\Config.xml /i:migapps.xml /i:MigDocs.xml /i:CustomRules.xml @@ -173,54 +182,61 @@ ScanState.exe /config:c:\myFolder\Config.xml /i:migapps.xml /i:MigDocs.x ### XML rules for migrating user files > [!IMPORTANT] -> You should not use the `MigUser.xml` and `MigDocs.xml` files together in the same command. Using both XML files can result in duplication of some migrated files. This occurs when conflicting target-location instructions are given in each XML file. The target file will be stored once during the migration, but will be applied by each XML file to a different location on the destination computer. +> +> The `MigUser.xml` and `MigDocs.xml` files shouldn't be used together in the same command. Using both XML files can result in duplication of some migrated files. Duplication of some migrated files can occur when conflicting target-location instructions are given in each XML file. The target file is stored once during the migration, but each XML file applies the file to a different location on the destination computer. -If your data set is unknown or if many files are stored outside of the standard user-profile folders, the `MigDocs.xml` is a better choice than the `MigUser.xml` file, because the `MigDocs.xml` file will gather a broader scope of data. The `MigDocs.xml` file migrates folders of data based on location. The `MigUser.xml` file migrates only the files with the specified file name extensions. +If the data set is unknown or if many files are stored outside of the standard user-profile folders, the `MigDocs.xml` is a better choice than the `MigUser.xml` file, because the `MigDocs.xml` file gathers a broader scope of data. The `MigDocs.xml` file migrates folders of data based on location. The `MigUser.xml` file migrates only the files with the specified file name extensions. -If you want more control over the migration, you can create custom XML files. See [Creating and editing a custom XML file](#creating-and-editing-a-custom-xml-file) for more information. +For more control over the migration, create custom XML files. For more information on creating custom XML files, see [Creating and editing a custom XML file](#creating-and-editing-a-custom-xml-file). ## Creating and editing a custom XML file -You can use the `/genmigxml` command-line option to determine which files will be included in your migration. The `/genmigxml` option creates a file in a location you specify, so that you can review the XML rules and make modifications as necessary. +The `/genmigxml` command-line option can be used to determine which files are included in the migration. The `/genmigxml` option creates a file in a specified location. The XML rules in the file can then be reviewed and if necessary, modifications made. > [!NOTE] -> If you reinstall USMT, the default migration XML files will be overwritten and any customizations you make directly to these files will be lost. Consider creating separate XML files for your custom migration rules and saving them in a secure location. +> +> If USMT is reinstalled, the default migration XML files are overwritten and any customizations made to these files are lost. Consider creating separate XML files for the custom migration rules and saving them in a secure location. To generate the XML migration rules file for a source computer: 1. Select **Start** > **All Programs** > **Accessories** -2. Right-click **Command Prompt**, and then select **Run as**. +1. Right-click **Command Prompt**, and then select **Run as**. -3. Select an account with administrator privileges, supply a password, and then select **OK**. +1. Select an account with administrator privileges, supply a password, and then select **OK**. -4. At the command prompt, enter: +1. At the command prompt, enter: ```cmd cd /d ScanState.exe /genmigxml: ``` - Where *<USMTpath>* is the location on your source computer where you've saved the USMT files and tools, and *<filepath.xml>* is the full path to a file where you can save the report. For example, enter: + where: + + - **\** - location on the source computer of the saved USMT files and tools. + - **\** - full path to a file where the report can be saved. + + For example, enter: ```cmd cd /d c:\USMT - ScanState.exe /genmigxml:"C:\Documents and Settings\USMT Tester\Desktop\genMig.xml" + ScanState.exe /genmigxml:"C:\Users\USMT Tester\Desktop\genMig.xml" ``` ### The GenerateDocPatterns function -The `MigDocs.xml` file calls the `GenerateDocPatterns` function, which takes three Boolean values. You can change the settings to modify the way the `MigDocs.xml` file generates the XML rules for migration. +The `MigDocs.xml` file calls the `GenerateDocPatterns` function, which takes three Boolean values. The settings can be changed to modify the way the `MigDocs.xml` file generates the XML rules for migration. - `ScanProgramFiles`: This argument is valid only when the `GenerateDocPatterns` function is called in a system context. This argument determines whether or not to scan the Program Files directory to gather registered file name extensions for known applications. **Default value**: False - For example, when set to **TRUE**, the function discovers and migrates .doc files under the Microsoft Office directory, because .doc is a file name extension registered to a Microsoft Office application. The `GenerateDocPatterns` function generates this inclusion pattern for `.doc` files: + For example, when set to **TRUE**, the function discovers and migrates **.doc** files under the Microsoft Office directory, because **.doc** is a file name extension registered to a Microsoft Office application. The `GenerateDocPatterns` function generates this inclusion pattern for `.doc` files: `C:\Program Files\Microsoft Office[.doc]` - If a child folder of an included folder contains an installed application, ScanProgramFiles will also create an exclusion rule for the child folder. All folders under the application folder will be scanned recursively for registered file name extensions. + If a child folder of an included folder contains an installed application, `ScanProgramFiles` also creates an exclusion rule for the child folder. All folders under the application folder are scanned recursively for registered file name extensions. - `IncludePatterns`: This argument determines whether to generate exclude or include patterns in the XML. When this argument is set to **TRUE**, the `GenerateDocPatterns` function generates include patterns, and the function must be added under the `` element. Changing this argument to **FALSE** generates exclude patterns and the function must be added under the `` element. @@ -268,7 +284,10 @@ To create exclude data patterns: ### Understanding the system and user context -The migration XML files contain two <component> elements with different **context** settings. The system context applies to files on the computer that aren't stored in the User Profiles directory, while the user context applies to files that are particular to an individual user. +The migration XML files contain two \ elements with different **context** settings: + +- The system context applies to files on the computer that aren't stored in the User Profiles directory. +- The user context applies to files that are particular to an individual user. #### System context @@ -319,27 +338,29 @@ The user context includes rules for data in the User Profiles directory. When ca - FOLDERID_RecordedTV > [!NOTE] -> Rules contained in a component that is assigned the user context will be run for each user profile on the computer. Files that are scanned multiple times by the `MigDocs.xml` files will only be copied to the migration store once; however, a large number of rules in the user context can slow down the migration. Use the system context when it is applicable. +> +> Rules contained in a component that is assigned the user context runs for each user profile on the computer. Files that are scanned multiple times by the `MigDocs.xml` files are only copied to the migration store once. However, a large number of rules in the user context can slow down the migration. Use the system context when it's applicable. ### Sample migration rules for customized versions of XML files -> [!NOTE] +> [!TIP] +> > For best practices and requirements for customized XML files in USMT, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [General Conventions](usmt-general-conventions.md). ### Exclude rules usage examples -In the examples below, the source computer has a .txt file called "new text document" in a directory called "new folder". The default `MigDocs.xml` behavior migrates the new text document.txt file and all files contained in the "new folder" directory. The rules generated by the function are: +In the following examples, the source computer has a **.txt** file called `new text document` in a directory called `new folder`. The default `MigDocs.xml` behavior migrates the new text `document.txt` file and all files contained in the `new folder` directory. The rules generated by the function are: | Rule | Syntax | |--- |--- | |Rule 1|`d:\new folder[new text document.txt]`| |Rule 2|`d:\new folder[]`| -To exclude the new text document.txt file and any .txt files in "new folder", you can do the following modification: +To exclude the new text `document.txt` file and any **.txt** files in `new folder`, the following modifications can be made: #### Example 1: Exclude all .txt files in a folder -To exclude Rule 1, there needs to be an exact match of the file name. However, for Rule 2, you can create a pattern to exclude files by using the file name extension. +To exclude Rule 1, there needs to be an exact match of the file name. However, for Rule 2, a pattern can be created to exclude files by using the file name extension. ```xml @@ -352,7 +373,7 @@ To exclude Rule 1, there needs to be an exact match of the file name. However, f #### Example 2: Use the UnconditionalExclude element to give a rule precedence over include rules -If you don't know the file name or location of the file, but you do know the file name extension, you can use the `GenerateDrivePatterns` function. However, the rule will be less specific than the default include rule generated by the `MigDocs.xml` file, so it will not have precedence. You must use the <UnconditionalExclude> element to give this rule precedence over the default include rule. For more information about the order of precedence for XML migration rules, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). +If the file name or location of the file isn't known, but the file name extension is known, the `GenerateDrivePatterns` function can be used. However, the rule is less specific than the default include rule generated by the `MigDocs.xml` file, so it doesn't have precedence. The \ element must be used to give this rule precedence over the default include rule. For more information about the order of precedence for XML migration rules, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). ```xml @@ -364,7 +385,7 @@ If you don't know the file name or location of the file, but you do know the fil #### Example 3: Use a UserandSystem context component to run rules in both contexts -If you want the **<UnconditionalExclude>** element to apply to both the system and user context, you can create a third component using the **UserandSystem** context. Rules in this component will be run in both contexts. +To apply the **\** element to both the system and user context, a third component can be created using the **UserandSystem** context. Rules in this component run in both contexts. ```xml @@ -381,15 +402,15 @@ If you want the **<UnconditionalExclude>** element to apply to both the sy ``` -For more examples of exclude rules that you can use in custom migration XML files, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md). +For more examples of exclude rules that can be used in custom migration XML files, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md). ### Include rules usage examples -The application data directory is the most common location that you would need to add an include rule for. The `GenerateDocPatterns` function excludes this location by default. If your company uses an application that saves important data to this location, you can create include rules to migrate the data. For example, the default location for .pst files is: `%CSIDL_LOCAL_APPDATA%\Microsoft\Outlook`. The `MigApp.xml` file contains migration rules to move only those .pst files that are linked to Microsoft Outlook. To include .pst files that aren't linked, you can do the following modification: +The application data directory is the most common location that an include rule would need to be added for. The `GenerateDocPatterns` function excludes this location by default. If the organization uses an application that saves important data to this location, include rules can be created to migrate the data. For example, the default location for **.pst** files is: `%CSIDL_LOCAL_APPDATA%\Microsoft\Outlook`. The `MigApp.xml` file contains migration rules to move only those **.pst** files that are linked to Microsoft Outlook. To include **.pst** files that aren't linked, the following modification can be made: #### Example 1: Include a file name extension in a known user folder -This rule will include .pst files that are located in the default location, but aren't linked to Microsoft Outlook. Use the user context to run this rule for each user on the computer. +This rule includes **.pst** files that are located in the default location, but aren't linked to Microsoft Outlook. Use the user context to run this rule for each user on the computer. ```xml @@ -401,7 +422,7 @@ This rule will include .pst files that are located in the default location, but #### Example 2: Include a file name extension in Program Files -For locations outside the user profile, such as the Program Files folder, you can add the rule to the system context component. +For locations outside the user profile, such as the Program Files folder, the rule can be added to the system context component. ```xml @@ -411,19 +432,19 @@ For locations outside the user profile, such as the Program Files folder, you ca ``` -For more examples of include rules that you can use in custom migration XML files, see [Include Files and Settings](usmt-include-files-and-settings.md). +For more examples of include rules that can be used in custom migration XML files, see [Include Files and Settings](usmt-include-files-and-settings.md). -> [!NOTE] +> [!TIP] +> > For more information about the order of precedence for XML migration rules, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). ## Next steps -You can include additional rules for the migration in the `MigDocs.xml` file or other XML migration files. For example, you can use the `` element to move files from the folder where they were gathered to a different folder, when they're applied to the destination computer. +Additional rules for the migration can be included in the `MigDocs.xml` file or other XML migration files. For example, the `` element can be used to move files from the folder where they were gathered to a different folder, when they're applied to the destination computer. -You can use an XML schema (MigXML.xsd) file to validate the syntax of your customized XML files. For more information, see [USMT Resources](usmt-resources.md). +An XML schema (`MigXML.xsd`) file can be used to validate the syntax of the customized XML files. For more information, see [USMT Resources](usmt-resources.md). ## Related articles -[Exclude files and settings](usmt-exclude-files-and-settings.md) - -[Include files and settings](usmt-include-files-and-settings.md) +- [Exclude files and settings](usmt-exclude-files-and-settings.md). +- [Include files and settings](usmt-include-files-and-settings.md). diff --git a/windows/deployment/usmt/usmt-best-practices.md b/windows/deployment/usmt/usmt-best-practices.md index 98f95d0597..b0dd174acb 100644 --- a/windows/deployment/usmt/usmt-best-practices.md +++ b/windows/deployment/usmt/usmt-best-practices.md @@ -1,135 +1,141 @@ --- -title: USMT Best Practices (Windows 10) -description: This article discusses general and security-related best practices when using User State Migration Tool (USMT) 10.0. +title: USMT Best Practices +description: This article discusses general and security-related best practices when using User State Migration Tool (USMT). +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # USMT best practices -This article discusses general and security-related best practices when using User State Migration Tool (USMT) 10.0. +This article discusses general and security-related best practices when using User State Migration Tool (USMT). ## General best practices -- **Install applications before running the LoadState tool** +- **Install applications before running the LoadState tool.** - Though it isn't always essential, it's best practice to install all applications on the destination computer before restoring the user state. Installing applications before restoring user state helps ensure that migrated settings are preserved. + Though it isn't always essential, it's best practice to install all applications on the destination computer before restoring the user state. Installing applications before restoring user state helps ensure that migrated settings are preserved. -- **Don't use MigUser.xml and MigDocs.xml together** +- **Don't use MigUser.xml and MigDocs.xml together.** - If you use both .xml files, some migrated files may be duplicated if conflicting instructions are given about target locations. You can use the `/genmigxml` command-line option to determine which files will be included in your migration, and to determine if any modifications are necessary. For more information, see [Identify file types, files, and folders](usmt-identify-file-types-files-and-folders.md). + If both `MigUser.xml` and `MigDocs.xml` are used together, some migrated files can be duplicated if conflicting instructions are given about target locations. The `/genmigxml` command-line option can be used to determine which files are included in the migration, and to determine if any modifications are necessary. For more information, see [Identify file types, files, and folders](usmt-identify-file-types-files-and-folders.md). -- **Use MigDocs.xml for a better migration experience** +- **Use MigDocs.xml for a better migration experience.** - If your data set is unknown or if many files are stored outside of the standard user-profile folders, the `MigDocs.xml` file is a better choice than the `MigUser.xml` file, because the `MigDocs.xml` file will gather a broader scope of data. The `MigDocs.xml` file migrates folders of data based on location, and on registered file type by querying the registry for registered application extensions. The `MigUser.xml` file migrates only the files with the specified file extensions. + If the data set is unknown or if many files are stored outside of the standard user-profile folders, the `MigDocs.xml` file is a better choice than the `MigUser.xml` file, because the `MigDocs.xml` file gathers a broader scope of data. The `MigDocs.xml` file migrates folders of data based on location, and on registered file type by querying the registry for registered application extensions. The `MigUser.xml` file migrates only the files with the specified file extensions. -- **Close all applications before running either the ScanState or LoadState tools** +- **Close all applications before running either the ScanState or LoadState tools.** - Although using the `/vsc` switch can allow the migration of many files that are open with another application, it's a best practice to close all applications in order to ensure all files and settings migrate. Without the `/vsc` or `/c` switch USMT will fail when it can't migrate a file or setting. When you use the `/c` option, USMT will ignore any files or settings that it can't migrate and log an error each time. + Although using the `/vsc` switch can allow the migration of many files that are open with another application, it's a best practice to close all applications in order to ensure all files and settings migrate. Without the `/vsc` or `/c` switch, USMT fails when it can't migrate a file or setting. When the `/c` option is used, USMT ignores any files or settings that it can't migrate and log an error each time. -- **Log off after you run the LoadState** +- **Log off after running the LoadState.** - Some settings, such as fonts, wallpaper, and screensaver settings, won't take effect until the next time the user logs on. For this reason, you should sign out after you run the LoadState tool. + Some settings, such as fonts, wallpaper, and screensaver settings, won't take effect until the next time the user logs on. For this reason, sign out after running the **LoadState** tool. -- **Managed environment** +- **Managed environment.** - To create a managed environment, you can move all of the end user's documents into My Documents (%CSIDL\_PERSONAL%). We recommend that you migrate files into the smallest-possible number of folders on the destination computer. Minimizing folders will help you to clean up files on the destination computer, if the `LoadState.exe` command fails before completion. + To create a managed environment, all of the end user's documents can be moved into the **Documents** folder (%CSIDL\_PERSONAL%). Microsoft recommends migrating files into the smallest-possible number of folders on the destination computer. Minimizing folders helps to clean up files on the destination computer if the `LoadState.exe` command fails before completion. -- **Chkdsk.exe** +- **Chkdsk.exe.** - We recommend that you run **Chkdsk.exe** before running the ScanState and LoadState tools. **Chkdsk.exe** creates a status report for a hard disk drive and lists and corrects common errors. For more information about the **Chkdsk.exe** tool, see [Chkdsk](/previous-versions/windows/it-pro/windows-xp/bb490876(v=technet.10)). + Microsoft recommends running **Chkdsk.exe** before running the **ScanState** and **LoadState** tools. **Chkdsk.exe** creates a status report for a hard disk drive and lists and corrects common errors. For more information about the **Chkdsk.exe** tool, see [Chkdsk](/previous-versions/windows/it-pro/windows-xp/bb490876(v=technet.10)). -- **Migrate in groups** +- **Migrate in groups.** - If you decide to perform the migration while users are using the network, it's best to migrate user accounts in groups. To minimize the impact on network performance, determine the size of the groups based on the size of each user account. Migrating in phases also allows you to make sure each phase is successful before starting the next phase. Using this method, you can make any necessary modifications to your plan between groups. + If the migration is performed while users are using the network, it's best to migrate user accounts in groups. To minimize the effect on network performance, determine the size of the groups based on the size of each user account. Migrating in phases also allows making sure each phase is successful before starting the next phase. When this method is, any necessary modifications can be made to the plan between groups. ## Security best practices -As the authorized administrator, it is your responsibility to protect the privacy of the users and maintain security during and after the migration. In particular, you must consider the following issues: +As the authorized administrator, it's the responsibility to protect the privacy of the users and maintain security during and after the migration. In particular, the following issues must be considered: -- **Encrypting File System (EFS)** +- **Encrypting File System (EFS).** - Take extreme caution when migrating encrypted files, because the end user doesn't need to be logged on to capture the user state. By default, USMT fails if an encrypted file is found. For specific instructions about EFS best practices, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md). + Take extreme caution when migrating encrypted files, because the end user doesn't need to be logged on to capture the user state. By default, USMT fails if an encrypted file is found. For specific instructions about EFS best practices, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md). - > [!NOTE] - > If you migrate an encrypted file without also migrating the certificate, end users will not be able to access the file after the migration. + > [!NOTE] + > + > If an encrypted file is migrated without also migrating the certificate, end users won't be able to access the file after the migration. -- **Encrypt the store** +- **Encrypt the store.** - Consider using the `/encrypt` option with the `ScanState.exe` command and the `/decrypt` option with the `LoadState.exe` command. However, use extreme caution with this set of options, because anyone who has access to the `ScanState.exe` command-line script also has access to the encryption key. + Consider using the `/encrypt` option with the `ScanState.exe` command and the `/decrypt` option with the `LoadState.exe` command. However, use extreme caution with this set of options, because anyone who has access to the `ScanState.exe` command-line script also has access to the encryption key. -- **Virus Scan** +- **Virus Scan.** - We recommend that you scan both the source and destination computers for viruses before running USMT. In addition, you should scan the destination computer image. To help protect data from viruses, we strongly recommend running an antivirus utility before migration. + Microsoft recommends to scan both the source and destination computers for viruses before running USMT. In addition, the destination computer image should be scanned. To help protect data from viruses, Microsoft strongly recommends running an antivirus utility before migration. -- **Maintain security of the file server and the deployment server** +- **Maintain security of the file server and the deployment server.** - We recommend that you manage the security of the file and deployment servers. It's important to make sure that the file server where you save the store is secure. You must also secure the deployment server, to ensure that the user data that is in the log files isn't exposed. We also recommend that you only transmit data over a secure Internet connection, such as a virtual private network. For more information about network security, see [Microsoft Security Compliance Manager](https://www.microsoft.com/download/details.aspx?id=53353). + Microsoft recommends managing the security of the file and deployment servers. It's important to make sure that the file server where the store is saved is secure. The deployment server must also be secured to ensure that the user data that is in the log files isn't exposed. Microsoft also recommends to only transmit data over a secure network connection, such as a virtual private network. For more information about network security, see [Microsoft Security Compliance Manager](https://www.microsoft.com/download/details.aspx?id=53353). -- **Password Migration** +- **Password Migration.** - To ensure the privacy of the end users, USMT doesn't migrate passwords, including passwords for applications such as Windows Live™ Mail, Microsoft Internet Explorer®, and Remote Access Service (RAS) connections and mapped network drives. It's important to make sure that end users know their passwords. + To ensure the privacy of the end users, USMT doesn't migrate passwords, including passwords for applications or mapped network drives. It's important to make sure that end users know their passwords. -- **Local Account Creation** +- **Local Account Creation.** - Before you migrate local accounts, see the Migrating Local Accounts section in the [Identify Users](usmt-identify-users.md) article. + Before local accounts are migrated, see the Migrating Local Accounts section in the [Identify Users](usmt-identify-users.md) article. ## XML file best practices -- **Specify the same set of mig\*.xml files in both the ScanState and the LoadState tools** +- **Specify the same set of mig\*.xml files in both the ScanState and the LoadState tools.** - If you used a particular set of mig\*.xml files in the ScanState tool, either called through the `/auto` option, or individually through the `/i` option, then you should use same option to call the exact same mig\*.xml files in the LoadState tool. + If a particular set of mig\*.xml files are used with the **ScanState** tool, either called through the `/auto` option, or individually through the `/i` option, then the same option should be used to call the exact same mig\*.xml files in the **LoadState** tool. -- **The <CustomFileName> in the migration urlid should match the name of the file** +- **The \ in the migration urlid should match the name of the file.** - Although it isn't a requirement, it's good practice for **<CustomFileName>** to match the name of the file. For example, the following example is from the `MigApp.xml` file: + Although it isn't a requirement, it's good practice for **\** to match the name of the file. For example, the following example is from the `MigApp.xml` file: - ```xml - - - ``` + ```xml + + + ``` -- **Use the XML Schema (MigXML.xsd) when authoring .xml files to validate syntax** +- **Use the XML Schema (MigXML.xsd) when authoring .xml files to validate syntax.** - The `MigXML.xsd` schema file shouldn't be included on the command line or in any of the .xml files. + The `MigXML.xsd` schema file shouldn't be included on the command line or in any of the **.xml** files. -- **Use the default migration XML files as models** +- **Use the default migration XML files as models.** - To create a custom .xml file, you can use the migration .xml files as models to create your own. If you need to migrate user data files, model your custom .xml file on `MigUser.xml`. To migrate application settings, model your custom .xml file on the `MigApp.xml` file. + To create a custom **.xml** file, migration **.xml** files can be used as models to create customized versions. If user data files need to be migrated, model the custom **.xml** file on `MigUser.xml`. To migrate application settings, model the custom **.xml** file on the `MigApp.xml` file. -- **Consider the impact on performance when using the <context> parameter** +- **Consider the impact on performance when using the \ parameter.** - Your migration performance can be affected when you use the **<context>** element with the **<component>** element; for example, as in when you want to encapsulate logical units of file- or path-based **<include>** and **<exclude>** rules. + The migration performance can be affected when the **\** element is used with the **\** element. For example, when encapsulating logical units of file- or path-based **\** and **\** rules. - In the **User** context, a rule is processed one time for each user on the system. + In the **User** context, a rule is processed one time for each user on the system. + + In the **System** context, a rule is processed one time for the system. - In the **System** context, a rule is processed one time for the system. + In the **UserAndSystem** context, a rule is processed one time for each user on the system and one time for the system. - In the **UserAndSystem** context, a rule is processed one time for each user on the system and one time for the system. + > [!NOTE] + > + > The number of times a rule is processed doesn't affect the number of times a file is migrated. The USMT migration engine ensures that each file migrates only once. - > [!NOTE] - > The number of times a rule is processed does not affect the number of times a file is migrated. The USMT migration engine ensures that each file migrates only once. +- **Microsoft recommends to create a separate .xml file instead of adding .xml code to one of the existing migration .xml files.** -- **We recommend that you create a separate .xml file instead of adding your .xml code to one of the existing migration .xml files** + For example, for code that migrates the settings for an application, the code shouldn't just be added to the `MigApp.xml` file. - For example, if you have code that migrates the settings for an application, you shouldn't just add the code to the `MigApp.xml` file. +- **Custom .xml files shouldn't be created to alter the operating system settings that are migrated.** -- **You should not create custom .xml files to alter the operating system settings that are migrated** + Manifest files determine what settings are migrated. Manifest files can't be modified. Since manifest files can't be modified, to exclude certain operating system settings from the migration, create and modify a `Config.xml` file instead. - These settings are migrated by manifests and you can't modify those files. If you want to exclude certain operating system settings from the migration, you should create and modify a `Config.xml` file. +- **The asterisk (\*) wildcard character can be used in any migration XML file that is created.** -- **You can use the asterisk (\*) wildcard character in any migration XML file that you create** - - > [!NOTE] - > The question mark is not valid as a wildcard character in USMT .xml files. + > [!NOTE] + > + > The question mark isn't valid as a wildcard character in USMT **.xml** files. ## Related articles -[Migration store encryption](usmt-migration-store-encryption.md) - -[Plan your migration](usmt-plan-your-migration.md) +- [Migration store encryption](usmt-migration-store-encryption.md). +- [Plan the migration](usmt-plan-your-migration.md). diff --git a/windows/deployment/usmt/usmt-choose-migration-store-type.md b/windows/deployment/usmt/usmt-choose-migration-store-type.md index ab33c29403..0f81628b29 100644 --- a/windows/deployment/usmt/usmt-choose-migration-store-type.md +++ b/windows/deployment/usmt/usmt-choose-migration-store-type.md @@ -1,30 +1,38 @@ --- -title: Choose a Migration Store Type (Windows 10) -description: Learn how to choose a migration store type and estimate the amount of disk space needed for computers in your organization. +title: Choose a Migration Store Type +description: Learn how to choose a migration store type and estimate the amount of disk space needed for computers in the organization. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Choose a migration store type -One of the main considerations for planning your migration is to determine which migration store type best meets your needs. As part of these considerations, determine how much space is required to run the User State Migration Tool (USMT) 10.0 components on your source and destination computers, and how much space is needed to create and host the migration store, whether you're using a local share, network share, or storage device. The final consideration is ensuring that user date integrity is maintained by encrypting the migration store. +One of the main considerations for planning the migration is to determine which migration store type best meets the organization's needs. As part of these considerations, determine the following items: + +- How much space is required to run the User State Migration Tool (USMT) components on the source and destination computers. +- How much space is needed to create and host the migration store. +- Whether a local share, network share, or storage device should be used. +- Ensure that user date integrity is maintained by encrypting the migration store. ## In this section | Link | Description | |--- |--- | -|[Migration store types overview](migration-store-types-overview.md)|Choose the migration store type that works best for your needs and migration scenario.| -|[Estimate migration store size](usmt-estimate-migration-store-size.md)|Estimate the amount of disk space needed for computers in your organization based on information about your organization's infrastructure.| +|[Migration store types overview](migration-store-types-overview.md)|Choose the migration store type that works best for the organization's needs and migration scenario.| +|[Estimate migration store size](usmt-estimate-migration-store-size.md)|Estimate the amount of disk space needed for computers in the organization based on information about the organization's infrastructure.| |[Hard-link migration store](usmt-hard-link-migration-store.md)|Learn about hard-link migration stores and the scenarios in which they're used.| |[Migration store encryption](usmt-migration-store-encryption.md)|Learn about the using migration store encryption to protect user data integrity during a migration.| ## Related articles -[Plan your migration](usmt-plan-your-migration.md) - -[User State Migration Tool (USMT) how-to topics](usmt-how-to.md) +- [Plan the migration](usmt-plan-your-migration.md) +- [User State Migration Tool (USMT) how-articles](usmt-how-to.md) diff --git a/windows/deployment/usmt/usmt-command-line-syntax.md b/windows/deployment/usmt/usmt-command-line-syntax.md index 55cfe5e69c..46389ba17b 100644 --- a/windows/deployment/usmt/usmt-command-line-syntax.md +++ b/windows/deployment/usmt/usmt-command-line-syntax.md @@ -1,23 +1,27 @@ --- -title: User State Migration Tool (USMT) Command-line Syntax (Windows 10) -description: Learn about the User State Migration Tool (USMT) command-line syntax for using the ScanState tool, LoadState tool, and UsmtUtils tool. +title: User State Migration Tool (USMT) Command-line Syntax +description: Learn about the User State Migration Tool (USMT) command-line syntax for using the **ScanState** tool, **LoadState** tool, and UsmtUtils tool. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # User State Migration Tool (USMT) command-line syntax -The User State Migration Tool (USMT) 10.0 migrates user files and settings during large deployments of Windows. To improve and simplify the migration process, USMT captures desktop, network, and application settings in addition to a user's files. USMT then migrates these items to a new Windows installation. +The User State Migration Tool (USMT) migrates user files and settings during large deployments of Windows. To improve and simplify the migration process, USMT captures desktop, network, and application settings in addition to a user's files. USMT then migrates these items to a new Windows installation. ## In this Section | Link | Description | |--- |--- | -|[ScanState syntax](usmt-scanstate-syntax.md)|Lists the command-line options for using the ScanState tool.| -|[LoadState syntax](usmt-loadstate-syntax.md)|Lists the command-line options for using the LoadState tool.| +|[**ScanState** syntax](usmt-scanstate-syntax.md)|Lists the command-line options for using the **ScanState** tool.| +|[LoadState syntax](usmt-loadstate-syntax.md)|Lists the command-line options for using the **LoadState** tool.| |[UsmtUtils syntax](usmt-utilities.md)|Lists the command-line options for using the UsmtUtils tool.| diff --git a/windows/deployment/usmt/usmt-common-migration-scenarios.md b/windows/deployment/usmt/usmt-common-migration-scenarios.md index 183565827a..3f2d0b63c8 100644 --- a/windows/deployment/usmt/usmt-common-migration-scenarios.md +++ b/windows/deployment/usmt/usmt-common-migration-scenarios.md @@ -1,109 +1,120 @@ --- -title: Common Migration Scenarios (Windows 10) -description: See how the User State Migration Tool (USMT) 10.0 is used when planning hardware and/or operating system upgrades. +title: Common Migration Scenarios +description: See how the User State Migration Tool (USMT) is used when planning hardware and/or operating system upgrades. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Common Migration Scenarios -You use the User State Migration Tool (USMT) 10.0 when hardware and/or operating system upgrades are planned for a large number of computers. USMT manages the migration of an end-user's digital identity by capturing the user's operating-system settings, application settings, and personal files from a source computer and reinstalling them on a destination computer after the upgrade has occurred. +The User State Migration Tool (USMT) can be used when hardware and/or operating system upgrades are planned for a large number of computers. USMT manages the migration of an end-user's digital identity by capturing from a source computer the following user's items: -One common scenario is when the operating system is upgraded on existing hardware without the hardware being replaced. This scenario is referred to as *PC-refresh*. A second common scenario is known as *PC replacement*, where one piece of hardware is being replaced, typically by newer hardware and a newer operating system. +- Operating-system settings. +- Application settings. +- Personal files. + +Once these items are capture, they're reinstalled on a destination computer after the upgrade completes. + +One common scenario is when the operating system is upgraded on existing hardware without the hardware being replaced. This scenario is referred to as **PC-refresh**. A second common scenario is known as **PC replacement**, where one piece of hardware is being replaced, typically by newer hardware and a newer operating system. ## PC-refresh -The following diagram shows a PC-refresh migration, also known as a computer refresh migration. First, the administrator migrates the user state from a source computer to an intermediate store. After installing the operating system, the administrator migrates the user state back to the source computer. +The following diagram shows a PC-refresh migration, also known as a computer refresh migration. First, the administrator migrates the user state from a source computer to an intermediate store. After the administrator installs the operating system, they migrate the user state back to the source computer. ![usmt pc refresh scenario.](images/dep-win8-l-usmt-pcrefresh.jpg) ### Scenario One: PC-refresh offline using Windows PE and a hard-link migration store -A company has received funds to update the operating system on all of its computers in the accounting department to Windows 10. Each employee will keep the same computer, but the operating system on each computer will be updated. In this scenario, the update is being handled offline, without a network connection. An administrator uses Windows Preinstallation Environment (WinPE) and a hard-link migration store to save each user state to their respective computer. +An organization receives funds to update the operating system on all of its computers in the accounting department to the latest supported version of Windows. Each employee keeps the same computer, but the operating system on each computer will be updated. In this scenario, the update is being handled offline, without a network connection. An administrator uses Windows Preinstallation Environment (WinPE) and a hard-link migration store to save each user state to their respective computer. 1. On each computer, the administrator boots the machine into WinPE and runs the **ScanState** command-line tool, specifying the `/hardlink /nocompress` command-line options. **ScanState** saves the user state to a hard-link migration store on each computer, improving performance by minimizing network traffic and minimizing migration failures on computers with limited space available on the hard drive. -2. On each computer, the administrator installs the company's standard operating environment (SOE) which includes Windows 10 and other company applications. +1. On each computer, the administrator installs the organization's standard operating environment (SOE) which includes the latest supported version of Windows and other organization applications. -3. The administrator runs the **LoadState** command-line tool on each computer. **LoadState** restores each user state back to each computer. +1. The administrator runs the **LoadState** command-line tool on each computer. **LoadState** restores each user state back to each computer. ### Scenario Two: PC-refresh using a compressed migration store -A company has received funds to update the operating system on all of its computers to Windows 10. Each employee will keep the same computer, but the operating system on each computer will be updated. In this scenario, an administrator uses a compressed migration store to save the user states to a server. +An organization receives funds to update the operating system on all of its computers to the latest supported version of Windows. Each employee keeps the same computer, but the operating system on each computer will be updated. In this scenario, an administrator uses a compressed migration store to save the user states to a server. 1. The administrator runs the **ScanState** command-line tool on each computer. **ScanState** saves each user state to a server. -2. On each computer, the administrator installs the company's standard SOE that includes Windows 10 and other company applications. +1. On each computer, the administrator installs the organization's standard SOE that includes the latest supported version of Windows and other organization applications. -3. The administrator runs the **LoadState** command-line tool on each source computer, and **LoadState** restores each user state back to the computer. +1. The administrator runs the **LoadState** command-line tool on each source computer, and **LoadState** restores each user state back to the computer. ### Scenario Three: PC-refresh using a hard-link migration store -A company has received funds to update the operating system on all of its computers to Windows 10. Each employee will keep the same computer, but the operating system on each computer will be updated. In this scenario, an administrator uses a hard-link migration store to save each user state to their respective computer. +An organization receives funds to update the operating system on all of its computers to the latest supported version of Windows. Each employee keeps the same computer, but the operating system on each computer will be updated. In this scenario, an administrator uses a hard-link migration store to save each user state to their respective computer. 1. The administrator runs the **ScanState** command-line tool on each computer, specifying the `/hardlink /nocompress` command-line options. **ScanState** saves the user state to a hard-link migration store on each computer, improving performance by minimizing network traffic and minimizing migration failures on computers with limited space available on the hard drive. -2. On each computer, the administrator installs the company's SOE that includes Windows 10 and other company applications. +1. On each computer, the administrator installs the organization's SOE that includes the latest supported version of Windows and other organization applications. -3. The administrator runs the **LoadState** command-line tool on each computer. **LoadState** restores each user state back on each computer. +1. The administrator runs the **LoadState** command-line tool on each computer. **LoadState** restores each user state back on each computer. ### Scenario Four: PC-refresh using Windows.old folder and a hard-link migration store -A company has decided to update the operating system on all of its computers to Windows 10. Each employee will keep the same computer, but the operating system on each computer will be updated. In this scenario, an administrator uses Windows.old and a hard-link migration store to save each user state to their respective computer. +An organization decides to update the operating system on all of its computers to the latest supported version of Windows. Each employee keeps the same computer, but the operating system on each computer will be updated. In this scenario, an administrator uses **Windows.old** and a hard-link migration store to save each user state to their respective computer. -1. The administrator clean installs Windows 10 on each computer, making sure that the Windows.old directory is created by installing Windows 10 without formatting or repartitioning and by selecting a partition that contains the previous version of Windows. +1. The administrator clean installs the latest supported version of Windows on each computer. During the install, they make sure that the **Windows.old** directory is created by taking the following actions: -2. On each computer, the administrator installs the company's SOE that includes company applications. + - Performing the install without formatting or repartitioning the disk. + - Selecting a partition that contains the previous version of Windows. -3. The administrator runs the **ScanState** and **LoadState** command-line tools successively on each computer while specifying the `/hardlink /nocompress` command-line options. +1. On each computer, the administrator installs the organization's SOE that includes organization applications. + +1. The administrator runs the **ScanState** and **LoadState** command-line tools successively on each computer while specifying the `/hardlink /nocompress` command-line options. ## PC-replacement -The following diagram shows a PC-replacement migration. First, the administrator migrates the user state from the source computer to an intermediate store. After installing the operating system on the destination computer, the administrator migrates the user state from the store to the destination computer. +The following diagram shows a PC-replacement migration. First, the administrator migrates the user state from the source computer to an intermediate store. After the administrator installs the operating system on the destination computer, they migrate the user state from the store to the destination computer. ![usmt pc replace scenario.](images/dep-win8-l-usmt-pcreplace.jpg) ### Scenario One: Offline migration using Windows PE and an external migration store -A company is allocating 20 new computers to users in the accounting department. The users each have a source computer with their files and settings. In this scenario, migration is being handled offline, without a network connection. +An organization is allocating 20 new computers to users in the accounting department. The users each have a source computer with their files and settings. In this scenario, migration is being handled offline, without a network connection. 1. On each source computer, an administrator boots the machine into WinPE and runs **ScanState** to collect the user state to either a server or an external hard disk. -2. On each new computer, the administrator installs the company's SOE that includes Windows 10 and other company applications. +1. On each new computer, the administrator installs the organization's SOE that includes the latest supported version of Windows and other organization applications. -3. On each of the new computers, the administrator runs the **LoadState** tool, restoring each user state from the migration store to one of the new computers. +1. On each of the new computers, the administrator runs the **LoadState** tool, restoring each user state from the migration store to one of the new computers. ### Scenario Two: Manual network migration -A company receives 50 new laptops for their managers and needs to reallocate 50 older laptops to new employees. In this scenario, an administrator runs the **ScanState** tool from the cmd prompt on each computer to collect the user states and save them to a server in a compressed migration store. +An organization receives 50 new laptops for their managers and needs to reallocate 50 older laptops to new employees. In this scenario, an administrator runs the **ScanState** tool from the cmd prompt on each computer to collect the user states and save them to a server in a compressed migration store. 1. The administrator runs the **ScanState** tool on each of the manager's old laptops, and saves each user state to a server. -2. On the new laptops, the administrator installs the company's SOE, which includes Windows 10 and other company applications. +1. On the new laptops, the administrator installs the organization's SOE, which includes the latest supported version of Windows and other organization applications. -3. The administrator runs the **LoadState** tool on the new laptops to migrate the managers' user states to the appropriate computer. The new laptops are now ready for the managers to use. +1. The administrator runs the **LoadState** tool on the new laptops to migrate the managers' user states to the appropriate computer. The new laptops are now ready for the managers to use. -4. On the old computers, the administrator installs the company's SOE, which includes Windows 10, Microsoft Office, and other company applications. The old computers are now ready for the new employees to use. +1. On the old computers, the administrator installs the organization's SOE, which includes the latest supported version of Windows, Microsoft Office, and other organization applications. The old computers are now ready for the new employees to use. ### Scenario Three: Managed network migration -A company is allocating 20 new computers to users in the accounting department. The users each have a source computer that contains their files and settings. An administrator uses a management technology such as a sign-in script or a batch file to run **ScanState** on each source computer to collect the user states and save them to a server in a compressed migration store. +An organization is allocating 20 new computers to users in the accounting department. The users each have a source computer that contains their files and settings. An administrator uses a management technology such as a sign-in script or a batch file to run **ScanState** on each source computer to collect the user states and save them to a server in a compressed migration store. 1. On each source computer, the administrator runs the **ScanState** tool using Microsoft Configuration Manager, Microsoft Deployment Toolkit (MDT), a sign-in script, a batch file, or a non-Microsoft management technology. **ScanState** collects the user state from each source computer and then saves it to a server. -2. On each new computer, the administrator installs the company's SOE, which includes Windows 10 and other company applications. +1. On each new computer, the administrator installs the organization's SOE, which includes the latest supported version of Windows and other organization applications. -3. On each of the new computers, the administrator runs the **LoadState** tool using Microsoft Configuration Manager, a sign-in script, a batch file, or a non-Microsoft management technology. **LoadState** migrates each user state from the migration store to one of the new computers. +1. On each of the new computers, the administrator runs the **LoadState** tool using Microsoft Configuration Manager, a sign-in script, a batch file, or a non-Microsoft management technology. **LoadState** migrates each user state from the migration store to one of the new computers. ## Related articles -[Plan your migration](usmt-plan-your-migration.md) - -[Choose a migration store type](usmt-choose-migration-store-type.md) - -[Offline migration reference](offline-migration-reference.md) +- [Plan the migration](usmt-plan-your-migration.md). +- [Choose a migration store type](usmt-choose-migration-store-type.md). +- [Offline migration reference](offline-migration-reference.md). diff --git a/windows/deployment/usmt/usmt-configxml-file.md b/windows/deployment/usmt/usmt-configxml-file.md index a144f93cd4..2a5afcc0d3 100644 --- a/windows/deployment/usmt/usmt-configxml-file.md +++ b/windows/deployment/usmt/usmt-configxml-file.md @@ -1,53 +1,66 @@ --- -title: Config.xml File (Windows 10) -description: Learn how the Config.xml file is an optional User State Migration Tool (USMT) 10.0 file that you can create using the /genconfig option with the ScanState.exe tool. +title: Config.xml File +description: Learn how the Config.xml file is an optional User State Migration Tool (USMT) file that can be created using the /genconfig option with the ScanState.exe tool. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Config.xml File -The `Config.xml` file is an optional User State Migration Tool (USMT) 10.0 file that you can create using the `/genconfig` option with the ScanState tool. If you want to include all of the default components, and don't want to change the default store-creation or profile-migration behavior, you don't need to create a `Config.xml` file. +The `Config.xml` file is an optional User State Migration Tool (USMT) file that can be created using the `/genconfig` option with the **ScanState** tool. If all of the default components should be included and no changes need to be made to the default store-creation or profile-migration behavior, a `Config.xml` file doesn't need to be created. -However, if you're satisfied with the default migration behavior defined in the `MigApp.xml`, `MigUser.xml` and `MigDocs.xml` files, but you want to exclude certain components, you can create and modify a `Config.xml` file and leave the other .xml files unchanged. For example, you must create and modify the `Config.xml` file if you want to exclude any of the operating-system settings that are migrated. It's necessary to create and modify this file if you want to change any of the default store-creation or profile-migration behavior. +However, if the default migration behavior defined in the `MigApp.xml`, `MigUser.xml` and `MigDocs.xml` files is satisfactory, but certain components need to be excluded, a `Config.xml` file can be created and modified while leaving the other **.xml** files unchanged. For example, a `Config.xml` file must be created to exclude any of the operating-system settings that are migrated. It's necessary to create and modify the `Config.xml` file to change any of the default store-creation or profile-migration behavior. -The `Config.xml` file has a different format than the other migration .xml files, because it doesn't contain any migration rules. It contains only a list of the operating-system components, applications, user documents that can be migrated, and user-profile policy and error-control policy. For this reason, excluding components using the `Config.xml` file is easier than modifying the migration .xml files, because you don't need to be familiar with the migration rules and syntax. However, you can't use wildcard characters in this file. +The `Config.xml` file has a different format than the other migration **.xml** files, because it doesn't contain any migration rules. It contains only a list of the operating-system components, applications, user documents that can be migrated, and user-profile policy and error-control policy. For this reason, excluding components using the `Config.xml` file is easier than modifying the migration **.xml** files, because familiarization with the migration rules and syntax isn't needed. However, wildcard characters can't be used in this file. For more information about using the `Config.xml` file with other migration files, such as the `MigDocs.xml` and `MigApps.xml` files, see [Understanding Migration XML Files](understanding-migration-xml-files.md). > [!NOTE] -> To exclude a component from the `Config.xml` file, set the **migrate** value to **no**. Deleting the XML tag for the component from the `Config.xml` file will not exclude the component from your migration. +> +> To exclude a component from the `Config.xml` file, set the **migrate** value to **no**. Deleting the XML tag for the component from the `Config.xml` file doesn't exclude the component from the migration. ## Migration Policies -In USMT there are new migration policies that can be configured in the `Config.xml` file. For example, you can configure additional **<ErrorControl>**, **<ProfileControl>**, and **<HardLinkStoreControl>** options. The following elements and parameters are for use in the `Config.xml` file only. +In USMT, there are migration policies that can be configured in the `Config.xml` file. For example, **\**, **\**, and **\** options can be configured. The following elements and parameters are for use in the `Config.xml` file only. -### <Policies> +### \ -The **<Policies>** element contains elements that describe the policies that USMT follows while creating a migration store. Valid children of the **<Policies>** element are **<ErrorControl>** and **<HardLinkStoreControl>**. The **<Policies>** element is a child of **<Configuration>**. +The **\** element contains elements that describe the policies that USMT follows while creating a migration store. Valid children of the **\** element are **\** and **\**. The **\** element is a child of **\**. -Syntax: `` `` +Syntax: -### <ErrorControl> +```xml + +``` -The **<ErrorControl>** element is an optional element you can configure in the `Config.xml` file. The configurable **<ErrorControl>** rules support only the environment variables for the operating system that is running and the currently logged-on user. As a workaround, you can specify a path using the (\*) wildcard character. +### \ + +The **\** element is an optional element that can be configured in the `Config.xml` file. The configurable **\** rules support only the environment variables for the operating system that is running and the currently logged-on user. As a workaround, a path can be specified using the (\*) wildcard character. - **Number of occurrences**: Once for each component -- **Parent elements**: The **<Policies>** element +- **Parent elements**: The **\** element -- **Child elements**: The **<fileError>** and **<registryError>** element +- **Child elements**: The **\** and **\** element -Syntax: `` `` +Syntax: -The following example specifies that all locked files, regardless of their location (including files in C:\\Users), should be ignored. However, the migration fails if any file in C:\\Users can't be accessed because of any other reason. In the example below, the **<ErrorControl>** element ignores any problems in migrating registry keys that match the supplied pattern, and it resolves them to an **Access denied** error. +```xml + +``` -Additionally, the order in the **<ErrorControl>** section implies priority. In this example, the first **<nonFatal>** tag takes precedence over the second **<fatal>** tag. This precedence is applied, regardless of how many tags are listed. +The following example specifies that all locked files, regardless of their location (including files in C:\\Users), should be ignored. However, the migration fails if any file in C:\\Users can't be accessed because of any other reason. In the following example, the **\** element ignores any problems in migrating registry keys that match the supplied pattern, and it resolves them to an **Access denied** error. + +Additionally, the order in the **\** section implies priority. In this example, the first **\** tag takes precedence over the second **\** tag. This precedence is applied, regardless of how many tags are listed. ```xml @@ -62,94 +75,120 @@ Additionally, the order in the **<ErrorControl>** section implies priority ``` > [!IMPORTANT] -> The configurable **<ErrorControl>** rules support only the environment variables for the operating system that is running and the currently logged-on user. As a workaround, you can specify a path using the (\*) wildcard character. +> +> The configurable **\** rules support only the environment variables for the operating system that is running and the currently logged-on user. As a workaround, a path using the (\*) wildcard character can be specified. -### <fatal> +### \ -The **<fatal>** element isn't required. +The **\** element isn't required. - **Number of occurrences**: Once for each component -- **Parent elements**: **<fileError>** and **<registryError>** +- **Parent elements**: **\** and **\** - **Child elements**: None. -Syntax: `` *<pattern>* `` +Syntax: + +```xml + +``` |Parameter|Required|Value| |--- |--- |--- | |errorCode|No|"any" or "*specify system error message here*"| -You use the **<fatal>** element to specify that errors matching a specific pattern should cause USMT to halt the migration. +The **\** element can be used to specify that errors matching a specific pattern should cause USMT to halt the migration. -### <fileError> +### \ -The **<fileError>** element isn't required. +The **\** element isn't required. - **Number of occurrences**: Once for each component -- **Parent elements**: **<ErrorControl>** +- **Parent elements**: **\** -- **Child elements**: **<nonFatal>** and **<fatal>** +- **Child elements**: **\** and **\** -Syntax: `` `` +Syntax: -You use the **<fileError>** element to represent the behavior associated with file errors. +```xml + +``` -### <nonFatal> +The **\** element can be used to represent the behavior associated with file errors. -The **<nonFatal>** element isn't required. +### \ + +The **\** element isn't required. - **Number of occurrences**: Once for each component -- **Parent elements**: The **<fileError>** and **<registryError>** elements. +- **Parent elements**: The **\** and **\** elements. - **Child elements**: None. -Syntax: `` *<pattern>* `` +Syntax: + +```xml + +``` |Parameter|Required|Value| |--- |--- |--- | -|**<errorCode>**|No|"any" or "*specify system error message here*". If system error messages aren't specified, the default behavior applies the parameter to all system error messages.| +|**\**|No|"any" or "*specify system error message*". If system error messages aren't specified, the default behavior applies the parameter to all system error messages.| -You use the **<nonFatal>** element to specify that errors matching a specific pattern shouldn't cause USMT to halt the migration. +The **\** element can be used to specify that errors matching a specific pattern shouldn't cause USMT to halt the migration. -### <registryError> +### \ -The **<registryError>** element isn't required. +The **\** element isn't required. - **Number of occurrences**: Once for each component -- **Parent elements**: **<ErrorControl>** +- **Parent elements**: **\** -- **Child elements**: **<nonfatal>** and **<fatal>** +- **Child elements**: **\** and **\** -Syntax: `` `` +Syntax: + +```xml + +``` |Parameter|Required|Value| |--- |--- |--- | -|**<errorCode>**|No|"any" or "*specify system error message here*". If system error messages aren't specified, the default behavior applies the parameter to all system error messages.| +|**\**|No|"any" or "*specify system error message here*". If system error messages aren't specified, the default behavior applies the parameter to all system error messages.| -You use the **<registryError>** element to specify that errors matching a specific pattern shouldn't cause USMT to halt the migration. +The **\** element can be used to specify that errors matching a specific pattern shouldn't cause USMT to halt the migration. -### <HardLinkStoreControl> +### \ -The **<HardLinkStoreControl>** element contains elements that describe how to handle files during the creation of a hard-link migration store. Its only valid child is **<fileLocked>**. +The **\** element contains elements that describe how to handle files during the creation of a hard-link migration store. Its only valid child is **\**. -Syntax: `` `` +Syntax: + +```xml + +``` - **Number of occurrences**: Once for each component -- **Parent elements**: **<Policies>** +- **Parent elements**: **\** -- **Child elements**: **<fileLocked>** +- **Child elements**: **\** -Syntax: `` `` +Syntax: -The **<HardLinkStoreControl>** sample code below specifies that hard links can be created to locked files only if the locked file resides somewhere under C:\\Users\\. Otherwise, a file-access error occurs when a locked file is encountered that can't be copied, even though is technically possible for the link to be created. +```xml + +``` + +The following **\** sample code specifies that hard links can be created to locked files only if the locked file resides somewhere under C:\\Users\\. Otherwise, a file-access error occurs when a locked file is encountered that can't be copied, even though is technically possible for the link to be created. > [!IMPORTANT] -> The **<ErrorControl>** section can be configured to conditionally ignore file access errors, based on the file's location. +> +> The **\** section can be configured to conditionally ignore file access errors, based on the file's location. ```xml @@ -165,45 +204,69 @@ The **<HardLinkStoreControl>** sample code below specifies that hard links ``` -### <fileLocked> +### \ -The **<fileLocked>** element contains elements that describe how to handle files that are locked for editing. The rules defined by the **<fileLocked>** element are processed in the order in which they appear in the XML file. +The **\** element contains elements that describe how to handle files that are locked for editing. The rules defined by the **\** element are processed in the order in which they appear in the XML file. -Syntax: `` `` +Syntax: -### <createHardLink> +```xml + +``` -The **<createHardLink>** element defines a standard MigXML pattern that describes file paths where hard links should be created, even if the file is locked for editing by another application. +### \ -Syntax: `` *<pattern>* `` +The **\** element defines a standard MigXML pattern that describes file paths where hard links should be created, even if the file is locked for editing by another application. -### <errorHardLink> +Syntax: -The **<errorHardLink>** element defines a standard MigXML pattern that describes file paths where hard links shouldn't be created if the file is locked for editing by another application. USMT will attempt to copy files under these paths into the migration store. However, if that isn't possible, **Error\_Locked** is thrown. This error is a standard Windows application programming interface (API) error that can be captured by the **<ErrorControl>** section to either cause USMT to skip the file or abort the migration. +```xml + +``` -Syntax: `` *<pattern>* `` +### \ -### <ProfileControl> +The **\** element defines a standard MigXML pattern that describes file paths where hard links shouldn't be created if the file is locked for editing by another application. USMT attempts to copy files under these paths into the migration store. However, if that isn't possible, **Error\_Locked** is thrown. This error is a standard Windows application programming interface (API) error that can be captured by the **\** section to either cause USMT to skip the file or abort the migration. -This element is used to contain other elements that establish rules for migrating profiles, users, and policies around local group membership during the migration. **<ProfileMigration>** is a child of **<Configuration>**. +Syntax: -Syntax: <`ProfileControl>` `` +```xml + +``` -### <localGroups> +### \ -This element is used to contain other elements that establish rules for how to migrate local groups. **<localGroups>** is a child of **<ProfileControl>**. +This element is used to contain other elements that establish rules for migrating profiles, users, and policies around local group membership during the migration. **\** is a child of **\**. -Syntax: `` `` +Syntax: -### <mappings> +```xml + +``` + +### \ + +This element is used to contain other elements that establish rules for how to migrate local groups. **\** is a child of **\**. + +Syntax: + +```xml + +``` + +### \ This element is used to contain other elements that establish mappings between groups. -Syntax: `` `` +Syntax: -### <changeGroup> +```xml + +``` -This element describes the source and destination groups for a local group membership change during the migration. It's a child of **<localGroups>**. The following parameters are defined: +### \ + +This element describes the source and destination groups for a local group membership change during the migration. It's a child of **\**. The following parameters are defined: |Parameter|Required|Value| |--- |--- |--- | @@ -211,25 +274,38 @@ This element describes the source and destination groups for a local group membe |To|Yes|A local group that the users are to be moved to during the migration.| |appliesTo|Yes|nonmigratedUsers, migratedUsers, AllUsers. This value defines which users the change group operation should apply to.| -The valid and required children of **<changeGroup>** are **<include>** and **<exclude>**. Although both can be children at the same time, only one is required. +The valid and required children of **\** are **\** and **\**. Although both can be children at the same time, only one is required. -Syntax: `` `` +Syntax: -### <include> +```xml + +``` -This element specifies that its required child, *<pattern>*, should be included in the migration. +### \ -Syntax: `` `` +This element specifies that its required child, *\*, should be included in the migration. -### <exclude> +Syntax: -This element specifies that its required child, *<pattern>*, should be excluded from the migration. +```xml + +``` -Syntax: `` `` +### \ + +This element specifies that its required child, *\*, should be excluded from the migration. + +Syntax: + +```xml + +``` ## Sample Config.xml File -Refer to the following sample `Config.xml` file for more details about items you can choose to exclude from a migration. +The following sample `Config.xml` file contains detailed examples about items that can be excluded from a migration. +

@@ -430,4 +506,4 @@ Refer to the following sample `Config.xml` file for more details about items you ## Related articles -[USMT XML reference](usmt-xml-reference.md) +- [USMT XML reference](usmt-xml-reference.md). diff --git a/windows/deployment/usmt/usmt-conflicts-and-precedence.md b/windows/deployment/usmt/usmt-conflicts-and-precedence.md index b3c5c22025..1cbc5f19e7 100644 --- a/windows/deployment/usmt/usmt-conflicts-and-precedence.md +++ b/windows/deployment/usmt/usmt-conflicts-and-precedence.md @@ -1,40 +1,44 @@ --- -title: Conflicts and Precedence (Windows 10) -description: In this article, learn how User State Migration Tool (USMT) 10.0 deals with conflicts and precedence. +title: Conflicts and Precedence +description: In this article, learn how User State Migration Tool (USMT) deals with conflicts and precedence. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Conflicts and precedence -When you include, exclude, and reroute files and settings, it's important to know how User State Migration Tool (USMT) 10.0 deals with conflicts and precedence. When working with USMT, the following are the most important conflicts and precedence guidelines to keep in mind. +When including, excluding, and rerouting files and settings, it's important to know how User State Migration Tool (USMT) deals with conflicts and precedence. The following are the most important conflicts and precedence guidelines to keep in mind when working with USMT. -- **If there are conflicting rules within a component, the most specific rule is applied.** However, the **<unconditionalExclude>** rule is an exception because it takes precedence over all others. Directory names take precedence over file extensions. For examples, see [What happens when there are conflicting <include> and <exclude> rules?](#what-happens-when-there-are-conflicting-include-and-exclude-rules) and the first example in [<include> and <exclude> rules precedence examples](#include-and-exclude-rules-precedence-examples) later in this article. +- **If there are conflicting rules within a component, the most specific rule is applied.** However, the **\** rule is an exception because it takes precedence over all others. Directory names take precedence over file extensions. For examples, see [What happens when there are conflicting \ and \ rules?](#what-happens-when-there-are-conflicting-include-and-exclude-rules) and the first example in [\ and \ rules precedence examples](#include-and-exclude-rules-precedence-examples) later in this article. -- **Only rules inside the same component can affect each other, depending on specificity.** Rules that are in different components don't affect each other, except for the **<unconditionalExclude>** rule. +- **Only rules inside the same component can affect each other, depending on specificity.** Rules that are in different components don't affect each other, except for the **\** rule. -- **If the rules are equally specific, <exclude> takes precedence over <include>.** For example, if you use the **<exclude>** rule to exclude a file and use the **<include>** rule to include the same file, the file will be excluded. +- **If the rules are equally specific, \ takes precedence over \.** For example, if the **\** rule is used to exclude a file and use the **\** rule to include the same file, the file is excluded. -- **The ordering of components does not matter.** It doesn't matter which components are listed in which .xml file, because each component is processed independently of the other components across all of the .xml files. +- **The ordering of components does not matter.** It doesn't matter which components are listed in which **.xml** file, because each component is processed independently of the other components across all of the **.xml** files. -- **The ordering of the <include> and <exclude> rules within a component does not matter.** +- **The ordering of the \ and \ rules within a component does not matter.** -- **You can use the <unconditionalExclude> element to globally exclude data.** This element excludes objects, regardless of any other **<include>** rules that are in the .xml files. For example, you can use the **<unconditionalExclude>** element to exclude all MP3 files on the computer or to exclude all files from `C:\UserData`. +- **The \ element can be used to globally exclude data.** This element excludes objects, regardless of any other **\** rules that are in the **.xml** files. For example, the **\** element can be used to exclude all MP3 files on the computer or to exclude all files from `C:\UserData`. ## General ### What is the relationship between rules that are located within different components? -Only rules inside the same component can affect each other, depending on specificity, except for the **<unconditionalExclude>** rule. Rules that are in different components don't affect each other. If there's an **<include>** rule in one component and an identical **<exclude>** rule in another component, the data will be migrated because the two rules are independent of each other. +Only rules inside the same component can affect each other, depending on specificity, except for the **\** rule. Rules that are in different components don't affect each other. If there's an **\** rule in one component and an identical **\** rule in another component, the data is migrated because the two rules are independent of each other. -If you have an **<include>** rule in one component and a **<locationModify>** rule in another component for the same file, the file will be migrated in both places. That is, it will be included based on the **<include>** rule, and it will be migrated based on the **<locationModify>** rule. +If an **\** rule is in one component and a **\** rule is in another component for the same file, the file is migrated in both places. That is, the file is included based on the **\** rule, and the file is migrated based on the **\** rule. -The following .xml file migrates all files from C:\\Userdocs, including .mp3 files, because the **<exclude>** rule is specified in a separate component. +The following **.xml** file migrates all files from C:\\Userdocs, including **.mp3** files, because the **\** rule is specified in a separate component. ```xml @@ -68,7 +72,7 @@ The following .xml file migrates all files from C:\\Userdocs, including .mp3 fil ### How does precedence work with the Config.xml file? -Specifying `migrate="no"` in the `Config.xml` file is the same as deleting the corresponding component from the migration .xml file. However, if you set `migrate="no"` for My Documents, but you have a rule similar to the one shown below in a migration .xml file (which includes all of the .doc files from My Documents), then only the .doc files will be migrated, and all other files will be excluded. +Specifying `migrate="no"` in the `Config.xml` file is the same as deleting the corresponding component from the migration **.xml** file. However, if `migrate="no"` is set for the **Documents** folder, but a rule similar to the following rule exists in a migration **.xml** file (which includes all of the **.doc** files from the **Documents** folder), then only the **.doc** files is migrated, and all other files are excluded: ```xml @@ -80,27 +84,27 @@ Specifying `migrate="no"` in the `Config.xml` file is the same as deleting the c ### How does USMT process each component in an .xml file with multiple components? -The ordering of components doesn't matter. Each component is processed independently of other components. For example, if you have an **<include>** rule in one component and a **<locationModify>** rule in another component for the same file, the file will be migrated in both places. That is, it will be included based on the **<include>** rule, and it will be migrated based on the **<locationModify>** rule. +The ordering of components doesn't matter. Each component is processed independently of other components. For example, if an **\** rule is in one component and a **\** rule is in another component for the same file, the file is migrated in both places. That is, the file is included based on the **\** rule, and the file is migrated based on the **\** rule. ### How are rules processed? There are two broad categories of rules. -- **Rules that affect the behavior of both the ScanState and LoadState tools**. For example, the **<include>**, **<exclude>**, and **<unconditionalExclude>** rules are processed for each component in the .xml files. For each component, USMT creates an include list and an exclude list. Some of the rules in the component might be discarded due to specificity, but all of the remaining rules are processed. For each **<include>** rule, USMT iterates through the elements to see if any of the locations need to be excluded. USMT enumerates all of the objects and creates a list of objects it's going to collect for each user. Once the list is complete, each of the objects is stored or migrated to the destination computer. +- **Rules that affect the behavior of both the ScanState and LoadState tools**. For example, the **\**, **\**, and **\** rules are processed for each component in the **.xml** files. For each component, USMT creates an include list and an exclude list. Some of the rules in the component might be discarded due to specificity, but all of the remaining rules are processed. For each **\** rule, USMT iterates through the elements to see if any of the locations need to be excluded. USMT enumerates all of the objects and creates a list of objects it's going to collect for each user. Once the list is complete, each of the objects is stored or migrated to the destination computer. -- **Rules that affect the behavior of only the LoadState tool**. For example, the **<locationModify>**, **<contentModify>**, and **<destinationCleanup>** rules don't affect ScanState. They're processed only with LoadState. First, the LoadState tool determines the content and location of each component based on the **<locationModify>** and **<contentModify>** rules. Then, LoadState processes all of the **<destinationCleanup>** rules and deletes data from the destination computer. Lastly, LoadState applies the components to the computer. +- **Rules that affect the behavior of only the LoadState tool**. For example, the **\**, **\**, and **\** rules don't affect ScanState. They're processed only with LoadState. First, the **LoadState** tool determines the content and location of each component based on the **\** and **\** rules. Then, **LoadState** processes all of the **\** rules and deletes data from the destination computer. Lastly, **LoadState** applies the components to the computer. ### How does USMT combine all of the .xml files that I specify on the command line? -USMT doesn't distinguish the .xml files based on their name or content. It processes each component within the files separately. USMT supports multiple .xml files only to make it easier to maintain and organize the components within them. Because USMT uses a urlid to distinguish each component from the others, be sure that each .xml file that you specify on the command line has a unique migration urlid. +USMT doesn't distinguish the **.xml** files based on their name or content. It processes each component within the files separately. USMT supports multiple **.xml** files only to make it easier to maintain and organize the components within them. Because USMT uses a urlid to distinguish each component from the others, be sure that each **.xml** file that is specified on the command line has a unique migration urlid. -## The <include> and <exclude> rules +## The \ and \ rules -### What happens when there are conflicting <include> and <exclude> rules? +### What happens when there are conflicting \ and \ rules? -If there are conflicting rules within a component, the most specific rule is applied, except with the **<unconditionalExclude>** rule, which takes precedence over all other rules. If the rules are equally specific, then the data won't be migrated. For example if you exclude a file, and include the same file, the file won't be migrated. If there are conflicting rules within different components, the rules don't affect each other because each component is processed independently. +If there are conflicting rules within a component, the most specific rule is applied, except with the **\** rule, which takes precedence over all other rules. If the rules are equally specific, then the data isn't migrated. For example if the same file is both excluded and included, the file isn't migrated. If there are conflicting rules within different components, the rules don't affect each other because each component is processed independently. -In the following example, mp3 files won't be excluded from the migration. The mp3 files won't be excluded because directory names take precedence over the file extensions. +In the following example, mp3 files aren't excluded from the migration. The mp3 files aren't excluded because directory names take precedence over the file extensions. ```xml @@ -115,9 +119,9 @@ In the following example, mp3 files won't be excluded from the migration. The mp ``` -### <include> and <exclude> rules precedence examples +### \ and \ rules precedence examples -These examples explain how USMT deals with **<include>** and **<exclude>** rules. When the rules are in different components, the resulting behavior will be the same regardless of whether the components are in the same or in different migration .xml files. +These examples explain how USMT deals with **\** and **\** rules. When the rules are in different components, the resulting behavior is the same regardless of whether the components are in the same or in different migration **.xml** files. - [Including and excluding files](#including-and-excluding-files) @@ -125,42 +129,42 @@ These examples explain how USMT deals with **<include>** and **<exclude ### Including and excluding files -| If you have the following code in the same component | Resulting behavior | Explanation | +| If the following code exists in the same component | Resulting behavior | Explanation | |-----|-----|-----| -|
  • Include rule: <pattern type="File">C:\Dir1* []</pattern>
  • Exclude rule: <pattern type="File">C:* [.txt]</pattern>
| Migrates all files and subfolders in Dir1 (including all .txt files in C:). | The **<exclude>** rule doesn't affect the migration because the **<include>** rule is more specific. | -|
  • Include rule: <pattern type="File">C:\Dir1* []</pattern>
  • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>
| Migrates all files and subfolders in C:\Dir1, except the .txt files in C:\Dir1\Dir2 and its subfolders. | Both rules are processed as intended. | -|
  • Include rule: <pattern type="File">C:\Dir1* []</pattern>
  • Exclude rule: <pattern type="File">C:\Dir1\ * [.txt]</pattern>
| Migrates all files and subfolders in C:\Dir1, except the .txt files in C:\Dir1 and its subfolders. | Both rules are processed as intended. | -|
  • Include rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>
  • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>
| Nothing will be migrated. | The rules are equally specific, so the **<exclude>** rule takes precedence over the **<include>** rule. | -|
  • Include rule: C:\Dir1* [.txt]
  • Exclude rule: C:\Dir1\Dir2* []
| Migrates the .txt files in Dir1 and the .txt files from subfolders other than Dir2.
No files are migrated from Dir2 or its subfolders. | Both rules are processed as intended. | -|
  • Include rule: C:\Dir1\Dir2* []
  • Exclude rule: C:\Dir1* [.txt]
| Migrates all files and subfolders of Dir2, except the .txt files from Dir1 and any subfolders of Dir1 (including Dir2). | Both rules are processed as intended. | +|
  • Include rule: \C:\Dir1* []\
  • Exclude rule: \C:* [.txt]\
| Migrates all files and subfolders in Dir1 (including all **.txt** files in C:). | The **\** rule doesn't affect the migration because the **\** rule is more specific. | +|
  • Include rule: \C:\Dir1* []\
  • Exclude rule: \C:\Dir1\Dir2* [.txt]\
| Migrates all files and subfolders in C:\Dir1, except the **.txt** files in C:\Dir1\Dir2 and its subfolders. | Both rules are processed as intended. | +|
  • Include rule: \C:\Dir1* []\
  • Exclude rule: \C:\Dir1\ * [.txt]\
| Migrates all files and subfolders in C:\Dir1, except the **.txt** files in C:\Dir1 and its subfolders. | Both rules are processed as intended. | +|
  • Include rule: \C:\Dir1\Dir2* [.txt]\
  • Exclude rule: \C:\Dir1\Dir2* [.txt]\
| Nothing is migrated. | The rules are equally specific, so the **\** rule takes precedence over the **\** rule. | +|
  • Include rule: C:\Dir1* [.txt]
  • Exclude rule: C:\Dir1\Dir2* []
| Migrates the **.txt** files in Dir1 and the **.txt** files from subfolders other than Dir2.
No files are migrated from Dir2 or its subfolders. | Both rules are processed as intended. | +|
  • Include rule: C:\Dir1\Dir2* []
  • Exclude rule: C:\Dir1* [.txt]
| Migrates all files and subfolders of Dir2, except the **.txt** files from Dir1 and any subfolders of Dir1 (including Dir2). | Both rules are processed as intended. | -| If you have the following code in different components | Resulting behavior | Explanation | +| If the following code exists in different components | Resulting behavior | Explanation | |-----|----|----| -| Component 1:
  • Include rule: <pattern type="File">C:\Dir1* []</pattern>
  • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

Component 2:
  • Include rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>
  • Exclude rule: <pattern type="File">C:\Dir1* []</pattern>
| Migrates all files and subfolders of C:\Dir1\ (including C:\Dir1\Dir2). | Rules that are in different components don't affect each other, except for the **<unconditionalExclude>** rule. Therefore, in this example, although some .txt files were excluded when Component 1 was processed, they were included when Component 2 was processed. | -| Component 1:
  • Include rule: C:\Dir1\Dir2* []

Component 2:
  • Exclude rule: C:\Dir1* [.txt]
| Migrates all files and subfolders from Dir2 except the .txt files in C:\Dir1 and its subfolders. | Both rules are processed as intended. | -| Component 1:
  • Exclude rule: C:\Dir1\Dir2* []

Component 2:
  • Include rule: C:\Dir1* [.txt]
| Migrates all .txt files in Dir1 and any subfolders. | Component 1 doesn't contain an **<include>** rule, so the **<exclude>** rule isn't processed. | +| Component 1:
  • Include rule: \C:\Dir1* []\
  • Exclude rule: \C:\Dir1\Dir2* [.txt]\

Component 2:
  • Include rule: \C:\Dir1\Dir2* [.txt]\
  • Exclude rule: \C:\Dir1* []\
| Migrates all files and subfolders of C:\Dir1\ (including C:\Dir1\Dir2). | Rules that are in different components don't affect each other, except for the **\** rule. Therefore, in this example, although some **.txt** files were excluded when Component 1 was processed, they were included when Component 2 was processed. | +| Component 1:
  • Include rule: C:\Dir1\Dir2* []

Component 2:
  • Exclude rule: C:\Dir1* [.txt]
| Migrates all files and subfolders from Dir2 except the **.txt** files in C:\Dir1 and its subfolders. | Both rules are processed as intended. | +| Component 1:
  • Exclude rule: C:\Dir1\Dir2* []

Component 2:
  • Include rule: C:\Dir1* [.txt]
| Migrates all **.txt** files in Dir1 and any subfolders. | Component 1 doesn't contain an **\** rule, so the **\** rule isn't processed. | ### Including and excluding registry objects -| If you have the following code in the same component | Resulting behavior | Explanation | +| If the following code exists in the same component | Resulting behavior | Explanation | |-----|-----|-----| -|
  • Include rule:
    HKLM\Software\Microsoft\Command Processor* []
  • Exclude Rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
| Migrates all keys in HKLM\Software\Microsoft\Command Processor except DefaultColor. | Both rules are processed as intended. | -|
  • Include rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
  • Exclude Rule:
    HKLM\Software\Microsoft\Command Processor* []
| Migrates only DefaultColor in HKLM\Software\Microsoft\Command Processor. | DefaultColor is migrated because the **<include>** rule is more specific than the **<exclude>** rule. | -|
  • Include rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
  • Exclude rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
| Doesn't migrate DefaultColor. | The rules are equally specific, so the **<exclude>** rule takes precedence over the <include> rule. | +|
  • Include rule:
    HKLM\Software\Microsoft\Command Processor* []
  • Exclude Rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
| Migrates all keys in HKLM\Software\Microsoft\Command Processor except DefaultColor. | Both rules are processed as intended. | +|
  • Include rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
  • Exclude Rule:
    HKLM\Software\Microsoft\Command Processor* []
| Migrates only DefaultColor in HKLM\Software\Microsoft\Command Processor. | DefaultColor is migrated because the **\** rule is more specific than the **\** rule. | +|
  • Include rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
  • Exclude rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
| Doesn't migrate DefaultColor. | The rules are equally specific, so the **\** rule takes precedence over the \ rule. | -| If you have the following code in different components | Resulting behavior | Explanation | +| If the following code exists in different components | Resulting behavior | Explanation | |-----|-----|-----| -| Component 1:
  • Include rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
  • Exclude rule:
    HKLM\Software\Microsoft\Command Processor* []

Component 2:
  • Include rule:
    HKLM\Software\Microsoft\Command Processor* []
  • Exclude rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
| Migrates all the keys/values under HKLM\Software\Microsoft\Command Processor. | Rules that are in different components don't affect each other, except for the **<unconditionalExclude>** rule. Therefore, in this example, the objects that were excluded when Component 1 was processed were included when Component 2 was processed. | +| Component 1:
  • Include rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
  • Exclude rule:
    HKLM\Software\Microsoft\Command Processor* []

Component 2:
  • Include rule:
    HKLM\Software\Microsoft\Command Processor* []
  • Exclude rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
| Migrates all the keys/values under HKLM\Software\Microsoft\Command Processor. | Rules that are in different components don't affect each other, except for the **\** rule. In this example, the objects that were excluded when Component 1 was processed were included when Component 2 was processed. | ## File collisions ### What is the default behavior when there are file collisions? -If there isn't a **<merge>** rule, the default behavior for the registry is for the source to overwrite the destination. The default behavior for files is for the source to be renamed incrementally: for example, OriginalFileName(1).OriginalExtension, OriginalFileName(2).OriginalExtension, and so on. +If there isn't a **\** rule, the default behavior for the registry is for the source to overwrite the destination. The default behavior for files is for the source to be renamed incrementally: for example, OriginalFileName(1).OriginalExtension, OriginalFileName(2).OriginalExtension, and so on. -### How does the <merge> rule work when there are file collisions? +### How does the \ rule work when there are file collisions? -When a collision is detected, USMT will select the most specific **<merge>** rule and apply it to resolve the conflict. For example, if you have a **<merge>** rule for **C:\\\* \[\*\]** set to **sourcePriority()** and another **<merge>** rule for **C:\\subfolder\\\* \[\*\]** set to **destinationPriority()** , then USMT uses the **destinationPriority()** rule because it's the most specific. +When a collision is detected, USMT selects the most specific **\** rule and apply it to resolve the conflict. For example, if a **\** rule exists for **C:\\\* \[\*\]** set to **sourcePriority()** and another **\** rule for **C:\\subfolder\\\* \[\*\]** set to **destinationPriority()** , then USMT uses the **destinationPriority()** rule because it's the most specific. ### Example scenario @@ -178,7 +182,7 @@ The destination computer contains the following files: - `C:\Data\SampleB.txt` -You have a custom .xml file that contains the following code: +A custom **.xml** file contains the following code: ```xml @@ -188,7 +192,7 @@ You have a custom .xml file that contains the following code: ``` -For this example, the following information describes the resulting behavior if you add the code to your custom .xml file. +For this example, the following information describes the resulting behavior if the code is added to the custom **.xml** file. #### Example 1 @@ -200,7 +204,7 @@ For this example, the following information describes the resulting behavior if ``` -**Result**: During ScanState, all the files will be added to the store. During LoadState, only `C:\Data\SampleA.txt` will be restored. +**Result**: During ScanState, all the files are added to the store. During LoadState, only `C:\Data\SampleA.txt` is restored. #### Example 2 @@ -212,8 +216,8 @@ For this example, the following information describes the resulting behavior if ``` -**Result**: During ScanState, all the files will be added to the store. -During LoadState, all the files will be restored, overwriting the existing files on the destination computer. +**Result**: During ScanState, all the files are added to the store. +During LoadState, all the files are restored, overwriting the existing files on the destination computer. #### Example 3 @@ -225,12 +229,12 @@ During LoadState, all the files will be restored, overwriting the existing files ``` -**Result**: During ScanState, all the files will be added to the store. During LoadState, the following actions will occur: +**Result**: During ScanState, all the files are added to the store. During LoadState, the following actions occur: -- `C:\Data\SampleA.txt` will be restored. -- `C:\Data\SampleB.txt` will be restored, overwriting the existing file on the destination computer. -- `C:\Data\Folder\SampleB.txt` won't be restored. +- `C:\Data\SampleA.txt` is restored. +- `C:\Data\SampleB.txt` is restored, overwriting the existing file on the destination computer. +- `C:\Data\Folder\SampleB.txt` aren't restored. ## Related articles -[USMT XML reference](usmt-xml-reference.md) +[USMT XML reference](usmt-xml-reference.md). diff --git a/windows/deployment/usmt/usmt-custom-xml-examples.md b/windows/deployment/usmt/usmt-custom-xml-examples.md index 73cf61e887..30bc9366d2 100644 --- a/windows/deployment/usmt/usmt-custom-xml-examples.md +++ b/windows/deployment/usmt/usmt-custom-xml-examples.md @@ -1,20 +1,24 @@ --- -title: Custom XML Examples (Windows 10) -description: Use custom XML examples to learn how to migrate an unsupported application, migrate files and registry keys, and migrate the My Videos folder. +title: Custom XML Examples +description: Use custom XML examples to learn how to migrate an unsupported application, migrate files and registry keys, and migrate the Videos folder. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.date: 11/01/2022 +ms.date: 01/09/2024 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Custom XML Examples ## Example 1: Migrating an unsupported application -The following template is a template for the sections that you need to migrate your application. The template isn't functional on its own, but you can use it to write your own .xml file. +The following template is a template for the sections that are needed to migrate applications. The template isn't functional on its own, but it can be used to write custom **.xml** file. **Template**
@@ -89,19 +93,19 @@ The following template is a template for the sections that you need to migrate y ## Example 2: Migrating the My Videos folder -The following sample is a custom .xml file named `CustomFile.xml` that migrates **My Videos** for all users, if the folder exists on the source computer. +The following sample is a custom **.xml** file named `CustomFile.xml` that migrates the **Videos** folder for all users, if the folder exists on the source computer. -- **Sample condition**: Verifies that **My Videos** exists on the source computer: +- **Sample condition**: Verifies that the **Videos** folder exists on the source computer: `MigXmlHelper.DoesObjectExist("File","%CSIDL_MYVIDEO%")` -- **Sample filter**: Filters out the shortcuts in **My Videos** that don't resolve on the destination computer: +- **Sample filter**: Filters out the shortcuts in the **Videos** folder that don't resolve on the destination computer: `` - This filter has no effect on files that aren't shortcuts. For example, if there's a shortcut in **My Videos** on the source computer that points to `C:\Folder1`, that shortcut will be migrated only if `C:\Folder1` exists on the destination computer. However, all other files, such as .mp3 files, migrate without any filtering. + This filter has no effect on files that aren't shortcuts. For example, if there's a shortcut in the **Videos** folder on the source computer that points to `C:\Folder1`, that shortcut is migrated only if `C:\Folder1` exists on the destination computer. However, all other files, such as **.mp3** files, migrate without any filtering. -- **Sample pattern**: Migrates **My Videos** for all users: +- **Sample pattern**: Migrates the **Videos** folder for all users: `%CSIDL_MYVIDEO%* [*]` @@ -137,7 +141,7 @@ The following sample is a custom .xml file named `CustomFile.xml` that migrates ## Example 3: Migrating files and registry keys -The sample patterns describe the behavior in the following example .xml file. +The sample patterns describe the behavior in the following example **.xml** file. - **Sample pattern**: Migrates all instances of the file `Usmttestfile.txt` from all subdirectories under `%ProgramFiles%\USMTTestFolder`: @@ -195,7 +199,7 @@ The sample patterns describe the behavior in the following example .xml file. ## Example 4: Migrating specific folders from various locations -The behavior for this custom .xml file is described within the `` tags in the code. +The behavior for this custom **.xml** file is described within the `` tags in the code. **XML file**
@@ -275,6 +279,5 @@ The behavior for this custom .xml file is described within the `` t ## Related articles -[USMT XML reference](usmt-xml-reference.md) - -[Customize USMT XML files](usmt-customize-xml-files.md) +- [USMT XML reference](usmt-xml-reference.md). +- [Customize USMT XML files](usmt-customize-xml-files.md). diff --git a/windows/deployment/usmt/usmt-customize-xml-files.md b/windows/deployment/usmt/usmt-customize-xml-files.md index 7964757619..caf629751e 100644 --- a/windows/deployment/usmt/usmt-customize-xml-files.md +++ b/windows/deployment/usmt/usmt-customize-xml-files.md @@ -1,77 +1,84 @@ --- -title: Customize USMT XML Files (Windows 10) +title: Customize USMT XML Files description: Learn how to customize USMT XML files. Also, learn about the migration XML files that are included with USMT. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Customize USMT XML files ## Overview -If you want the ScanState and LoadState tools to use any of the migration .xml files, specify these files at the command line using the `/i` option. Because the ScanState and LoadState tools need the .xml files to control the migration, specify the same set of .xml files for both the `ScanState.exe` and `LoadState.exe` commands. However, you don't have to specify the `Config.xml` file with the `/config` option, unless you want to exclude some of the files and settings that you migrated to the store. For example, you might want to migrate the My Documents folder to the store but not to the destination computer. To achieve this scenario, modify the `Config.xml` file and specify the updated file with the `LoadState.exe` command. Then the `LoadState.exe` command will migrate only the files and settings that you want to migrate. +To use any of the migration **.xml** files with the **ScanState** and **LoadState** tools, specify these files at the command line using the `/i` option. Because the **ScanState** and **LoadState** tools need the **.xml** files to control the migration, specify the same set of **.xml** files for both the `ScanState.exe` and `LoadState.exe` commands. However, the `Config.xml` file with the `/config` option doesn't need to be specified, unless some of the migrated files and settings from the store need to be excluded. For example, to migrate the **Documents** folder to the store but not to the destination computer. To achieve this scenario, modify the `Config.xml` file and specify the updated file with the `LoadState.exe` command. The `LoadState.exe` command then only migrates the desired files and settings. -If you leave out an .xml file from the `LoadState.exe` command, all of the data in the store that was migrated with the missing .xml files will be migrated. However, the migration rules that were specified with the `ScanState.exe` command won't apply. For example, if you leave out an .xml file, and it contains a rerouting rule such as: +If an **.xml** file is left out from the `LoadState.exe` command, all of the data in the store that was migrated with the missing **.xml** files are migrated. However, the migration rules that were specified with the `ScanState.exe` command don't apply. For example, if an **.xml** file is left out, and it contains a rerouting rule such as: `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")` -USMT won't reroute the files, and they'll be migrated to `C:\data`. +USMT doesn't reroute the files, and they're migrated to `C:\data`. To modify the migration, do one or more of the following. -- **Modify the migration .xml files.** If you want to exclude a portion of a component, for example, you want to migrate C:\\ but exclude all of the .mp3 files, or if you want to move data to a new location on the destination computer, modify the .xml files. To modify these files, you must be familiar with the migration rules and syntax. If you want ScanState and LoadState to use these files, specify them at the command line when each command is entered. +- **Modify the migration .xml files.** To exclude a portion of a component, modify the **.xml** files. For example, to migrate C:\\ but exclude all of the **.mp3** files, or to move data to a new location on the destination computer. To modify these files, familiarity with the migration rules and syntax is a must. For **ScanState** and **LoadState** to use these files, specify them at the command line when each command is entered. -- **Create a custom .xml file.** You can also create a custom .xml file to migrate settings for another application, or to change the migration behavior to suit your needs. For ScanState and LoadState to use this file, specify them on both command lines. +- **Create a custom .xml file.** A custom **.xml** file can also be created to migrate settings for another application, or to change the migration behavior to suit the organization's needs. For **ScanState** and **LoadState** to use this file, specify them on both command lines. -- **Create and modify a Config.xml file.** Create and modify a `Config.xml` file if you want to exclude an entire component from the migration. For example, you can use a `Config.xml` file to exclude the entire My Documents folder, or exclude the settings for an application. Excluding components using a `Config.xml` file is easier than modifying the migration .xml files because you don't need to be familiar with the migration rules and syntax. In addition, using a `Config.xml` file is the only way to exclude the operating system settings from being migrated. +- **Create and modify a Config.xml file.** Create and modify a `Config.xml` file to exclude an entire component from the migration. For example, a `Config.xml` file can be used to exclude the entire **Documents** folder, or exclude the settings for an application. Excluding components using a `Config.xml` file is easier than modifying the migration **.xml** files because familiarity with the migration rules and syntax isn't needed. In addition, using a `Config.xml` file is the only way to exclude the operating system settings from being migrated. For more information about excluding data, see the [Exclude Files and Settings](usmt-exclude-files-and-settings.md) article. ## Migration .xml files -This section describes the migration .xml files that are included with USMT. Each file contains migration rules that control which components are migrated and where they're migrated to on the destination computer. +This section describes the migration **.xml** files that are included with USMT. Each file contains migration rules that control which components are migrated and where they're migrated to on the destination computer. > [!NOTE] -> You can use the asterisk (\*) wildcard character in each of these files. However, you cannot use a question mark (?) as a wildcard character. +> +> The asterisk (\*) wildcard character can be used in each of these files. However, a question mark (?) can't be used as a wildcard character. - **The MigApp.xml file.** Specify this file with both the `ScanState.exe` and `LoadState.exe` commands to migrate application settings. -- **The MigDocs.xml file.** Specify this file with both the ScanState and LoadState tools to migrate all user folders and files that are found by the **MigXmlHelper.GenerateDocPatterns** helper function. This helper function finds user data that resides on the root of any drive and in the Users directory. However, it doesn't find and migrate any application data, program files, or any files in the Windows directory. You can modify the `MigDocs.xml` file. +- **The MigDocs.xml file.** Specify this file with both the **ScanState** and **LoadState** tools to migrate all user folders and files that are found by the **MigXmlHelper.GenerateDocPatterns** helper function. This helper function finds user data that resides on the root of any drive and in the Users directory. However, it doesn't find and migrate any application data, program files, or any files in the Windows directory. The `MigDocs.xml` file can be modified. -- **The MigUser.xml file.** Specify this file with both the `ScanState.exe` and `LoadState.exe` commands to migrate user folders, files, and file types. You can modify the `MigUser.xml` file. This file doesn't contain rules that migrate specific user accounts. The only way to specify which user accounts to migrate is on the command line using the ScanState and the LoadState user options. +- **The MigUser.xml file.** Specify this file with both the `ScanState.exe` and `LoadState.exe` commands to migrate user folders, files, and file types. The `MigUser.xml` file can be modified. This file doesn't contain rules that migrate specific user accounts. The only way to specify which user accounts to migrate is on the command line by using the [ScanState User options](usmt-scanstate-syntax.md#user-options) and the [LoadState User options](usmt-loadstate-syntax.md#user-options). > [!NOTE] +> > Don't use the `MigUser.xml` and `MigDocs.xml` files together. For more information, see the [Identify file types, files, and folders](usmt-identify-file-types-files-and-folders.md) and [USMT best practices](usmt-best-practices.md) articles. ## Custom .xml files -You can create custom .xml files to customize the migration for your unique needs. For example, you may want to create a custom file to migrate a line-of-business application or to modify the default migration behavior. If you want `ScanState.exe` and `LoadState.exe` to use this file, specify it with both commands. For more information, see the [Custom XML examples](usmt-custom-xml-examples.md) article. +Custom **.xml** files can be created to customize the migration for the organization's unique needs. For example, a custom **.xml** file can be created to migrate a line-of-business application or to modify the default migration behavior. For `ScanState.exe` and `LoadState.exe` to use this file, specify it with both commands. For more information, see the [Custom XML examples](usmt-custom-xml-examples.md) article. ## The Config.xml file -The `Config.xml` file is an optional file that you create using the `/genconfig` option with the `ScanState.exe` command. You should create and modify this file if you want to exclude certain components from the migration. In addition, you must create and modify this file if you want to exclude any of the operating system settings from being migrated. The `Config.xml` file format is different from the migration .xml files because it doesn't contain any migration rules. It contains only a list of the operating system components, applications, and the user documents that can be migrated. For an example, see the [Config.xml File](usmt-configxml-file.md) article. For this reason, excluding components using this file is easier than modifying the migration .xml files because you don't need to be familiar with the migration rules and syntax. However, you can't use wildcard characters in a `Config.xml` file. +The `Config.xml` file is an optional file that is created using the `/genconfig` option with the `ScanState.exe` command. This file should be created and modified to exclude certain components from the migration. In addition, this file must be created and modified to exclude any of the operating system settings from being migrated. The `Config.xml` file format is different from the migration **.xml** files because it doesn't contain any migration rules. It contains only a list of the operating system components, applications, and the user documents that can be migrated. For an example, see the [Config.xml File](usmt-configxml-file.md) article. For this reason, excluding components using the `Config.xml` file is easier than modifying the migration **.xml** files. With the `Config.xml`, familiarity with the migration rules and syntax isn't. However, wildcard characters can't be used in a `Config.xml` file. -If you want to include all of the default components, you don't need to create the `Config.xml` file. Alternatively, if you're satisfied with the default migration behavior defined in the `MigApp.xml`, `MigDocs.xml`, and `MigUser.xml` files, and you want to exclude only some components, you can create and modify a `Config.xml` file and leave the other .xml files in their original state. +To include all of the default components, a `Config.xml` file doesn't need to be created. Alternatively, if the default migration behavior defined in the `MigApp.xml`, `MigDocs.xml`, and `MigUser.xml` files are satisfactory, and only some components need to be excluded, a `Config.xml` file can be created. The other **.xml** files can be left in their original state. -When you run the `ScanState.exe` command with the `/genconfig` option, `ScanState.exe` reads the other .xml files that you specify using the `/i` option to create a custom list of components that can be migrated from the computer. This file will contain only operating system components, applications, and the user document sections that are in both of the .xml files and that are installed on the computer when you run the `ScanState.exe` command with the `/genconfig` option. Therefore, you should create this file on a source computer that contains all of the components, applications, and settings that will be present on the destination computers. Creating the file on the source computer will ensure that this file contains every component that can be migrated. The components are organized into sections: <Applications>, <WindowsComponents>, and <Documents>. To choose not to migrate a component, change its entry to `migrate="no"`. +When the `ScanState.exe` command is run with the `/genconfig` option, `ScanState.exe` reads the other **.xml** files that are specified using the `/i` option to create a custom list of components that can be migrated from the computer. This file contains only operating system components, applications, and the user document sections that are in both of the **.xml** files and that are installed on the computer when the `ScanState.exe` command is run with the `/genconfig` option. Therefore, this file should be created on a source computer that contains all of the components, applications, and settings that are present on the destination computers. Creating the file on the source computer ensures that this file contains every component that can be migrated. The components are organized into sections: \, \, and \. To choose not to migrate a component, change its entry to `migrate="no"`. -After you create this file, you need to specify it only with the `ScanState.exe` command using the `/Config` option for it to affect the migration. However, if you want to exclude additional data that you migrated to the store, modify the `Config.xml` file and specify the updated file with the `LoadState.exe` command. For example, if you collected the My Documents folder in the store, but you decide that you don't want to migrate the My Documents folder to a destination computer, you can modify the `Config.xml` file to indicate `migrate="no"` before you run the `LoadState.exe` command, and the file won't be migrated. For more information about the precedence that takes place when excluding data, see the [Exclude files and settings](usmt-exclude-files-and-settings.md) article. +After this file is created, it only needs to be specified with the `ScanState.exe` command using the `/Config` option for it to affect the migration. However, if additional data that was migrated to the store needs to be excluded, modify the `Config.xml` file and specify the updated file with the `LoadState.exe` command. For example, if the **Documents** folder is collected in the store, but the **Documents** folder doesn't need to be migrated to a destination computer, the `Config.xml` file can be modified to indicate `migrate="no"` before the `LoadState.exe` command runs, and the file aren't be migrated. For more information about the precedence that takes place when excluding data, see the [Exclude files and settings](usmt-exclude-files-and-settings.md) article. In addition, note the following functionality with the `Config.xml` file: -- If a parent component is removed from the migration in the `Config.xml` file by specifying `migrate="no"`, all of its child components will automatically be removed from the migration, even if the child component is set to `migrate="yes"`. +- If a parent component is removed from the migration in the `Config.xml` file by specifying `migrate="no"`, all of its child components are automatically removed from the migration, even if the child component is set to `migrate="yes"`. -- If you mistakenly have two lines of code for the same component where one line specifies `migrate="no"` and the other line specifies `migrate="yes"`, the component will be migrated. +- If mistakenly two lines of code exist for the same component where one line specifies `migrate="no"` and the other line specifies `migrate="yes"`, the component is migrated. -- In USMT, there are several migration policies that can be configured in the `Config.xml` file. For example, you can configure additional **<ErrorControl>**, **<ProfileControl>**, and **<HardLinkStoreControl>** options. For more information, see the [Config.xml File](usmt-configxml-file.md) article. +- In USMT, there are several migration policies that can be configured in the `Config.xml` file. For example, additional **\**, **\**, and **\** options can be configured. For more information, see the [Config.xml File](usmt-configxml-file.md) article. > [!NOTE] -> To exclude a component from the `Config.xml` file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the `Config.xml` file will not exclude the component from your migration. +> +> To exclude a component from the `Config.xml` file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the `Config.xml` file doesn't exclude the component from the migration. ### Examples @@ -79,7 +86,7 @@ In addition, note the following functionality with the `Config.xml` file: `ScanState.exe /i:MigApp.xml /i:MigDocs.xml /genconfig:Config.xml /v:5` -- The following command creates an encrypted store using the `Config.xml` file and the default migration .xml files: +- The following command creates an encrypted store using the `Config.xml` file and the default migration **.xml** files: `ScanState.exe \\server\share\migration\mystore /i:MigApp.xml /i:MigDocs.xml /o /config:Config.xml /v:5 /encrypt /key:"mykey"` @@ -89,14 +96,11 @@ In addition, note the following functionality with the `Config.xml` file: ## Additional information -- For more information about how to change the files and settings that are migrated, see the [User State Migration Tool (USMT) how-to topics](usmt-how-to.md). - -- For more information about each .xml element, see the [XML elements library](usmt-xml-elements-library.md) article. - +- For more information about how to change the files and settings that are migrated, see the [User State Migration Tool (USMT) how-to articles](usmt-how-to.md). +- For more information about each **.xml** element, see the [XML elements library](usmt-xml-elements-library.md) article. - For answers to common questions, see ".xml files" in the [Frequently asked questions](usmt-faq.yml) article. ## Related articles -[User State Migration Tool (USMT) command-line syntax](usmt-command-line-syntax.md) - -[USMT resources](usmt-resources.md) +- [User State Migration Tool (USMT) command-line syntax](usmt-command-line-syntax.md). +- [USMT resources](usmt-resources.md). diff --git a/windows/deployment/usmt/usmt-determine-what-to-migrate.md b/windows/deployment/usmt/usmt-determine-what-to-migrate.md index 67138078a2..45f064acbe 100644 --- a/windows/deployment/usmt/usmt-determine-what-to-migrate.md +++ b/windows/deployment/usmt/usmt-determine-what-to-migrate.md @@ -1,28 +1,37 @@ --- -title: Determine What to Migrate (Windows 10) -description: Determine migration settings for standard or customized for the User State Migration Tool (USMT) 10.0. +title: Determine What to Migrate +description: Determine migration settings for standard or customized for the User State Migration Tool (USMT). +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Determine what to migrate -By default, User State Migration Tool (USMT) 10.0 migrates the items listed in [What does USMT migrate?](usmt-what-does-usmt-migrate.md), depending on the migration .xml files you specify. These default settings are often enough for a basic migration. +By default, User State Migration Tool (USMT) migrates the items listed in [What does USMT migrate?](usmt-what-does-usmt-migrate.md), depending on the migration **.xml** files that are specified. These default settings are often enough for a basic migration. -However, when considering what settings to migrate, you should also consider what settings you would like the user to be able to configure, if any, and what settings you would like to standardize. Many organizations use their migration as an opportunity to create and begin enforcing a better-managed environment. Some of the settings that users can configure on unmanaged computers prior to the migration can be locked on the new, managed computers. For example, standard wallpaper, Internet Explorer security settings, and desktop configuration are some of the items you can choose to standardize. +However, when considering what settings to migrate, also consider: -To reduce complexity and increase standardization, your organization should consider creating a *standard operating environment (SOE)*. An SOE is a combination of hardware and software that you distribute to all users. Creating an SOE means selecting: +- What settings the user can configure, if any. +- What settings should be standardized. -- A baseline for all computers, including standard hardware drivers -- Core operating system features -- Core productivity applications, especially if they are under volume licensing +Many organizations use their migration as an opportunity to create and begin enforcing a better-managed environment. Some of the settings that users can configure on unmanaged computers prior to the migration can be locked on the new, managed computers. For example, standard wallpaper and desktop configuration are some of the items that can be standardized. + +To reduce complexity and increase standardization, the organization should consider creating a *standard operating environment (SOE)*. An SOE is a combination of hardware and software that is distributed to all users. Creating an SOE means selecting: + +- A baseline for all computers, including standard hardware drivers. +- Core operating system features. +- Core productivity applications, especially if they are under volume licensing. - Core utilities. -- A standard set of security features, as outlined in the organization's corporate policy +- A standard set of security features, as outlined in the organization's corporate policy. Using an SOE can vastly simplify the migration and reduce overall deployment challenges. @@ -31,10 +40,10 @@ Using an SOE can vastly simplify the migration and reduce overall deployment cha | Link | Description | |--- |--- | |[Identify users](usmt-identify-users.md)|Use command-line options to specify which users to migrate and how they should be migrated.| -|[Identify applications settings](usmt-identify-application-settings.md)|Determine which applications you want to migrate and prepare a list of application settings to be migrated.| +|[Identify applications settings](usmt-identify-application-settings.md)|Determine which applications need to be migrated and prepare a list of application settings to be migrated.| |[Identify operating system settings](usmt-identify-operating-system-settings.md)|Use migration to create a new standard environment on each of the destination computers.| -|[Identify file types, files, and folders](usmt-identify-file-types-files-and-folders.md)|Determine and locate the standard, company-specified, and non-standard locations of the file types, files, folders, and settings that you want to migrate.| +|[Identify file types, files, and folders](usmt-identify-file-types-files-and-folders.md)|For the following items that need to be migrated:
  • File types.
  • Files.
  • Folders.
  • Settings.
determine where these items might be located. For example:
  • Standard default OS locations.
  • Organization-specified locations.
  • Non-standard locations.
| ## Related articles -[What does USMT migrate?](usmt-what-does-usmt-migrate.md) +- [What does USMT migrate?](usmt-what-does-usmt-migrate.md). diff --git a/windows/deployment/usmt/usmt-estimate-migration-store-size.md b/windows/deployment/usmt/usmt-estimate-migration-store-size.md index e994e3640b..fb45d82016 100644 --- a/windows/deployment/usmt/usmt-estimate-migration-store-size.md +++ b/windows/deployment/usmt/usmt-estimate-migration-store-size.md @@ -1,77 +1,87 @@ --- -title: Estimate Migration Store Size (Windows 10) -description: Estimate the disk space requirement for a migration so that you can use User State Migration Tool (USMT). +title: Estimate Migration Store Size +description: Estimate the disk space requirement for a migration so that the User State Migration Tool (USMT) can be used. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Estimate migration store size -The disk space requirements for a migration are dependent on the size of the migration store and the type of migration. You can estimate the amount of disk space needed for computers in your organization based on information about your organization's infrastructure. You can also calculate the disk space requirements using the ScanState tool. +The disk space requirements for a migration are dependent on the size of the migration store and the type of migration. The amount of disk space needed for computers in the organization can be estimated based on information about the organization's infrastructure. Disk space requirements can also be calculated using the **ScanState** tool. ## Hard disk space requirements -- **Store**: For non-hard-link migrations, you should ensure that there's enough available disk space at the location where you'll save your store to contain the data being migrated. You can save your store to another partition, an external storage device such as a USB flash drive or a server. For more information, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md). +- **Store**: For non-hard-link migrations, ensure that there's enough available disk space at the location where the store is saved. The store contains the data being migrated. The store can be saved to another partition, an external storage device such as a USB flash drive, or a server. For more information, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md). - **Source Computer**: The source computer needs enough available space for the following items: - - **E250 megabytes (MB) minimum of hard disk space**: Space is needed to support the User State Migration Tool (USMT) 10.0 operations, for example, growth in the page file. If every volume involved in the migration is formatted as NTFS, 250 MB should be enough space to ensure success for almost every hard-link migration, regardless of the size of the migration. The USMT tools won't create the migration store if 250 MB of disk space isn't available. + - **E250 megabytes (MB) minimum of hard disk space**: Space is needed to support the User State Migration Tool (USMT) operations, for example, growth in the page file. If every volume involved in the migration is formatted as NTFS, 250 MB should be enough space to ensure success for almost every hard-link migration, regardless of the size of the migration. The USMT tool that captures data (ScanState) doesn't create the migration store if 250 MB of disk space isn't available. - - **Temporary space for USMT to run**: Extra disk space for the USMT tools to operate is required. This disk space requirement doesn't include the minimum 250 MB needed to create the migration store. The amount of temporary space required can be calculated using the ScanState tool. + - **Temporary space for USMT to run**: Extra disk space is required for the USMT tools to operate. This disk space requirement doesn't include the minimum 250 MB needed to create the migration store. The amount of temporary space required can be calculated using the **ScanState** tool. - **Hard-link migration store**: It isn't necessary to estimate the size of a hard-link migration store. The only case where the hard-link store can be large is when non-NTFS file volumes exist on the system and those volumes contain data being migrated. - **Destination computer**: The destination computer needs enough available space for the following components: - - **Operating system** + - **Operating system**. - - **Applications** + - **Applications**. - **Data being migrated**: Data being migrated includes files and registry information. - - **Temporary space for USMT to run**: Extra disk space for the USMT tools to operate is required. The amount of temporary space required can be calculated using the ScanState tool. + - **Temporary space for USMT to run**: Extra disk space is required for the USMT tools to operate. The amount of temporary space required can be calculated using the **ScanState** tool. -## Calculate disk space requirements using the ScanState tool +## Calculate disk space requirements using the **ScanState** tool -You can use the ScanState tool to calculate the disk space requirements for a particular compressed or uncompressed migration. It isn't necessary to estimate the migration store size for a hard-link migration since this method doesn't create a separate migration store. The ScanState tool provides disk space requirements for the state of the computer at the time the tool is run. The state of the computer may change during day-to-day use so it's recommended that you use the calculations as an estimate when planning your migration. +The **ScanState** tool can be used to calculate the disk space requirements for a particular compressed or uncompressed migration. It isn't necessary to estimate the migration store size for a hard-link migration since this method doesn't create a separate migration store. The **ScanState** tool provides disk space requirements for the state of the computer at the time the tool is run. The state of the computer might change during day-to-day use. For this reason, use the calculations as an estimate when planning the migration. -To run the ScanState tool on the source computer with USMT installed: +To run the **ScanState** tool on the source computer with USMT installed: 1. Open a command prompt with administrator privileges. -2. Navigate to the USMT tools. For example, enter: +1. Navigate to the USMT tools. For example, enter: ```cmd - cd /d "C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\User State Migration Tool\" + cd /d "C:\Program Files (x86)\Windows Kits\10.0\Assessment and Deployment Kit\User State Migration Tool\" ``` - where *<architecture>* is x86 or amd64. + where *\* is x86 or amd64. -3. Run the **ScanState** tool to generate an XML report of the space requirements. At the command prompt, enter: +1. Run the **ScanState** tool to generate an XML report of the space requirements. At the command prompt, enter: ```cmd ScanState.exe /p: ``` - Where *<StorePath>* is a path to a directory where the migration store will be saved and *<path to a file>* is the path and filename where the XML report for space requirements will be saved. For example: + Where: + + - *\* is a path to a directory where the migration store is saved. + - *\* is the path and filename where the XML report for space requirements is saved. + + For example: ```cmd ScanState.exe c:\store /p:c:\spaceRequirements.xml ``` - Although a migration store isn't created by running this command, the *<StorePath>* is still a required parameter. + Although a migration store isn't created by running this command, the *\* is still a required parameter. -The ScanState tool also allows you to estimate disk space requirements based on a customized migration. For example, you might not want to migrate the My Documents folder to the destination computer. You can specify this condition in a configuration file when you run the ScanState tool. For more information, see [Customize USMT XML files](usmt-customize-xml-files.md). +The **ScanState** tool also allows estimation of disk space requirements based on a customized migration. For example, the **Documents** folder might need to be migrated to the destination computer. This condition can be specified in a configuration file when the **ScanState** tool is run. For more information, see [Customize USMT XML files](usmt-customize-xml-files.md). > [!NOTE] -> To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, the `/p` option is still available in USMT without having to specify the path to a file. See [Monitoring Options](usmt-scanstate-syntax.md#monitoring-options) for more information. +> +> To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, the `/p` option is still available in USMT without having to specify the path to a file. For more information, see [Monitoring Options](usmt-scanstate-syntax.md#monitoring-options). -The space requirements report provides two elements, <**storeSize**> and <**temporarySpace**>. The <**temporarySpace**> value shows the disk space, in bytes, that USMT uses to operate during the migration but it doesn't include the minimum 250 MB needed to support USMT. The <**storeSize**> value shows the disk space, in bytes, required to host the migration store contents on both the source and destination computers. The following example shows a report generated using `/p:`*<path to a file>*. +The space requirements report provides two elements, \<**storeSize**\> and \<**temporarySpace**\>. The \<**temporarySpace**\> value shows the disk space, in bytes, that USMT uses to operate during the migration but it doesn't include the minimum 250 MB needed to support USMT. The \<**storeSize**\> value shows the disk space, in bytes, required to host the migration store contents on both the source and destination computers. The following example shows a report generated using `/p:`*\*. ```xml @@ -85,25 +95,26 @@ The space requirements report provides two elements, <**storeSize**> and & ``` -Additionally, USMT performs a compliance check for a required minimum of 250 MB of available disk space and won't create a store if the compliance check fails. +Additionally, USMT performs a compliance check for a required minimum of 250 MB of available disk space and doesn't create a store if the compliance check fails. ## Estimating migration store size -Determine how much space you'll need to store the migrated data. You should base your calculations on the volume of e-mail, personal documents, and system settings for each user. The best way to estimate the required space is to survey several computers to arrive at an average for the size of the store that you'll need. +Determine how much space is needed to store the migrated data. Calculations should be based on the volume of e-mail, personal documents, and system settings for each user. The best way to estimate the required space is to survey several computers to arrive at an average for the size of the store that is needed. -The amount of space that is required in the store will vary, depending on the local storage strategies your organization uses. For example, one key element that determines the size of migration data sets is e-mail storage. If e-mail is stored centrally, data sets will be smaller. If e-mail is stored locally, such as offline-storage files, data sets will be larger. Mobile users will typically have larger data sets than workstation users. You should perform tests and inventory the network to determine the average data set size in your organization. +The amount of space that is required in the store varies and depends on the local storage strategies the organization uses. For example, one key element that determines the size of migration data sets is e-mail storage. If e-mail is stored centrally, data sets are smaller. If e-mail is stored locally, such as offline-storage files, data sets are larger. Mobile users typically have larger data sets than workstation users. Tests should be performed and the network inventoried to determine the average data set size in the organization. > [!NOTE] -> You can create a space-estimate file (`Usmtsize.txt`) to estimate the size of the store by using the legacy `/p` command-line option . +> +> A space-estimate file (`Usmtsize.txt`) can be created to estimate the size of the store by using the legacy `/p` command-line option. -When trying to determine how much disk space you'll need, consider the following issues: +When trying to determine how much disk space is needed, consider the following issues: - **E-mail**: If users deal with a large volume of e-mail or keep e-mail on their local computers instead of on a mail server, the e-mail can take up as much disk space as all other user files combined. Prior to migrating user data, make sure that users who store e-mail locally synchronize their inboxes with their mail server. -- **User documents**: Frequently, all of a user's documents fit into less than 50 MB of space, depending on the types of files involved. This estimate assumes typical office work, such as word-processing documents and spreadsheets. This estimate can vary substantially based on the types of documents that your organization uses. For example, an architectural firm that predominantly uses computer-aided design (CAD) files needs much more space than a law firm that primarily uses word-processing documents. You don't need to migrate the documents that users store on file servers through mechanisms such as Folder Redirection, as long as users will have access to these locations after the migration. +- **User documents**: Frequently, all of a user's documents fit into less than 50 MB of space, depending on the types of files involved. This estimate assumes typical office work, such as word-processing documents and spreadsheets. This estimate can vary substantially based on the types of documents that the organization uses. For example, an architectural firm that predominantly uses computer-aided design (CAD) files needs more space than a law firm that primarily uses word-processing documents. Documents that users store on file servers through mechanisms such as Folder Redirection don't need to be migrated, as long as users will have access to these locations after the migration. -- **User system settings**: Five megabytes is adequate space to save the registry settings. This requirement can fluctuate, however, based on the number of applications that have been installed. It's rare, however, for the user-specific portion of the registry to exceed 5 MB. +- **User system settings**: Five megabytes is adequate space to save the registry settings. This requirement can fluctuate, however, based on the number of applications that are installed. It's rare, however, for the user-specific portion of the registry to exceed 5 MB. ## Related articles -[Common migration scenarios](usmt-common-migration-scenarios.md) +- [Common migration scenarios](usmt-common-migration-scenarios.md). diff --git a/windows/deployment/usmt/usmt-exclude-files-and-settings.md b/windows/deployment/usmt/usmt-exclude-files-and-settings.md index d7c0f5e4fd..3d5057bb4b 100644 --- a/windows/deployment/usmt/usmt-exclude-files-and-settings.md +++ b/windows/deployment/usmt/usmt-exclude-files-and-settings.md @@ -1,40 +1,44 @@ --- -title: Exclude Files and Settings (Windows 10) +title: Exclude Files and Settings description: In this article, learn how to exclude files and settings when creating a custom .xml file and a Config.xml file. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 09/18/2023 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Exclude files and settings -When you specify the migration .xml files, `MigApp.xml`, `MigDocs.xml`, and `MigUser.xml`, the User State Migration Tool (USMT) 10.0 migrates the settings and components listed, as discussed in [What does USMT migrate?](usmt-what-does-usmt-migrate.md) You can create a custom .xml file to further specify what to include or exclude in the migration. In addition, you can create a `Config.xml` file to exclude an entire component from a migration. You can't, however, exclude users by using the migration .xml files or the `Config.xml` file. The only way to specify which users to include and exclude is by using the user options on the command line in the ScanState tool. For more information, see the [User options](usmt-scanstate-syntax.md#user-options) section of the [ScanState syntax](usmt-scanstate-syntax.md) article. +When the migration **.xml** files `MigApp.xml`, `MigDocs.xml`, and `MigUser.xml` are specified, the User State Migration Tool (USMT) migrates the settings and components listed, as discussed in [What does USMT migrate?](usmt-what-does-usmt-migrate.md) A custom **.xml** file can be created to further specify what to include or exclude in the migration. In addition, a `Config.xml` file can be created to exclude an entire component from a migration. However, users can't be excluded by using the migration **.xml** files or the `Config.xml` file. The only way to specify which users to include and exclude is by using the user options on the command line in the **ScanState** tool. For more information, see the [User options](usmt-scanstate-syntax.md#user-options) section of the [ScanState syntax](usmt-scanstate-syntax.md) article. Methods to customize the migration and include and exclude files and settings include: -- [Create a custom .xml file](#create-a-custom-xml-file). You can use the following elements to specify what to exclude: +- [Create a custom .xml file](#create-a-custom-xml-file). The following elements can be used to specify what to exclude: - - [Include and exclude](#include-and-exclude): You can use the **<include>** and **<exclude>** elements to exclude objects with conditions. For example, you can migrate all files located in the `C:\` drive, except any `.mp3` files. It's important to remember that [Conflicts and precedence](usmt-conflicts-and-precedence.md) apply to these elements. + - [Include and exclude](#include-and-exclude): The **\** and **\** elements can be used to exclude objects with conditions. For example, all files located in the `C:\` drive can be migrated, except any `.mp3` files. It's important to remember that [Conflicts and precedence](usmt-conflicts-and-precedence.md) apply to these elements. - - [unconditionalExclude](#example-1-how-to-migrate-all-files-from-c-except-mp3-files): You can use the **<unconditionalExclude>** element to globally exclude data. This element takes precedence over all other include and exclude rules in the .xml files. Therefore, this element excludes objects regardless of any other **<include>** rules that are in the .xml files. For example, you can exclude all .mp3 files on the computer, or you can exclude all files from C:\\UserData. + - [unconditionalExclude](#example-1-how-to-migrate-all-files-from-c-except-mp3-files): The **\** element can be used to globally exclude data. This element takes precedence over all other include and exclude rules in the **.xml** files. Therefore, this element excludes objects regardless of any other **\** rules that are in the **.xml** files. For example, all **.mp3** files can be excluded on the computer, or all files from C:\\UserData can be excluded. -- [Create a Config.xml file](#create-a-config-xml-file): You can create and modify a `Config.xml` file to exclude an entire component from the migration. For example, you can use this file to exclude the settings for one of the default applications. In addition, creating and modifying a `Config.xml` file is the only way to exclude the operating-system settings that are migrated to computers running Windows. Excluding components using this file is easier than modifying the migration .xml files because you don't need to be familiar with the migration rules and syntax. +- [Create a Config.xml file](#create-a-config-xml-file): A `Config.xml` file can be created and modified to exclude an entire component from the migration. For example, this file can be used to exclude the settings for one of the default applications. In addition, creating and modifying a `Config.xml` file is the only way to exclude the operating-system settings that are migrated to computers running Windows. Excluding components using this file is easier than modifying the migration **.xml** files because familiarity with the migration rules and syntax isn't required. ## Create a custom .xml file -We recommend that you create a custom .xml file instead of modifying the default migration .xml files. When you use a custom .xml file, you can keep your changes separate from the default .xml file, which makes it easier to track your modifications. +Microsoft recommends creating a custom **.xml** file instead of modifying the default migration **.xml** files. When a custom **.xml** file is used, the changes can be kept separate from the default **.xml** file, which makes it easier to track the modifications. -### <include> and <exclude> +### \ and \ -The migration .xml files, `MigApp.xml`, `MigDocs.xml`, and `MigUser.xml`, contain the **<component>** element, which typically represents a self-contained component or an application such as Microsoft® Office Outlook® and Word. To exclude the files and registry settings that are associated with these components, use the **<include>** and **<exclude>** elements. For example, you can use these elements to migrate all files and settings with pattern X except files and settings with pattern Y, where Y is more specific than X. For the syntax of these elements, see [USMT XML Reference](usmt-xml-reference.md). +The migration **.xml** files, `MigApp.xml`, `MigDocs.xml`, and `MigUser.xml`, contain the **\** element, which typically represents a self-contained component or an application such as Microsoft Office Outlook and Word. To exclude the files and registry settings that are associated with these components, use the **\** and **\** elements. For example, these elements can be used to migrate all files and settings with pattern X except files and settings with pattern Y, where Y is more specific than X. For the syntax of these elements, see [USMT XML Reference](usmt-xml-reference.md). > [!NOTE] > -> If you specify an **<exclude>** rule, always specify a corresponding **<include>** rule. Otherwise, if you don't specify an **<include>** rule, the specific files or settings aren't included. They're already excluded from the migration. Thus, an unaccompanied **<exclude>** rule is unnecessary. +> If an **\** rule is specified, always specify a corresponding **\** rule. Otherwise, if an **\** rule isn't specified, the specific files or settings aren't included. They're already excluded from the migration. Thus, an unaccompanied **\** rule is unnecessary. - [Example 1: How to migrate all files from C:\\ except .mp3 files](#example-1-how-to-migrate-all-files-from-c-except-mp3-files) @@ -48,7 +52,7 @@ The migration .xml files, `MigApp.xml`, `MigDocs.xml`, and `MigUser.xml`, contai ### Example 1: How to migrate all files from `C:\` except `.mp3` files -The following .xml file migrates all files located on the C: drive, except any .mp3 files. +The following **.xml** file migrates all files located on the C: drive, except any **.mp3** files. ```xml @@ -75,7 +79,7 @@ The following .xml file migrates all files located on the C: drive, except any . ### Example 2: How to migrate all files located in `C:\Data` except files in `C:\Data\tmp` -The following .xml file migrates all files and subfolders in `C:\Data`, except the files and subfolders in `C:\Data\tmp`. +The following **.xml** file migrates all files and subfolders in `C:\Data`, except the files and subfolders in `C:\Data\tmp`. ```xml @@ -101,7 +105,7 @@ The following .xml file migrates all files and subfolders in `C:\Data`, except t ### Example 3: How to exclude the files in a folder but include all subfolders -The following .xml file migrates any subfolders in `C:\`EngineeringDrafts`, but excludes all files that are in `C:\EngineeringDrafts`. +The following **.xml** file migrates any subfolders in `C:\EngineeringDrafts`, but excludes all files that are in `C:\EngineeringDrafts`. ```xml @@ -127,7 +131,7 @@ The following .xml file migrates any subfolders in `C:\`EngineeringDrafts`, but ### Example 4: How to exclude a file from a specific folder -The following .xml file migrates all files and subfolders in `C:\EngineeringDrafts`, except for the `Sample.doc` file in `C:\EngineeringDrafts`. +The following **.xml** file migrates all files and subfolders in `C:\EngineeringDrafts`, except for the `Sample.doc` file in `C:\EngineeringDrafts`. ```xml @@ -153,13 +157,13 @@ The following .xml file migrates all files and subfolders in `C:\EngineeringDraf ### Example 5: How to exclude a file from any location -To exclude a Sample.doc file from any location on the C: drive, use the **<pattern>** element. If multiple files exist with the same name on the C: drive, all of these files are excluded. +To exclude a Sample.doc file from any location on the C: drive, use the **\** element. If multiple files exist with the same name on the C: drive, all of these files are excluded. ```xml C:\* [Sample.doc] ``` -To exclude a Sample.doc file from any drive on the computer, use the **<script>** element. If multiple files exist with the same name, all of these files are excluded. +To exclude a Sample.doc file from any drive on the computer, use the **\** element. If multiple files exist with the same name, all of these files are excluded. ```xml @@ -171,7 +175,7 @@ Here are some examples of how to use XML to exclude files, folders, and registry ##### Example 1: How to exclude all `.mp3` files -The following .xml file excludes all `.mp3` files from the migration: +The following **.xml** file excludes all `.mp3` files from the migration: ```xml @@ -192,7 +196,7 @@ The following .xml file excludes all `.mp3` files from the migration: ##### Example 2: How to exclude all of the files on a specific drive -The following .xml file excludes only the files located on the C: drive. +The following **.xml** file excludes only the files located on the C: drive. ```xml @@ -213,7 +217,7 @@ The following .xml file excludes only the files located on the C: drive. ##### Example 3: How to exclude registry keys -The following .xml file unconditionally excludes the `HKEY_CURRENT_USER` registry key and all of its subkeys. +The following **.xml** file unconditionally excludes the `HKEY_CURRENT_USER` registry key and all of its subkeys. ```xml @@ -240,7 +244,7 @@ The following .xml file unconditionally excludes the `HKEY_CURRENT_USER` registr ##### Example 4: How to Exclude `C:\Windows` and `C:\Program Files` -The following .xml file unconditionally excludes the system folders of `C:\Windows` and `C:\Program Files`. All `*.docx`, `*.xls` and `*.ppt` files aren't migrated because the **<unconditionalExclude>** element takes precedence over the **<include>** element. +The following **.xml** file unconditionally excludes the system folders of `C:\Windows` and `C:\Program Files`. All `*.docx`, `*.xls` and `*.ppt` files aren't migrated because the **\** element takes precedence over the **\** element. ```xml @@ -270,22 +274,21 @@ The following .xml file unconditionally excludes the system folders of `C:\Windo ## Create a Config XML File -You can create and modify a `Config.xml` file if you want to exclude components from the migration. Excluding components using this file is easier than modifying the migration .xml files because you don't need to be familiar with the migration rules and syntax. `Config.xml` is an optional file that you can create using the `/genconfig` command-line option with the ScanState tool. For example, you can use the `Config.xml` file to exclude the settings for one of the default applications. In addition, creating and modifying this file is the only way to exclude the operating-system settings that are migrated to computers running Windows. +A `Config.xml` file can be created and modified to exclude components from the migration. Excluding components using this file is easier than modifying the migration **.xml** files because familiarity with the migration rules and syntax isn't required. `Config.xml` is an optional file that can be created using the `/genconfig` command-line option with the **ScanState** tool. For example, the `Config.xml` file can be used to exclude the settings for one of the default applications. In addition, creating and modifying this file is the only way to exclude the operating-system settings that are migrated to computers running Windows. -- **To exclude the settings for a default application:** Specify `migrate="no"` for the application under the **<Applications>** section of the `Config.xml` file. +- **To exclude the settings for a default application:** Specify `migrate="no"` for the application under the **\** section of the `Config.xml` file. -- **To exclude an operating system setting:** Specify `migrate="no"` for the setting under the **<WindowsComponents>** section. +- **To exclude an operating system setting:** Specify `migrate="no"` for the setting under the **\** section. -- **To exclude My Documents:** Specify `migrate="no"` for **My Documents** under the **<Documents>** section. Any **<include>** rules in the .xml files are still applied. For example, if you have a rule that includes all the .docx files in My Documents, then .docx files are still migrated. However, any additional files that aren't .docx aren't migrated. +- **To exclude the Documents folder:** Specify `migrate="no"` for the **Documents** folder under the **\** section. Any **\** rules in the **.xml** files are still applied. For example, if a rule exists that includes all the **.docx** files in the **Documents** folder, then **.docx** files are still migrated. However, any additional files that aren't **.docx** aren't migrated. For more information, see [Config.xml File](usmt-configxml-file.md). > [!NOTE] > -> To exclude a component from the `Config.xml` file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the `Config.xml` file doesn't exclude the component from your migration. +> To exclude a component from the `Config.xml` file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the `Config.xml` file doesn't exclude the component from the migration. ## Related articles -- [Customize USMT XML files](usmt-customize-xml-files.md) - -- [USMT XML reference](usmt-xml-reference.md) +- [Customize USMT XML files](usmt-customize-xml-files.md). +- [USMT XML reference](usmt-xml-reference.md). diff --git a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md index 0e973ffb4e..34a771f93f 100644 --- a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md +++ b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md @@ -1,18 +1,22 @@ --- -title: Extract Files from a Compressed USMT Migration Store (Windows 10) +title: Extract Files from a Compressed USMT Migration Store description: In this article, learn how to extract files from a compressed User State Migration Tool (USMT) migration store. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Extract files from a compressed USMT migration store -When you migrate files and settings during a typical PC-refresh migration, you usually create a compressed migration store file on the intermediate store. This migration store is a single image file that contains all files being migrated as well as a catalog file. To protect the compressed file, you can encrypt it by using different encryption algorithms. When you migrate the file back to the source computer after the operating system is installed, you can run the **UsmtUtils** command with the `/extract` option to recover the files from the compressed migration store. You can also use the **UsmtUtils** command with the `/extract` option any time you need to recover data from a migration store. +When files and settings are migrated during a typical PC-refresh migration, a compressed migration store file is usually created on the intermediate store. This migration store is a single image file that contains all files being migrated as well as a catalog file. To protect the compressed file, it can be encrypted by using different encryption algorithms. When the file is migrated back to the source computer after the operating system is installed, the **UsmtUtils** command can be run with the `/extract` option to recover the files from the compressed migration store. The **UsmtUtils** command with the `/extract` option can also be used any time data needs to be recovered from a migration store. Options used with the `/extract` option can specify: @@ -22,7 +26,7 @@ Options used with the `/extract` option can specify: - Include and exclude patterns for selective data extraction. -In addition, you can specify the file patterns that you want to extract by using the `/i` option to include file patterns or the `/e` option to exclude file patterns. When both the `/i` option and the `/e` option are used in the same command, include patterns take precedence over exclude patterns. Note that this is different from the include and exclude rules used in the **ScanState** and **LoadState** tools. +In addition, the file patterns that need to be extracted can be specified by using the `/i` option to include file patterns or the `/e` option to exclude file patterns. When both the `/i` option and the `/e` option are used in the same command, include patterns take precedence over exclude patterns. The `/i` and the `/e` options are different from the include and exclude rules used in the **ScanState** and **LoadState** tools. ## To run the UsmtUtils tool with the /extract option @@ -34,23 +38,23 @@ UsmtUtils.exe /extract [/i:] [/e:** is the location where the USMT files and tools are saved. -- **<filePath>** is the location of the migration store. +- **\** is the location of the migration store. -- **<destination path>** is the location of the file where you want the **/extract** option to put the extracted migration store contents. +- **\** is the location of the file where the **/extract** option should put the extracted migration store contents. -- **<includePattern>** specifies the pattern for the files to include in the extraction. +- **\** specifies the pattern for the files to include in the extraction. -- **<excludePattern>** specifies the pattern for the files to omit from the extraction. +- **\** specifies the pattern for the files to omit from the extraction. -- **<AlgID>** is the cryptographic algorithm that was used to create the migration store on the `ScanState.exe` command line. +- **\** is the cryptographic algorithm that was used to create the migration store on the `ScanState.exe` command line. -- **<logfile>** is the location and name of the log file. +- **\** is the location and name of the log file. -- **<keystring>** is the encryption key that was used to encrypt the migration store. +- **\** is the encryption key that was used to encrypt the migration store. -- **<filename>** is the location and name of the text file that contains the encryption key. +- **\** is the location and name of the text file that contains the encryption key. ### To extract all files from a compressed migration store @@ -80,18 +84,16 @@ UsmtUtils.exe /extract D:\MyMigrationStore\USMT\store.mig /e:*.exe C:\ExtractedS ### To extract file types using the include pattern and the exclude pattern -To extract files from a compressed migration store, and to exclude files of one type (such as .exe files) while including only specific files, use both the include pattern and the exclude pattern, as in this example: +When files are extracted from a compressed migration store, both the include and the exclude patterns can be used at the same time. Files of one type can be excluded while files of another type can be included. For example: ```cmd UsmtUtils.exe /extract D:\MyMigrationStore\USMT\store.mig /i:myProject.* /e:*.exe C:\ExtractedStore /o ``` -In this example, if there is a myProject.exe file, it will also be extracted because the include pattern option takes precedence over the exclude pattern option. +In this example, if there's a **myProject.exe** file, the file is also extracted because the include pattern option takes precedence over the exclude pattern option. ## Related articles -[UsmtUtils syntax](usmt-utilities.md) - -[Return codes](/troubleshoot/windows-client/deployment/usmt-return-codes) - -[Verify the condition of a compressed migration store](verify-the-condition-of-a-compressed-migration-store.md) +- [UsmtUtils syntax](usmt-utilities.md). +- [Return codes](/troubleshoot/windows-client/deployment/usmt-return-codes). +- [Verify the condition of a compressed migration store](verify-the-condition-of-a-compressed-migration-store.md). diff --git a/windows/deployment/usmt/usmt-faq.yml b/windows/deployment/usmt/usmt-faq.yml index f22b052e29..f53ff44eee 100644 --- a/windows/deployment/usmt/usmt-faq.yml +++ b/windows/deployment/usmt/usmt-faq.yml @@ -1,7 +1,7 @@ ### YamlMime:FAQ metadata: - title: 'Frequently Asked Questions (Windows 10)' - description: 'Learn about frequently asked questions and recommended solutions for migrations using User State Migration Tool (USMT) 10.0.' + title: 'USMT Frequently Asked Questions' + description: 'Learn about frequently asked questions and recommended solutions for migrations using User State Migration Tool (USMT).' ms.assetid: 813c13a7-6818-4e6e-9284-7ee49493241b ms.prod: windows-client ms.technology: itpro-deploy @@ -11,11 +11,16 @@ metadata: ms.mktglfcycl: deploy ms.sitesec: library audience: itpro - ms.date: 11/01/2022 + ms.date: 01/09/2024 ms.topic: faq title: Frequently Asked Questions summary: | - The following sections provide frequently asked questions and recommended solutions for migrations using User State Migration Tool (USMT) 10.0. + **Applies to:** + + - Windows 11 + - Windows 10 + + The following sections provide frequently asked questions and recommended solutions for migrations using User State Migration Tool (USMT). sections: @@ -33,54 +38,66 @@ sections: - Uncompressed store - question: | - Can I store the files and settings directly on the destination computer or do I need a server? + Can the files and settings be stored directly on the destination computer or is a server needed? answer: | - You don't need to save the files to a server. If you're moving the user state to a new computer, you can create the store on a shared folder, on media that you can remove, such as a USB flash drive (UFD), or you can store it directly on the destination computer, as in the following steps: + Files don't need to be saved to a server. If moving the user state to a new computer, the store can be created on: + + - A shared folder. + - On removable media, such as a USB flash drive (UFD). + - Directly on the destination computer. + + To store it directly on the destination computer: 1. Create and share the directory `C:\store` on the destination computer. - 2. Run the **ScanState** tool on the source computer and save the files and settings to `\\\store` + 1. Run the **ScanState** tool on the source computer and save the files and settings to `\\\store` - 3. Run the **LoadState** tool on the destination computer and specify `C:\store` as the store location. + 1. Run the **LoadState** tool on the destination computer and specify `C:\store` as the store location. - question: | - Can I migrate data between operating systems with different languages? + Can data be migrated between operating systems with different languages? answer: | No. USMT doesn't support migrating data between operating systems with different languages; the source computer's operating-system language must match the destination computer's operating-system language. - question: | - Can I change the location of the temporary directory on the destination computer? + Can the location of the temporary directory on the destination computer be changed? answer: | Yes. The environment variable `USMT\_WORKING\_DIR` can be changed to an alternative temporary directory. There are some offline migration scenarios where changing the temporary directory is necessary, for example, when the USMT binaries are located on read-only Windows Preinstallation Environment (WinPE) boot media. - question: | - How do I install USMT? + How is USMT installed? answer: | - Because USMT is included in Windows Assessment and Deployment Kit (Windows ADK), you need to install the Windows ADK package on at least one computer in your environment. The USMT binaries can then be copied from the USMT directory located on the original computer where the Windows ADK was installed to additional client computers. + Because USMT is included in Windows Assessment and Deployment Kit (Windows ADK), the Windows ADK package needs to be installed on at least one computer in the environment. The USMT binaries can then be copied from the USMT directory located on the original computer where the Windows ADK was installed to additional client computers. - question: | - How do I uninstall USMT? + How is USMT uninstalled? answer: | - If you've installed the Windows ADK on the computer, uninstalling Windows ADK will uninstall USMT. For client computers that don't have the Windows ADK installed, you can delete the USMT directory to uninstall USMT. + For computers that have the Windows ADK installed, uninstalling the Windows ADK from the computer uninstalls USMT. For client computers that don't have the Windows ADK installed, the USMT directory can be deleted to uninstall USMT. - name: Files and Settings questions: - question: | - How can I exclude a folder or a certain type of file from the migration? + How can a folder or a certain type of file be excluded from the migration? answer: | - You can use the **<unconditionalExclude>** element to globally exclude data from the migration. For example, you can use this element to exclude all MP3 files on the computer or to exclude all files from `C:\UserData`. This element excludes objects regardless of any other **<include>** rules that are in the .xml files. For an example, see **<unconditionalExclude>** in the [Exclude files and settings](usmt-exclude-files-and-settings.md) article. For the syntax of this element, see [XML elements library](usmt-xml-elements-library.md). + The **\** element can be used to globally exclude data from the migration. For example, this element can be used to exclude all MP3 files on the computer or to exclude all files from `C:\UserData`. This element excludes objects regardless of any other **\** rules that are in the **.xml** files. For an example, see **\** in the [Exclude files and settings](usmt-exclude-files-and-settings.md) article. For the syntax of this element, see [XML elements library](usmt-xml-elements-library.md). - question: | What happens to files that were located on a drive that don't exist on the destination computer? answer: | - USMT migrates the files to the `%SystemDrive%` while maintaining the correct folder hierarchy. For example, if `E:\data\File.pst` is on the source computer, but the destination computer doesn't have an E:\\ drive, the file will be migrated to `C:\data\File.pst`, if C:\\ is the system drive. This behavior holds true even when **<locationModify>** rules attempt to move data to a drive that doesn't exist on the destination computer. + USMT migrates the files to the `%SystemDrive%` while maintaining the correct folder hierarchy. For example: + + - `E:\data\File.pst` is on the source computer. + - Destination computer doesn't have an E:\\ drive. + - C:\\ is the system drive on the destination computer. + + the file is migrated to `C:\data\File.pst`. This behavior holds true even when **\** rules attempt to move data to a drive that doesn't exist on the destination computer. - name: USMT .xml Files questions: - question: | - Where can I get examples of USMT .xml files? + Where are there examples of USMT **.xml** files? answer: | - The following articles include examples of USMT .xml files: + The following articles include examples of USMT **.xml** files: - [Exclude files and settings](usmt-exclude-files-and-settings.md) @@ -91,37 +108,37 @@ sections: - [Custom XML examples](usmt-custom-xml-examples.md) - question: | - Can I use custom .xml files that were written for USMT 5.0? + Can custom **.xml** files that were written for USMT 5.0 be used? answer: | - Yes. You can use custom .xml files that were written for USMT 5.0 with USMT for Windows 10. However, in order to use new USMT functionality, you must revisit your custom USMT files and refresh them to include the new command-line options and XML elements. + Yes. Custom **.xml** files that were written for USMT 5.0 can be used with newer versions of USMT. However, in order to use new USMT functionality, the custom USMT files must be revisited and refreshed to include the new command-line options and XML elements. - question: | - How can I validate the .xml files? + How can the **.xml** files be validated? answer: | - You can use the USMT XML Schema (`MigXML.xsd`) to write and validate migration .xml files. + The USMT XML Schema (`MigXML.xsd`) can be used to write and validate migration **.xml** files. - question: | - Why must I list the .xml files with both the `ScanState.exe` and `LoadState.exe` commands? + Why must the **.xml** files be included with both the `ScanState.exe` and `LoadState.exe` commands? answer: | - The .xml files aren't copied to the store as in previous versions of USMT. Because the **ScanState** and **LoadState** tools need the .xml files to control the migration, you must specify the same set of .xml files for the `ScanState.exe` and `LoadState.exe` commands. If you used a particular set of mig\*.xml files in the **ScanState** tool, either called through the `/auto` option, or individually through the `/i` option, then you should use same option to call the exact same mig\*.xml files in the **LoadState** tool. However, you don't have to specify the `Config.xml` file, unless you want to exclude some of the files and settings that you migrated to the store. For example, you might want to migrate the **My Documents** folder to the store, but not to the destination computer. To do this type of migration, modify the `Config.xml` file and specify the updated file with the `LoadState.exe` command. **LoadState** will migrate only the files and settings that you want to migrate. + The **.xml** files aren't copied to the store as in previous versions of USMT. Because the **ScanState** and **LoadState** tools need the **.xml** files to control the migration, the same set of **.xml** files must be specified for the `ScanState.exe` and `LoadState.exe` commands. If a particular set of mig\*.xml files were used in the **ScanState** tool, either called through the `/auto` option, or individually through the `/i` option, then the same option should be used to call the exact same mig\*.xml files in the **LoadState** tool. However, the `Config.xml` file doesn't need to be specified, unless files and settings that were migrated to the store need to be excluded. For example, the **Documents** folder might be migrated to the store, but not to the destination computer. To do this type of migration, modify the `Config.xml` file and specify the updated file with the `LoadState.exe` command. **LoadState** migrates only the desired files and settings. - If you exclude an .xml file from the `LoadState.exe` command, then all of the data that is in the store that was migrated with the missing .xml files will be migrated. However, the migration rules that were specified for the `ScanState.exe` command won't apply. For example, if you exclude a `MigApp.xml` file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT won't reroute the files. Instead, it will migrate them to `C:\data`. + If an **.xml** file is excluded from the `LoadState.exe` command, then all of the data in the store that was migrated with the missing **.xml** files are migrated. However, the migration rules that were specified for the `ScanState.exe` command don't apply. For example, if a `MigApp.xml` file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")` is excluded, USMT doesn't reroute the files. Instead, it migrates them to `C:\data`. - question: | - Which files can I modify and specify on the command line? + Which files can be modified and specified on the command line? answer: | - You can specify the `MigUser.xml` and `MigApp.xml` files on the command line. You can modify each of these files. The migration of operating system settings is controlled by the manifests, which you can't modify. If you want to exclude certain operating-system settings or any other components, create and modify the `Config.xml` file. + The `MigUser.xml`, `MigApp.xml`, and `MigDocs.xml` files can be specified on the command line. Each of these files can be modified. Manifests control the migration of operating system settings. Manifests can't be modified. To exclude certain operating-system settings or any other components, create and modify the `Config.xml` file. - question: | - What happens if I don't specify the .xml files on the command line? + What happens if the **.xml** files aren't specified on the command line? answer: | - **ScanState** - If you don't specify any files with the `ScanState.exe` command, all user accounts and default operating system components are migrated. + If no files are specified with the `ScanState.exe` command, all user accounts and default operating system components are migrated. - **LoadState** - If you don't specify any files with the `LoadState.exe` command, all data that is in the store is migrated. However, any target-specific migration rules that were specified in .xml files with the `ScanState.exe` command won't apply. For example, if you exclude a `MigApp.xml` file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT won't reroute the files. Instead, it will migrate them to `C:\data`. + If no files are specified with the `LoadState.exe` command, all data that is in the store is migrated. However, any target-specific migration rules that were specified in **.xml** files with the `ScanState.exe` command doesn't apply. For example, if a `MigApp.xml` file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")` is excluded, USMT doesn't reroute the files. Instead, it migrates them to `C:\data`. - name: Conflicts and Precedence questions: @@ -135,8 +152,6 @@ additionalContent: | ## Related topics - [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) - - [Extract files from a compressed USMT migration store](usmt-extract-files-from-a-compressed-migration-store.md) - - [Verify the condition of a compressed migration store](verify-the-condition-of-a-compressed-migration-store.md) + - [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md). + - [Extract files from a compressed USMT migration store](usmt-extract-files-from-a-compressed-migration-store.md). + - [Verify the condition of a compressed migration store](verify-the-condition-of-a-compressed-migration-store.md). diff --git a/windows/deployment/usmt/usmt-general-conventions.md b/windows/deployment/usmt/usmt-general-conventions.md index a7078f7b0b..d33d7352e7 100644 --- a/windows/deployment/usmt/usmt-general-conventions.md +++ b/windows/deployment/usmt/usmt-general-conventions.md @@ -1,58 +1,62 @@ --- -title: General Conventions (Windows 10) +title: General Conventions description: Learn about general XML guidelines and how to use XML helper functions in the XML Elements library to change migration behavior. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # General conventions -This topic describes the XML helper functions. +This article describes the XML helper functions. ## General XML guidelines -Before you modify the .xml files, become familiar with the following guidelines: +Before modifying the **.xml** files, become familiar with the following guidelines: -- **XML schema** +- **XML schema.** - You can use the User State Migration Tool (USMT) 10.0 XML schema, MigXML.xsd, to write and validate migration .xml files. + The User State Migration Tool (USMT) XML schema, `MigXML.xsd`, can be used to write and validate migration **.xml** files. -- **Conflicts** +- **Conflicts.** In general, when there are conflicts within the XML schema, the most specific pattern takes precedence. For more information, see [Conflicts and precedence](usmt-conflicts-and-precedence.md). -- **Required elements** +- **Required elements.** - The required elements for a migration .xml file are **<migration>**, **<component>**, **<role>**, and **<rules>**. + The required elements for a migration **.xml** file are **\**, **\**, **\**, and **\**. -- **Required child elements** +- **Required child elements.** - - USMT doesn't fail with an error if you don't specify the required child elements. However, you must specify the required child elements for the parent element to affect the migration. + - USMT doesn't fail with an error if the required child elements aren't specified. However, the required child elements must be specified for the parent element to affect the migration. - - The required child elements apply only to the first definition of the element. If these elements are defined and then referred to using their name, the required child elements don't apply. For example, if you define `` in **<namedElements>**, and you specify `` in **<component>** to refer to this element, the definition inside **<namedElements>** must have the required child elements, but the **<component>** element doesn't need to have the required child elements. + - The required child elements apply only to the first definition of the element. If these elements are defined and then referred to using their name, the required child elements don't apply. For example, if `` is defined in **\**, and `` is specified in **\** to refer to this element, the definition inside **\** must have the required child elements, but the **\** element doesn't need to have the required child elements. -- **File names with brackets** +- **File names with brackets.** - If you're migrating a file that has a bracket character (\[ or \]) in the file name, you must insert a carat (^) character directly before the bracket for the bracket character to be valid. For example, if there's a file named **file].txt**, you must specify `c:\documents\mydocs [file^].txt]` instead of `c:\documents\mydocs [file].txt]`. + If a file that has a bracket character (\[ or \]) in the file name is being migrated, a carat (^) character must be inserted. The carat (^) character must be directly before the bracket for the bracket character to be valid. For example, if there's a file named **file].txt**, `c:\documents\mydocs [file^].txt]` must be specified instead of `c:\documents\mydocs [file].txt]`. -- **Using quotation marks** +- **Using quotation marks.** - When you surround code in quotation marks, you can use either double ("") or single (') quotation marks. + When code is surrounded in quotation marks, either the double ("") or the single (') quotation marks can be used. ## Helper functions -You can use the XML helper functions in the [XML elements library](usmt-xml-elements-library.md) to change migration behavior. Before you use these functions in an .xml file, note the following items: +The XML helper functions in the [XML elements library](usmt-xml-elements-library.md) can be used to change migration behavior. Before using these functions in an **.xml** file, note the following items: -- **All of the parameters are strings** +- **All of the parameters are strings.** -- **You can leave NULL parameters blank** +- **NULL parameters can be left blank.** - As with parameters with a default value convention, if you have a NULL parameter at the end of a list, you can leave it out. For example, the following function: + As with parameters with a default value convention, if there's a NULL parameter at the end of a list, it can be left out. For example, the following function: ```cmd SomeFunction("My String argument",NULL,NULL) @@ -64,20 +68,36 @@ You can use the XML helper functions in the [XML elements library](usmt-xml-elem SomeFunction("My String argument") ``` -- **The encoded location used in all the helper functions is an unambiguous string representation for the name of an object** +- **The encoded location used in all the helper functions is an unambiguous string representation for the name of an object.** - It's composed of the node part, optionally followed by the leaf enclosed in square brackets. This format makes a clear distinction between nodes and leaves. + The encoded location is composed of the node part, optionally followed by the leaf enclosed in square brackets. This format makes a clear distinction between nodes and leaves. - For example, specify the file `C:\Windows\Notepad.exe`: **c:\\Windows\[Notepad.exe\]**. Similarly, specify the directory `C:\Windows\System32` like this: **c:\\Windows\\System32**; note the absence of the **\[\]** characters. + For example, specify the file + + `C:\Windows\Notepad.exe` + + as + + **c:\\Windows\[Notepad.exe\]** + + Similarly, specify the directory + + `C:\Windows\System32` + + as + + **c:\\Windows\\System32** + + Note the absence of the **\[\]** characters in second example. The registry is represented in a similar way. The default value of a registry key is represented as an empty **\[\]** construct. For example, the default value for the `HKLM\SOFTWARE\MyKey` registry key is **HKLM\\SOFTWARE\\MyKey\[\]**. -- **You specify a location pattern in a way that is similar to how you specify an actual location** +- **A location pattern is specified in a way that is similar to how an actual location is specified.** The exception is that both the node and leaf part accept patterns. However, a pattern from the node doesn't extend to the leaf. - For example, the pattern **c:\\Windows\\\\\*** will match the `\Windows` directory and all subdirectories, but it will not match any of the files in those directories. To match the files as well, you must specify **c:\\Windows\\\*\[\*\]**. + For example, the pattern **c:\\Windows\\\\\*** matches the `\Windows` directory and all subdirectories, but it doesn't match any of the files in those directories. To match the files as well, **c:\\Windows\\\*\[\*\]** must be specified. ## Related articles -[USMT XML reference](usmt-xml-reference.md) +- [USMT XML reference](usmt-xml-reference.md). diff --git a/windows/deployment/usmt/usmt-hard-link-migration-store.md b/windows/deployment/usmt/usmt-hard-link-migration-store.md index 13a65a73e1..0223b25691 100644 --- a/windows/deployment/usmt/usmt-hard-link-migration-store.md +++ b/windows/deployment/usmt/usmt-hard-link-migration-store.md @@ -1,78 +1,87 @@ --- -title: Hard-Link Migration Store (Windows 10) +title: Hard-Link Migration Store description: Use of a hard-link migration store for a computer-refresh scenario drastically improves migration performance and significantly reduces hard-disk utilization. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Hard-Link Migration Store -A **hard-link migration store** enables you to perform an in-place migration where all user state is maintained on the computer while the old operating system is removed and the new operating system is installed. This functionality is what makes **hard-link migration store** best suited for the computer-refresh scenario. Use of a hard-link migration store for a computer-refresh scenario drastically improves migration performance and significantly reduces hard-disk utilization, reduces deployment costs, and enables entirely new migration scenarios. +A **hard-link migration store** enables an in-place migration to be performed where all user state is maintained on the computer while the old operating system is removed and the new operating system is installed. This functionality is what makes **hard-link migration store** best suited for the computer-refresh scenario. Use of a hard-link migration store for a computer-refresh scenario drastically improves migration performance and significantly reduces hard-disk utilization, reduces deployment costs, and enables entirely new migration scenarios. ## When to use a hard-link migration -You can use a hard-link migration store when your planned migration meets both of the following criteria: +A hard-link migration store can be used when the planned migration meets both of the following criteria: -- You're upgrading the operating system on existing hardware rather than migrating to new computers. +- The operating system is being upgraded on existing hardware rather than migrating to new computers. -- You're upgrading the operating system on the same volume of the computer. +- The operating system is being upgraded on the same volume of the computer. -You can't use a hard-link migration store if your planned migration includes any of the following tasks: +A hard-link migration store can't be used if the planned migration includes any of the following tasks: -- You're migrating data from one computer to a second computer. +- Data is being migrated from one computer to a different computer. -- You're migrating data from one volume on a computer to another volume, for example from `C:` to `D:`. +- Data is being migrating from one volume on a computer to another volume on the same computer, for example from `C:` to `D:`. -- You're formatting or repartitioning the disk outside of Windows Setup, or specifying a disk format or repartition during Windows Setup that will remove the migration store. +- The disk containing the migration store is being formatted or repartitioned disk either outside of Windows Setup or during Windows Setup. ## Understanding a hard-link migration The hard-link migration store is created using the command-line option, `/hardlink`, and is equivalent to other migration-store types. However, it differs in that hard links are utilized to keep files stored on the source computer during the migration. Keeping the files in place on the source computer eliminates the redundant work of duplicating files. It also enables the performance benefits and reduction in disk utilization that define this scenario. -When you create a hard link, you give an existing file one more path. For instance, you could create a hard link to `c:\file1.txt` called `c:\hard link\myFile.txt`. These two paths relate to the same file. If you open `c:\file1.txt`, make changes, and save the file, you'll see those changes when you open `c:\hard link\myFile.txt`. If you delete `c:\file1.txt`, the file still exists on your computer as `c:\hardlink\myFile.txt`. You must delete both references to the file in order to delete the file. +When a hard link is created, an existing file is given one more path. For instance, a hard link to `c:\file1.txt` can be created called `c:\hard link\myFile.txt`. These two paths relate to the same file. If `c:\file1.txt` is opened, then changes made to the file followed by the file being saved, those changes are seen when `c:\hard link\myFile.txt` is opened. If `c:\file1.txt` is deleted, the file still exists on the computer as `c:\hardlink\myFile.txt`. Both references to the file must be deleted in order to delete the file. > [!NOTE] -> A hard link can only be created for a file on the same volume. If you copy a hard-link migration store to another drive or external device, the files, and not the links, are copied, as in a non-compressed migration-store scenario. +> +>A hard link can only be created for a file on the same volume. If a hard-link migration store is copied to another drive or external device, the files, and not the links, are copied, as in a non-compressed migration-store scenario. For more information about hard links, see [Hard Links and Junctions](/windows/win32/fileio/hard-links-and-junctions) -In most aspects, a hard-link migration store is identical to an uncompressed migration store. It's located where specified by the **ScanState.exe** command-line tool and you can view the contents of the store by using Windows Explorer. Once created, it can be deleted or copied to another location without changing user state. Restoring a hard-link migration store is similar to restoring any other migration store. However, as with creating the store, the same hard-link functionality is used to keep files in-place. +In most aspects, a hard-link migration store is identical to an uncompressed migration store. The hard-link migration store is located as specified by the **ScanState.exe** command-line tool. The contents of the store can be viewed by using Windows Explorer. Once created, it can be deleted or copied to another location without changing user state. Restoring a hard-link migration store is similar to restoring any other migration store. However, as with creating the store, the same hard-link functionality is used to keep files in-place. -As a best practice, it's recommended that you delete the hard-link migration store after you confirm that the **LoadState** tool has successfully migrated the files. Since **LoadState** has created new paths to the files on the new installation of a Windows operating system, deleting the hard links in the migration store will only delete one path to the files, and won't delete the actual files or the paths to them from the new operating system. +As a best practice, delete the hard-link migration store after confirming that the files are successfully migrated via the **LoadState** tool. Since **LoadState** creates new paths to the files on the new installation of a Windows operating system, deleting the hard links in the migration store only deletes one path to the files. It doesn't delete the actual files or the paths to them from the new operating system. > [!IMPORTANT] -> Using the `/c` option will force the **LoadState** tool to continue applying files when non-fatal errors occur. If you use the `/c` option, you should verify that no errors are reported in the logs before deleting the hard-link migration store in order to avoid data loss. +> +> Using the `/c` option forces the **LoadState** tool to continue applying files when non-fatal errors occur. If the `/c` option is used, verify that no errors are reported in the logs before deleting the hard-link migration store in order to avoid data loss. Keeping the hard-link migration store can result in extra disk space being consumed or problems with some applications for the following reasons: -- Applications reporting file-system statistics, for example, space used and free space, might incorrectly report these statistics while the hard-link migration store is present. The file may be reported twice because of the two paths that reference that file. +- Applications reporting file-system statistics, for example, space used and free space, might incorrectly report these statistics while the hard-link migration store is present. The file might be reported twice because of the two paths that reference that file. -- A hard link may lose its connection to the original file. Some applications save changes to a file by creating a temporary file and then renaming the original to a backup filename. The path that wasn't used to open the file in this application will continue to refer to the unmodified file. The unmodified file that isn't in use is taking up more disk space. You should create the hard-link migration store just before you perform the migration, and not use applications once the store is created, in order to make sure you're migrating the latest versions of all files. +- A hard link might lose its connection to the original file. Some applications save changes to a file by creating a temporary file and then renaming the original to a backup filename. The path that wasn't used to open the file in this application continues to refer to the unmodified file. The unmodified file that isn't in use is taking up more disk space. The hard-link migration store should be created just before the migration is performed. Once the store is created, applications shouldn't be used in order to make sure the latest versions of all files are being migrating. -- Editing the file by using different paths simultaneously may result in data corruption. +- Editing the file by using different paths simultaneously might result in data corruption. > [!IMPORTANT] +> > The read-only file attribute on migrated files is lost when the hard-link migration store is deleted. This is due to a limitation in NTFS file system hard links. ## Hard-link migration scenario -For example, a company has decided to deploy Windows 10 on all of their computers. Each employee will keep the same computer, but the operating system on each computer will be updated. +For example, an organization decides to deploy the latest supported version of Windows on all of their computers. Each employee keeps the same computer, but the operating system on each computer will be updated. 1. An administrator runs the **ScanState** command-line tool on each computer, specifying the `/hardlink` command-line option. The **ScanState** tool saves the user state to a hard-link migration store on each computer, improving performance by reducing file duplication, except in certain specific instances. > [!NOTE] - > As a best practice, we recommend that you do not create your hard-link migration store until just before you perform the migration in order to migrate the latest versions of your files. You should not use your software applications on the computer after creating the migration store until you have finished migrating your files with **LoadState**. + > + > As a best practice, Microsoft recommends not to create the hard-link migration store until just before the migration is performed in order to migrate the latest versions of files. Software applications shouldn't be used on the computer after creating the migration store until files finish migrating with **LoadState**. -2. On each computer, an administrator installs the company's standard operating environment (SOE), which includes Windows 10 and other applications the company currently uses. +1. On each computer, an administrator installs the organization's standard operating environment (SOE), which includes the latest supported version of Windows and other applications the organization currently uses. -3. An administrator runs the **LoadState** command-line tool on each computer. The **LoadState** tool restores user state back on each computer. +1. An administrator runs the **LoadState** command-line tool on each computer. The **LoadState** tool restores user state back on each computer. > [!NOTE] +> > During the update of a domain-joined computer, the profiles of users whose SID cannot be resolved will not be migrated. When using a hard-link migration store, it could cause a data loss. ## Hard-link migration store details @@ -85,46 +94,52 @@ The `/hardlink` command-line option proceeds with creating the migration store o ### Hard-link store size estimation -It isn't necessary to estimate the size of a hard-link migration store since hard-link migration store on NTFS volumes will be relatively small and require much less incremental space than other store options. Estimating the size of a migration store is only useful in scenarios where the migration store is large. The only case where the local store can be large with hard-link migrations is when non-NTFS file systems exist on the system and the non-NTFS files system contain data that needs to be migrated. Since NTFS has been the default file system format for Windows XP and newer operating systems, this situation is unusual. +It isn't necessary to estimate the size of a hard-link migration store since a hard-link migration store on an NTFS volume is relatively small and require much less incremental space than other store options. Estimating the size of a migration store is only useful in scenarios where the migration store is large. The only case where the local store can be large with hard-link migrations is: + +- A non-NTFS file system exists on the system. +- The non-NTFS files system contains data that needs to be migrated. + +Since NTFS is the default file system format for all currently supported versions of Windows, this situation is unusual. ### Migration store path on multiple volumes -Separate hard-link migration stores are created on each NTFS volume that contain data being migrated. In this scenario, the primary migration-store location will be specified on the command line, and should be the operating-system volume. Migration stores with identical names and directory names will be created on every volume containing data being migrated. For example: +Separate hard-link migration stores are created on each NTFS volume that contain data being migrated. In this scenario, the primary migration-store location is specified on the command line, and should be the operating-system volume. Migration stores with identical names and directory names are created on every volume containing data being migrated. For example: - ```cmd + ```cmd ScanState.exe /hardlink c:\USMTMIG […] ``` -Running this command on a system that contains the operating system on the C: drive and the user data on the D: drive will generate migration stores in the following locations, assuming that both drives are NTFS: +Running this command on a system that contains the operating system on the C: drive and the user data on the D: drive generates migration stores in the following locations, assuming that both drives are NTFS: `C:\USMTMIG\` `D:\USMTMIG\` -The drive you specify on the command line for the hard-link migration store is important, because it defines where the **master migration store** should be placed. The **master migration store** is the location where data migrating from non-NTFS volumes is stored. This volume must have enough space to contain all of the data that comes from non-NTFS volumes. As in other scenarios, if a migration store already exists at the specified path, the `/o` option must be used to overwrite the existing data in the store. +The drive specified on the command line for the hard-link migration store is important, because it defines where the **master migration store** should be placed. The **master migration store** is the location where data migrating from non-NTFS volumes is stored. This volume must have enough space to contain all of the data that comes from non-NTFS volumes. As in other scenarios, if a migration store already exists at the specified path, the `/o` option must be used to overwrite the existing data in the store. ### Location modifications -Location modifications that redirect migrated content from one volume to a different volume have an adverse impact on the performance of a hard-link migration. This impact is because the migrating data that must cross system volumes can't remain in the hard-link migration store, and must be copied across the system volumes. +Location modifications that redirect migrated content from one volume to a different volume have an adverse effect on the performance of a hard-link migration. Performance is affected because the migrating data that must cross system volumes can't remain in the hard-link migration store. They must be copied across the system volumes. ### Migrating Encrypting File System (EFS) certificates and files To migrate Encrypting File System (EFS) files to a new installation of an operating system on the same volume of the computer, specify the `/efs:hardlink` option in the `ScanState.exe` command-line syntax. -If the EFS files are being restored to a different partition, you should use the `/efs:copyraw` option instead of the `/efs:hardlink` option. Hard links can only be created for files on the same volume. Moving the files to another partition during the migration requires a copy of the files to be created on the new partition. The `/efs:copyraw` option will copy the files to the new partition in encrypted format. +If the EFS files are being restored to a different partition, the `/efs:copyraw` option should be used instead of the `/efs:hardlink` option. Hard links can only be created for files on the same volume. Moving the files to another partition during the migration requires a copy of the files to be created on the new partition. The `/efs:copyraw` option copies the files to the new partition in encrypted format. For more information, see [Migrate EFS files and certificates](usmt-migrate-efs-files-and-certificates.md) and [Encrypted file options](usmt-scanstate-syntax.md#encrypted-file-options). ### Migrating locked files with the hard-link migration store -Files that are locked by an application or the operating system are handled differently when using a hard-link migration store. +When an application or the operating system has a lock on a file, the file is handled differently when using a hard-link migration store. -Files that are locked by the operating system can't remain in place and must be copied into the hard-link migration store. As a result, selecting many operating-system files for migration significantly reduces performance during a hard-link migration. As a best practice, we recommend that you don't migrate any files out of the `\Windows` directory, which minimizes performance-related issues. +Operating system locked files can't remain in place and must be copied into the hard-link migration store. As a result, selecting many operating-system files for migration significantly reduces performance during a hard-link migration. As a best practice, Microsoft recommends not migrating any files out of the `\Windows` directory, which minimizes performance-related issues. -Files that are locked by an application are treated the same in hard-link migrations as in other scenarios when the volume shadow-copy service isn't being utilized. The volume shadow-copy service can't be used with hard-link migrations. However, by modifying the new **<HardLinkStoreControl>** section in the `Config.xml` file, it's possible to enable the migration of files locked by an application. +Application locked files are treated the same in hard-link migrations as in other scenarios when the volume shadow-copy service isn't being utilized. The volume shadow-copy service can't be used with hard-link migrations. However, by modifying the new **\** section in the `Config.xml` file, it's possible to enable the migration of files locked by an application. > [!IMPORTANT] -> There are some scenarios in which modifying the **<HardLinkStoreControl>** section in the `Config.xml` file makes it more difficult to delete a hard-link migration store. In these scenarios, you must use `UsmtUtils.exe` to schedule the migration store for deletion on the next restart. +> +> There are some scenarios in which modifying the **\** section in the `Config.xml` file makes it more difficult to delete a hard-link migration store. In these scenarios, `UsmtUtils.exe` must be used to schedule the migration store for deletion on the next restart. ## XML elements in the Config.xml file @@ -132,14 +147,15 @@ A new section in the `Config.xml` file allows optional configuration of some of | Element | Description | |--- |--- | -| **<Policies>** | This element contains elements that describe the policies that USMT follows while creating a migration store. | -| **<HardLinkStoreControl>** | This element contains elements that describe how to handle files during the creation of a hard link migration store. | -| **<fileLocked>** | This element contains elements that describe how to handle files that are locked for editing. | -| **<createHardLink>** | This element defines a standard MigXML pattern that describes file paths where hard links should be created, even if the file is locked for editing by another application.

Syntax: `` [pattern] `` | -| **<errorHardLink>** | This element defines a standard MigXML pattern that describes file paths where hard links shouldn't be created, if the file is locked for editing by another application.

`` [pattern] `` | +| **\** | This element contains elements that describe the policies that USMT follows while creating a migration store. | +| **\** | This element contains elements that describe how to handle files during the creation of a hard link migration store. | +| **\** | This element contains elements that describe how to handle files that are locked for editing. | +| **\** | This element defines a standard MigXML pattern that describes file paths where hard links should be created, even if the file is locked for editing by another application.

Syntax: `` [pattern] `` | +| **\** | This element defines a standard MigXML pattern that describes file paths where hard links shouldn't be created, if the file is locked for editing by another application.

`` [pattern] `` | > [!IMPORTANT] -> You must use the `/nocompress` option with the `/HardLink` option. +> +> The `/nocompress` option must be used with the `/HardLink` option. The following XML sample specifies that files locked by an application under the `\Users` directory can remain in place during the migration. It also specifies that locked files that aren't located in the `\Users` directory should result in the **File in Use** error. It's important to exercise caution when specifying the paths using the **``** tag in order to minimize scenarios that make the hard-link migration store more difficult to delete. @@ -156,4 +172,4 @@ The following XML sample specifies that files locked by an application under the ## Related articles -[Plan your migration](usmt-plan-your-migration.md) +- [Plan the migration](usmt-plan-your-migration.md). diff --git a/windows/deployment/usmt/usmt-how-it-works.md b/windows/deployment/usmt/usmt-how-it-works.md index 751bdc54ee..d104178d52 100644 --- a/windows/deployment/usmt/usmt-how-it-works.md +++ b/windows/deployment/usmt/usmt-how-it-works.md @@ -1,75 +1,78 @@ --- -title: How USMT Works (Windows 10) +title: How USMT Works description: Learn how USMT works and how it includes two tools that migrate settings and data - ScanState and LoadState. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.date: 11/01/2022 +ms.date: 01/09/2024 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # How USMT works USMT includes two tools that migrate settings and data: **ScanState** and **LoadState**. **ScanState** collects information from the source computer, and **LoadState** applies that information to the destination computer. -- [How USMT works](#how-usmt-works) - - [The ScanState process](#the-scanstate-process) - - [The LoadState process](#the-loadstate-process) - - [Related articles](#related-articles) - - > [!NOTE] - > For more information about how USMT processes the rules and the XML files, see [Conflicts and precedence](usmt-conflicts-and-precedence.md). +> [!NOTE] +> +> For more information about how USMT processes the rules and the XML files, see [Conflicts and precedence](usmt-conflicts-and-precedence.md). ## The ScanState process -When you run the **ScanState** tool on the source computer, it goes through the following process: +When the **ScanState** tool runs on the source computer, it goes through the following process: 1. It parses and validates the command-line parameters, creates the `ScanState.log` file, and then begins logging. -2. It collects information about all of the migration components that need to be migrated. A *migration component* is a logical group of files, registry keys, and values. For example, the set of files, registry keys, and values that store the settings of Adobe Acrobat is grouped into a single migration component. +1. It collects information about all of the migration components that need to be migrated. A *migration component* is a logical group of files, registry keys, and values. For example, the set of files, registry keys, and values that store the settings of Adobe Acrobat is grouped into a single migration component. There are three types of components: - - Components that migrate the operating system settings + - Components that migrate the operating system settings. - - Components that migrate application settings + - Components that migrate application settings. - - Components that migrate users' files + - Components that migrate users' files. - The **ScanState** tool collects information about the application settings and user data components from the .xml files that are specified on the command line. + The **ScanState** tool collects information about the application settings and user data components from the **.xml** files that are specified on the command line. - In Windows 7, and Windows 8, the manifest files control how the operating-system settings are migrated. You can't modify these files. If you want to exclude certain operating-system settings, you must create and modify a `Config.xml` file. + In currently supported versions of Windows, the manifest files control how the operating-system settings are migrated. These files can't be modified. To exclude certain operating-system settings, a `Config.xml` file must be created and modified. -3. **ScanState** determines which user profiles should be migrated. By default, all user profiles on the source computer are migrated. However, you can include and exclude users using the User Options. The public profile in a source computer running Windows 7, Windows 8, and Windows 10 is always migrated, and you can't exclude these profiles from the migration. +1. **ScanState** determines which user profiles should be migrated. By default, all user profiles on the source computer are migrated. However, users can be included and excluded using the [User options](usmt-scanstate-syntax.md#user-options). The System profile and the Public profile in a source computer running currently supported versions of Windows is always migrated, and these profiles can't be excluded from the migration. -4. In the **Scanning** phase, **ScanState** does the following for each user profile selected for migration: +1. In the **Scanning** phase, **ScanState** does the following for each user profile selected for migration: 1. For each component, **ScanState** checks the type of the component. If the current user profile is the system profile and the component type is **System** or **UserAndSystem**, the component is selected for this user. Otherwise, the component is ignored. Alternatively, if the current user profile isn't the system profile and the component type is **User** or **UserAndSystem**, the component is selected for this user. Otherwise, this component is ignored. > [!NOTE] - > From this point on, **ScanState** does not distinguish between components that migrate operating-system settings, those that migrate application settings, and those that migrate users' files. **ScanState** processes all components in the same way. + > + > From this point on, **ScanState** doesn't distinguish between components that migrate operating-system settings, components that migrate application settings, and components that migrate users' files. **ScanState** processes all components in the same way. - 2. Each component that is selected in the previous step is processed further. Any profile-specific variables (such as **CSIDL_PERSONAL**) are evaluated in the context of the current profile. For example, if the profile that is being processed belongs to **User1**, then **CSIDL_PERSONAL** would expand to `C:\Users\User1\Documents`, assuming that the user profiles are stored in the `C:\Users` directory. + 1. Each component that is selected in the previous step is processed further. Any profile-specific variables (such as **CSIDL_PERSONAL**) are evaluated in the context of the current profile. For example, if the profile that is being processed belongs to **User1**, then **CSIDL_PERSONAL** would expand to `C:\Users\User1\Documents`, assuming that the user profiles are stored in the `C:\Users` directory. - 3. For each selected component, **ScanState** evaluates the **<detects>** section. If the condition in the **<detects>** section evaluates to false, the component isn't processed any further. Otherwise, the processing of this component continues. + 1. For each selected component, **ScanState** evaluates the **\** section. If the condition in the **\** section evaluates to false, the component isn't processed any further. Otherwise, the processing of this component continues. - 4. For each selected component, **ScanState** evaluates the **<rules>** sections. For each **<rules>** section, if the current user profile is the system profile and the context of the **<rules>** section is **System** or **UserAndSystem**, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile isn't the system profile and the context of the **<rules>** section is **User** or **UserAndSystem**, the rule is processed further. Otherwise, this rule is ignored. + 1. For each selected component, **ScanState** evaluates the **\** sections. For each **\** section, if the current user profile is the system profile and the context of the **\** section is **System** or **UserAndSystem**, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile isn't the system profile and the context of the **\** section is **User** or **UserAndSystem**, the rule is processed further. Otherwise, this rule is ignored. - 5. **ScanState** creates a list of migration units that need to be migrated by processing the various subsections under this **<rules>** section. Each unit is collected if it's mentioned in an **<include>** subsection, as long as there isn't a more specific rule for it in an **<exclude>** subsection in the same **<rules>** section. For more information about precedence in the .xml files, see [Conflicts and precedence](usmt-conflicts-and-precedence.md). + 1. **ScanState** creates a list of migration units that need to be migrated by processing the various subsections under this **\** section. Each unit is collected if the unit is mentioned in an **\** subsection, as long as there isn't a more specific rule for it in an **\** subsection in the same **\** section. For more information about precedence in the **.xml** files, see [Conflicts and precedence](usmt-conflicts-and-precedence.md). - In addition, any migration unit (such as a file, registry key, or set of registry values) that is in an <UnconditionalExclude> section isn't migrated. + In addition, any migration unit (such as a file, registry key, or set of registry values) that is in an \ section isn't migrated. > [!NOTE] - > **ScanState** ignores some subsections such as <destinationCleanup> and <locationModify>. These sections are evaluated only on the destination computer. + > + > **ScanState** ignores some subsections such as \ and \. These sections are evaluated only on the destination computer. -5. In the **Collecting** phase, **ScanState** creates a master list of the migration units by combining the lists that were created for each selected user profile. +1. In the **Collecting** phase, **ScanState** creates a central list of the migration units by combining the lists that were created for each selected user profile. -6. In the **Saving** phase, **ScanState** writes the migration units that were collected to the store location. +1. In the **Saving** phase, **ScanState** writes the migration units that were collected to the store location. > [!NOTE] - > **ScanState** does not modify the source computer in any way. + > + > **ScanState** doesn't modify the source computer in any way. ## The LoadState process @@ -77,45 +80,48 @@ The **LoadState** process is similar to the **ScanState** process. The **ScanSta 1. **ScanState** parses and validates the command-line parameters, creates the `ScanState.log` file, and then begins logging. -2. **LoadState** collects information about the migration components that need to be migrated. +1. **LoadState** collects information about the migration components that need to be migrated. - **LoadState** obtains information for the application-settings components and user-data components from the migration .xml files that are specified by the `LoadState.exe` command. + **LoadState** obtains information for the application-settings components and user-data components from the migration **.xml** files that are specified by the `LoadState.exe` command. - In Windows 7, Windows 8, and Windows 10, the manifest files control how the operating-system settings are migrated. You can't modify these files. If you want to exclude certain operating-system settings, you must create and modify a `Config.xml` file. + In currently supported versions of Windows, the manifest files control how the operating-system settings are migrated. These files can't be modified. To exclude certain operating-system settings, a `Config.xml` file must be created and modified. -3. **LoadState** determines which user profiles should be migrated. By default, all user profiles present on the source computer are migrated. However, you can include and exclude users using the **User Options**. The system profile, the Public profile in a source computer running Windows 7, Windows 8, and Windows 10 is always migrated and you can't exclude these profiles from the migration. +1. **LoadState** determines which user profiles should be migrated. By default, all user profiles present on the source computer are migrated. However, users can be included and excluded using the [User options](usmt-loadstate-syntax.md#user-options). The System profile and the Public profile in a source computer running currently supported versions of Windows is always migrated and these profiles can't be excluded from the migration. - - If you're migrating local user accounts and if the accounts don't already exist on the destination computer, you must use the `/lac` command-line option. If you don't specify the `/lac` option, any local user accounts that aren't already present on the destination computer, aren't migrated. + - If local user accounts are being migrated and if the accounts don't already exist on the destination computer, the `/lac` command-line option must be used. If the `/lac` option isn't specified, any local user accounts that aren't already present on the destination computer, aren't migrated. - - The `/md` and `/mu` options are processed to rename the user profile on the destination computer, if they've been included when the `LoadState.exe` command was specified. + - When specified with the `LoadState.exe` command, the `/md` and `/mu` options are processed to rename the user profile on the destination computer. - For each user profile selected from the store, **LoadState** creates a corresponding user profile on the destination computer. The destination computer doesn't need to be connected to the domain for domain user profiles to be created. If USMT can't determine a domain, it attempts to apply the settings to a local account. For more information, see [Identify Users](usmt-identify-users.md). -4. In the **Scanning** phase, **LoadState** does the following for each user profile: +1. In the **Scanning** phase, **LoadState** does the following for each user profile: 1. For each component, **LoadState** checks the type of the component. If the current user profile is the system profile and the component type is **System** or **UserAndSystem**, the component is selected for this user. Otherwise, the component is ignored. Alternatively, if the current user profile isn't the system profile and the component type is **User** or **UserAndSystem**, the component is selected for this user. Otherwise, this component is ignored. > [!NOTE] - > From this point on, **LoadState** does not distinguish between components that migrate operating-system settings, those that migrate application settings, and those that migrate users' files. **LoadState** evaluates all components in the same way. + > + > From this point on, **LoadState** doesn't distinguish between components that migrate operating-system settings, components that migrate application settings, and components that migrate users' files. **LoadState** evaluates all components in the same way. - 2. Each component that is selected is processed further. Any profile-specific variables (such as **CSIDL_PERSONAL**) are evaluated in the context of the current profile. For example, if the profile being processed belongs to **User1**, then **CSIDL_PERSONAL** would expand to `C:\Users\User1\Documents` (assuming that the user profiles are stored in the `C:\Users` directory). + 1. Each component that is selected is processed further. Any profile-specific variables (such as **CSIDL_PERSONAL**) are evaluated in the context of the current profile. For example, if the profile being processed belongs to **User1**, then **CSIDL_PERSONAL** would expand to `C:\Users\User1\Documents` (assuming that the user profiles are stored in the `C:\Users` directory). > [!NOTE] - > **LoadState** ignores the **<detects>** section specified in a component. At this point, all specified components are considered to be detected and are selected for migration. + > + > **LoadState** ignores the **\** section specified in a component. At this point, all specified components are considered to be detected and are selected for migration. - 3. For each selected component, **LoadState** evaluates the **<rules>** sections. For each **<rules>** section, if the current user profile is the system profile and the context of the **<rules>** section is **System** or **UserAndSystem**, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile isn't the system profile and the context of the **<rules>** section is **User** or **UserAndSystem**, the rule is processed further. Otherwise, this rule is ignored. + 1. For each selected component, **LoadState** evaluates the **\** sections. For each **\** section, if the current user profile is the system profile and the context of the **\** section is **System** or **UserAndSystem**, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile isn't the system profile and the context of the **\** section is **User** or **UserAndSystem**, the rule is processed further. Otherwise, this rule is ignored. - 4. **LoadState** creates a master list of migration units by processing the various subsections under the **<rules>** section. Each migration unit that is in an **<include>** subsection is migrated as long, as there isn't a more specific rule for it in an **<exclude>** subsection in the same **<rules>** section. For more information about precedence, see [Conflicts and precedence](usmt-conflicts-and-precedence.md). + 1. **LoadState** creates a central list of migration units by processing the various subsections under the **\** section. Each migration unit that is in an **\** subsection is migrated as long, as there isn't a more specific rule for it in an **\** subsection in the same **\** section. For more information about precedence, see [Conflicts and precedence](usmt-conflicts-and-precedence.md). - 5. **LoadState** evaluates the destination computer-specific subsections, for example, the **<destinationCleanup>** and **<locationModify>** subsections. + 1. **LoadState** evaluates the destination computer-specific subsections, for example, the **\** and **\** subsections. - 6. If the destination computer is running Windows 7, Windows 8, or Windows 10, then the migunits that were collected by **ScanState** using downlevel manifest files are processed by **LoadState** using the corresponding Component Manifest for Windows 7. The downlevel manifest files aren't used during **LoadState**. + 1. If the destination computer is running a currently supported version of Windows, then the migunits that were collected by **ScanState** using downlevel manifest files are processed by **LoadState** using the corresponding Component Manifest from the downlevel Windows version. The downlevel manifest files aren't used during **LoadState**. > [!IMPORTANT] - > It is important to specify the .xml files with the `LoadState.exe` command if you want **LoadState** to use them. Otherwise, any destination-specific rules, such as **<locationModify>**, in these .xml files are ignored, even if the same .xml files were provided when the `ScanState.exe` command ran. + > + > For **LoadState** to use the **.xml** files, it's important to specify them with the `LoadState.exe` command. Otherwise, any destination-specific rules, such as **\**, in these **.xml** files are ignored, even if the same **.xml** files were provided when the `ScanState.exe` command ran. -5. In the **Apply** phase, **LoadState** writes the migration units that were collected to the various locations on the destination computer. If there are conflicts and there isn't a **<merge>** rule for the object, the default behavior for the registry is for the source to overwrite the destination. The default behavior for files is for the source to be renamed incrementally, for example, OriginalFileName(1).OriginalExtension. Some settings, such as fonts, wallpaper, and screen-saver settings, don't take effect until the next time the user logs on. For this reason, you should sign out when the `LoadState.exe` command actions have completed. +1. In the **Apply** phase, **LoadState** writes the migration units that were collected to the various locations on the destination computer. If there are conflicts and there isn't a **\** rule for the object, the default behavior for the registry is for the source to overwrite the destination. The default behavior for files is for the source to be renamed incrementally, for example, OriginalFileName(1).OriginalExtension. Some settings, such as fonts, wallpaper, and screen-saver settings, don't take effect until the next time the user logs on. For this reason, sign out when the `LoadState.exe` command actions are finished. ## Related articles -[User State Migration Tool (USMT) command-line syntax](usmt-command-line-syntax.md) +- [User State Migration Tool (USMT) command-line syntax](usmt-command-line-syntax.md). diff --git a/windows/deployment/usmt/usmt-how-to.md b/windows/deployment/usmt/usmt-how-to.md index 0b38e19dbe..ec174c6783 100644 --- a/windows/deployment/usmt/usmt-how-to.md +++ b/windows/deployment/usmt/usmt-how-to.md @@ -1,34 +1,38 @@ --- -title: User State Migration Tool (USMT) How-to articles (Windows 10) -description: Reference the articles in this article to learn how to use User State Migration Tool (USMT) 10.0 to perform specific tasks. +title: User State Migration Tool (USMT) How-to articles +description: Reference the articles in this article to learn how to use User State Migration Tool (USMT) to perform specific tasks. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # User State Migration Tool (USMT) how-to articles -The following table lists articles that describe how to use User State Migration Tool (USMT) 10.0 to perform specific tasks. +The following table lists articles that describe how to use User State Migration Tool (USMT) to perform specific tasks. ## In this section | Link | Description | |------ |----------- | -|[Exclude files and settings](usmt-exclude-files-and-settings.md)|Create a custom .xml file to exclude files, file types, folders, or registry settings from your migration.| +|[Exclude files and settings](usmt-exclude-files-and-settings.md)|Create a custom **.xml** file to exclude files, file types, folders, or registry settings from the migration.| |[Extract files from a compressed USMT migration store](usmt-extract-files-from-a-compressed-migration-store.md)|Recover files from a compressed migration store after installing the operating system.| -|[Include files and settings](usmt-include-files-and-settings.md)|Create a custom .xml file to include files, file types, folders, or registry settings in your migration.| -|[Migrate application settings](migrate-application-settings.md)|Migrate the settings of an application that the MigApp.xml file doesn't include by default.| +|[Include files and settings](usmt-include-files-and-settings.md)|Create a custom **.xml** file to include files, file types, folders, or registry settings in the migration.| +|[Migrate application settings](migrate-application-settings.md)|Migrate the settings of an application that the `MigApp.xml` file doesn't include by default.| |[Migrate EFS files and certificates](usmt-migrate-efs-files-and-certificates.md)|Migrate Encrypting File System (EFS) certificates by using USMT.| -|[Migrate user accounts](usmt-migrate-user-accounts.md)|Specify the users to include and exclude in your migration.| -|[Reroute files and settings](usmt-reroute-files-and-settings.md)|Create a custom .xml file to reroute files and settings during a migration.| +|[Migrate user accounts](usmt-migrate-user-accounts.md)|Specify the users to include and exclude in the migration.| +|[Reroute files and settings](usmt-reroute-files-and-settings.md)|Create a custom **.xml** file to reroute files and settings during a migration.| |[Verify the condition of a compressed migration store](verify-the-condition-of-a-compressed-migration-store.md)|Determine whether a compressed migration store is intact, or whether it contains corrupt files or a corrupt catalog.| ## Related articles -- [User State Migration Tool (USMT) overview topics](usmt-topics.md) -- [User State Migration Tool (USMT) troubleshooting](usmt-troubleshooting.md) -- [User State Migration Toolkit (USMT) reference](usmt-reference.md) +- [User State Migration Tool (USMT) overview topics](usmt-topics.md). +- [User State Migration Tool (USMT) troubleshooting](usmt-troubleshooting.md). +- [User State Migration Toolkit (USMT) reference](usmt-reference.md). diff --git a/windows/deployment/usmt/usmt-identify-application-settings.md b/windows/deployment/usmt/usmt-identify-application-settings.md index 101e8b5666..493e1d8149 100644 --- a/windows/deployment/usmt/usmt-identify-application-settings.md +++ b/windows/deployment/usmt/usmt-identify-application-settings.md @@ -1,30 +1,34 @@ --- -title: Identify Applications Settings (Windows 10) -description: Identify which applications and settings you want to migrate before using the User State Migration Tool (USMT). +title: Identify Applications Settings +description: Identify which applications and settings need to be migrated before using the User State Migration Tool (USMT). +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Identify applications settings -When planning for your migration, you should identify which applications and settings you want to migrate. For more information about how to create a custom .xml file to migrate the settings of another application, see [Customize USMT XML files](usmt-customize-xml-files.md). +Which applications and settings need to be migrated should be identified when planning a migration. For more information about how to create a custom **.xml** file to migrate the settings of another application, see [Customize USMT XML files](usmt-customize-xml-files.md). ## Applications -First, create and prioritize a list of applications that need to be migrated. It may be helpful to review the application lists and decide which applications will be redeployed and which applications will be retired. Often, what applications are migrated are prioritized based on a combination of how widely the application is used and how complex the application is. +First, create and prioritize a list of applications that need to be migrated. It might be helpful to review the application lists and decide which applications need to be redeployed and which applications need to be retired. Often, how the application is used and how complex the application is determines the priority of what applications are migrated. -Next, identify an application owner to be in charge of each application. Application ownership identification is necessary because the developers won't be experts on all of the applications in the organization. The application owner should have the most experience with an application. The application owner provides insight into how the organization installs, configures, and uses the application. +Next, identify an application owner to be in charge of each application. Application ownership identification is necessary because the developers aren't be experts on all of the applications in the organization. The application owner should have the most experience with an application. The application owner provides insight into how the organization installs, configures, and uses the application. ## Application settings -Next, determine and locate the application settings to be migrated. You can acquire much of the information that you need for this step when you're testing the new applications for compatibility with the new operating system. +Next, determine and locate the application settings to be migrated. Much of the information that is needed for this step can be acquired when testing the new applications for compatibility with the new operating system. -After completing the list of applications to be migrated, review the list, and work with each application owner on a list of settings to be migrated. For each setting, determine whether it needs to be migrated or if the default settings are adequate. Then, determine where the setting is located, for example, in the registry or in an .ini file. Next, consider the following questions to determine what needs to be done to migrate the setting successfully: +After completing the list of applications to be migrated, review the list, and work with each application owner on a list of settings to be migrated. For each setting, determine whether it needs to be migrated or if the default settings are adequate. Then, determine where the setting is located, for example, in the registry or in an **.ini** file. Next, consider the following questions to determine what needs to be done to migrate the setting successfully: - Is the destination version of the application newer than the source version? @@ -32,9 +36,9 @@ After completing the list of applications to be migrated, review the list, and w - Do the settings need to be moved or altered? -- Can the first-run process force the application to appear as if it had run already? If so, does this work correctly, or does it break the application? +- Can the first-run process force the application to appear as if it ran already? If so, does this work correctly, or does it break the application? -After answering these questions, create a custom .xml file to migrate settings. Work with the application owner to develop test cases and to determine the file types that need to be migrated for the application. +After answering these questions, create a custom **.xml** file to migrate settings. Work with the application owner to develop test cases and to determine the file types that need to be migrated for the application. ## Locating where settings are stored @@ -42,4 +46,4 @@ See [Migrate application settings](migrate-application-settings.md) and follow t ## Related articles -[Determine what to migrate](usmt-determine-what-to-migrate.md) +- [Determine what to migrate](usmt-determine-what-to-migrate.md). diff --git a/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md b/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md index 049a88b921..54fbd98fbd 100644 --- a/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md +++ b/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md @@ -1,40 +1,45 @@ --- -title: Identify File Types, Files, and Folders (Windows 10) -description: Learn how to identify the file types, files, folders, and settings that you want to migrate when you're planning your migration. +title: Identify File Types, Files, and Folders +description: Identify the file types, files, folders, and settings that need to be migrated when planning the migration. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Identify file types, files, and folders -When planning for your migration, if not using MigDocs.xml, you should identify the file types, files, folders, and settings that you want to migrate. First, you should determine the standard file locations on each computer, such as **My Documents** , `C:\Data` , and company-specified locations, such as `\\EngineeringDrafts`. Next, you should determine and locate the non-standard locations. For non-standard locations, consider the following items: +When a migration is planned and `MigDocs.xml` isn't being used, the file types, files, folders, and settings that need to be migrated should be identified. First, the standard file locations on each computer, such as the **Documents** folder, `C:\Data` , and organization-specified locations, such as `\\EngineeringDrafts`, should be determined. Next, non-standard locations should be determined and located. For non-standard locations, consider the following items: -- **File types**. Consider which file types need to be included and excluded from the migration. You can create this list based on common applications used in your organization. Applications normally use specific file name extensions. For example, Microsoft Office Word primarily uses `.doc`, `.docx` and `.dotx` file name extension. However, it also uses other file types, such as templates (`.dot` files), on a less frequent basis. +- **File types**: Consider which file types need to be included and excluded from the migration. This list can be created based on common applications used in the organization. Applications normally use specific file name extensions. For example, Microsoft Office Word primarily uses `.doc`, `.docx` and `.dotx` file name extension. However, it also uses other file types, such as templates (`.dot` files), on a less frequent basis. -- **Excluded locations**. Consider the locations on the computer that should be excluded from the migration (for example, `%WINDIR%` and **Program Files**). +- **Excluded locations**: Consider the locations on the computer that should be excluded from the migration (for example, `%WINDIR%` and **Program Files**). -- **New locations**. Decide where files should be migrated to on the destination computer, such as **My Documents**, a designated folder, or a folder matching the files' name and location on the source computer. For example, you might have shared data on source machine or you might wish to clean up documents outside the user profiles on the source system. Identify any data that needs to be redirected to a new location in the apply phase. Redirection can be accomplished with location modify rules. +- **New locations**: Decide where files should be migrated to on the destination computer, such as the **Documents** folder, a designated folder, or a folder matching the files' name and location on the source computer. For example, shared data might exist on the source machine or documents outside the user profiles on the source system might need to be cleaned up. Identify any data that needs to be redirected to a new location in the Apply phase. Redirection can be accomplished with location modify rules. -Once you've verified which files and file types that the end users work with regularly, you'll need to locate them. Files may be saved to a single folder or scattered across a drive. A good starting point for finding files types to include is to look at the registered file types on the computer. +Once which files and file types that the end users work with regularly is verified, locate the files and file types. Files might be saved to a single folder or scattered across a drive. A good starting point for finding files types to include is to look at the registered file types on the computer. -To find the registered file types on a computer running Windows 7, Windows 8, Windows 10, or Windows 11: +To find the registered file types on a computer running a currently supported version of Windows: -1. Open **Control Panel** -2. Make sure **View by:** is set to **Category** and then select **Programs**. +1. Right-click the **Start Menu** and select **Settings**. -3. Select **Default Programs** +1. When the **Settings** window opens, select **Apps**. -4. select **Associate a file type or protocol with a program**. +1. Select **Default apps**. -5. On this screen, the registered file types are displayed. +1. Scroll down and then select **Choose defaults by file type** or **Choose default apps by file type**. -For more information about how to change the file types, files, and folders that are migrated when you specify the MigUser.xml file, see [User State Migration Tool (USMT) how-to topics](usmt-how-to.md). +1. In the window that opens, the registered file types are displayed. + +For more information about how to change the file types, files, and folders that are migrated when the `MigUser.xml` file is specified, see [User State Migration Tool (USMT) how-to articles](usmt-how-to.md). ## Related articles -[Determine what to migrate](usmt-determine-what-to-migrate.md) +- [Determine what to migrate](usmt-determine-what-to-migrate.md). diff --git a/windows/deployment/usmt/usmt-identify-operating-system-settings.md b/windows/deployment/usmt/usmt-identify-operating-system-settings.md index 6781531b60..3d88e65fb7 100644 --- a/windows/deployment/usmt/usmt-identify-operating-system-settings.md +++ b/windows/deployment/usmt/usmt-identify-operating-system-settings.md @@ -1,44 +1,65 @@ --- -title: Identify Operating System Settings (Windows 10) -description: Identify which system settings you want to migrate, then use the User State Migration Tool (USMT) to select settings and keep the default values for all others. +title: Identify Operating System Settings +description: Identify which system settings need to be migrated. The User State Migration Tool (USMT) can then be used to select settings and keep the default values for all others. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Identify operating system settings -When planning for your migration, you should identify which operating system settings you want to migrate and to what extent you want to create a new standard environment on each of the computers. User State Migration Tool (USMT) 10.0 enables you to migrate select settings and keep the default values for all others. The operating system settings include the following parameters: +When the migration is being planned, which operating system settings need to be migrated should be identified. Additionally, to what extent a new standard environment should be created on each of the computers should also be identified. User State Migration Tool (USMT) enables migrating select settings and keep the default values for all others. The operating system settings include the following parameters: - **Appearance** - The appearance factor includes items such as wallpaper, colors, sounds, and the location of the taskbar. + The appearance factor includes items such as wallpaper, colors, sounds, and the location of the taskbar. - **Action** - The action factor includes items such as the key-repeat rate, whether double-clicking a folder opens it in a new window or the same window, and whether you need to single-click or double-click an item to open it. + The action factor includes items such as: + + - The key-repeat rate. + - Whether double-clicking a folder opens it in a new window or the same window. + - Whether single-clicking or double-clicking an item opens it. - **Internet** - The Internet factor includes the settings that let you connect to the Internet and control how your browser operates. The settings include items such as your home page URL, favorites, bookmarks, cookies, security settings, dial-up connections, and proxy settings. + The Internet factor includes the settings needed to connect to the Internet and controls how the browser operates. The settings include items such as the home page URL, favorites, bookmarks, cookies, security settings, and proxy settings. These settings might not be supported in all browsers. - **Mail** - The mail factor includes the information that you need to connect to your mail server, your signature file, views, mail rules, local mail, and contacts. + The mail factor includes the information needed to connect the mail server, the signature file, views, mail rules, local mail, and contacts. These settings might not be supported in all email applications. -To help you decide which settings to migrate, you should consider any previous migration experiences and the results of any surveys and tests that you've conducted. You should also consider the number of help-desk calls related to operating-system settings that you've had in the past, and are able to handle in the future. Also decide how much of the new operating-system functionality you want to take advantage of. +To help determine which settings to migrate, consider any previous migration experiences and the results of any conducted surveys and tests. Also consider the number of help-desk calls related to operating-system settings from the past, and are able to handle in the future. Also decide how much of the new operating-system functionality needs to be taken advantage of. -You should migrate any settings that users need to get their jobs done, those settings that make the work environment comfortable, and those settings that will reduce help-desk calls after the migration. Although it's easy to dismiss migrating user preferences, you should consider the factor of users spending a significant amount of time restoring items such as wallpaper, screen savers, and other customizable user-interface features. Most users don't remember how these settings were applied. Although these items aren't critical to migration success, migrating these items increases user productivity and overall satisfaction of the migration process. +Settings that should be migrated include: + +- Settings that allow users need to get their jobs done. +- Settings that make the work environment comfortable. +- Settings that will reduce help-desk calls after the migration. + +Although it's easy to dismiss migrating user preferences, the factor should be considered of users spending time restoring items such as: + +- Wallpaper. +- Screen savers. +- Other customizable user-interface features. + +Most users don't remember how these settings were applied. Although these items aren't critical to migration success, migrating these items increases user productivity and overall satisfaction of the migration process. > [!NOTE] -> For more information about how to change the operating-system settings that are migrated, see [User State Migration Tool (USMT) how-to topics](usmt-how-to.md). +> +> For more information about how to change the operating-system settings that are migrated, see [User State Migration Tool (USMT) how-to articles](usmt-how-to.md). For information about the operating-system settings that USMT migrates, see [What does USMT migrate?](usmt-what-does-usmt-migrate.md) ## Related articles -[Determine What to Migrate](usmt-determine-what-to-migrate.md) +- [Determine What to Migrate](usmt-determine-what-to-migrate.md). diff --git a/windows/deployment/usmt/usmt-identify-users.md b/windows/deployment/usmt/usmt-identify-users.md index 40a4f58cb6..012922be11 100644 --- a/windows/deployment/usmt/usmt-identify-users.md +++ b/windows/deployment/usmt/usmt-identify-users.md @@ -1,6 +1,7 @@ --- -title: Identify Users (Windows 10) -description: Learn how to identify users you plan to migrate, and how to migrate local accounts and domain accounts. +title: Identify Users +description: Learn how to identify users that need to be migrated, and how to migrate local accounts and domain accounts. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client @@ -8,25 +9,29 @@ author: frankroj ms.topic: article ms.localizationpriority: medium ms.technology: itpro-deploy -ms.date: 11/01/2022 +ms.date: 01/09/2024 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Identify users -It's important to carefully consider how you plan to migrate users. By default, all users are migrated by User State Migration Tool (USMT) 5.0. You must specify which users to include by using the command line. You can't specify users in the .xml files. For instructions on how to migrate users, see [Migrate user accounts](usmt-migrate-user-accounts.md). +It's important to carefully consider and plan how users are migrated. By default, User State Migration Tool (USMT) migrates all users. Which users to include must be specified by using the command line. Users can't be specified in the **.xml** files. For instructions on how to migrate users, see [Migrate user accounts](usmt-migrate-user-accounts.md). ## Migrating local accounts Before migrating local accounts, be aware of the following items: -- **You must explicitly specify that local accounts that are not on the destination computer should be migrated**. If you're migrating local accounts and the local account doesn't exist on the destination computer, you must use the `/lac` option when using the `LoadState.exe` command. If the `/lac` option isn't specified, no local user accounts will be migrated. +- **Local accounts that aren't on the destination computer must be explicitly specified if they should be migrated.** If migrating local accounts and the local account doesn't exist on the destination computer, the `/lac` option must be specified when using the `LoadState.exe` command. If the `/lac` option isn't specified, no local user accounts are migrated. -- **Consider whether to enable user accounts that are new to the destination computer.** The `/lae` option enables the account that was created with the `/lac` option. However, if you create a disabled local account by using only the `/lac` option, a local administrator must enable the account on the destination computer. +- **Consider whether to enable user accounts that are new to the destination computer.** The `/lae` option enables the account that was created with the `/lac` option. However, if a disabled local account is created by using only the `/lac` option, a local administrator must enable the account on the destination computer. -- **Be careful when specifying a password for local accounts.** If you create the local account with a blank password, anyone could sign in that account on the destination computer. If you create the local account with a password, the password is available to anyone with access to the USMT command-line tools. +- **Be careful when specifying a password for local accounts.** If the local account is created with a blank password, anyone could sign in that account on the destination computer. If the local account is created with a password, the password is available to anyone with access to the USMT command-line tools. > [!NOTE] -> If there are multiple users on a computer, and you specify a password with the `/lac` option, all migrated users will have the same password. +> +> If there are multiple users on a computer, and a password is specified with the `/lac` option, all migrated users have the same password. ## Migrating domain accounts @@ -36,22 +41,24 @@ The source and destination computers don't need to be connected to the domain fo USMT provides several options to migrate multiple users on a single computer. The following command-line options specify which users to migrate. -- **Specifying users.** You can specify which users to migrate with the `/all`, `/ui`, `/uel`, and `/ue` options with both the **ScanState** and **LoadState** command-line tools. +- **Specifying users.** Which users to migrate can be specified with the `/all`, `/ui`, `/uel`, and `/ue` options with both the **ScanState** and **LoadState** command-line tools. > [!IMPORTANT] - > The `/uel` option excludes users based on the **LastModified** date of the `Ntuser.dat` file. The `/uel` option is not valid in offline migrations. + > + > The `/uel` option excludes users based on the **LastModified** date of the `Ntuser.dat` file. The `/uel` option isn't valid in offline migrations. -- **Moving users to another domain.** You can move user accounts to another domain using the `/md` option with the **LoadState** command-line tool. +- **Moving users to another domain.** User accounts can be moved to another domain using the `/md` option with the **LoadState** command-line tool. -- **Creating local accounts.** You can create and enable local accounts using the `/lac` and `/lae` options with the **LoadState** command-line tool. +- **Creating local accounts.** Local accounts can be created and enabled using the `/lac` and `/lae` options with the **LoadState** command-line tool. -- **Renaming user accounts.** You can rename user accounts using the `/mu` option. +- **Renaming user accounts.** User accounts can be renamed using the `/mu` option. > [!NOTE] - >By default, if a user name is not specified in any of the command-line options, the user will be migrated. + > + > By default, if a user name isn't specified in any of the command-line options, the user is migrated. ## Related articles -- [Determine what to migrate](usmt-determine-what-to-migrate.md) -- [ScanState syntax](usmt-scanstate-syntax.md) -- [LoadState syntax](usmt-loadstate-syntax.md) +- [Determine what to migrate](usmt-determine-what-to-migrate.md). +- [ScanState syntax](usmt-scanstate-syntax.md). +- [LoadState syntax](usmt-loadstate-syntax.md). diff --git a/windows/deployment/usmt/usmt-include-files-and-settings.md b/windows/deployment/usmt/usmt-include-files-and-settings.md index 8e5821354c..1da15a3f4c 100644 --- a/windows/deployment/usmt/usmt-include-files-and-settings.md +++ b/windows/deployment/usmt/usmt-include-files-and-settings.md @@ -1,22 +1,26 @@ --- -title: Include Files and Settings (Windows 10) -description: Specify the migration .xml files you want, then use the User State Migration Tool (USMT) 10.0 to migrate the settings and components specified. +title: Include Files and Settings +description: Specify the migration .xml files that are needed, then use the User State Migration Tool (USMT) to migrate the settings and components specified. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Include Files and Settings -When you specify the migration .xml files, User State Migration Tool (USMT) 10.0 migrates the settings and components specified in [What does USMT migrate?](usmt-what-does-usmt-migrate.md). To include additional files and settings, we recommend that you create a custom .xml file, and then include this file when using both the `ScanState.exe` and `LoadState.exe` commands. By creating a custom .xml file, you can keep your changes separate from the default .xml files, which makes it easier to track your modifications. +When the migration **.xml** files are specified, User State Migration Tool (USMT) migrates the settings and components specified in [What does USMT migrate?](usmt-what-does-usmt-migrate.md). To include additional files and settings, Microsoft recommends creating a custom **.xml** file, and then include this file when using both the `ScanState.exe` and `LoadState.exe` commands. Creating a custom **.xml** file allows changes to be kept separate from the default **.xml** files. Creating a custom **.xml** file makes it easier to track modifications. ## Migrate a single registry key -The following .xml file migrates a single registry key. +The following **.xml** file migrates a single registry key. ```xml @@ -41,7 +45,7 @@ The following examples show how to migrate a folder from a specific drive, and f ### Migrate a folder from a specific drive -- **Including subfolders.** The following .xml file migrates all files and subfolders from `C:\EngineeringDrafts` to the destination computer. +- **Including subfolders.** The following **.xml** file migrates all files and subfolders from `C:\EngineeringDrafts` to the destination computer. ```xml @@ -60,7 +64,7 @@ The following examples show how to migrate a folder from a specific drive, and f ``` -- **Excluding subfolders.** The following .xml file migrates all files from `C:\EngineeringDrafts`, but it doesn't migrate any subfolders within `C:\EngineeringDrafts`. +- **Excluding subfolders.** The following **.xml** file migrates all files from `C:\EngineeringDrafts`, but it doesn't migrate any subfolders within `C:\EngineeringDrafts`. ```xml @@ -81,7 +85,7 @@ The following examples show how to migrate a folder from a specific drive, and f ### Migrate a folder from any location -The following .xml file migrates all files and subfolders of the `EngineeringDrafts` folder from any drive on the computer. If multiple folders exist with the same name, then all files with this name are migrated. +The following **.xml** file migrates all files and subfolders of the `EngineeringDrafts` folder from any drive on the computer. If multiple folders exist with the same name, then all files with this name are migrated. ```xml @@ -101,7 +105,7 @@ The following .xml file migrates all files and subfolders of the `EngineeringDra ``` -The following .xml file migrates all files and subfolders of the `EngineeringDrafts` folder from any location on the `C:\` drive. If multiple folders exist with the same name, they're all migrated. +The following **.xml** file migrates all files and subfolders of the `EngineeringDrafts` folder from any location on the `C:\` drive. If multiple folders exist with the same name, they're all migrated. ```xml @@ -123,12 +127,12 @@ The following .xml file migrates all files and subfolders of the `EngineeringDra ## Migrate a file type into a specific folder -The following .xml file migrates `.mp3` files located in the specified drives on the source computer into the `C:\Music` folder on the destination computer. +The following **.xml** file migrates `.mp3` files located in the specified drives on the source computer into the `C:\Music` folder on the destination computer. ```xml - All .mp3 files to My Documents + All .mp3 files to the Documents folder @@ -152,7 +156,7 @@ The following .xml file migrates `.mp3` files located in the specified drives on The following examples show how to migrate a file from a specific folder, and how to migrate a file from any location. -- **To migrate a file from a folder.** The following .xml file migrates only the `Sample.doc` file from `C:\EngineeringDrafts` on the source computer to the destination computer. +- **To migrate a file from a folder.** The following **.xml** file migrates only the `Sample.doc` file from `C:\EngineeringDrafts` on the source computer to the destination computer. ```xml @@ -171,13 +175,13 @@ The following examples show how to migrate a file from a specific folder, and ho ``` -- **To migrate a file from any location.** To migrate the `Sample.doc` file from any location on the `C:\` drive, use the **<pattern>** element, as the following example shows. If multiple files exist with the same name on the `C:\` drive, all of files with this name are migrated. +- **To migrate a file from any location.** To migrate the `Sample.doc` file from any location on the `C:\` drive, use the **\** element, as the following example shows. If multiple files exist with the same name on the `C:\` drive, all of files with this name are migrated. ```xml C:\* [Sample.doc] ``` - To migrate the Sample.doc file from any drive on the computer, use <script> as the following example shows. If multiple files exist with the same name, all files with this name are migrated. + To migrate the Sample.doc file from any drive on the computer, use \ as the following example shows. If multiple files exist with the same name, all files with this name are migrated. ```xml @@ -185,10 +189,7 @@ The following examples show how to migrate a file from a specific folder, and ho ## Related articles -[Customize USMT XML files](usmt-customize-xml-files.md) - -[Custom XML examples](usmt-custom-xml-examples.md) - -[Conflicts and precedence](usmt-conflicts-and-precedence.md) - -[USMT XML reference](usmt-xml-reference.md) +- [Customize USMT XML files](usmt-customize-xml-files.md). +- [Custom XML examples](usmt-custom-xml-examples.md). +- [Conflicts and precedence](usmt-conflicts-and-precedence.md). +- [USMT XML reference](usmt-xml-reference.md). diff --git a/windows/deployment/usmt/usmt-loadstate-syntax.md b/windows/deployment/usmt/usmt-loadstate-syntax.md index e5c04fe082..596f89f4fa 100644 --- a/windows/deployment/usmt/usmt-loadstate-syntax.md +++ b/windows/deployment/usmt/usmt-loadstate-syntax.md @@ -1,45 +1,45 @@ --- -title: LoadState Syntax (Windows 10) -description: Learn about the syntax and usage of the command-line options available when you use the LoadState command. +title: LoadState Syntax +description: Learn about the syntax and usage of the command-line options available when using the LoadState command. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # LoadState syntax -The `LoadState.exe` command is used with the User State Migration Tool (USMT) 10.0 to restore a store previously captured by the `ScanState.exe` command onto a destination computer. This article discusses the `LoadState.exe` command syntax and the options available with it. +The `LoadState.exe` command is used with the User State Migration Tool (USMT) to restore a store previously captured by the `ScanState.exe` command onto a destination computer. This article discusses the `LoadState.exe` command syntax and the options available with it. -## Before you begin +## Before beginning -Before you run the `LoadState.exe` command, note the following items: +Before running the `LoadState.exe` command, note the following items: -- To ensure that all operating system settings migrate, we recommend that you run the `LoadState.exe` commands in administrator mode from an account with administrative credentials. +- To ensure that all operating system settings migrate, Microsoft recommends running `LoadState.exe` commands in administrator mode from an account with administrative credentials. - For information about software requirements for running the `LoadState.exe` command, see [USMT requirements](usmt-requirements.md). -- You should sign out after you run the `LoadState.exe` command. Some settings, such as example, fonts, wallpaper, and screensaver settings, won't take effect until the next time the user logs in. +- Sign out after running the `LoadState.exe` command. Some settings, such as example, fonts, wallpaper, and screensaver settings, won't take effect until the next time the user logs in. -- Unless otherwise specified, you can use each option only once when running a tool on the command line. +- Unless otherwise specified, each option can only be used once when running a tool from the command line. -- **LoadState** doesn't require domain controller access to apply domain profiles. This functionality is available without any additional configuration. It isn't necessary for the source computer to have had domain controller access when the user profile was gathered using **ScanState**. However, domain profiles are inaccessible until the destination computer is joined to the domain. +- **LoadState** doesn't require domain controller access to apply domain profiles. This functionality is available without any additional configuration. It isn't necessary for the source computer to have domain controller access when the user profile was gathered using **ScanState**. However, domain profiles are inaccessible until the destination computer is joined to the domain. -- The [Incompatible command-line options](#incompatible-command-line-options) table lists which options you can use together and which command-line options are incompatible. +- The [Incompatible command-line options](#incompatible-command-line-options) table lists which options can be used together and which command-line options are incompatible. ## Syntax -This section explains the syntax and usage of the command-line options available when you use the `LoadState.exe` command. The options can be specified in any order. If the option contains a parameter, you can specify either a colon or space separator. +This section explains the syntax and usage of the command-line options available when using the `LoadState.exe` command. The options can be specified in any order. If the option contains a parameter, either a colon or space separator can be specified. The `LoadState.exe` command's syntax is: - - > LoadState.exe *StorePath* \[/i:\[*Path*\\\]*FileName*\] \[/v:*VerbosityLevel*\] \[/nocompress\] \[/decrypt /key:*KeyString*|/keyfile:\[Path\\\]*FileName*\] \[/l:\[*Path*\\\]*FileName*\] \[/progress:\[*Path*\\\]*FileName*\] \[/r:*TimesToRetry*\] \[/w:*SecondsToWait*\] \[/c\] \[/all\] \[/ui:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/ue:\[\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/uel:*NumberOfDays*|*YYYY/MM/DD*|0\] \[/md:*OldDomain*:*NewDomain*\] \[/mu:*OldDomain*\\*OldUserName*:\[*NewDomain*\\\]*NewUserName*\] \[/lac:\[*Password*\]\] \[/lae\] \[/config:\[*Path*\\\]*FileName*\] \[/?|help\] For example, to decrypt the store and migrate the files and settings to a computer, type the following command: @@ -48,58 +48,58 @@ For example, to decrypt the store and migrate the files and settings to a comput ## Storage options -USMT provides the following options that you can use to specify how and where the migrated data is stored. +USMT provides the following options that can be used to specify how and where the migrated data is stored. | Command-Line Option | Description | |--- |--- | -| **StorePath** | Indicates the folder where the files and settings data are stored. You must specify *StorePath* when using the `LoadState.exe` command. You can't specify more than one *StorePath*. | -| **/decrypt /key**:*KeyString*
or
**/decrypt /key**:"*Key String*"
or
**/decrypt /keyfile**:[*Path*]*FileName* | Decrypts the store with the specified key. With this option, you'll need to specify the encryption key in one of the following ways:
  • `/key`:*KeyString* specifies the encryption key. If there's a space in *KeyString*, you must surround the argument with quotation marks (`"`).
  • `/keyfile`:*FilePathAndName* specifies a text (`.txt`) file that contains the encryption key

*KeyString* can't exceed 256 characters.
The `/key` and `/keyfile` options can't be used on the same command line.
The `/decrypt` and `/nocompress` options can't be used on the same command line.
**Important**
Use caution when using the `/key` or `keyfile` options. For example, anyone who has access to scripts that run the `LoadState.exe` command with these options will also have access to the encryption key.

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /decrypt /key:mykey` | +| **StorePath** | Indicates the folder where the files and settings data are stored. *StorePath* must be specified when using the `LoadState.exe` command. More than one *StorePath* can't be specified. | +| **/decrypt /key**:*KeyString*
or
**/decrypt /key**:"*Key String*"
or
**/decrypt /keyfile**:[*Path*]*FileName* | Decrypts the store with the specified key. With this option, the encryption key needs to be specified in one of the following ways:
  • `/key`:*KeyString* specifies the encryption key. If there's a space in *KeyString*, the argument must be surrounded with quotation marks (`"`).
  • `/keyfile`:*FilePathAndName* specifies a text (`.txt`) file that contains the encryption key

*KeyString* can't exceed 256 characters.
The `/key` and `/keyfile` options can't be used on the same command line.
The `/decrypt` and `/nocompress` options can't be used on the same command line.
**Important**
Use caution when using the `/key` or `keyfile` options. For example, anyone who has access to scripts that run the `LoadState.exe` command with these options also have access to the encryption key.

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /decrypt /key:mykey` | | **/decrypt**:*"encryption strength"* | The `/decrypt` option accepts a command-line parameter to define the encryption strength specified for the migration store encryption. For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md). | | **/hardlink** | Enables user-state data to be restored from a hard-link migration store. The `/nocompress` parameter must be specified with `/hardlink` option. | -| **/nocompress** | Specifies that the store isn't compressed. You should only use this option in testing environments. We recommend that you use a compressed store during your actual migration. This option can't be used with the `/decrypt` option.
For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /nocompress` | +| **/nocompress** | Specifies that the store isn't compressed. This option should only be used in testing environments. Microsoft recommends using a compressed store during the actual migration. This option can't be used with the `/decrypt` option.
For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /nocompress` | ## Migration rule options -USMT provides the following options to specify what files you want to migrate. +USMT provides the following options to specify what files to migrate. | Command-Line Option | Description | |--- |--- | -| **/i**:[*Path*]*FileName* | **(include)**
Specifies an .xml file that contains rules that define what state to migrate. You can specify this option multiple times to include all of your .xml files (`MigApp.xml`, `MigSys.xml`, `MigDocs.xml` and any custom .xml files that you create). *Path* can be either a relative or full path. If you don't specify the *Path* variable, then *FileName* must be located in the current directory.

For more information about which files to specify, see the "XML files" section of the [Frequently Asked Questions](usmt-faq.yml) article. | -| **/config**:[*Path*]*FileName* | Specifies the `Config.xml` file that the `LoadState.exe` command should use. You can't specify this option more than once on the command line. *Path* can be either a relative or full path. If you don't specify the *Path* variable, then the *FileName* must be located in the current directory.

This example migrates the files and settings based on the rules in the `Config.xml`, `MigDocs.xml`, and `MigApp.xml` files:

`LoadState.exe \server\share\migration\mystore /config:Config.xml /i:MigDocs.xml /i:MigApp.xml /v:5 /l:LoadState.log` | -| **/auto**:*"path to script files"* | This option enables you to specify the location of the default .xml files and then launch your migration. If no path is specified, USMT will use the directory where the USMT binaries are located. The `/auto` option has the same effect as using the following options: `/i:MigDocs.xml` `/i:MigApp.xml /v:5`. | +| **/i**:[*Path*]*FileName* | **(include)**
Specifies an **.xml** file that contains rules that define what data to migrate. This option can be specified multiple times to include all of the **.xml** files (`MigApp.xml`, `MigSys.xml`, `MigDocs.xml` and any custom **.xml** files that are created). *Path* can be either a relative or full path. If the *Path* variable isn't specified, then *FileName* must be located in the current directory.

For more information about which files to specify, see the "XML files" section of the [Frequently Asked Questions](usmt-faq.yml) article. | +| **/config**:[*Path*]*FileName* | Specifies the `Config.xml` file that the `LoadState.exe` command should use. This option can't be specified more than once on the command line. *Path* can be either a relative or full path. If the *Path* variable isn't specified, then the *FileName* must be located in the current directory.

This example migrates the files and settings based on the rules in the `Config.xml`, `MigDocs.xml`, and `MigApp.xml` files:

`LoadState.exe \server\share\migration\mystore /config:Config.xml /i:MigDocs.xml /i:MigApp.xml /v:5 /l:LoadState.log` | +| **/auto**:*"path to script files"* | This option enables specifying the location of the default **.xml** files. If no path is specified, USMT uses the directory where the USMT binaries are located. The `/auto` option has the same effect as using the following options: `/i:MigDocs.xml` `/i:MigApp.xml /v:5`. | ## Monitoring options -USMT provides several command-line options that you can use to analyze problems that occur during migration. +USMT provides several command-line options that can be used to analyze problems that occur during migration. | Command-Line Option | Description | |--- |--- | -| **/l**:[*Path*]*FileName* | Specifies the location and name of the **LoadState** log. You can't store any of the log files in *StorePath*. *Path* can be either a relative or full path. If you don't specify the *Path* variable, then the log will be created in the current directory. You can specify the `/v` option to adjust the verbosity of the log.

If you run the `LoadState.exe` command from a shared network resource, you must specify the `l` option, or USMT will fail with the error:

***USMT was unable to create the log file(s)***

To fix this issue, make sure to specify the `/l` option when running `LoadState.exe` from a shared network resource. | -| **/v**:*``* | **(Verbosity)**

Enables verbose output in the **LoadState** log file. The default value is 0.
You can set the *VerbosityLevel* to one of the following levels:
  • **0** - Only the default errors and warnings are enabled.
  • **1** - Enables verbose output.
  • **4** - Enables error and status output.
  • **5** - Enables verbose and status output.
  • **8** - Enables error output to a debugger.
  • **9** - Enables verbose output to a debugger.
  • **12** - Enables error and status output to a debugger.
  • **13** - Enables verbose, status, and debugger output.

For example:
`LoadState.exe \server\share\migration\mystore /v:5 /i:MigDocs.xml /i:MigApp.xml` | -| **/progress**:[*Path*]*FileName* | Creates the optional progress log. You can't store any of the log files in *StorePath*. *Path* can be either a relative or full path. If you don't specify the *Path* variable, then *FileName* will be created in the current directory.

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /progress:Progress.log /l:loadlog.log` | -| **/c** | When this option is specified, the `LoadState.exe` command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there's a large file that won't fit on the computer, the `LoadState.exe` command will log an error and continue with the migration. Without the `/c` option, the `LoadState.exe` command will exit on the first error. You can use the new <**ErrorControl**> section in the `Config.xml` file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This error control enables the `/c` command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the `/genconfig` option now generates a sample <**ErrorControl**> section that is enabled by specifying error messages and desired behaviors in the `Config.xml` file. | -| **/r**:*``* | **(Retry)**

Specifies the number of times to retry when an error occurs while migrating the user state from a server. The default is three times. This option is useful in environments where network connectivity isn't reliable.

While restoring the user state, the `/r` option won't recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem. | -| **/w**:*``* | **(Wait)**

Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second. | +| **/l**:[*Path*]*FileName* | Specifies the location and name of the **LoadState** log. The log files can't be stored in *StorePath*. *Path* can be either a relative or full path. If the *Path* variable isn't specified, then the log is created in the current directory. The `/v` option can be specified to adjust the verbosity of the log.

If running the `LoadState.exe` command from a shared network resource, the `l` option must be specified, or USMT fails with the error:

***USMT was unable to create the log file(s)***

To fix this issue, make sure to specify the `/l` option when running `LoadState.exe` from a shared network resource. | +| **/v**:*``* | **(Verbosity)**

Enables verbose output in the **LoadState** log file. The default value is 0.
The *VerbosityLevel* can be set to one of the following levels:
  • **0** - Only the default errors and warnings are enabled.
  • **1** - Enables verbose output.
  • **4** - Enables error and status output.
  • **5** - Enables verbose and status output.
  • **8** - Enables error output to a debugger.
  • **9** - Enables verbose output to a debugger.
  • **12** - Enables error and status output to a debugger.
  • **13** - Enables verbose, status, and debugger output.

For example:
`LoadState.exe \server\share\migration\mystore /v:5 /i:MigDocs.xml /i:MigApp.xml` | +| **/progress**:[*Path*]*FileName* | Creates the optional progress log. The log files can't be stored in *StorePath*. *Path* can be either a relative or full path. If the *Path* variable isn't specified, then *FileName* is created in the current directory.

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /progress:Progress.log /l:loadlog.log` | +| **/c** | When this option is specified, the `LoadState.exe` command continues to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there's a large file that doesn't fit on the computer, the `LoadState.exe` command logs an error and continue with the migration. Without the `/c` option, the `LoadState.exe` command exits on the first error. The \<**ErrorControl**\> section can be used in the `Config.xml` file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This error control enables the `/c` command-line option to safely skip all input/output (I/O) errors in the environment. In addition, the `/genconfig` option now generates a sample \<**ErrorControl**\> section that is enabled by specifying error messages and desired behaviors in the `Config.xml` file. | +| **/r**:*``* | **(Retry)**

Specifies the number of times to retry when an error occurs while migrating the user state from a server. The default is three times. This option is useful in environments where network connectivity isn't reliable.

When the user state is being restored, the `/r` option doesn't recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem. | +| **/w**:*``* | **(Wait)**

Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second. | | **/?** or **/help** | Displays Help on the command line. | ## User options -By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. You can't exclude users in the migration .xml files or by using the `Config.xml` file. For more information, see [Identify Users](usmt-identify-users.md). +By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. Users can't be excluded in the migration **.xml** files or by using the `Config.xml` file. For more information, see [Identify Users](usmt-identify-users.md). | Command-Line Option | Description | |--- |--- | -| **/all** | Migrates all of the users on the computer.

USMT migrates all user accounts on the computer, unless you specifically exclude an account with the `/ue` or `/uel` options. For this reason, you don't need to specify this option on the command line. However, if you choose to use the `/all` option, you can't also use the `/ui`, `/ue` or `/uel` options. | -| **/ui**:*DomainName UserName*
or
**/ui**:*"DomainName User Name"*
or
**/ui**:*ComputerName LocalUserName* | **(User include)**

Migrates the specified user. By default, all users are included in the migration. Therefore, this option is helpful only when used with the `/ue` option. You can specify multiple `/ui` options, but you can't use the `/ui` option with the `/all` option. *DomainName* and *UserName* can contain the asterisk (`*`) wildcard character. When you specify a user name that contains spaces, you'll need to surround it with quotations marks (`"`).

For example, to include only **User2** from the Corporate domain, enter:

`/ue:* /ui:corporate\user2`

**Note**
If a user is specified for inclusion with the `/ui` option and also specified to be excluded with either the `/ue` or `/uel` options, the user will be included in the migration.

For more examples, see the descriptions of the `/uel`, `/ue`, and `/ui` options in this table. | -| **/uel**:*``*
or
**/uel**:*``*
or
**/uel**:0 | **(User exclude based on last logon)**

Migrates only the users that logged onto the source computer within the specified time period, based on the **Last Modified** date of the Ntuser.dat file on the source computer. The `/uel` option acts as an include rule. For example, the `/uel:30` option migrates users who logged on, or whose user account was modified, within the last 30 days from the date when the `ScanState.exe` command is run. You can specify the number of days or you can specify a date. You can't use this option with the `/all` option. USMT retrieves the last sign-in information from the local computer, so the computer doesn't need to be connected to the network when you run this option. In addition, if a domain user has signed into another computer, that sign-in instance isn't considered by USMT.
**Note**
The `/uel` option isn't valid in offline migrations.

Examples:
  • `/uel:0` migrates accounts that were logged on to the source computer when the `ScanState.exe` command was run.
  • `/uel:90` migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.
  • `/uel:1` migrates users whose accounts have been modified within the last 24 hours.
  • `/uel:2020/2/15` migrates users who have logged on or whose accounts have been modified since February 15, 2020.

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /uel:0` | -| **/ue**:*DomainName\UserName*
or
**/ue** *"DomainName\User Name"*
or
**/ue**:*ComputerName\LocalUserName* | **(User exclude)**

Excludes the specified users from the migration. You can specify multiple `/ue` options but you can't use the `/ue` option with the `/all` option. *DomainName* and *UserName* can contain the asterisk (`*`) wildcard character. When you specify a user name that contains spaces, you'll need to surround it with quotation marks (`"`).

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /ue:contoso\user1`
For more examples, see the descriptions of the `/uel`, `/ue`, and `/ui` options in this table. | -| **/md**:*OldDomain*:*NewDomain*
or
**/md**:*LocalComputerName:NewDomain* | **(Move domain)**

Specifies a new domain for the user. Use this option to change the domain for users on a computer or to migrate a local user to a domain account. *OldDomain* may contain the asterisk () wildcard character.

You can specify this option more than once. You may want to specify multiple `/md` options if you're consolidating users across multiple domains to a single domain. For example, you could specify the following to consolidate the users from the Corporate and FarNorth domains into the Fabrikam domain: `/md:corporate:fabrikam` and `/md:farnorth:fabrikam`.

If there are conflicts between two `/md` commands, the first rule that you specify is applied. For example, if you specify the `/md:corporate:fabrikam` and `/md:corporate:farnorth` commands, then Corporate users would be mapped to the Fabrikam domain.
**Note**
If you specify an *OldDomain* that didn't exist on the source computer, the `LoadState.exe` command will appear to complete successfully, without an error or warning. However, in this case, users won't be moved to *NewDomain* but will remain in their original domain. For example, if you misspell **contoso** and you instead specify **/md:contso:fabrikam**, the users will remain in **contoso** on the destination computer.

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore`
` /progress:Progress.log /l:LoadState.log /md:contoso:fabrikam` | -| **/mu**:*OldDomain OldUserName*:[*NewDomain*]*NewUserName*
or
**/mu**:*OldLocalUserName*:*NewDomain NewUserName* | **(Move user)**

Specifies a new user name for the specified user. If the store contains more than one user, you can specify multiple `/mu` options. You can't use wildcard characters with this option.

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore`
`/progress:Progress.log /l:LoadState.log /mu:contoso\user1:fabrikam\user1` | -| **/lac**:[*Password*] | **(Local account create)**

Specifies that if a user account is a local (non-domain) account, and it doesn't exist on the destination computer, USMT will create the account on the destination computer but it will be disabled. To enable the account, you must also use the `/lae` option.

If the `/lac` option isn't specified, any local user accounts that don't already exist on the destination computer won't be migrated.

*Password* is the password for the newly created account. An empty password is used by default.
**Caution**
Use the *Password* variable with caution because it's provided in plain text and can be obtained by anyone with access to the computer that is running the `LoadState.exe` command.
Also, if the computer has multiple users, all migrated users will have the same password.

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore`

For instructions, see [Migrate user accounts](usmt-migrate-user-accounts.md). | -| `/lae` | **(Local account enable)**

Enables the account that was created with the `/lac` option. You must specify the `/lac` option with this option.

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore`
`/progress:Progress.log /l:LoadState.log /lac:password /lae`

For instructions, see [Migrate user accounts](usmt-migrate-user-accounts.md). | +| **/all** | Migrates all of the users on the computer.

USMT migrates all user accounts on the computer, unless an account is specifically excluded with the `/ue` or `/uel` options. For this reason, this option doesn't need to be specified on the command line. However, if using the `/all` option, the `/ui`, `/ue` or `/uel` options can't also be used. | +| **/ui**:*DomainName UserName*
or
**/ui**:*"DomainName User Name"*
or
**/ui**:*ComputerName LocalUserName* | **(User include)**

Migrates the specified user. By default, all users are included in the migration. Therefore, this option is helpful only when used with the `/ue` option. Multiple `/ui` options can be specified, but the `/ui` option can't be used with the `/all` option. *DomainName* and *UserName* can contain the asterisk (`*`) wildcard character. When user name that contains spaces is specified, it needs to be surrounded with quotations marks (`"`).

For example, to include only **User2** from the Corporate domain, enter:

`/ue:* /ui:corporate\user2`

**Note**
If a user is specified for inclusion with the `/ui` option and also specified to be excluded with either the `/ue` or `/uel` options, the user is included in the migration.

For more examples, see the descriptions of the `/uel`, `/ue`, and `/ui` options in this table. | +| **/uel**:*``*
or
**/uel**:*``*
or
**/uel**:0 | **(User exclude based on last logon)**

Migrates only the users that logged onto the source computer within the specified time period, based on the **Last Modified** date of the **Ntuser.dat** file on the source computer. The `/uel` option acts as an include rule. For example, the `/uel:30` option migrates users who logged on, or whose user account was modified, within the last 30 days from the date when the `ScanState.exe` command is run. The number of days can be specified or a date can be specified. This option can't be used with the `/all` option. USMT retrieves the last sign-in information from the local computer, so the computer doesn't need to be connected to the network when running this option. In addition, if a domain user signs into another computer, USMT doesn't consider that sign-in instance.
**Note**
The `/uel` option isn't valid in offline migrations.

Examples:
  • `/uel:0` migrates accounts that were logged on to the source computer when the `ScanState.exe` command was run.
  • `/uel:90` migrates users who logged on, or whose accounts were otherwise modified, within the last 90 days.
  • `/uel:1` migrates users whose accounts were modified within the last 24 hours.
  • `/uel:2020/2/15` migrates users who logged on or whose accounts modified since February 15, 2020.

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /uel:0` | +| **/ue**:*DomainName\UserName*
or
**/ue** *"DomainName\User Name"*
or
**/ue**:*ComputerName\LocalUserName* | **(User exclude)**

Excludes the specified users from the migration. Multiple `/ue` options can be used but the `/ue` option can't be used with the `/all` option. *DomainName* and *UserName* can contain the asterisk (`*`) wildcard character. When a user name that contains spaces is specified, it needs to be surround with quotation marks (`"`).

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /ue:contoso\user1`
For more examples, see the descriptions of the `/uel`, `/ue`, and `/ui` options in this table. | +| **/md**:*OldDomain*:*NewDomain*
or
**/md**:*LocalComputerName:NewDomain* | **(Move domain)**

Specifies a new domain for the user. Use this option to change the domain for users on a computer or to migrate a local user to a domain account. *OldDomain* might contain the asterisk () wildcard character.

This option can be specified more than once. If consolidating users across multiple domains to a single domain, multiple `/md` options might need to be specified. For example, to consolidate the users from the Corporate and FarNorth domains into the Fabrikam domain, specify the following settings: `/md:corporate:fabrikam` and `/md:farnorth:fabrikam`.

If there are conflicts between two `/md` commands, the first rule specified is applied. For example, if the `/md:corporate:fabrikam` and `/md:corporate:farnorth` commands are specified, then Corporate users would be mapped to the Fabrikam domain.
**Note**
If a domain that didn't exist on the source computer is specified, the `LoadState.exe` command appears to complete successfully, without an error or warning. However, in this case, users aren't moved to *NewDomain* but instead remain in their original domain. For example, if **contoso** is misspelled and instead **/md:contso:fabrikam** is specified, the users remain in **contoso** on the destination computer.

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore`
`/progress:Progress.log /l:LoadState.log /md:contoso:fabrikam` | +| **/mu**:*OldDomain OldUserName*:[*NewDomain*]*NewUserName*
or
**/mu**:*OldLocalUserName*:*NewDomain NewUserName* | **(Move user)**

Specifies a new user name for the specified user. If the store contains more than one user, multiple `/mu` options can be specified. Wildcard characters can't be used with this option.

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore`
`/progress:Progress.log /l:LoadState.log /mu:contoso\user1:fabrikam\user1` | +| **/lac**:[*Password*] | **(Local account create)**

If a user account is:
  • A local (non-domain) account
  • An account that doesn't exist on the destination computer
this setting specifies to create the account on the destination computer. However, the account is disabled. To enable the account, the `/lae` option must also be used.

If the `/lac` option isn't specified, any local user accounts that don't already exist on the destination computer aren't migrated.

*Password* is the password for the newly created account. An empty password is used by default.
**Caution**
Use the *Password* variable with caution. The *Password* variable is provided in plain text and anyone with access to the computer that is running the `LoadState.exe` command can obtain the password.
Also, if the computer has multiple users, all migrated users have the same password.

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore`

For instructions, see [Migrate user accounts](usmt-migrate-user-accounts.md). | +| `/lae` | **(Local account enable)**

Enables the account that was created with the `/lac` option. The `/lac` option must be specified with this option.

For example:
`LoadState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore`
`/progress:Progress.log /l:LoadState.log /lac:password /lae`

For instructions, see [Migrate user accounts](usmt-migrate-user-accounts.md). | ### Examples for the /ui and /ue options -The following examples apply to both the **/ui** and **/ue** options. You can replace the **/ue** option with the **/ui** option to include, rather than exclude, the specified users. +The following examples apply to both the **/ui** and **/ue** options. The **/ue** option can be replaced with the **/ui** option to include, rather than exclude, the specified users. | Behavior | Command | |--- |--- | @@ -112,52 +112,53 @@ The following examples apply to both the **/ui** and **/ue** options. You can re ### Using the options together -You can use the `/uel`, `/ue` and `/ui` options together to migrate only the users that you want migrated. +The `/uel`, `/ue` and `/ui` options can be used together to migrate only the users that need to be migrated. -**The /ui option has precedence over the /ue and /uel options.** If a user is included using the `/ui` option and also excluded using either the `/ue` or `/uel` options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then User1 will be migrated, because the `/ui` option takes precedence over the `/ue` option. +**The /ui option has precedence over the /ue and /uel options.** If a user is included using the `/ui` option and also excluded using either the `/ue` or `/uel` options, the user is included in the migration. For example, if `/ui:contoso\* /ue:contoso\user1` is specified, then User1 is migrated, because the `/ui` option takes precedence over the `/ue` option. -**The /uel option takes precedence over the /ue option.** If a user has logged on within the specified time period set by the `/uel` option, that user's profile will be migrated even if they're excluded by using the `/ue` option. For example, if you specify `/ue:contoso\user1 /uel:14`, the User1 will be migrated if they've logged on to the computer within the last 14 days. +**The /uel option takes precedence over the /ue option.** If a user logged on within the specified time period set by the `/uel` option, that user's profile is migrated even if they're excluded by using the `/ue` option. For example, if `/ue:contoso\user1 /uel:14` is specified, then User1 is migrated if they logged on to the computer within the last 14 days. | Behavior | Command | |--- |--- | | Include only User2 from the Fabrikam domain and exclude all other users. | `/ue:* /ui:fabrikam\user2` | | Include only the local user named User1 and exclude all other users. | `/ue:* /ui:user1` | -| Include only the domain users from Contoso, except Contoso\User1. | This behavior can't be completed using a single command. Instead, to migrate this set of users, you'll need to specify the following options:
  • Using the **ScanState** command-line tool, enter:
    `/ue:* /ui:contoso`
  • Using the **LoadState** command-line tool, enter:
    `/ue:contoso\user1`
| +| Include only the domain users from Contoso, except Contoso\User1. | This behavior can't be completed using a single command. Instead, to migrate this set of users, specify the following options:
  • Using the **ScanState** command-line tool, enter:
    `/ue:* /ui:contoso`
  • Using the **LoadState** command-line tool, enter:
    `/ue:contoso\user1`
| | Include only local (non-domain) users. | `/ue: /ui:%computername%*` | ## Incompatible command-line options -The following table indicates which command-line options aren't compatible with the `LoadState.exe` command. If the table entry for a particular combination is blank, the options are compatible, and you can use them together. The X symbol means that the options aren't compatible. For example, you can't use the `/nocompress` option with the `/encrypt` option. +The following table indicates which command-line options aren't compatible with the `LoadState.exe` command. If the table entry for a particular combination has a ✔️, the options are compatible, and they can be used together. The ❌ symbol means that the options aren't compatible. For example, the `/nocompress` option can't be used with the `/encrypt` option. | Command-Line Option | /keyfile | /nocompress | /genconfig | /all | |--- |--- |--- |--- |--- | -| **/i** | | | | | -| **/v** | | | | | -| **/nocompress** | | N/A | X | | -| **/key** | X | | X | | -| **/decrypt** | Required* | X | X | | -| **/keyfile** | N/A | | X | | -| **/l** | | | | | -| **/progress** | | | X | | -| **/r** | | | X | | -| **/w** | | | X | | -| **/c** | | | X | | -| **/p** | | | X | N/A | -| **/all** | | | X | | -| **/ui** | | | X | X | -| **/ue** | | | X | X | -| **/uel** | | | X | X | -| **/genconfig** | | | N/A | | -| **/config** | | | X | | -| *StorePath* | | | | | -| **/md** | | | | | -| **/mu** | | | | | -| **/lae** | | | | | -| **/lac** | | | | | +| **/i** | ✔️ | ✔️ | ✔️ | ✔️ | +| **/v** | ✔️ | ✔️ | ✔️ | ✔️ | +| **/nocompress** | ✔️ | N/A | ❌ | ✔️ | +| **/key** | ❌ | ✔️ | ❌ | ✔️ | +| **/decrypt** | Required* | ❌ | ❌ | ✔️ | +| **/keyfile** | N/A | ✔️ | ❌ | ✔️ | +| **/l** | ✔️ | ✔️ | ✔️ | ✔️ | +| **/progress** | ✔️ | ✔️ | ❌ | ✔️ | +| **/r** | ✔️ | ✔️ | ❌ | ✔️ | +| **/w** | ✔️ | ✔️ | ❌ | ✔️ | +| **/c** | ✔️ | ✔️ | ❌ | ✔️ | +| **/p** | ✔️ | ✔️ | ❌ | N/A | +| **/all** | ✔️ | ✔️ | ❌ | ✔️ | +| **/ui** | ✔️ | ✔️ | ❌ | ❌ | +| **/ue** | ✔️ | ✔️ | ❌ | ❌ | +| **/uel** | ✔️ | ✔️ | ❌ | ❌ | +| **/genconfig** | ✔️ | ✔️ | N/A | ✔️ | +| **/config** | ✔️ | ✔️ | ❌ | ✔️ | +| *StorePath* | ✔️ | ✔️ | ✔️ | ✔️ | +| **/md** | ✔️ | ✔️ | ✔️ | ✔️ | +| **/mu** | ✔️ | ✔️ | ✔️ | ✔️ | +| **/lae** | ✔️ | ✔️ | ✔️ | ✔️ | +| **/lac** | ✔️ | ✔️ | ✔️ | ✔️ | > [!NOTE] -> You must specify either the `/key` or `/keyfile` option with the `/encrypt` option. +> +> Either the `/key` or `/keyfile` option must be specified with the `/decrypt` option. ## Related articles -[XML elements library](usmt-xml-elements-library.md) +- [XML elements library](usmt-xml-elements-library.md). diff --git a/windows/deployment/usmt/usmt-log-files.md b/windows/deployment/usmt/usmt-log-files.md index ad51352c37..1df852f15e 100644 --- a/windows/deployment/usmt/usmt-log-files.md +++ b/windows/deployment/usmt/usmt-log-files.md @@ -1,28 +1,25 @@ --- -title: Log Files (Windows 10) -description: Learn how to use User State Migration Tool (USMT) 10.0 logs to monitor your migration and to troubleshoot errors and failed migrations. +title: USMT Log Files +description: Learn how to use User State Migration Tool (USMT) logs to monitor the migration and to troubleshoot errors and failed migrations. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # USMT log files -You can use User State Migration Tool (USMT) 10.0 logs to monitor your migration and to troubleshoot errors and failed migrations. This article describes the available command-line options to enable USMT logs, and new XML elements that configure which types of errors are fatal and should halt the migration, which types are non-fatal and should be skipped so that the migration can continue. +User State Migration Tool (USMT) logs can be used to monitor the migration and to troubleshoot errors and failed migrations. This article describes the available command-line options to enable USMT logs. It also describes new XML elements that can be used to configure: -[Log command-line options](#log-command-line-options) - -[ScanState and LoadState logs](#scanstate-and-loadstate-logs) - -[Progress log](#progress-log) - -[List files log](#list-files-log) - -[Diagnostic log](#diagnostic-log) +- Which types of errors are fatal and should halt the migration. +- Which types are non-fatal and should be skipped so that the migration can continue. ## Log command-line options @@ -37,21 +34,22 @@ The following table describes each command-line option related to logs, and it p |Set the environment variable **MIG_ENABLE_DIAG** to a path to an XML file.|`USMTDiag.xml`|The diagnostic log contains detailed system environment information, user environment information, and information about the migration units (migunits) being gathered and their contents.| > [!NOTE] -> You cannot store any of the log files in *StorePath*. If you do, the log will be overwritten when USMT is run. +> +> The log files can't be stored in *StorePath*. If the log files are stored in *StorePath*, the log files are overwritten when USMT runs. ## ScanState and LoadState logs - **ScanState** and **LoadState** logs are text files that are create when you run the **ScanState** and **LoadState** tools. You can use these logs to help monitor your migration. The content of the log depends on the command-line options that you use and the verbosity level that you specify. For more information about verbosity levels, see [Monitoring options](usmt-scanstate-syntax.md#monitoring-options) in [ScanState syntax](usmt-scanstate-syntax.md). + **ScanState** and **LoadState** logs are text files that are created when the **ScanState** and **LoadState** tools run. These logs can be used to help monitor the migration. The content of the log depends on the command-line options that are used and the verbosity level that is specified. For more information about verbosity levels, see [Monitoring options](usmt-scanstate-syntax.md#monitoring-options) in [ScanState syntax](usmt-scanstate-syntax.md). ## Progress log -You can create a progress log using the `/progress` option. External tools, such as Microsoft System Center Operations Manager, can parse the progress log to update your monitoring systems. The first three fields in each line are fixed as follows: +A progress log can be created using the `/progress` option. External tools, such as Microsoft System Center Operations Manager, can parse the progress log to update the monitoring systems. The first three fields in each line are fixed as follows: -- **Date:** Date, in the format of *day* *shortNameOfTheMonth* *year*. For example: 08 Jun 2006. +- **Date:** Date, in the format of *day* *shortNameOfTheMonth* *year*. For example: 08 Jun 2023. - **Local time:** Time, in the format of *hrs*:*minutes*:*seconds* (using a 24-hour clock). For example: 13:49:13. -- **Migration time:** Duration of time that USMT was run, in the format of *hrs:minutes:seconds*. For example: 00:00:10. +- **Migration time:** Duration of time that USMT was run, in the format of *hrs:minutes:seconds*. For example: 00:00:20. The remaining fields are key/value pairs as indicated in the following table. @@ -62,15 +60,15 @@ The remaining fields are key/value pairs as indicated in the following table. | *computerName* | The name of the source or destination computer on which USMT was run. | | *commandLine* | The full command used to run USMT. | | *PHASE* | Reports that a new phase in the migration is starting. This key can be one of the following values:
  • Initializing
  • Scanning
  • Collecting
  • Saving
  • Estimating
  • Applying
| -| *detectedUser* |
  • For the **ScanState** tool, this key are the users USMT detected on the source computer that can be migrated.
  • For the **LoadState** tool, this key are the users USMT detected in the store that can be migrated.
| +| *detectedUser* |
  • For the **ScanState** tool, this key is the users USMT detected on the source computer that can be migrated.
  • For the **LoadState** tool, this key is the users USMT detected in the store that can be migrated.
| | *includedInMigration* | Defines whether the user profile/component is included for migration. Valid values are **Yes** or **No**. | | *forUser* | Specifies either of the following values:
  • The user state being migrated.
  • *This Computer*, meaning files and settings that aren't associated with a user.
| | *detectedComponent* | Specifies a component detected by USMT.
  • For *ScanState*, this key is a component or application that is installed on the source computer.
  • For **LoadState**, this key is a component or application that was detected in the store.
| | *totalSizeInMBToTransfer* | Total size of the files and settings to migrate in megabytes (MB). | -| *totalPercentageCompleted* | Total percentage of the migration that has been completed by either **ScanState** or **LoadState**. | +| *totalPercentageCompleted* | Total percentage of the migration that is completed by either **ScanState** or **LoadState**. | | *collectingUser* | Specifies which user **ScanState** is collecting files and settings for. | | *totalMinutesRemaining* | Time estimate, in minutes, for the migration to complete. | -| *error* | Type of non-fatal error that occurred. This key can be one of the following values:
  • **UnableToCopy**: Unable to copy to store because the disk on which the store is located is full.
  • **UnableToOpen**: Unable to open the file for migration because the file is opened in non-shared mode by another application or service.
  • **UnableToCopyCatalog**: Unable to copy because the store is corrupted.
  • **UnableToAccessDevice**: Unable to access the device.
  • **UnableToApply**: Unable to apply the setting to the destination computer.
| +| *error* | Type of non-fatal error that occurred. This key can be one of the following values:
  • **UnableToCopy**: Unable to copy to store because the disk on which the store is located is full.
  • **UnableToOpen**: Unable to open the file for migration because another application or service has the file open in non-shared mode.
  • **UnableToCopyCatalog**: Unable to copy because the store is corrupted.
  • **UnableToAccessDevice**: Unable to access the device.
  • **UnableToApply**: Unable to apply the setting to the destination computer.
| | *objectName* | The name of the file or setting that caused the non-fatal error. | | *action* | Action taken by USMT for the non-fatal error. The values are:
  • **Ignore**: Non-fatal error ignored and the migration continued because the **/c** option was specified on the command line.
  • **Abort**: Stopped the migration because the **/c** option wasn't specified.
| | *errorCode* | The errorCode or return value. | @@ -83,45 +81,45 @@ The List files log (`Listfiles.txt`) provides a list of the files that were migr ## Diagnostic log -You can obtain the diagnostic log by setting the environment variable **MIG_ENABLE_DIAG** to a path to an XML file. +The diagnostic log can be obtained by setting the environment variable **MIG_ENABLE_DIAG** to a path to an XML file. The diagnostic log contains: -- Detailed system environment information +- Detailed system environment information. -- Detailed user environment information +- Detailed user environment information. -- Information about the migration units (migunits) being gathered and their contents +- Information about the migration units (migunits) being gathered and their contents. ## Using the Diagnostic Log -The diagnostic log is essentially a report of all the migration units (migunits) included in the migration. A migunit is a collection of data that is identified by the component it's associated with in the XML files. The migration store is made up of all the migunits in the migration. The diagnostic log can be used to verify which migunits were included in the migration and can be used for troubleshooting while authoring migration XML files. +The diagnostic log is essentially a report of all the migration units (migunits) included in the migration. A migunit is a collection of data. In the XML files, the component identifies the migunit that the migunit is associated with. The migration store is made up of all the migunits in the migration. The diagnostic log can be used to verify which migunits were included in the migration and can be used for troubleshooting while authoring migration XML files. -The following examples describe common scenarios in which you can use the diagnostic log. +The following examples describe common scenarios in which the diagnostic log can be used. **Why is this file not migrating when I authored an "include" rule for it?** Let's imagine that we have the following directory structure and that we want the **data** directory to be included in the migration along with the **New Text Document.txt** file in the **New Folder**. The directory of `C:\data` contains: -```console -01/21/2009 10:08 PM . -01/21/2009 10:08 PM .. -01/21/2009 10:08 PM New Folder -01/21/2009 09:19 PM 13 test (1).txt -01/21/2009 09:19 PM 13 test.txt +```cmd +12/21/2023 01:08 PM . +12/21/2023 01:08 PM .. +12/21/2023 01:08 PM New Folder +12/21/2023 01:19 PM 13 test (1).txt +12/21/2023 01:19 PM 13 test.txt 2 File(s) 26 bytes ``` The directory of `C:\data\New Folder` contains: -```console -01/21/2009 10:08 PM . -01/21/2009 10:08 PM .. -01/21/2009 10:08 PM 0 New Text Document.txt +```cmd +12/21/2023 01:08 PM . +12/21/2023 01:08 PM .. +12/21/2023 01:08 PM 0 New Text Document.txt 1 File(s) 0 bytes ``` -To migrate these files you author the following migration XML: +To migrate these files the following migration XML is authored: ```xml @@ -143,28 +141,28 @@ To migrate these files you author the following migration XML: ``` -However, upon testing the migration you notice that the **New Text Document.txt** file isn't included in the migration. To troubleshoot this failure, the migration can be repeated with the environment variable **MIG_ENABLE_DIAG** set such that the diagnostic log is generated. Upon searching the diagnostic log for the component **DATA1**, the following XML section is discovered: +However, upon testing the migration, the **New Text Document.txt** file is noticed that it wasn't included in the migration. To troubleshoot this failure, the migration can be repeated with the environment variable **MIG_ENABLE_DIAG** set such that the diagnostic log is generated. Searching the diagnostic log for the component **DATA1** reveals the following XML section: ```xml - - - - - + + + + + - - - - - + + + + + ``` -Analysis of this XML section reveals the migunit that was created when the migration rule was processed. The **<Perform>** section details the actual files that were scheduled for gathering and the result of the gathering operation. The **New Text Document.txt** file doesn't appear in this section, which confirms that the migration rule wasn't correctly authored. +Analysis of this XML section reveals the migunit that was created when the migration rule was processed. The **\** section details the actual files that were scheduled for gathering and the result of the gathering operation. The **New Text Document.txt** file doesn't appear in this section, which confirms that the migration rule wasn't correctly authored. -An analysis of the [XML elements library](usmt-xml-elements-library.md) reference article reveals that the [**<pattern>**](usmt-xml-elements-library.md#pattern) tag needs to be modified as follows: +An analysis of the [XML elements library](usmt-xml-elements-library.md) reference article reveals that the [**\**](usmt-xml-elements-library.md#pattern) tag needs to be modified as follows: ```xml c:\data\* [*] @@ -174,14 +172,14 @@ When the migration is performed again with the modified tag, the diagnostic log ```xml - + - + @@ -191,33 +189,33 @@ When the migration is performed again with the modified tag, the diagnostic log ``` -This diagnostic log confirms that the modified **<pattern>** value enables the migration of the file. +This diagnostic log confirms that the modified **\** value enables the migration of the file. **Why is this file migrating when I authored an exclude rule excluding it?** -In this scenario, you have the following directory structure and you want all files in the **Data** directory to migrate, except for text files. The `C:\Data` folder contains: +In this scenario, the following directory structure exists and all files in the **Data** directory should migrate, except for text files. The `C:\Data` folder contains: -```console +```cmd Directory of C:\Data -01/21/2009 10:08 PM . -01/21/2009 10:08 PM .. -01/21/2009 10:08 PM New Folder -01/21/2009 09:19 PM 13 test (1).txt -01/21/2009 09:19 PM 13 test.txt +12/21/2023 01:08 PM . +12/21/2023 01:08 PM .. +12/21/2023 01:08 PM New Folder +12/21/2023 01:19 PM 13 test (1).txt +12/21/2023 01:19 PM 13 test.txt 2 File(s) 26 bytes ``` The `C:\Data\New Folder\` contains: -```console -01/21/2009 10:08 PM . -01/21/2009 10:08 PM .. -01/21/2009 10:08 PM 0 New Text Document.txt +```cmd +12/21/2023 01:08 PM . +12/21/2023 01:08 PM .. +12/21/2023 01:08 PM 0 New Text Document.txt 1 File(s) 0 bytes ``` -You author the following migration XML: +The following migration XML is authored: ```xml @@ -245,11 +243,11 @@ You author the following migration XML: ``` -However, upon testing the migration you notice that all the text files are still included in the migration. In order to troubleshoot this issue, the migration can be performed with the environment variable **MIG_ENABLE_DIAG** set so that the diagnostic log is generated. Upon searching the diagnostic log for the component **DATA1**, the following XML section is discovered: +However, upon testing the migration, all the text files are noticed that they're still included in the migration. In order to troubleshoot this issue, the migration can be performed with the environment variable **MIG_ENABLE_DIAG** set so that the diagnostic log is generated. Searching the diagnostic log for the component **DATA1** reveals the following XML section: ```xml - + @@ -259,7 +257,7 @@ However, upon testing the migration you notice that all the text files are still - + @@ -271,7 +269,7 @@ However, upon testing the migration you notice that all the text files are still ``` -Upon reviewing the diagnostic log, you confirm that the files are still migrating, and that it's a problem with the authored migration XML rule. You author an update to the migration XML script as follows: +When the diagnostic log is reviewed, the files are still migrating is confirmed, and that it's a problem with the authored migration XML rule. An update is authored to the migration XML script as follows: ```xml @@ -302,11 +300,11 @@ Upon reviewing the diagnostic log, you confirm that the files are still migratin ``` -Your revised migration XML script excludes the files from migrating, as confirmed in the diagnostic log: +The revised migration XML script excludes the files from migrating, as confirmed in the diagnostic log: ```xml - + @@ -316,7 +314,7 @@ Your revised migration XML script excludes the files from migrating, as confirme - + @@ -327,9 +325,6 @@ Your revised migration XML script excludes the files from migrating, as confirme ## Related articles -[XML elements library](usmt-xml-elements-library.md) - -[ScanState syntax](usmt-scanstate-syntax.md) - -[LoadState syntax](usmt-loadstate-syntax.md) - +- [XML elements library](usmt-xml-elements-library.md). +- [ScanState syntax](usmt-scanstate-syntax.md). +- [LoadState syntax](usmt-loadstate-syntax.md). diff --git a/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md b/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md index c19ee33c65..cf601ee1cf 100644 --- a/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md +++ b/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md @@ -1,13 +1,17 @@ --- -title: Migrate EFS Files and Certificates (Windows 10) +title: Migrate EFS Files and Certificates description: Learn how to migrate Encrypting File System (EFS) certificates. Also, learn where to find information about how to identify file types, files, and folders. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Migrate EFS files and certificates @@ -16,7 +20,7 @@ This article describes how to migrate Encrypting File System (EFS) certificates. ## To migrate EFS files and certificates -Encrypting File System (EFS) certificates will be migrated automatically. However, by default, the User State Migration Tool (USMT) 10.0 fails if an encrypted file is found unless you specify an `/efs` option. Therefore when a device has EFS encrypted files, you must specify the `/efs` option with any one of the following parameters: +Encrypting File System (EFS) certificates are migrated automatically. However, by default, the User State Migration Tool (USMT) fails if an encrypted file is found unless the `/efs` option is specified. Therefore when a device has EFS encrypted files, the `/efs` option must be specified with any one of the following parameters: - `abort` - `skip` @@ -24,23 +28,23 @@ Encrypting File System (EFS) certificates will be migrated automatically. Howeve - `copyraw` - `hardlink` -when running the `ScanState.exe` command to migrate the encrypted files. Then, when you run the `LoadState.exe` command on the destination computer, the encrypted file and the EFS certificate will be automatically migrated. +when running the `ScanState.exe` command to migrate the encrypted files. Then, when the `LoadState.exe` command is run on the destination computer, the encrypted file and the EFS certificate are automatically migrated. > [!NOTE] -> The `/efs` options are not used with the `LoadState.exe` command. +> +> The `/efs` options aren't used with the `LoadState.exe` command. -Before using the **ScanState** tool for a migration that includes encrypted files and EFS certificates, you must ensure that all files in an encrypted folder are encrypted as well or remove the encryption attribute from folders that contain unencrypted files. If the encryption attribute has been removed from a file but not from the parent folder, the file will be encrypted during the migration using the credentials of the account used to run the **LoadState** tool. +Before using the **ScanState** tool for a migration that includes encrypted files and EFS certificates, all files in an encrypted folder must also be encrypted. Otherwise, remove the encryption attribute from folders that contain unencrypted files. If the encryption attribute is removed from a file but not from the parent folder, the file is encrypted during the migration using the credentials of the account used to run the **LoadState** tool. -You can run the [Cipher.exe](/windows-server/administration/windows-commands/cipher) tool at a Windows command prompt to review and change encryption settings on files and folders. For example, to remove encryption from a folder, at a command prompt enter: +The [Cipher.exe](/windows-server/administration/windows-commands/cipher) tool can be run at a Windows command prompt to review and change encryption settings on files and folders. For example, to remove encryption from a folder, at a command prompt enter: ```cmd cipher.exe /D /S: ``` -where *<Path>* is the full path of the topmost parent directory where the encryption attribute is set. +where *\* is the full path of the topmost parent directory where the encryption attribute is set. ## Related articles -[What does USMT migrate?](usmt-what-does-usmt-migrate.md) - -[Identify file types, files, and folders](usmt-identify-file-types-files-and-folders.md) +- [What does USMT migrate?](usmt-what-does-usmt-migrate.md). +- [Identify file types, files, and folders](usmt-identify-file-types-files-and-folders.md). diff --git a/windows/deployment/usmt/usmt-migrate-user-accounts.md b/windows/deployment/usmt/usmt-migrate-user-accounts.md index d4ecef51aa..2ceb559375 100644 --- a/windows/deployment/usmt/usmt-migrate-user-accounts.md +++ b/windows/deployment/usmt/usmt-migrate-user-accounts.md @@ -1,18 +1,22 @@ --- -title: Migrate User Accounts (Windows 10) +title: Migrate User Accounts description: Learn how to migrate user accounts and how to specify which users to include and exclude by using the User options on the command line. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Migrate User Accounts -By default, all users are migrated. The only way to specify which users to include and exclude is on the command line by using the User options. You can't specify users in the migration XML files or by using the `Config.xml` file. +By default, all users are migrated. The only way to specify which users to include and exclude is on the command line by using the [ScanState User options](usmt-scanstate-syntax.md#user-options) and the [LoadState User options](usmt-loadstate-syntax.md#user-options). Users can't be specified in the migration XML files or by using the `Config.xml` file. ## To migrate all user accounts and user settings @@ -20,30 +24,31 @@ Links to detailed explanations of commands are available in the [Related article 1. Sign into the source computer as an administrator. -2. Enter the following `ScanState.exe` command line in a command prompt window: +1. Enter the following `ScanState.exe` command line in a command prompt window: ```cmd ScanState.exe \\server\share\migration\mystore /i:MigDocs.xml /i:MigApp.xml /o ```` -3. Sign into the destination computer as an administrator. +1. Sign into the destination computer as an administrator. -4. Enter one of the following `LoadState.exe ` command lines in a command prompt window: +1. Enter one of the following `LoadState.exe` command lines in a command prompt window: - - If you're migrating domain accounts, enter: + - If migrating domain accounts, enter: ```cmd LoadState.exe \\server\share\migration\mystore /i:MigDocs.xml /i:MigApp.xml ``` - - If you're migrating local accounts along with domain accounts, enter: + - If migrating local accounts along with domain accounts, enter: ```cmd LoadState.exe \\server\share\migration\mystore /i:MigDocs.xml /i:MigApp.xml /lac /lae ``` > [!NOTE] - > You do not have to specify the `/lae` option, which enables the account that was created with the `/lac` option. Instead, you can create a disabled local account by specifying only the `/lac` option, and then a local administrator needs to enable the account on the destination computer. + > + > The `/lae` option doesn't need to be specified, which enables the account that was created with the `/lac` option. Instead, create a disabled local account by specifying only the `/lac` option, and then a local administrator needs to enable the account on the destination computer. ## To migrate two domain accounts (User1 and User2) @@ -51,15 +56,15 @@ Links to detailed explanations of commands are available in the [Related article 1. Sign into the source computer as an administrator. -2. Enter the following `ScanState.exe` command line in a command prompt window: +1. Enter the following `ScanState.exe` command line in a command prompt window: ```cmd ScanState.exe \\server\share\migration\mystore /ue:*\* /ui:contoso\user1 /ui:fabrikam\user2 /i:MigDocs.xml /i:MigApp.xml /o ``` -3. Sign into the destination computer as an administrator. +1. Sign into the destination computer as an administrator. -4. Enter the following `LoadState.exe ` command line in a command prompt window: +1. Enter the following `LoadState.exe` command line in a command prompt window: ```cmd LoadState.exe \\server\share\migration\mystore /i:MigDocs.xml /i:MigApp.xml @@ -71,15 +76,15 @@ Links to detailed explanations of commands are available in the [Related article 1. Sign into the source computer as an administrator. -2. Enter the following `ScanState.exe` command line in a command prompt window: +1. Enter the following `ScanState.exe` command line in a command prompt window: ```cmd ScanState.exe \\server\share\migration\mystore /ue:*\* /ui:contoso\user1 /ui:contoso\user2 /i:MigDocs.xml /i:MigApp.xml /o ``` -3. Sign into the destination computer as an administrator. +1. Sign into the destination computer as an administrator. -4. Enter the following `LoadState.exe ` command line in a command prompt window: +1. Enter the following `LoadState.exe` command line in a command prompt window: ```cmd LoadState.exe \\server\share\migration\mystore /mu:contoso\user1:fabrikam\user1 /mu:contoso\user2:fabrikam\user2 /i:MigDocs.xml /i:MigApp.xml @@ -87,8 +92,6 @@ Links to detailed explanations of commands are available in the [Related article ## Related articles -[Identify users](usmt-identify-users.md) - -[ScanState syntax](usmt-scanstate-syntax.md) - -[LoadState syntax](usmt-loadstate-syntax.md) +- [Identify users](usmt-identify-users.md). +- [ScanState syntax](usmt-scanstate-syntax.md). +- [LoadState syntax](usmt-loadstate-syntax.md). diff --git a/windows/deployment/usmt/usmt-migration-store-encryption.md b/windows/deployment/usmt/usmt-migration-store-encryption.md index f136ae0f31..0a21f770cd 100644 --- a/windows/deployment/usmt/usmt-migration-store-encryption.md +++ b/windows/deployment/usmt/usmt-migration-store-encryption.md @@ -1,24 +1,28 @@ --- -title: Migration Store Encryption (Windows 10) +title: Migration Store Encryption description: Learn how the User State Migration Tool (USMT) enables support for stronger encryption algorithms, called Advanced Encryption Standard (AES). +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Migration store encryption -This article discusses User State Migration Tool (USMT) 10.0 options for migration store encryption to protect the integrity of user data during a migration. +This article discusses User State Migration Tool (USMT) options for migration store encryption to protect the integrity of user data during a migration. ## USMT encryption options USMT enables support for stronger encryption algorithms, called Advanced Encryption Standard (AES), in several bit-level options. AES is a National Institute of Standards and Technology (NIST) specification for the encryption of electronic data. -The encryption algorithm you choose must be specified for both the `ScanState.exe` and the `LoadState.exe` commands, so that these commands can create or read the store during encryption and decryption. The new encryption algorithms can be specified on the `ScanState.exe` and the `LoadState.exe` command lines by using the `/encrypt`:*encryptionstrength* and the `/decrypt`:*encryptionstrength* command-line options. All of the encryption application programming interfaces (APIs) used by USMT are available in Windows 7, Windows 8, and Windows 10 operating systems. However, export restrictions might limit the set of algorithms that are available to computers in certain locales. You can use the `UsmtUtils.exe` file to determine which encryption algorithms are available to the computers' locales before you begin the migration. +The chosen encryption algorithm must be specified for both the `ScanState.exe` and the `LoadState.exe` commands, so that these commands can create or read the store during encryption and decryption. The new encryption algorithms can be specified on the `ScanState.exe` and the `LoadState.exe` command lines by using the `/encrypt`:*encryption_strength* and the `/decrypt`:*encryption_strength* command-line options. All of the encryption application programming interfaces (APIs) used by USMT are available in currently supported versions of Windows. However, export restrictions might limit the set of algorithms that are available to computers in certain locales. The `UsmtUtils.exe` file can be used to determine which encryption algorithms are available to the computers' locales before the migration begins. The following table describes the command-line encryption options in USMT. @@ -28,8 +32,9 @@ The following table describes the command-line encryption options in USMT. |*LoadState*|**/decrypt**<*AES, AES_128, AES_192, AES_256, 3DES, 3DES_112*>|This option and argument specify that the store must be decrypted and which algorithm to use. When the algorithm argument isn't provided, the **LoadState** tool employs the **3DES** algorithm.| > [!IMPORTANT] -> Some encryption algorithms may not be available on your systems. You can verify which algorithms are available by running the `UsmtUtils.exe` command with the `/ec` option. For more information, see [UsmtUtils syntax](usmt-utilities.md). +> +> Some encryption algorithms might not be available on some systems. Which algorithms are available can be verified by running the `UsmtUtils.exe` command with the `/ec` option. For more information, see [UsmtUtils syntax](usmt-utilities.md). ## Related articles -[Plan your migration](usmt-plan-your-migration.md) +- [Plan the migration](usmt-plan-your-migration.md). diff --git a/windows/deployment/usmt/usmt-overview.md b/windows/deployment/usmt/usmt-overview.md index dae39a70bd..7f7d552536 100644 --- a/windows/deployment/usmt/usmt-overview.md +++ b/windows/deployment/usmt/usmt-overview.md @@ -1,27 +1,33 @@ --- title: User State Migration Tool (USMT) overview -description: Learn about using User State Migration Tool (USMT) 10.0 to streamline and simplify user state migration during large deployments of Windows operating systems. +description: Learn about using User State Migration Tool (USMT) to streamline and simplify user state migration during large deployments of Windows operating systems. ms.prod: windows-client ms.technology: itpro-deploy author: frankroj +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: overview ms.collection: - highpri - tier2 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # User State Migration Tool (USMT) overview -You can use User State Migration Tool (USMT) 10.0 to streamline and simplify user state migration during large deployments of Windows operating systems. USMT captures user accounts, user files, operating system settings, and application settings, and then migrates them to a new Windows installation. You can use USMT for both PC replacement and PC refresh migrations. For more information, see [Common migration scenarios](usmt-common-migration-scenarios.md). +The User State Migration Tool (USMT) can be used to streamline and simplify user state migration during large deployments of Windows operating systems. USMT captures user accounts, user files, operating system settings, and application settings, and then migrates them to a new Windows installation. USMT can be used for both PC replacement and PC refresh migrations. For more information, see [Common migration scenarios](usmt-common-migration-scenarios.md). -USMT enables you to do the following actions: +USMT enables the following actions: -- Configure your migration according to your business needs by using the migration rule (.xml) files to control exactly which files and settings are migrated and how they're migrated. For more information about how to modify these files, see [USMT XML reference](usmt-xml-reference.md). -- Fit your customized migration into your automated deployment process by using the **ScanState** and **LoadState** tools, which control collecting and restoring the user files and settings. For more information, see [User State Migration Tool (USMT) command-line syntax](usmt-command-line-syntax.md). -- Perform offline migrations. You can run migrations offline by using the ScanState command in Windows Preinstallation Environment (WinPE) or you can perform migrations from previous installations of Windows contained in Windows.old directories. For more information about migration types, see [Choose a migration store Type](usmt-choose-migration-store-type.md) and [Offline migration reference](offline-migration-reference.md). +- Configure the migration according to the organization's business needs by using the migration rule (.xml) files to control exactly which files and settings are migrated and how they're migrated. For more information about how to modify these files, see [USMT XML reference](usmt-xml-reference.md). + +- Fit the customized migration into the automated deployment process by using the **ScanState** and **LoadState** tools, which control collecting and restoring the user files and settings. For more information, see [User State Migration Tool (USMT) command-line syntax](usmt-command-line-syntax.md). + +- Perform offline migrations. Migrations can be run offline by using the **ScanState** command in Windows Preinstallation Environment (WinPE) or migrations can be performed from previous installations of Windows contained in **Windows.old** directories. For more information about migration types, see [Choose a migration store Type](usmt-choose-migration-store-type.md) and [Offline migration reference](offline-migration-reference.md). ## Benefits @@ -36,7 +42,7 @@ USMT provides the following benefits to businesses that are deploying Windows op ## Limitations -USMT is intended for administrators who are performing large-scale automated deployments. If you're only migrating the user states of a few computers, you can use [PCmover Express](https://go.microsoft.com/fwlink/?linkid=620915). PCmover isn't a free utility. PCmover Express is a tool created by Microsoft's partner, Laplink. +USMT is intended for administrators who are performing large-scale automated deployments. If the user states of only a few computers are being migrated, [PCmover Express](https://go.microsoft.com/fwlink/?linkid=620915) can be used. PCmover isn't a free utility. PCmover Express is a tool created by Microsoft's partner, Laplink. There are some scenarios in which the use of USMT isn't recommended. These scenarios include: @@ -45,4 +51,4 @@ There are some scenarios in which the use of USMT isn't recommended. These scena ## Related articles -- [User State Migration Tool (USMT) technical reference](usmt-technical-reference.md) +- [User State Migration Tool (USMT) technical reference](usmt-technical-reference.md). diff --git a/windows/deployment/usmt/usmt-plan-your-migration.md b/windows/deployment/usmt/usmt-plan-your-migration.md index e7f255af34..259b476d8b 100644 --- a/windows/deployment/usmt/usmt-plan-your-migration.md +++ b/windows/deployment/usmt/usmt-plan-your-migration.md @@ -1,33 +1,37 @@ --- -title: Plan Your Migration (Windows 10) -description: Learn how to your plan your migration carefully so your migration can proceed smoothly and so that you reduce the risk of migration failure. +title: Plan The Migration +description: Learn how to plan the migration carefully so the migration can proceed smoothly and so that the risk of migration failure is reduced. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- -# Plan your migration +# Plan the migration -Before you use the User State Migration Tool (USMT) 10.0 to perform your migration, we recommend that you plan your migration carefully. Planning can help your migration proceed smoothly and can reduce the risk of migration failure. +Before using the User State Migration Tool (USMT) to perform a migration, Microsoft recommends that to plan the migration carefully. Planning can help the migration proceed smoothly and can reduce the risk of migration failure. -In migration planning, both organizations and individuals must first identify what to migrate, including user settings, applications and application settings, and personal data files and folders. Identifying the applications to migrate is especially important so that you can avoid capturing data about applications that may be phased out. +In migration planning, both organizations and individuals must first identify what to migrate, including user settings, applications and application settings, and personal data files and folders. Identifying the applications to migrate is especially important to avoid capturing data about applications that might be phased out. -One of the most important requirements for migrating settings and data is restoring only the information that the destination computer requires. Although the data that you capture on the source computer may be more comprehensive than the restoration data for backup purposes, restoring data or settings for applications that you won't install on the destination system is redundant. Restoring data or settings for applications that aren't installed can also introduce instability in a newly deployed computer. +One of the most important requirements for migrating settings and data is restoring only the information that the destination computer requires. Although the data that is captured on the source computer might be more comprehensive than the restoration data for backup purposes, restoring data or settings for applications that aren't installed on the destination system is redundant. Restoring data or settings for applications that aren't installed can also introduce instability in a newly deployed computer. ## In this section | Link | Description | |--- |--- | -|[Common migration scenarios](usmt-common-migration-scenarios.md)|Determine whether you'll perform a refresh migration or a replace migration.| +|[Common migration scenarios](usmt-common-migration-scenarios.md)|Determine whether to perform a refresh migration or a replace migration.| |[What does USMT migrate?](usmt-what-does-usmt-migrate.md)|Learn which applications, user data, and operating system components USMT migrates.| |[Choose a migration store type](usmt-choose-migration-store-type.md)|Choose an uncompressed, compressed, or hard-link migration store.| -|[Determine what to migrate](usmt-determine-what-to-migrate.md)|Identify user accounts, application settings, operating system settings, and files that you want to migrate inside your organization.| -|[Test your migration](usmt-test-your-migration.md)|Test your migration before you deploy Windows to all users.| +|[Determine what to migrate](usmt-determine-what-to-migrate.md)|Identify user accounts, application settings, operating system settings, and files that need to be migrated inside the organization.| +|[Test the migration](usmt-test-your-migration.md)|Test the migration before deploying Windows to all users.| ## Related articles -[USMT XML reference](usmt-xml-reference.md) +- [USMT XML reference](usmt-xml-reference.md). diff --git a/windows/deployment/usmt/usmt-recognized-environment-variables.md b/windows/deployment/usmt/usmt-recognized-environment-variables.md index 7e377402d1..c981506fa9 100644 --- a/windows/deployment/usmt/usmt-recognized-environment-variables.md +++ b/windows/deployment/usmt/usmt-recognized-environment-variables.md @@ -1,25 +1,29 @@ --- title: Recognized environment variables -description: Learn how to use environment variables to identify folders that may be different on different computers. +description: Learn how to use environment variables to identify folders that can be different on different computers. ms.prod: windows-client ms.technology: itpro-deploy +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: conceptual ms.collection: - highpri - tier2 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Recognized environment variables -When using the XML files `MigDocs.xml`, `MigApp.xml`, and `MigUser.xml`, you can use environment variables to identify folders that may be different on different computers. Constant special item ID list (CSIDL) values provide a way to identify folders that applications use frequently but may not have the same name or location on any given computer. For example, the **Documents** folder may be `C:\Users\\My Documents` on one computer and `C:\Documents and Settings\\My Documents` on another. You can use the asterisk (\*) wildcard character in `MigUser.xml`, `MigApp.xml` and `MigDoc.xml` files. However, you can't use the asterisk (\*) wildcard characters in the `Config.xml` file. +When the XML files `MigDocs.xml`, `MigApp.xml`, and `MigUser.xml` are used, the environment variables can be used to identify folders that can be different on different computers. Constant special item ID list (CSIDL) values provide a way to identify folders that applications use frequently but could have different names or locations on any given computer. For example, the **Documents** folder could be `C:\Users\\Documents` on one computer and `C:\Users\\My Documents` on another. The asterisk (\*) wildcard character can be used in the `MigUser.xml`, `MigApp.xml` and `MigDoc.xml` files. However, the asterisk (\*) wildcard character can't be used in the `Config.xml` file. ## Variables that are processed for the operating system and in the context of each user -You can use these variables within sections in the .xml files with `context=UserAndSystem`, `context=User`, and `context=System`. +These variables can be used within sections in the **.xml** files with `context=UserAndSystem`, `context=User`, and `context=System`. |Variable|Explanation| |--- |--- | @@ -40,8 +44,8 @@ You can use these variables within sections in the .xml files with `context=User |*CSIDL_COMMON_STARTUP*|The file-system directory that contains the programs that appear in the Startup folder for all users. A typical path is `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup`.| |*CSIDL_COMMON_TEMPLATES*|The file-system directory that contains the templates that are available to all users. A typical path is `C:\ProgramData\Microsoft\Windows\Templates`.| |*CSIDL_COMMON_VIDEO*|The file-system directory that serves as a repository for video files common to all users. A typical path is `C:\Users\Public\Videos`.| -|*CSIDL_DEFAULT_APPDATA*|Refers to the Appdata folder inside `%DEFAULTUSERPROFILE%`.| -|C*SIDL_DEFAULT_LOCAL_APPDATA*|Refers to the local Appdata folder inside `%DEFAULTUSERPROFILE%`.| +|*CSIDL_DEFAULT_APPDATA*|Refers to the `Appdata` folder inside `%DEFAULTUSERPROFILE%`.| +|C*SIDL_DEFAULT_LOCAL_APPDATA*|Refers to the local `Appdata` folder inside `%DEFAULTUSERPROFILE%`.| |*CSIDL_DEFAULT_COOKIES*|Refers to the Cookies folder inside `%DEFAULTUSERPROFILE%`.| |*CSIDL_DEFAULT_CONTACTS*|Refers to the Contacts folder inside `%DEFAULTUSERPROFILE%`.| |*CSIDL_DEFAULT_DESKTOP*|Refers to the Desktop folder inside `%DEFAULTUSERPROFILE%`.| @@ -50,10 +54,10 @@ You can use these variables within sections in the .xml files with `context=User |*CSIDL_DEFAULT_HISTORY*|Refers to the History folder inside `%DEFAULTUSERPROFILE%`.| |*CSIDL_DEFAULT_INTERNET_CACHE*|Refers to the Internet Cache folder inside `%DEFAULTUSERPROFILE%`.| |*CSIDL_DEFAULT_PERSONAL*|Refers to the Personal folder inside `%DEFAULTUSERPROFILE%`.| -|*CSIDL_DEFAULT_MYDOCUMENTS*|Refers to the My Documents folder inside `%DEFAULTUSERPROFILE%`.| -|*CSIDL_DEFAULT_MYPICTURES*|Refers to the My Pictures folder inside `%DEFAULTUSERPROFILE%`.| -|*CSIDL_DEFAULT_MYMUSIC*|Refers to the My Music folder inside `%DEFAULTUSERPROFILE%`.| -|*CSIDL_DEFAULT_MYVIDEO*|Refers to the My Videos folder inside `%DEFAULTUSERPROFILE%`.| +|*CSIDL_DEFAULT_MYDOCUMENTS*|Refers to the Documents folder inside `%DEFAULTUSERPROFILE%`.| +|*CSIDL_DEFAULT_MYPICTURES*|Refers to the Pictures folder inside `%DEFAULTUSERPROFILE%`.| +|*CSIDL_DEFAULT_MYMUSIC*|Refers to the Music folder inside `%DEFAULTUSERPROFILE%`.| +|*CSIDL_DEFAULT_MYVIDEO*|Refers to the Videos folder inside `%DEFAULTUSERPROFILE%`.| |*CSIDL_DEFAULT_RECENT*|Refers to the Recent folder inside `%DEFAULTUSERPROFILE%`.| |*CSIDL_DEFAULT_SENDTO*|Refers to the Send To folder inside `%DEFAULTUSERPROFILE%`.| |*CSIDL_DEFAULT_STARTMENU*|Refers to the Start Menu folder inside `%DEFAULTUSERPROFILE%`.| @@ -83,12 +87,12 @@ You can use these variables within sections in the .xml files with `context=User ## Variables that are recognized only in the user context -You can use these variables in the .xml files within sections with `context=User` and `context=UserAndSystem`. +These variables can be used in the **.xml** files within sections with `context=User` and `context=UserAndSystem`. |Variable|Explanation| |--- |--- | |*APPDATA*|Same as **CSIDL_APPDATA**.| -|*CSIDL_ADMINTOOLS*|The file-system directory that is used to store administrative tools for an individual user. The Microsoft® Management Console (MMC) saves customized consoles to this directory, which roams with the user profile.| +|*CSIDL_ADMINTOOLS*|The file-system directory that is used to store administrative tools for an individual user. The Microsoft Management Console (MMC) saves customized consoles to this directory, which roams with the user profile.| |*CSIDL_ALTSTARTUP*|The file-system directory that corresponds to the user's non-localized Startup program group.| |*CSIDL_APPDATA*|The file-system directory that serves as a common repository for application-specific data. A typical path is `C:\Users\\AppData\Roaming`.| |*CSIDL_BITBUCKET*|The virtual folder that contains the objects in the user's Recycle Bin.| @@ -99,20 +103,20 @@ You can use these variables in the .xml files within sections with `context=User |*CSIDL_COOKIES*|The file-system directory that serves as a common repository for Internet cookies. A typical path is `C:\Users\\AppData\Roaming\Microsoft\Windows\Cookies`.| |*CSIDL_DESKTOP*|The virtual folder representing the Windows desktop.| |*CSIDL_DESKTOPDIRECTORY*|The file-system directory used to physically store file objects on the desktop, which shouldn't be confused with the desktop folder itself. A typical path is `C:\Users\\Desktop`.| -|*CSIDL_DRIVES*|The virtual folder representing My Computer that contains everything on the local computer: storage devices, printers, and Control Panel. The folder may also contain mapped network drives.| +|*CSIDL_DRIVES*|The virtual folder representing **This PC** that contains everything on the local computer: storage devices, printers, and Control Panel. The folder could also contain mapped network drives.| |*CSIDL_FAVORITES*|The file-system directory that serves as a common repository for the user's favorites. A typical path is `C:\Users\\Favorites`.| |*CSIDL_HISTORY*|The file-system directory that serves as a common repository for Internet history items.| |*CSIDL_INTERNET*|A virtual folder for Internet Explorer.| |*CSIDL_INTERNET_CACHE*|The file-system directory that serves as a common repository for temporary Internet files. A typical path is `C:\Users\\AppData\Local\Microsoft\Windows\Temporary Internet Files`| |*CSIDL_LOCAL_APPDATA*|The file-system directory that serves as a data repository for local, non-roaming applications. A typical path is `C:\Users\\AppData\Local`.| -|*CSIDL_MYDOCUMENTS*|The virtual folder representing My Documents.A typical path is `C:\Users\\Documents`.| +|*CSIDL_MYDOCUMENTS*|The virtual folder representing the **Documents** folder.A typical path is `C:\Users\\Documents`.| |*CSIDL_MYMUSIC*|The file-system directory that serves as a common repository for music files. A typical path is `C:\Users\\Music`.| |*CSIDL_MYPICTURES*|The file-system directory that serves as a common repository for image files. A typical path is `C:\Users\\Pictures`.| |*CSIDL_MYVIDEO*|The file-system directory that serves as a common repository for video files. A typical path is `C:\Users\\Videos`.| -|*CSIDL_NETHOOD*|A file-system directory that contains the link objects that may exist in the My Network Places virtual folder. It isn't the same as *CSIDL_NETWORK*, which represents the network namespace root. A typical path is `C:\Users\\AppData\Roaming\Microsoft\Windows\Network Shortcuts`.| -|*CSIDL_NETWORK*|A virtual folder representing My Network Places, the root of the network namespace hierarchy.| -|*CSIDL_PERSONAL*|The virtual folder representing the My Documents desktop item. This value is equivalent to **CSIDL_MYDOCUMENTS**. A typical path is `C:\Documents and Settings\\My Documents`.| -|*CSIDL_PLAYLISTS*|The virtual folder used to store play albums, typically `C:\Users\\My Music\Playlists`.| +|*CSIDL_NETHOOD*|A file-system directory that contains the link objects that could exist in the **Network** virtual folder. It isn't the same as *CSIDL_NETWORK*, which represents the network namespace root. A typical path is `C:\Users\\AppData\Roaming\Microsoft\Windows\Network Shortcuts`.| +|*CSIDL_NETWORK*|A virtual folder representing the **Network** desktop item, the root of the network namespace hierarchy.| +|*CSIDL_PERSONAL*|The virtual folder representing the **\** desktop item. This value is equivalent to **CSIDL_MYDOCUMENTS**. A typical path is `C:\User\\Documents`.| +|*CSIDL_PLAYLISTS*|The virtual folder used to store play albums, typically `C:\Users\\Music\Playlists`.| |*CSIDL_PRINTERS*|The virtual folder that contains installed printers.| |*CSIDL_PRINTHOOD*|The file-system directory that contains the link objects that can exist in the Printers virtual folder. A typical path is `C:\Users\\AppData\Roaming\Microsoft\Windows\Printer Shortcuts`.| |*CSIDL_PROFILE*|The user's profile folder. A typical path is `C:\Users\`.| diff --git a/windows/deployment/usmt/usmt-reference.md b/windows/deployment/usmt/usmt-reference.md index fdf20145f0..d9e5035776 100644 --- a/windows/deployment/usmt/usmt-reference.md +++ b/windows/deployment/usmt/usmt-reference.md @@ -1,13 +1,17 @@ --- -title: User State Migration Toolkit (USMT) Reference (Windows 10) +title: User State Migration Toolkit (USMT) Reference description: Use this User State Migration Toolkit (USMT) article to learn details about USMT, like operating system, hardware, and software requirements, and user prerequisites. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # User State Migration Toolkit (USMT) reference @@ -18,16 +22,14 @@ ms.technology: itpro-deploy |--- |--- | |[USMT requirements](usmt-requirements.md)|Describes operating system, hardware, and software requirements, and user prerequisites.| |[USMT best practices](usmt-best-practices.md)|Discusses general and security-related best practices when using USMT.| -|[How USMT works](usmt-how-it-works.md)|Learn about the processes behind the ScanState and LoadState tools.| -|[Plan your migration](usmt-plan-your-migration.md)|Choose what to migrate and the best migration scenario for your enterprise.| +|[How USMT works](usmt-how-it-works.md)|Learn about the processes behind the **ScanState** and **LoadState** tools.| +|[Plan the migration](usmt-plan-your-migration.md)|Choose what to migrate and the best migration scenario for the organization.| |[User State Migration Tool (USMT) command-line syntax](usmt-command-line-syntax.md)|Explore command-line options for the ScanState, LoadState, and UsmtUtils tools.| |[USMT XML reference](usmt-xml-reference.md)|Learn about customizing a migration with XML files.| |[Offline Migration reference](offline-migration-reference.md)|Find requirements, best practices, and other considerations for performing a migration offline.| ## Related articles -[User State Migration Tool (USMT) overview topics](usmt-topics.md) - -[User State Migration Tool (USMT) how-to topics](usmt-how-to.md) - -[User State Migration Tool (USMT) troubleshooting](usmt-troubleshooting.md) +- [User State Migration Tool (USMT) overview articles](usmt-topics.md). +- [User State Migration Tool (USMT) how-to articles](usmt-how-to.md). +- [User State Migration Tool (USMT) troubleshooting](usmt-troubleshooting.md). diff --git a/windows/deployment/usmt/usmt-requirements.md b/windows/deployment/usmt/usmt-requirements.md index 87a290ad93..eb7ed1c382 100644 --- a/windows/deployment/usmt/usmt-requirements.md +++ b/windows/deployment/usmt/usmt-requirements.md @@ -1,59 +1,73 @@ --- -title: USMT Requirements (Windows 10) +title: USMT Requirements description: While the User State Migration Tool (USMT) doesn't have many requirements, these tips and tricks can help smooth the migration process. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/18/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # USMT requirements ## Supported operating systems -The User State Migration Tool (USMT) 10.0 doesn't have any explicit RAM or CPU speed requirements for either the source or destination computers. If your computer complies with the system requirements of the operating system, it also complies with the requirements for USMT. You need an intermediate store location large enough to hold all of the migrated data and settings, and the same amount of hard disk space on the destination computer for the migrated files and settings. +The User State Migration Tool (USMT) doesn't have any explicit RAM or CPU speed requirements for either the source or destination computers. If the computer complies with the system requirements of the operating system, it also complies with the requirements for USMT. An intermediate store location large enough to hold all of the migrated data and settings is needed. The same amount of hard disk space is also needed on the destination computer for the migrated files and settings. The following table lists the operating systems supported in USMT. -|Operating Systems|ScanState (source computer)|LoadState (destination computer)| +| Operating
Systems | ScanState
(Source
Device)| LoadState
(Destination
Device)| |--- |--- |--- | -|32-bit versions of Windows 7|✔️|✔️| -|64-bit versions of Windows 7|✔️|✔️| -|32-bit versions of Windows 8|✔️|✔️| -|64-bit versions of Windows 8|✔️|✔️| -|32-bit versions of Windows 10|✔️|✔️| -|64-bit versions of Windows 10|✔️|✔️| +|Windows 7|✔️|❌| +|Windows 8|✔️|❌| +|Windows 10|✔️|✔️| +|Windows 11|✔️|✔️| > [!NOTE] -> You can migrate a 32-bit operating system to a 64-bit operating system. However, you cannot migrate a 64-bit operating system to a 32-bit operating system. +> +> - 32-bit operating system can be migrated to a 64-bit operating system. However, a 64-bit operating system can't be migrated to a 32-bit operating system. +> +> - Gathering data from a source device using **ScanState** for a version of Windows that is out of support is supported. However, restoring data to a destination device using **LoadState** to a version of Windows that is out of support isn't supported. ## Unsupported scenarios -- USMT doesn't support any of the Windows Server® operating systems. -- USMT for Windows 10 shouldn't be used for migrating between previous versions of Windows. USMT for Windows 10 is only meant to migrate to Windows 10 or between Windows 10 versions. For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) overview](/previous-versions/windows/hh825227(v=win.10)). +- USMT doesn't support any of the Windows Server operating systems. +- USMT doesn't support Microsoft Entra joined devices as either a source or destination device. +- USMT might work with Microsoft Entra hybrid joined devices, but it's not a tested scenario so therefore unsupported. +- USMT doesn't support migrating settings for Microsoft Store apps. +- USMT shouldn't be used for migrating between previous versions of Windows. USMT is only meant to: + - Migrate to a currently supported version of Windows + - Migrate between currently supported versions of Windows, assuming the version of Windows being migrated to is newer or the same as the previous version of Windows being migrated from. + +For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) overview](/previous-versions/windows/hh825227(v=win.10)). ## Windows PE -- **Must use latest version of Windows PE.** For example, to migrate to Windows 10, you'll need Windows PE 5.1. For more info, see [What's New in Windows PE](/windows-hardware/manufacture/desktop/whats-new-in-windows-pe-s14). +- **Must use latest version of Windows PE.** For more info, see [What's New in Windows PE](/windows-hardware/manufacture/desktop/whats-new-in-windows-pe-s14). ## Credentials -- **Run as administrator** - When manually running the **ScanState** and **LoadState** tools on Windows 7, Windows 8, or Windows 10 you must run them from an elevated command prompt to ensure that all specified users are migrated. If you don't run USMT from an elevated prompt, only the user profile that is logged on will be included in the migration. +- **Run as administrator.** + + When the **ScanState** and **LoadState** tools are run, they must be run from an elevated command prompt to ensure that all specified users are migrated. If USMT isn't run from an elevated prompt, only the user profile that is logged on is included in the migration. To open an elevated command prompt: 1. Select **Start**. -2. Enter `cmd` in the search function. -3. Depending on the OS you're using, **cmd** or **Command Prompt** is displayed. -4. Right-click **cmd** or **Command Prompt**, and then select **Run as administrator**. -5. If the current user isn't already an administrator, you'll be prompted to enter administrator credentials. +1. Enter `cmd` in the search function. +1. **cmd** or **Command Prompt** is displayed. +1. Right-click **cmd** or **Command Prompt**, and then select **Run as administrator**. +1. If the current user isn't already an administrator, it prompts to enter administrator credentials. > [!IMPORTANT] -> You must run USMT using an account with full administrative permissions, including the following privileges: +> +> USMT must run using an account with full administrative permissions, including the following privileges: > > - SeBackupPrivilege (Back up files and directories) > - SeDebugPrivilege (Debug programs) @@ -63,9 +77,9 @@ To open an elevated command prompt: ## Config.xml -### Specify the `/c` option and <ErrorControl> settings in the `Config.xml` file +### Specify the `/c` option and \ settings in the `Config.xml` file -USMT will fail if it can't migrate a file or setting, unless you specify the `/c` option. When you specify the `/c` option, USMT logs an error each time it encounters a file that is in use that didn't migrate, but the migration won't be interrupted. In USMT, you can specify in the `Config.xml` file, which types of errors should allow the migration to continue, and which should cause the migration to fail. For more information about error reporting, and the **<ErrorControl>** element, see [Config.xml file](usmt-configxml-file.md#errorcontrol), [Log files](usmt-log-files.md), and [XML elements library](usmt-xml-elements-library.md). +USMT fails if it can't migrate a file or setting, unless the `/c` option is specified. When the `/c` option is specified, USMT logs an error each time it encounters a file that is in use that didn't migrate, but the migration isn't be interrupted. In USMT, which types of errors should allow the migration to continue and which should cause the migration to fail can be specified in the `Config.xml` file. For more information about error reporting, and the **\** element, see [Config.xml file](usmt-configxml-file.md#errorcontrol), [Log files](usmt-log-files.md), and [XML elements library](usmt-xml-elements-library.md). ## LoadState @@ -88,6 +102,6 @@ This documentation assumes that IT professionals using USMT understand command-l ## Related articles -- [Plan your migration](usmt-plan-your-migration.md) -- [Estimate migration store size](usmt-estimate-migration-store-size.md) -- [User State Migration Tool (USMT) overview topics](usmt-topics.md) +- [Plan the migration](usmt-plan-your-migration.md). +- [Estimate migration store size](usmt-estimate-migration-store-size.md). +- [User State Migration Tool (USMT) overview articles](usmt-topics.md). diff --git a/windows/deployment/usmt/usmt-reroute-files-and-settings.md b/windows/deployment/usmt/usmt-reroute-files-and-settings.md index 8edfb43a05..e1d3c09748 100644 --- a/windows/deployment/usmt/usmt-reroute-files-and-settings.md +++ b/windows/deployment/usmt/usmt-reroute-files-and-settings.md @@ -1,22 +1,26 @@ --- -title: Reroute Files and Settings (Windows 10) +title: Reroute Files and Settings description: Learn how to create a custom .xml file and specify this file name on both the ScanState and LoadState command lines to reroute files and settings. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # Reroute Files and Settings -To reroute files and settings, create a custom .xml file and specify the .xml file name on both the `ScanState.exe` and `LoadState.exe` command-lines. Th custom .xml file enables you to keep your changes separate from the default .xml files, so that it's easier to track your modifications. +To reroute files and settings, create a custom **.xml** file and specify the **.xml** file name on both the `ScanState.exe` and `LoadState.exe` command-lines. The custom **.xml** file enables keeping changes separate from the default **.xml** files, so that it's easier to track modifications. ## Reroute a folder -The following custom .xml file migrates the directories and files from `C:\EngineeringDrafts` into the **My Documents** folder of every user. **%CSIDL_PERSONAL%** is the virtual folder representing the **My Documents** desktop item, which is equivalent to **CSIDL_MYDOCUMENTS**. +The following custom **.xml** file migrates the directories and files from `C:\EngineeringDrafts` into the **Documents** folder of every user. **%CSIDL_PERSONAL%** is the virtual folder representing the **\** desktop item, which is equivalent to **CSIDL_MYDOCUMENTS**. ```xml @@ -44,12 +48,12 @@ The following custom .xml file migrates the directories and files from `C:\Engin ## Reroute a specific file type -The following custom .xml file reroutes .mp3 files located in the fixed drives on the source computer into the `C:\Music` folder on the destination computer. +The following custom **.xml** file reroutes **.mp3** files located in the fixed drives on the source computer into the `C:\Music` folder on the destination computer. ```xml - All .mp3 files to My Documents + All .mp3 files to the Documents folder @@ -71,12 +75,12 @@ The following custom .xml file reroutes .mp3 files located in the fixed drives o ## Reroute a specific file -The following custom .xml file migrates the `Sample.doc` file from `C:\EngineeringDrafts` into the **My Documents** folder of every user. **%CSIDL_PERSONAL%** is the virtual folder representing the **My Documents** desktop item, which is equivalent to **CSIDL_MYDOCUMENTS**. +The following custom **.xml** file migrates the `Sample.doc` file from `C:\EngineeringDrafts` into the **Documents** folder of every user. **%CSIDL_PERSONAL%** is the virtual folder representing the **\** desktop item, which is equivalent to **CSIDL_MYDOCUMENTS**. ```xml -Sample.doc into My Documents +Sample.doc into the Documents folder @@ -97,8 +101,6 @@ The following custom .xml file migrates the `Sample.doc` file from `C:\Engineeri ## Related articles -[Customize USMT XML files](usmt-customize-xml-files.md) - -[Conflicts and precedence](usmt-conflicts-and-precedence.md) - -[USMT XML reference](usmt-xml-reference.md) +- [Customize USMT XML files](usmt-customize-xml-files.md). +- [Conflicts and precedence](usmt-conflicts-and-precedence.md). +- [USMT XML reference](usmt-xml-reference.md). diff --git a/windows/deployment/usmt/usmt-resources.md b/windows/deployment/usmt/usmt-resources.md index 63e2f70b4c..3eb634db20 100644 --- a/windows/deployment/usmt/usmt-resources.md +++ b/windows/deployment/usmt/usmt-resources.md @@ -1,35 +1,39 @@ --- -title: USMT Resources (Windows 10) +title: USMT Resources description: Learn about User State Migration Tool (USMT) online resources, including Microsoft Visual Studio and forums. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # USMT resources ## USMT online resources -- [ADK Release Notes](/windows-hardware/get-started/what-s-new-in-kits-and-tools) +- [ADK Release Notes](/windows-hardware/get-started/what-s-new-in-kits-and-tools). - Microsoft Visual Studio - - You can use the User State Migration Tool (USMT) XML schema (the `MigXML.xsd` file) to validate the migration .xml files using an XML authoring tool such as Microsoft® Visual Studio®. + - The User State Migration Tool (USMT) XML schema (the `MigXML.xsd` file) can be used to validate the migration **.xml** files using an XML authoring tool such as Microsoft Visual Studio. - For more information about how to use the schema with your XML authoring environment, see the environment's documentation. + For more information about how to use the schema with an XML authoring environment, see the environment's documentation. -- [Ask the Directory Services Team blog](https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/bg-p/AskDS) +- [Ask the Directory Services Team blog](https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/bg-p/AskDS). - Forums: - - [Microsoft Deployment Toolkit forum](/answers/topics/mem-mdt.html) + - [Microsoft Deployment Toolkit forum](/answers/topics/mem-mdt.html). - - [Configuration Manager Operating System Deployment forum](/answers/topics/mem-cm-osd.html) + - [Configuration Manager Operating System Deployment forum](/answers/topics/mem-cm-osd.html). ## Related articles -[User State Migration Tool (USMT) overview topics](usmt-topics.md) +[User State Migration Tool (USMT) overview articles](usmt-topics.md). diff --git a/windows/deployment/usmt/usmt-scanstate-syntax.md b/windows/deployment/usmt/usmt-scanstate-syntax.md index d8ee510c34..7ac1922e48 100644 --- a/windows/deployment/usmt/usmt-scanstate-syntax.md +++ b/windows/deployment/usmt/usmt-scanstate-syntax.md @@ -1,40 +1,44 @@ --- -title: ScanState Syntax (Windows 10) -description: The ScanState command is used with the User State Migration Tool (USMT) 10.0 to scan the source computer, collect the files and settings, and create a store. +title: ScanState Syntax +description: The ScanState command is used with the User State Migration Tool (USMT) to scan the source computer, collect the files and settings, and create a store. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # ScanState syntax -The `ScanState.exe` command is used with the User State Migration Tool (USMT) 10.0 to scan the source computer, collect the files and settings, and create a store. This article discusses the `ScanState.exe` command syntax and the options available with it. +The `ScanState.exe` command is used with the User State Migration Tool (USMT) to scan the source computer, collect the files and settings, and create a store. This article discusses the `ScanState.exe` command syntax and the options available with it. -## Before you begin +## Before beginning -Before you run the `ScanState.exe` command, note the items: +Before running the `ScanState.exe` command, note the items: -- To ensure that all operating system settings migrate, in most cases you must run the `ScanState.exe` commands in administrator mode from an account with administrative credentials. +- To ensure that all operating system settings migrate, in run the `ScanState.exe` commands in administrator mode from an account with administrative credentials. -- If you encrypt the migration store, you'll be required to enter an encryption key or a path to a file containing the encryption key. Be sure to make note of the key or the key file location, because this information isn't kept anywhere in the migration store. You'll need this information when you run the `LoadState.exe` command to decrypt the migration store, or if you need to run the recovery utility. An incorrect or missing key or key file results in an error message. +- If the migration store is encrypted, an encryption key or a path to a file containing the encryption key is required. Be sure to make note of the key or the key file location, because this information isn't kept anywhere in the migration store. This information is needed when the `LoadState.exe` command is run to decrypt the migration store, or if the recovery utility needs to be used. An incorrect or missing key or key file results in an error message. - For information about software requirements for running the `ScanState.exe` command, see [USMT requirements](usmt-requirements.md). -- Unless otherwise noted, you can use each option only once when running a tool on the command line. +- Unless otherwise noted, use each option only once when running a tool on the command line. -- You can gather domain accounts without the source computer having domain controller access. This functionality is available without any extra configuration. +- Domain accounts can be gathered without the source computer having domain controller access. This functionality is available without any extra configuration. -- The [Incompatible command-line options](#incompatible-command-line-options) table lists which options you can use together and which command-line options are incompatible. +- The [Incompatible command-line options](#incompatible-command-line-options) table lists which options can be used together and which command-line options are incompatible. -- The directory location where you save the migration store will be excluded from the scan. For example, if you save the migration store to the root of the D drive, the D drive and all of its subdirectories will be excluded from the scan. +- The directory location where the migration store is saved is excluded from the scan. For example, if the migration store is saved to the root of the D drive, the D drive and all of its subdirectories is excluded from the scan. ## Syntax -This section explains the syntax and usage of the command-line options available when you use the `ScanState.exe` command. The options can be specified in any order. If the option contains a parameter, you can use either a colon or a space separator. +This section explains the syntax and usage of the command-line options available when using the `ScanState.exe` command. The options can be specified in any order. If the option contains a parameter, either a colon or a space separator can be used. The `ScanState.exe` command's syntax is: @@ -46,7 +50,7 @@ For example, to create a `Config.xml` file in the current directory, use: ScanState.exe /i:MigApp.xml /i:MigDocs.xml /genconfig:Config.xml /v:13 ``` -To create an encrypted store using the `Config.xml` file and the default migration .xml files, use: +To create an encrypted store using the `Config.xml` file and the default migration **.xml** files, use: `ScanState.exe \\server\share\migration\mystore /i:MigApp.xml /i:MigDocs.xml /o /config:Config.xml /v:13 /encrypt /key:"mykey"` @@ -54,94 +58,96 @@ To create an encrypted store using the `Config.xml` file and the default migrati | Command-Line Option | Description | |-----|-----| -| *StorePath* | Indicates a folder where files and settings will be saved. *StorePath* can't be `C:\`. You must specify the *StorePath* option in the `ScanState.exe` command, except when using the `/genconfig` option. You can't specify more than one *StorePath* location. | +| *StorePath* | Indicates a folder where files and settings are saved. *StorePath* can't be `C:\`. The *StorePath* option must be specified in the `ScanState.exe` command, except when using the `/genconfig` option. More than one *StorePath* location can't be specified. | | **/apps** | Scans the image for apps and includes them and their associated registry settings. | -| **/ppkg** [*<FileName>*] | Exports to a specific file location. | -| **/o** | Required to overwrite any existing data in the migration store or `Config.xml` file. If not specified, the `ScanState.exe` command will fail if the migration store already contains data. You can't use this option more than once on a command line. | -| **/vsc** | This option enables the volume shadow-copy service to migrate files that are locked or in use. This command-line option eliminates most file-locking errors that are typically encountered by the **<ErrorControl>** section.

This option is only used with the **ScanState** executable file and can't be combined with the `/hardlink` option. | +| **/ppkg** [*\*] | Exports to a specific file location. | +| **/o** | Required to overwrite any existing data in the migration store or `Config.xml` file. If not specified, the `ScanState.exe` command fails if the migration store already contains data. This option can't be used more than once on a command line. | +| **/vsc** | This option enables the volume shadow-copy service to migrate files that are locked or in use. This command-line option eliminates most file-locking errors that are typically encountered by the **\** section.

This option is only used with the **ScanState** executable file and can't be combined with the `/hardlink` option. | | **/hardlink** | Enables the creation of a hard-link migration store at the specified location. The `/nocompress` option must be specified with the `/hardlink` option. | -| **/encrypt** [{**/key:** *<KeyString>* | **/keyfile**:*<file>*]} | Encrypts the store with the specified key. Encryption is disabled by default. With this option, you'll need to specify the encryption key-in one of the following ways:
  • `/key`: *KeyString* specifies the encryption key. If there's a space in *KeyString*, you'll need to surround *KeyString* with quotation marks (`"`).
  • `/keyfile`: *FilePathAndName* specifies a text (`.txt`) file that contains the encryption key.

*KeyString* is recommended to be at least eight characters long, but it can't exceed 256 characters. The `/key` and `/keyfile` options can't be used on the same command line. The `/encrypt` and `/nocompress` options can't be used on the same command line.
**Important**
Use caution when using the `/key` or `keyfile` options. For example, anyone who has access to scripts that run the `ScanState.exe` command with these options will also have access to the encryption key.

The following example shows the `ScanState.exe` command and the `/key` option:
`ScanState.exe /i:MigDocs.xml /i:MigApp.xml \server\share\migration\mystore /encrypt /key:mykey` | -| **/encrypt**:*<EncryptionStrength>* | The `/encrypt` option accepts a command-line parameter to define the encryption strength to be used for encryption of the migration store. For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md). | -| **/nocompress** | Disables compression of data and saves the files to a hidden folder named "File" at *StorePath*\USMT. Compression is enabled by default. Combining the `/nocompress` option with the `/hardlink` option generates a hard-link migration store. You can use the uncompressed store to view what USMT stored, troubleshoot a problem, or run an antivirus utility against the files. You should use this option only in testing environments, because we recommend that you use a compressed store during your actual migration, unless you're combining the `/nocompress` option with the `/hardlink` option.

The `/nocompress` and `/encrypt` options can't be used together in one statement on the command line. However, if you do choose to migrate an uncompressed store, the `LoadState.exe` command will migrate each file directly from the store to the correct location on the destination computer without a temporary location.

For example:
`ScanState.exe /i:MigDocs.xml /i:MigApp.xml \server\share\migration\mystore /nocompress` | +| **/encrypt** [{**/key:** *\* | **/keyfile**:*\*]} | Encrypts the store with the specified key. Encryption is disabled by default. With this option, the encryption key needs to be specified in one of the following ways:
  • `/key`: *KeyString* specifies the encryption key. If there's a space in *KeyString*, *KeyString* needs to be surrounded with quotation marks (`"`).
  • `/keyfile`: *FilePathAndName* specifies a text (`.txt`) file that contains the encryption key.

*KeyString* is recommended to be at least eight characters long, but it can't exceed 256 characters. The `/key` and `/keyfile` options can't be used on the same command line. The `/encrypt` and `/nocompress` options can't be used on the same command line.
**Important**
Use caution when using the `/key` or `keyfile` options. For example, anyone who has access to scripts that run the `ScanState.exe` command with these options also have access to the encryption key.

The following example shows the `ScanState.exe` command and the `/key` option:
`ScanState.exe /i:MigDocs.xml /i:MigApp.xml \server\share\migration\mystore /encrypt /key:mykey` | +| **/encrypt**:*\* | The `/encrypt` option accepts a command-line parameter to define the encryption strength to be used for encryption of the migration store. For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md). | +| **/nocompress** | Disables compression of data and saves the files to a hidden folder named "File" at *StorePath*\USMT. Compression is enabled by default. Combining the `/nocompress` option with the `/hardlink` option generates a hard-link migration store. The uncompressed store can be used to view what USMT stored, troubleshoot a problem, or run an antivirus utility against the files. This option should only be used in testing environments. Microsoft recommends using a compressed store during production migrations, unless combining the `/nocompress` option with the `/hardlink` option.

The `/nocompress` and `/encrypt` options can't be used together in one statement on the command line. However, if an uncompressed store is migrated, the `LoadState.exe` command migrates each file directly from the store to the correct location on the destination computer without a temporary location.

For example:
`ScanState.exe /i:MigDocs.xml /i:MigApp.xml \server\share\migration\mystore /nocompress` | ## Run the ScanState command on an offline Windows system -You can run the `ScanState.exe` command in Windows Preinstallation Environment (WinPE). In addition, USMT supports migrations from previous installations of Windows contained in Windows.old directories. The offline directory can be a Windows directory when you run the `ScanState.exe` command in WinPE or a Windows.old directory when you run the `ScanState.exe` command in Windows. +The `ScanState.exe` command can be run in Windows Preinstallation Environment (WinPE). In addition, USMT supports migrations from previous installations of Windows contained in **Windows.old** directories. The offline directory can be a Windows directory when the `ScanState.exe` command is run in WinPE or a **Windows.old** directory when the `ScanState.exe` command is run in Windows. There are several benefits to running the `ScanState.exe` command on an offline Windows image, including: - **Improved performance.** - Because WinPE is a thin operating system, there are fewer running services. In this environment, the `ScanState.exe` command has more access to the local hardware resources, enabling **ScanState** to perform migration operations more quickly. + Because WinPE is a thin operating system, there are fewer running services. In this environment, the `ScanState.exe` command has more access to the local hardware resources, enabling **ScanState** to perform migration operations more quickly. - **Simplified end to end deployment process.** - Migrating data from Windows.old simplifies the end-to-end deployment process by enabling the migration process to occur after the new operating system is installed. + Migrating data from **Windows.old** simplifies the end-to-end deployment process by enabling the migration process to occur after the new operating system is installed. - **Improved success of migration.** - The migration success rate is increased because files won't be locked for editing while offline, and because WinPE provides administrator access to files in the offline Windows file system, eliminating the need for administrator-level access to the online system. + The migration success rate is increased because: + + - Files aren't locked for editing while offline. + - WinPE provides administrator access to files in the offline Windows file system, eliminating the need for administrator-level access to the online system. -- **Ability to recover an unbootable computer.** +- **Ability to recover an from a computer that doesn't boot.** - It might be possible to recover and migrate data from an unbootable computer. + It might be possible to recover and migrate data from a computer that doesn't boot. ## Offline migration options |Command-Line Option|Definition| |--- |--- | -|**/offline:** *"path to an Offline.xml file"*|This option is used to define a path to an offline .xml file that might specify other offline migration options, for example, an offline Windows directory or any domain or folder redirection required in your migration.| -|**/offlinewindir:** *"path to a Windows directory"*|This option specifies the offline Windows directory that the `ScanState.exe` command gathers user state from. The offline directory can be Windows.old when you run the `ScanState.exe` command in Windows or a Windows directory when you run the `ScanState.exe` command in WinPE.| -|**/offlinewinold:** *"Windows.old directory"*|This command-line option enables the offline migration mode and starts the migration from the location specified. It's only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.| +|**/offline:** *"path to an Offline.xml file"*|This option is used to define a path to an offline **.xml** file that might specify other offline migration options. For example, an offline Windows directory or any domain or folder redirection required in the migration.| +|**/offlinewindir:** *"path to a Windows directory"*|This option specifies the offline Windows directory that the `ScanState.exe` command gathers user state from. The offline directory can be **Windows.old** when the `ScanState.exe` command is run in Windows or a Windows directory when the `ScanState.exe` command is run in WinPE.| +|**/offlinewinold:** *"Windows.old directory"*|This command-line option enables the offline migration mode and starts the migration from the location specified. This option is only intended to be used in **Windows.old** migration scenarios, where the migration is occurring from a **Windows.old** directory.| ## Migration rule options -USMT provides the following options to specify what files you want to migrate. +USMT provides the following options to specify what files to migrate. | Command-Line Option | Description | |-----|-----| -| **/i:**[*Path*]*FileName* | **(include)**

Specifies an .xml file that contains rules that define what user, application, or system state to migrate. You can specify this option multiple times to include all of your .xml files (`MigApp.xml`, `MigDocs.xml`, and any custom .xml files that you create). *Path* can be either a relative or full path. If you don't specify the *Path* variable, then *FileName* must be located in the current directory. For more information about which files to specify, see the "XML Files" section of the [Frequently asked questions](usmt-faq.yml) article. | -| **/genconfig:**[*Path*]*FileName* | (Generate **Config.xml**)

Generates the optional `Config.xml` file, but doesn't create a migration store. To ensure that this file contains every component, application and setting that can be migrated, you should create this file on a source computer that contains all the components, applications, and settings that will be present on the destination computers. In addition, you should specify the other migration .xml files, using the **/i** option, when you specify this option.

After you create this file, you'll need to make use of it with the `ScanState.exe` command using the **/config** option.

The only options that you can specify with this option are the `/i`, `/v`, and `/l` options. You can't specify *StorePath*, because the `/genconfig` option doesn't create a store. *Path* can be either a relative or full path. If you don't specify the *Path* variable, then *FileName* will be created in the current directory.

Examples:
  • The following example creates a `Config.xml` file in the current directory:
    `ScanState.exe /i:MigApp.xml /i:MigDocs.xml /genconfig:Config.xml /v:13`
| -| **/config:**[*Path*]*FileName* | Specifies the `Config.xml` file that the `ScanState.exe` command should use to create the store. You can't use this option more than once on the command line. *Path* can be either a relative or full path. If you don't specify the *Path* variable, then *FileName* must be located in the current directory.

The following example creates a store using the `Config.xml` file, `MigDocs.xml`, and `MigApp.xml` files:
`ScanState.exe \server\share\migration\mystore /config:Config.xml /i:MigDocs.xml /i:MigApp.xml /v:13 /l:ScanState.log`

The following example migrates the files and settings to the destination computer using the `Config.xml`, `MigDocs.xml`, and `MigApp.xml` files:
`LoadState.exe \server\share\migration\mystore /config:Config.xml /i:MigDocs.xml /i:MigApp.xml /v:13 /l:LoadState.log` | -| **/auto:** *path to script files* | This option enables you to specify the location of the default .xml files and then begin the migration. If no path is specified, USMT will reference the directory where the USMT binaries are located. The `/auto` option has the same effect as using the following options: `/i: MigDocs.xml /i:MigApp.xml /v:5`. | -| **/genmigxml:** *path to a file* | This option specifies that the `ScanState.exe` command should use the document finder to create and export an .xml file that defines how to migrate all of the files on the computer on which the `ScanState.exe` command is running. | -| **/targetwindows8** | Optimizes `ScanState.exe` when using USMT 10.0 to migrate a user state to Windows 8 or Windows 8.1 instead of Windows 10. You should use this command-line option in the following scenarios:
  • **To create a `Config.xml` file by using the `/genconfig` option.** Using the `/targetwindows8` option optimizes the `Config.xml` file so that it only contains components that relate to Windows 8 or Windows 8.1.
  • **To create a migration store.** Using the `/targetwindows8` option ensures that the **ScanState** tool gathers the correct set of operating system settings. Without the `/targetwindows8` command-line option, some settings can be lost during the migration.
| -| **/targetwindows7** | Optimizes `ScanState.exe` when using USMT 10.0 to migrate a user state to Windows 7 instead of Windows 10. You should use this command-line option in the following scenarios:
  • **To create a `Config.xml` file by using the `/genconfig` option.** Using the **/targetwindows7** option optimizes the `Config.xml` file so that it only contains components that relate to Windows 7.
  • **To create a migration store.** Using the `/targetwindows7` option ensures that the **ScanState** tool gathers the correct set of operating system settings. Without the `/targetwindows7` command-line option, some settings can be lost during the migration.
| -| **/localonly** | Migrates only files that are stored on the local computer, regardless of the rules in the .xml files that you specify on the command line. You should use this option when you want to exclude the data from removable drives on the source computer, such as USB flash drives (UFDs), some external hard drives, and so on, and when there are network drives mapped on the source computer. If the `/localonly` option isn't specified, then the `ScanState.exe` command will copy files from these removable or network drives into the store.

Anything that isn't considered a fixed drive by the OS will be excluded by `/localonly`. In some cases, large external hard drives are considered fixed drives. These drives can be explicitly excluded from migration by using a custom .xml file. For more information about how to exclude all files on a specific drive, see [Exclude files and settings](usmt-exclude-files-and-settings.md).

The `/localonly` command-line option includes or excludes data in the migration as identified in the following storage locations:
  • **Removable drives such as a USB flash drive** - Excluded
  • **Network drives** - Excluded
  • **Fixed drives** - Included
| +| **/i:**[*Path*]*FileName* | **(include)**

Specifies an **.xml** file that contains rules that define what user, application, or system state to migrate. This option can be specified multiple times to include all of the **.xml** files (`MigApp.xml`, `MigDocs.xml`, and any custom **.xml** files that are created). *Path* can be either a relative or full path. If the *Path* variable isn't specified, then *FileName* must be located in the current directory. For more information about which files to specify, see the "XML Files" section of the [Frequently asked questions](usmt-faq.yml) article. | +| **/genconfig:**[*Path*]*FileName* | (Generate **Config.xml**)

Generates the optional `Config.xml` file, but doesn't create a migration store. To ensure that this file contains everything that needs to be migrated, create this file on a source computer that contains all of the:
  • components
  • applications
  • settings
present on the destination computers. In addition, the other migration **.xml** files should be specified, using the **/i** option, when this option is specified.

After this file is created, it can be used with the `ScanState.exe` command using the **/config** option.

The only options that can be specified with this option are the `/i`, `/v`, and `/l` options. *StorePath* can't be specified, because the `/genconfig` option doesn't create a store. *Path* can be either a relative or full path. If the *Path* variable isn't specified, then *FileName* is created in the current directory.

Examples:
  • The following example creates a `Config.xml` file in the current directory:
    `ScanState.exe /i:MigApp.xml /i:MigDocs.xml /genconfig:Config.xml /v:13`
| +| **/config:**[*Path*]*FileName* | Specifies the `Config.xml` file that the `ScanState.exe` command should use to create the store. This option can't be used more than once on the command line. *Path* can be either a relative or full path. If the *Path* variable isn't specified, then *FileName* must be located in the current directory.

The following example creates a store using the `Config.xml` file, `MigDocs.xml`, and `MigApp.xml` files:
`ScanState.exe \server\share\migration\mystore /config:Config.xml /i:MigDocs.xml /i:MigApp.xml /v:13 /l:ScanState.log`

The following example migrates the files and settings to the destination computer using the `Config.xml`, `MigDocs.xml`, and `MigApp.xml` files:
`LoadState.exe \server\share\migration\mystore /config:Config.xml /i:MigDocs.xml /i:MigApp.xml /v:13 /l:LoadState.log` | +| **/auto:** *path to script files* | This option enables specifying the location of the default **.xml** files. If no path is specified, USMT references the directory where the USMT binaries are located. The `/auto` option has the same effect as using the following options: `/i: MigDocs.xml /i:MigApp.xml /v:5`. | +| **/genmigxml:** *path to a file* | This option specifies that the `ScanState.exe` command should use the document finder to create and export an **.xml** file that defines how to migrate all of the files on the computer on which the `ScanState.exe` command is running. | +| **/localonly** | Migrates only files that are stored on the local computer, regardless of the rules in the **.xml** files that are specified on the command line. This option should be used to exclude the data from removable drives on the source computer and when there are network drives mapped on the source computer. Examples of removable drives include USB flash drives (UFDs) and some external hard drives. If the `/localonly` option isn't specified, then the `ScanState.exe` command copies files from these removable or network drives into the store.

`/localonly` excludes anything that isn't considered a fixed drive by the OS. In some cases, large external hard drives are considered fixed drives. These drives can be explicitly excluded from migration by using a custom **.xml** file. For more information about how to exclude all files on a specific drive, see [Exclude files and settings](usmt-exclude-files-and-settings.md).

The `/localonly` command-line option includes or excludes data in the migration as identified in the following storage locations:
  • **Removable drives such as a USB flash drive** - Excluded
  • **Network drives** - Excluded
  • **Fixed drives** - Included
| ## Monitoring options -USMT provides several options that you can use to analyze problems that occur during migration. +USMT provides several options that can be used to analyze problems that occur during migration. > [!NOTE] -> The **ScanState** log is created by default, but you can specify the name and location of the log with the **/l** option. +> +> The **ScanState** log is created by default, but the name and location of the log can be specified with the **/l** option. | Command-Line Option | Description | |-----|-----| -| **/listfiles**:<FileName> | You can use the `/listfiles` command-line option with the `ScanState.exe` command to generate a text file that lists all of the files included in the migration. | -| **/l:**[*Path*]*FileName* | Specifies the location and name of the **ScanState** log.

You can't store any of the log files in *StorePath*. *Path* can be either a relative or full path. If you don't specify the *Path* variable, then the log will be created in the current directory. You can use the `/v` option to adjust the amount of output.

If you run the `ScanState.exe` command from a shared network resource, you must specify the `/l` option, or USMT will fail with the following error:

***USMT was unable to create the log file(s)***

To fix this issue, make sure to specify the `/l` option when running `ScanState.exe` from a shared network resource. | -| **/v:***<VerbosityLevel>* | **(Verbosity)**

Enables verbose output in the **ScanState** log file. The default value is 0.

You can set the *VerbosityLevel* to one of the following levels:
  • **0** - Only the default errors and warnings are enabled.
  • **1** - Enables verbose output.
  • **4** - Enables error and status output.
  • **5** - Enables verbose and status output.
  • **8** - Enables error output to a debugger.
  • **9** - Enables verbose output to a debugger.
  • **12** - Enables error and status output to a debugger.
  • **13** - Enables verbose, status, and debugger output.

For example:
`ScanState.exe \server\share\migration\mystore /v:13 /i:MigDocs.xml /i:MigApp.xml`| -| **/progress**:[*Path*]*FileName* | Creates the optional progress log. You can't store any of the log files in *StorePath*. *Path* can be either a relative or full path. If you don't specify the *Path* variable, then *FileName* will be created in the current directory.

For example:
`ScanState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /progress:Progress.log /l:scanlog.log` | -| **/c** | When this option is specified, the `ScanState.exe` command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there's a large file that won't fit in the store, the `ScanState.exe` command will log an error and continue with the migration. In addition, if a file is open or in use by an application, USMT may not be able to migrate the file and will log an error. Without the `/c` option, the `ScanState.exe` command will exit on the first error.

You can use the new <**ErrorControl**> section in the `Config.xml` file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This advantage in the `Config.xml` file enables the `/c` command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the /`genconfig` option now generates a sample <**ErrorControl**> section that is enabled by specifying error messages and desired behaviors in the `Config.xml` file. | -| **/r:***<TimesToRetry>* | **(Retry)**

Specifies the number of times to retry when an error occurs while saving the user state to a server. The default is three times. This option is useful in environments where network connectivity isn't reliable.

While storing the user state, the `/r` option won't be able to recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem. | -| **/w:***<SecondsBeforeRetry>* | **(Wait)**

Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second. | -| **/p:***<pathToFile>* | When the `ScanState.exe` command runs, it will create an .xml file in the path specified. This .xml file includes improved space estimations for the migration store. The following example shows how to create this .xml file:
`ScanState.exe C:\MigrationLocation [additional parameters]`
`/p:"C:\MigrationStoreSize.xml"`

For more information, see [Estimate Migration Store Size](usmt-estimate-migration-store-size.md).

To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, you can use the `/p` option, without specifying *"pathtoafile"*, in USMT. If you specify only the `/p` option, the storage space estimations are created in the same manner as with USMT3.x releases. | +| **/listfiles**:\ | The `/listfiles` command-line option can be used with the `ScanState.exe` command to generate a text file that lists all of the files included in the migration. | +| **/l:**[*Path*]*FileName* | Specifies the location and name of the **ScanState** log.

The log files can't be stored in *StorePath*. *Path* can be either a relative or full path. If the *Path* variable isn't specified, then the log is created in the current directory. The `/v` option can be used to adjust the amount of output.

If the `ScanState.exe` command is run from a shared network resource, the `/l` option must be specified, or USMT fails with the following error:

***USMT was unable to create the log file(s)***

To fix this issue, make sure to specify the `/l` option when running `ScanState.exe` from a shared network resource. | +| **/v:***\* | **(Verbosity)**

Enables verbose output in the **ScanState** log file. The default value is 0.

The *VerbosityLevel* can be set to one of the following levels:
  • **0** - Only the default errors and warnings are enabled.
  • **1** - Enables verbose output.
  • **4** - Enables error and status output.
  • **5** - Enables verbose and status output.
  • **8** - Enables error output to a debugger.
  • **9** - Enables verbose output to a debugger.
  • **12** - Enables error and status output to a debugger.
  • **13** - Enables verbose, status, and debugger output.

For example:
`ScanState.exe \server\share\migration\mystore /v:13 /i:MigDocs.xml /i:MigApp.xml`| +| **/progress**:[*Path*]*FileName* | Creates the optional progress log. The log files can't be stored in *StorePath*. *Path* can be either a relative or full path. If the *Path* variable isn't specified, then *FileName* is created in the current directory.

For example:
`ScanState.exe /i:MigApp.xml /i:MigDocs.xml \server\share\migration\mystore /progress:Progress.log /l:scanlog.log` | +| **/c** | When this option is specified, the `ScanState.exe` command continues to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there's a large file that doesn't fit in the store, the `ScanState.exe` command logs an error and continue with the migration. In addition, if a file is open or in use by an application, USMT might not be able to migrate the file and logs an error. Without the `/c` option, the `ScanState.exe` command exits on the first error.

The \<**ErrorControl**\> section in the `Config.xml` file can be used to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This advantage in the `Config.xml` file enables the `/c` command-line option to safely skip all input/output (I/O) errors in the environment. In addition, the /`genconfig` option now generates a sample \<**ErrorControl**\> section that is enabled by specifying error messages and desired behaviors in the `Config.xml` file. | +| **/r:***\* | **(Retry)**

Specifies the number of times to retry when an error occurs while saving the user state to a server. The default is three times. This option is useful in environments where network connectivity isn't reliable.

When the user state is stored, the `/r` option can't recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem. | +| **/w:***\* | **(Wait)**

Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second. | +| **/p:***\* | When the `ScanState.exe` command runs, it creates an **.xml** file in the path specified. This **.xml** file includes improved space estimations for the migration store. The following example shows how to create this **.xml** file:
`ScanState.exe C:\MigrationLocation [additional parameters]`
`/p:"C:\MigrationStoreSize.xml"`

For more information, see [Estimate Migration Store Size](usmt-estimate-migration-store-size.md).

To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, the `/p` option can be used, without specifying *"pathtoafile"*, in USMT. If only the `/p` option is specified, the storage space estimations are created in the same manner as with USMT 3.x releases. | | **/?** or **/help** | Displays Help at the command line. | ## User options -By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. You can't exclude users in the migration .xml files or using the `Config.xml` file. For more information, see [Identify users](usmt-identify-users.md) and [Migrate user accounts](usmt-migrate-user-accounts.md). +By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. Users can't be excluded in the migration **.xml** files or using the `Config.xml` file. For more information, see [Identify users](usmt-identify-users.md) and [Migrate user accounts](usmt-migrate-user-accounts.md). | Command-Line Option | Description | |-----|-----| -| **/all** | Migrates all of the users on the computer.

USMT migrates all user accounts on the computer, unless you specifically exclude an account with either the `/ue` or `/uel` options. For this reason, you don't need to specify this option on the command line. However, if you choose to specify the `/all` option, you can't also use the `/ui`, `/ue` or `/uel` options. | -| **/ui**:*<DomainName>*\*<UserName>*
or
**/ui**:*<ComputerName>*\*<LocalUserName>* | **(User include)**

Migrates the specified users. By default, all users are included in the migration. Therefore, this option is helpful only when used with the `/ue` or `/uel` options. You can specify multiple `/ui` options, but you can't use the `/ui` option with the `/all` option. *DomainName* and *UserName* can contain the asterisk (`*`) wildcard character. When you specify a user name that contains spaces, you'll need to surround it with quotation marks (`"`).
**Note**
If a user is specified for inclusion with the `/ui` option and also specified to be excluded with either the `/ue` or `/uel` options, the user will be included in the migration.

For example:
  • To include only **User2** from the Fabrikam domain, enter:

    `/ue:*\* /ui:fabrikam\user2`

  • To migrate all users from the Fabrikam domain, and only the user accounts from other domains that have been active or otherwise modified in the last 30 days, enter:

    `/uel:30 /ui:fabrikam\*`

    In this example, a user account from the Contoso domain that was last modified two months ago won't be migrated.

For more examples, see the descriptions of the `/ue` and `/ui` options in this table. | -| **/uel**:*<NumberOfDays>*
or
**/uel**:*<YYYY/MM/DD>*
or
**/uel:0** | **(User exclude based on last logon)**

Migrates the users that logged on to the source computer within the specified time period, based on the **Last Modified** date of the Ntuser.dat file on the source computer. The `/uel` option acts as an include rule. For example, the `/uel:30` option migrates users who logged on, or whose account was modified, within the last 30 days from the date when the `ScanState.exe` command is run.

You can specify the number of days or you can specify a date. You can't use this option with the `/all` option. USMT retrieves the last sign-in information from the local computer, so the computer doesn't need to be connected to the network when you run this option. In addition, if a domain user has signed in to another computer, that sign-in instance isn't considered by USMT.
**Note**
The `/uel` option isn't valid in offline migrations.
  • `/uel:0` migrates any users who are currently logged on.
  • `/uel:90` migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.
  • `/uel:1` migrates users whose account has been modified within the last 24 hours.
  • `/uel:2020/2/15` migrates users who have logged on or been modified February 15, 2020 or afterwards.

For example:
`ScanState.exe /i:MigApp.xml /i:MigDocs.xml \\server\share\migration\mystore /uel:0` | -| **/ue**:*<DomainName>*\*<UserName>*
-or-

**/ue**:*<ComputerName>*\*<LocalUserName>* | **(User exclude)**

Excludes the specified users from the migration. You can specify multiple `/ue` options. You can't use this option with the `/all` option. *<DomainName>* and *<UserName>* can contain the asterisk (`*`) wildcard character. When you specify a user name that contains spaces, you need to surround it with quotation marks (`"`).

For example:
`ScanState.exe /i:MigDocs.xml /i:MigApp.xml \\server\share\migration\mystore /ue:contoso\user1` | +| **/all** | Migrates all of the users on the computer.

USMT migrates all user accounts on the computer, unless an account is specifically excluded with either the `/ue` or `/uel` options. For this reason, this option doesn't need to be specified on the command line. However, if the `/all` option is specified, the `/ui`, `/ue` or `/uel` options can't also be specified. | +| **/ui**:*\*\*\*
or
**/ui**:*\*\*\* | **(User include)**

Migrates the specified users. By default, all users are included in the migration. Therefore, this option is helpful only when used with the `/ue` or `/uel` options. Multiple `/ui` options can be specified, but the `/ui` option can't be used with the `/all` option. *DomainName* and *UserName* can contain the asterisk (`*`) wildcard character. When a user name that contains spaces is specified, it needs to be surrounded with quotation marks (`"`).
**Note**
If a user is specified for inclusion with the `/ui` option and also specified to be excluded with either the `/ue` or `/uel` options, the user is included in the migration.

For example:
  • To include only **User2** from the Fabrikam domain, enter:

    `/ue:*\* /ui:fabrikam\user2`

  • To migrate all users from the Fabrikam domain, and only the user accounts from other domains that are active or otherwise modified in the last 30 days, enter:

    `/uel:30 /ui:fabrikam\*`

    In this example, a user account from the Contoso domain that was last modified two months ago isn't migrated.

For more examples, see the descriptions of the `/ue` and `/ui` options in this table. | +| **/uel**:*\*
or
**/uel**:*\*
or
**/uel:0** | **(User exclude based on last logon)**

Migrates the users that logged on to the source computer within the specified time period, based on the **Last Modified** date of the Ntuser.dat file on the source computer. The `/uel` option acts as an include rule. For example, the `/uel:30` option migrates users who logged on, or whose account was modified, within the last 30 days from the date when the `ScanState.exe` command is run.

The number of days or the date can be specified. This option can't be used with the `/all` option. USMT retrieves the last sign-in information from the local computer, so the computer doesn't need to be connected to the network when running this option. In addition, if a domain user signs in to another computer, USMT doesn't consider that sign-in instance.
**Note**
The `/uel` option isn't valid in offline migrations.
  • `/uel:0` migrates any users who are currently logged on.
  • `/uel:90` migrates users who logged on, or whose accounts were otherwise modified, within the last 90 days.
  • `/uel:1` migrates users whose account were modified within the last 24 hours.
  • `/uel:2020/2/15` migrates users who logged on or been modified February 15, 2020 or afterwards.

For example:
`ScanState.exe /i:MigApp.xml /i:MigDocs.xml \\server\share\migration\mystore /uel:0` | +| **/ue**:*\*\*\*
-or-

**/ue**:*\*\*\* | **(User exclude)**

Excludes the specified users from the migration. Multiple `/ue` options can be specified. This option can't be used with the `/all` option. *\* and *\* can contain the asterisk (`*`) wildcard character. When a user name that contains spaces is specified, it needs to be surrounded with quotation marks (`"`).

For example:
`ScanState.exe /i:MigDocs.xml /i:MigApp.xml \\server\share\migration\mystore /ue:contoso\user1` | ## How to use /ui and /ue -The following examples apply to both the `/ui` and `/ue` options. You can replace the `/ue` option with the `/ui` option to include, rather than exclude, the specified users. +The following examples apply to both the `/ui` and `/ue` options. The `/ue` option can be replaced with the `/ui` option to include, rather than exclude, the specified users. |Behavior|Command| |--- |--- | @@ -154,72 +160,75 @@ The following examples apply to both the `/ui` and `/ue` options. You can replac ## Using the options together -You can use the `/uel`, `/ue` and `/ui` options together to migrate only the users that you want migrated. +The `/uel`, `/ue` and `/ui` options can be used together to migrate only the users that need to be migrated. -The `/ui` option has precedence over the `/ue` and `/uel` options. If a user is specified for inclusion with the `/ui` option and also specified to be excluded with either the `/ue` or `/uel` options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then **User1** will be migrated, because the `/ui` option takes precedence over the `/ue` option. +The `/ui` option has precedence over the `/ue` and `/uel` options. If a user is specified for inclusion with the `/ui` option and also specified to be excluded with either the `/ue` or `/uel` options, the user is included in the migration. For example, if `/ui:contoso\* /ue:contoso\user1` is specified, then **User1** is migrated, because the `/ui` option takes precedence over the `/ue` option. -The `/uel` option takes precedence over the `/ue` option. If a user has logged on within the specified time period set by the `/uel` option, that user's profile will be migrated even if they're excluded by using the `/ue` option. For example, if you specify `/ue:fixed\user1 /uel:14`, the User1 will be migrated if they've logged on to the computer within the last 14 days. +The `/uel` option takes precedence over the `/ue` option. If a user logged on within the specified time period set by the `/uel` option, that user's profile is migrated even if they're excluded by using the `/ue` option. For example, if `/ue:fixed\user1 /uel:14` is specified, then User1 is migrated if they logged on to the computer within the last 14 days. |Behavior|Command| |--- |--- | |Include only User2 from the Fabrikam domain and exclude all other users.|`/ue:*\* /ui:fabrikam\user2`| |Include only the local user named User1 and exclude all other users.|`/ue:*\* /ui:user1`| -|Include only the domain users from Contoso, except Contoso\User1.|This behavior can't be completed using a single command. Instead, to migrate this set of users, you'll need to specify the following commands:
  • On the `ScanState.exe` command line, enter:
    `/ue:*\* /ui:contoso\*`
  • On the `LoadState.exe` command line, enter:
    `/ue:contoso\user1`
| +|Include only the domain users from Contoso, except Contoso\User1.|This behavior can't be completed using a single command. Instead, to migrate this set of users, specify the following commands:
  • On the `ScanState.exe` command line, enter:
    `/ue:*\* /ui:contoso\*`
  • On the `LoadState.exe` command line, enter:
    `/ue:contoso\user1`
| |Include only local (non-domain) users.|`/ue:*\* /ui:%computername%\*`| ## Encrypted file options -You can use the following options to migrate encrypted files. In all cases, by default, USMT fails if an encrypted file is found unless you specify an `/efs` option. To migrate encrypted files, you must change the default behavior. +The following options can be used to migrate encrypted files. In all cases, by default, USMT fails if an encrypted file is found unless the `/efs` option is specified. To migrate encrypted files, the default behavior must be changed. For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md). > [!NOTE] -> EFS certificates will be migrated automatically when migrating to Windows 7, Windows 8 or Windows 10. Therefore, you should specify the `/efs:copyraw` option with the `ScanState.exe` command to migrate the encrypted files +> +> EFS certificates are migrated automatically during the migration. Therefore, the `/efs:copyraw` option should be specified with the `ScanState.exe` command to migrate the encrypted files. > [!CAUTION] -> Take caution when migrating encrypted files. If you migrate an encrypted file without also migrating the certificate, end users will not be able to access the file after the migration. +> +> Take caution when migrating encrypted files. If an encrypted file is migrated without also migrating the certificate, end users won't be able to access the file after the migration. | Command-Line Option | Explanation | |----|----| | **/efs:hardlink** | Creates a hard link to the EFS file instead of copying it. Use only with the `/hardlink` and the `/nocompress` options. | | **/efs:abort** | Causes the `ScanState.exe` command to fail with an error code, if an Encrypting File System (EFS) file is found on the source computer. Enabled by default. | | **/efs:skip** | Causes the `ScanState.exe` command to ignore EFS files. | -| **/efs:decryptcopy** | Causes the `ScanState.exe` command to decrypt the file, if possible, before saving it to the migration store, and to fail if the file can't be decrypted. If the `ScanState.exe` command succeeds, the file will be unencrypted in the migration store, and once you run the `LoadState.exe` command, the file will be copied to the destination computer. | -| **/efs:copyraw** | Causes the `ScanState.exe` command to copy the files in the encrypted format. The files will be inaccessible on the destination computer until the EFS certificates are migrated. EFS certificates will be automatically migrated; however, by default USMT fails if an encrypted file is found, unless you specify an `/efs` option. Therefore you should specify the `/efs:copyraw` option with the `ScanState.exe` command to migrate the encrypted file. Then, when you run the `LoadState.exe` command, the encrypted file and the EFS certificate will be automatically migrated.

For example:
`ScanState.exe /i:MigDocs.xml /i:MigApp.xml \server\share\migration\mystore /efs:copyraw`
**Important**
All files must be encrypted if the parent folder is encrypted. If the encryption attribute on a file inside an encrypted folder has been removed, the file will be encrypted during the migration using the credentials of the account used to run the **LoadState** tool. For more information, see [Migrate EFS files and certificates](usmt-migrate-efs-files-and-certificates.md).
| +| **/efs:decryptcopy** | Causes the `ScanState.exe` command to decrypt the file, if possible, before saving it to the migration store, and to fail if the file can't be decrypted. If the `ScanState.exe` command succeeds, the file is unencrypted in the migration store, and once the `LoadState.exe` command is run, the file is copied to the destination computer. | +| **/efs:copyraw** | Causes the `ScanState.exe` command to copy the files in the encrypted format. The files are inaccessible on the destination computer until the EFS certificates are migrated. EFS certificates are automatically migrated; however, by default USMT fails if an encrypted file is found, unless the `/efs` option is specified. Therefore the `/efs:copyraw` option should be specified with the `ScanState.exe` command to migrate the encrypted file. When the `LoadState.exe` command is run, the encrypted file and the EFS certificate are automatically migrated.

For example:
`ScanState.exe /i:MigDocs.xml /i:MigApp.xml \server\share\migration\mystore /efs:copyraw`
**Important**
All files must be encrypted if the parent folder is encrypted. If the encryption attribute on a file inside an encrypted folder is removed, the file is encrypted during the migration using the credentials of the account used to run the **LoadState** tool. For more information, see [Migrate EFS files and certificates](usmt-migrate-efs-files-and-certificates.md).
| ## Incompatible command-line options -The following table indicates which command-line options aren't compatible with the `ScanState.exe` command. If the table entry for a particular combination is blank, the options are compatible and you can use them together. The X symbol means that the options aren't compatible. For example, you can't use the `/nocompress` option with the `/encrypt` option. +The following table indicates which command-line options aren't compatible with the `ScanState.exe` command. If the table entry for a particular combination has a ✔️, the options are compatible and they can be used together. The ❌ symbol means that the options aren't compatible. For example, the `/nocompress` option can't be used with the `/encrypt` option. |Command-Line Option|/keyfile|/nocompress|/genconfig|/all| |--- |--- |--- |--- |--- | -|**/i**||||| -|**/o**||||| -|**/v**||||| -|**/nocompress**||||N/A| -|**/localonly**|||X|| -|**/key**|X||X|| -|**/encrypt**|Required*|X|X|| -|**/keyfile**|N/A||X|| -|**/l**||||| -|**/listfiles**|||X|| -|**/progress**|||X|| -|**/r**|||X|| -|**/w**|||X|| -|**/c**|||X|| -|**/p**|||X|N/A| -|**/all**|||X|| -|**/ui**|||X|X| -|**/ue**|||X|X| -|**/uel**|||X|X| -|**/efs**:*<option>*|||X|| -|**/genconfig**|||N/A|| -|**/config**|||X|| -|*<StorePath>*|||X|| +|**/i**| ✔️ | ✔️ | ✔️ | ✔️ | +|**/o**| ✔️ | ✔️ | ✔️ | ✔️ | +|**/v**| ✔️ | ✔️ | ✔️ | ✔️ | +|**/nocompress**| ✔️ | ✔️ | ✔️ |N/A| +|**/localonly**| ✔️ | ✔️ | ❌ | ✔️ | +|**/key**| ❌ | ✔️ | ❌ | ✔️ | +|**/encrypt**|Required*| ❌ | ❌ | ✔️ | +|**/keyfile**|N/A| ✔️ | ❌ | ✔️ | +|**/l**| ✔️ | ✔️ | ✔️ | ✔️ | +|**/listfiles**| ✔️ | ✔️ | ❌ | ✔️ | +|**/progress**| ✔️ | ✔️ | ❌ | ✔️ | +|**/r**| ✔️ | ✔️ | ❌ | ✔️ | +|**/w**| ✔️ | ✔️ | ❌ | ✔️ | +|**/c**| ✔️ | ✔️ | ❌ | ✔️ | +|**/p**| ✔️ | ✔️ | ❌ |N/A| +|**/all**| ✔️ | ✔️ | ❌ | ✔️ | +|**/ui**| ✔️ | ✔️ | ❌ | ❌ | +|**/ue**| ✔️ | ✔️ | ❌ | ❌ | +|**/uel**| ✔️ | ✔️ | ❌ | ❌ | +|**/efs**:*\*| ✔️ | ✔️ | ❌ | ✔️ | +|**/genconfig**| ✔️ | ✔️ |N/A| ✔️ | +|**/config**| ✔️ | ✔️ | ❌ | ✔️ | +|*\*| ✔️ | ✔️ | ❌ | ✔️ | > [!NOTE] -> You must specify either the `/key` or `/keyfile` option with the `/encrypt` option. +> +> Either the `/key` or `/keyfile` option must be specified with the `/encrypt` option. ## Related articles -[XML Elements Library](usmt-xml-elements-library.md) +- [XML Elements Library](usmt-xml-elements-library.md). diff --git a/windows/deployment/usmt/usmt-technical-reference.md b/windows/deployment/usmt/usmt-technical-reference.md index b60e82e749..9e79a478fa 100644 --- a/windows/deployment/usmt/usmt-technical-reference.md +++ b/windows/deployment/usmt/usmt-technical-reference.md @@ -1,26 +1,24 @@ --- -title: User State Migration Tool (USMT) Technical Reference (Windows 10) +title: User State Migration Tool (USMT) Technical Reference description: The User State Migration Tool (USMT) provides a highly customizable user-profile migration experience for IT professionals. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # User State Migration Tool (USMT) technical reference -The User State Migration Tool (USMT) is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals. +The User State Migration Tool (USMT) is included with the Windows Assessment and Deployment Kit (Windows ADK). USMT provides a highly customizable user-profile migration experience for IT professionals. -Download the Windows ADK [from this website](/windows-hardware/get-started/adk-install). - -## USMT support for Microsoft Office - -- USMT in the Windows ADK for Windows 10, version 1511 (10.1.10586.0) supports migration of user settings for installations of Microsoft Office 2003, 2007, 2010, and 2013. - -- USMT in the Windows ADK for Windows 10, version 1607 (10.1.14393.0) adds support for migration of user settings for installations of Microsoft Office 2016. +The Windows ADK can be downloaded from the [Download and install the Windows ADK](/windows-hardware/get-started/adk-install) website. USMT includes three command-line tools: @@ -28,25 +26,25 @@ USMT includes three command-line tools: - LoadState.exe - UsmtUtils.exe -USMT also includes a set of three modifiable .xml files: +USMT also includes a set of three modifiable **.xml** files: - MigApp.xml - MigDocs.xml - MigUser.xml -Additionally, you can create custom .xml files to support your migration needs. You can also create a `Config.xml` file to specify files or settings to exclude from the migration. +Additionally, custom **.xml** files can be created to support the organization's migration needs. A `Config.xml` file can also be created to specify files or settings to exclude from the migration. -USMT tools can be used on several versions of Windows operating systems, for more information, see [USMT requirements](usmt-requirements.md). For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) overview](/previous-versions/windows/hh825227(v=win.10)). +USMT tools can be used on several versions of Windows operating systems. For more information, see [USMT requirements](usmt-requirements.md). For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) overview](/previous-versions/windows/hh825227(v=win.10)). + +## USMT support for Microsoft Office + +USMT in the currently supported versions of the Windows ADK supports migration of user settings for installations of Microsoft Office 2013 and 2016. ## In this section | Link | Description | |------ |----------- | -|[User State Migration Tool (USMT) overview topics](usmt-topics.md)|Describes what's new in USMT, how to get started with USMT, and the benefits and limitations of using USMT.| -|[User State Migration Tool (USMT) how-to topics](usmt-how-to.md)|Includes step-by-step instructions for using USMT and how-to topics for conducting tasks in USMT.| +|[User State Migration Tool (USMT) overview articles](usmt-topics.md)|Describes what's new in USMT, how to get started with USMT, and the benefits and limitations of using USMT.| +|[User State Migration Tool (USMT) how-to articles](usmt-how-to.md)|Includes step-by-step instructions for using USMT and how-to articles for conducting tasks in USMT.| |[User State Migration Tool (USMT) troubleshooting](usmt-troubleshooting.md)|Provides answers to frequently asked questions and common issues in USMT and a reference for return codes used in USMT.| |[User State Migration Toolkit (USMT) reference](usmt-reference.md)|Includes reference information for migration planning, migration best practices, command-line syntax, using XML, and requirements for using USMT.| - -## Related articles - -- [Windows Assessment and Deployment Kit](/previous-versions/windows/it-pro/windows-8.1-and-8/dn247001(v=win.10)) diff --git a/windows/deployment/usmt/usmt-test-your-migration.md b/windows/deployment/usmt/usmt-test-your-migration.md index 9b0981998d..e8afbe495c 100644 --- a/windows/deployment/usmt/usmt-test-your-migration.md +++ b/windows/deployment/usmt/usmt-test-your-migration.md @@ -1,35 +1,49 @@ --- -title: Test Your Migration (Windows 10) -description: Learn about testing your migration plan in a controlled laboratory setting before you deploy it to your entire organization. +title: Test The Migration +description: Learn about testing the migration plan in a controlled laboratory setting before deploying it to the entire organization. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- -# Test your migration +# Test the migration -Always test your migration plan in a controlled laboratory setting before you deploy it to your entire organization. In your test environment, you need at least one computer for each type of operating system from which you're migrating data. +Always test the migration plan in a controlled laboratory setting before deploying it to the entire organization. In the test environment, at least one computer is needed for each type of operating system from which data is being migrated. -After you've thoroughly tested the entire migration process on a single computer running each of your source operating systems, conduct a pilot migration with a small group of users. After migrating a few typical user states to the intermediate store, note the space required and adjust your initial calculations accordingly. For details about estimating the space needed for your migration, see [Estimate migration store size](usmt-estimate-migration-store-size.md). You might also need to adjust the registry-setting and file-location information in your migration-rule files. If you make changes, test the migration again. Then verify that all data and settings have migrated as expected. A pilot migration also gives you an opportunity to test your space estimates for the intermediate store. +Once the entire migration process is tested on a single computer running each of the organization source operating systems, conduct a pilot migration with a small group of users. After migrating a few typical user states to the intermediate store, note the space required and adjust the initial calculations accordingly. For details about estimating the space needed for the migration, see [Estimate migration store size](usmt-estimate-migration-store-size.md). Registry-setting and file-location information might need to be adjusted in the migration-rule files. If changes are made, test the migration again and verify that all data and settings migrated as expected. A pilot migration also gives the opportunity to test the space estimates for the intermediate store. -If your test migration encounters any errors, examine the **ScanState** and **LoadState** logs to obtain the exact User State Migration Tool (USMT) 10.0 return code and associated error messages or Windows application programming interface (API) error message. For more information about USMT return codes and error messages, see [Return codes](/troubleshoot/windows-client/deployment/usmt-return-codes). You can obtain more information about any listed **Windows** system error codes by typing in a command prompt window `net.exe helpmsg ` where ** is the error code number generated by the error message. For more information about System Error Codes, see [System Error Codes (0-499)](/windows/win32/debug/system-error-codes--0-499-). +If the test migration encounters any errors, examine the **ScanState** and **LoadState** logs to obtain the exact User State Migration Tool (USMT) return code and associated error messages or Windows application programming interface (API) error message. For more information about USMT return codes and error messages, see [Return codes](/troubleshoot/windows-client/deployment/usmt-return-codes). More information can be obtained about any listed **Windows** system error codes by typing in the following at a command prompt window: -In most cases, the **ScanState** and **LoadState** logs indicate why a USMT migration is failing. We recommend that you use the `/v:5` option when testing your migration. This verbosity level can be adjusted in a production migration. Reducing the verbosity level might make it more difficult to diagnose failures that are encountered during production migrations. You can use a higher verbosity level if you want the log files output to go to a debugger. +```cmd +net.exe helpmsg +``` + +where ** is the error code number generated by the error message. For more information about System Error Codes, see [System Error Codes (0-499)](/windows/win32/debug/system-error-codes--0-499-). + +In most cases, the **ScanState** and **LoadState** logs indicate why a USMT migration is failing. Microsoft recommends using the `/v:5` option when testing the migration. This verbosity level can be adjusted in a production migration. Reducing the verbosity level might make it more difficult to diagnose failures that are encountered during production migrations. Higher verbosity levels can be used if the log files need to output to go to a debugger. > [!NOTE] -> Running the **ScanState** and **LoadState** tools with the `/v:5` option creates a detailed log file. Although this option makes the log file large, it is helpful in determining where migration errors occurred. +> +> Running the **ScanState** and **LoadState** tools with the `/v:5` option creates a detailed log file. Although this option makes the log file large, it's helpful in determining where migration errors occurred. -After you've determined that the pilot migration successfully migrated the specified files and settings, you're ready to add USMT to the server that is running Microsoft Configuration Manager, or a non-Microsoft management technology. For more information, see [Manage user state in Configuration Manager](/configmgr/osd/get-started/manage-user-state). +After the pilot migration is verified that it successfully migrated the specified files and settings, USMT is ready to be used in the environment to migrate data. For example, using USMT with Microsoft Configuration Manager. For more information, see [Manage user state in Configuration Manager]/(mem/configmgr/osd/get-started/manage-user-state). > [!NOTE] -> For testing purposes, you can create an uncompressed store using the `/hardlink /nocompress` option. When compression is disabled, the **ScanState** tool saves the files and settings to a hidden folder named **File** at `\USMT`. You can use the uncompressed store to view what USMT has stored or to troubleshoot a problem, or you can run an antivirus utility against the files. Additionally, you can also use the `/listfiles` command-line option and the diagnostic log to list the files that were gathered and to troubleshoot problems with your migration. +> +> For testing purposes, an uncompressed store using the `/hardlink /nocompress` option can be created. When compression is disabled, the **ScanState** tool saves the files and settings to a hidden folder named **File** at `\USMT`. The uncompressed store can be used to view what USMT stored or to troubleshoot a problem. An antivirus utility can also be run against the files. Additionally, the following items can be used to troubleshoot problems with the migration: +> +> - The `/listfiles` command-line option. +> - The diagnostic log that lists the files that were gathered. ## Related articles -[Plan your migration](usmt-plan-your-migration.md) - -[Log files](usmt-log-files.md) +- [Plan the migration](usmt-plan-your-migration.md). +- [Log files](usmt-log-files.md). diff --git a/windows/deployment/usmt/usmt-topics.md b/windows/deployment/usmt/usmt-topics.md index a1a2c43ef3..57328e3440 100644 --- a/windows/deployment/usmt/usmt-topics.md +++ b/windows/deployment/usmt/usmt-topics.md @@ -1,18 +1,22 @@ --- -title: User State Migration Tool (USMT) Overview Topics (Windows 10) +title: User State Migration Tool (USMT) Overview Articles description: Learn about User State Migration Tool (USMT) overview articles that describe USMT as a highly customizable user-profile migration experience for IT professionals. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- -# User State Migration Tool (USMT) overview topics +# User State Migration Tool (USMT) overview articles -The User State Migration Tool (USMT) 10.0 provides a highly customizable user-profile migration experience for IT professionals. USMT includes three command-line tools: `ScanState.exe`, `LoadState.exe`, and `UsmtUtils.exe`. USMT also includes a set of three modifiable .xml files: `MigApp.xml`, `MigDocs.xml`, and `MigUser.xml`. Additionally, you can create custom .xml files to support your migration needs. You can also create a `Config.xml` file to specify files or settings to exclude from the migration. +The User State Migration Tool (USMT) provides a highly customizable user-profile migration experience for IT professionals. USMT includes three command-line tools: `ScanState.exe`, `LoadState.exe`, and `UsmtUtils.exe`. USMT also includes a set of three modifiable .xml files: `MigApp.xml`, `MigDocs.xml`, and `MigUser.xml`. Additionally, custom **.xml** files can be created to support the organization's migration needs. A `Config.xml` file can also be created to specify files or settings to exclude from the migration. ## In this section @@ -20,10 +24,10 @@ The User State Migration Tool (USMT) 10.0 provides a highly customizable user-pr |------ |----------- | |[User State Migration Tool (USMT) overview](usmt-overview.md)|Describes the benefits and limitations of using USMT.| |[Getting started with the User State Migration Tool (USMT)](getting-started-with-the-user-state-migration-tool.md)|Describes the general process to follow to migrate files and settings, and provides links to more information.| -|[Windows upgrade and migration considerations](../upgrade/windows-upgrade-and-migration-considerations.md)|Discusses the Microsoft® tools you can use to move files and settings between installations and special considerations for performing an upgrade or migration.| +|[Windows upgrade and migration considerations](../upgrade/windows-upgrade-and-migration-considerations.md)|Discusses the Microsoft tools that can be used to move files and settings between installations and special considerations for performing an upgrade or migration.| ## Related articles -- [User State Migration Tool (USMT) how-to topics](usmt-how-to.md) -- [User State Migration Tool (USMT) troubleshooting](usmt-troubleshooting.md) -- [User State Migration Toolkit (USMT) reference](usmt-reference.md) +- [User State Migration Tool (USMT) how-to articles](usmt-how-to.md). +- [User State Migration Tool (USMT) troubleshooting](usmt-troubleshooting.md). +- [User State Migration Toolkit (USMT) reference](usmt-reference.md). diff --git a/windows/deployment/usmt/usmt-troubleshooting.md b/windows/deployment/usmt/usmt-troubleshooting.md index 05971e5afd..203c1e2f5e 100644 --- a/windows/deployment/usmt/usmt-troubleshooting.md +++ b/windows/deployment/usmt/usmt-troubleshooting.md @@ -1,18 +1,22 @@ --- -title: User State Migration Tool (USMT) Troubleshooting (Windows 10) -description: Learn about topics that address common User State Migration Tool (USMT) 10.0 issues and questions to help troubleshooting. +title: User State Migration Tool (USMT) Troubleshooting +description: Learn about articles that address common User State Migration Tool (USMT) issues and questions to help troubleshooting. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # User State Migration Tool (USMT) troubleshooting -The following table describes articles that address common User State Migration Tool (USMT) 10.0 issues and questions. These articles describe tools that you can use to troubleshoot issues that arise during your migration. +The following table describes articles that address common User State Migration Tool (USMT) issues and questions. These articles describe tools that can be used to troubleshoot issues that arise during the migration. ## In this section @@ -20,16 +24,13 @@ The following table describes articles that address common User State Migration |--- |--- | |[Common Issues](/troubleshoot/windows-client/deployment/usmt-common-issues)|Find troubleshooting solutions for common problems in USMT.| |[Frequently Asked Questions](usmt-faq.yml)|Find answers to questions about how to use USMT.| -|[Log Files](usmt-log-files.md)|Learn how to enable logging to help you troubleshoot issues in USMT.| +|[Log Files](usmt-log-files.md)|Learn how to enable logging to help troubleshoot issues in USMT.| |[Return Codes](/troubleshoot/windows-client/deployment/usmt-return-codes)|Learn how to use return codes to identify problems in USMT.| |[USMT Resources](usmt-resources.md)|Find more information and support for using USMT.| ## Related articles -[USMT best practices](usmt-best-practices.md) - -[User State Migration Tool (USMT) overview topics](usmt-topics.md) - -[User State Migration Tool (USMT) how-to topics](usmt-how-to.md) - -[User State Migration Toolkit (USMT) reference](usmt-reference.md) +- [USMT best practices](usmt-best-practices.md). +- [User State Migration Tool (USMT) overview articles](usmt-topics.md). +- [User State Migration Tool (USMT) how-to articles](usmt-how-to.md). +- [User State Migration Toolkit (USMT) reference](usmt-reference.md). diff --git a/windows/deployment/usmt/usmt-utilities.md b/windows/deployment/usmt/usmt-utilities.md index 2a174b6f13..1cec514459 100644 --- a/windows/deployment/usmt/usmt-utilities.md +++ b/windows/deployment/usmt/usmt-utilities.md @@ -1,26 +1,30 @@ --- -title: UsmtUtils Syntax (Windows 10) -description: Learn about the syntax for the utilities available in User State Migration Tool (USMT) 10.0 through the command-line interface. +title: UsmtUtils Syntax +description: Learn about the syntax for the utilities available in User State Migration Tool (USMT) through the command-line interface. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # UsmtUtils Syntax -This article describes the syntax for the utilities available in User State Migration Tool (USMT) 10.0 through the command-line interface. These utilities: +This article describes the syntax for the utilities available in User State Migration Tool (USMT) through the command-line interface. These utilities: -- Improve your ability to determine cryptographic options for your migration. +- Improve the ability to determine cryptographic options for the migration. - Help removing hard-link stores that can't otherwise be deleted due to a sharing lock. -- Verify whether the catalog file or any of the other files in the compressed migration store have become corrupted. +- Verify whether the catalog file or any of the other files in the compressed migration store are corrupted. -- Extract files from the compressed migration store when you migrate files and settings to the destination computer. +- Extract files from the compressed migration store created when files and settings are migrated to the destination computer. ## UsmtUtils.exe @@ -28,30 +32,30 @@ The following table lists command-line options for `UsmtUtils.exe`. The sections The syntax for `UsmtUtils.exe` is: -> UsmtUtils.exe \[/ec | /rd *<storeDir>* | /verify *<filepath>* \[options\] | /extract *<filepath>* *<destinationPath>* \[options\]\] +> UsmtUtils.exe \[/ec | /rd *\* | /verify *\* \[options\] | /extract *\* *\* \[options\]\] |Command-line Option|Description| |--- |--- | -|**/ec**|Returns a list of supported cryptographic algorithms (AlgIDs) on the current system. You can use this option on a destination computer to determine which algorithm to use with the `/encrypt` command before you run the **ScanState** tool on the source computer.| -|**/rd** *<storeDir>* |Removes the directory path specified by the *<storeDir>* argument on the computer. You can use this command to delete hard-link migration stores that can't otherwise be deleted at a command prompt due to a sharing lock. If the migration store spans multiple volumes on a given drive, it will be deleted from all of these volumes.

For example:
`UsmtUtils.exe /rd D:\MyHardLinkStore`| -|**/y**|Overrides the accept deletions prompt when used with the `/rd` option. When you use the `/y` option with the `/rd` option, you won't be prompted to accept the deletions before USMT deletes the directories.| -|**/verify**|Returns information on whether the compressed migration store is intact or whether it contains corrupted files or a corrupted catalog.

See [Verify options](#verify-options) for syntax and options to use with `/verify`.| -|**/extract**|Recovers files from a compressed USMT migration store.

See [Extract options](#extract-options) for syntax and options to use with `/extract`.| +|**/ec**|Returns a list of supported cryptographic algorithms (AlgIDs) on the current system. This option can be used on a destination computer to determine which algorithm to use with the `/encrypt` command before running the **ScanState** tool on the source computer.| +|**/rd** *\* |Removes the directory path specified by the *\* argument on the computer. This command can be used to delete hard-link migration stores that can't otherwise be deleted at a command prompt due to a sharing lock. If the migration store spans multiple volumes on a given drive, the migration store is deleted from all of these volumes.

For example:
`UsmtUtils.exe /rd D:\MyHardLinkStore`| +|**/y**|Overrides the prompt to accept deletions when used with the `/rd` option. When the `/y` option is used with the `/rd` option, a prompt isn't displayed to accept the deletions before USMT deletes the directories.| +|**/verify**|Returns information on whether the compressed migration store is intact or whether it contains corrupted files or a corrupted catalog.

See [Verify options](#verify-options) for syntax and options to use with `/verify`.| +|**/extract**|Recovers files from a compressed USMT migration store.

See [Extract options](#extract-options) for syntax and options to use with `/extract`.| ## Verify options -Use the `/verify` option when you want to determine whether a compressed migration store is intact or whether it contains corrupted files or a corrupted catalog. For more information on how to use the `/verify` option, see [Verify the condition of a compressed migration store](verify-the-condition-of-a-compressed-migration-store.md). +Use the `/verify` option to determine whether a compressed migration store is intact or whether it contains corrupted files or a corrupted catalog. For more information on how to use the `/verify` option, see [Verify the condition of a compressed migration store](verify-the-condition-of-a-compressed-migration-store.md). The syntax for `/verify` is: -> UsmtUtils.exe /verify\[:*<reportType>*\] *<filePath>* \[/l:*<logfile>*\] \[/v:*VerbosityLevel*\] \[/decrypt \[:*<AlgID>*\] {/key:*<keystring>* | /keyfile:*<filename>*}\] +> UsmtUtils.exe /verify\[:*\*\] *\* \[/l:*\*\] \[/v:*VerbosityLevel*\] \[/decrypt \[:*\*\] {/key:*\* | /keyfile:*\*}\] | Command-line Option | Description | |-----|--------| -| *<reportType>* | Specifies whether to report on all files, corrupted files only, or the status of the catalog.
  • **Summary**. Returns both the number of files that are intact and the number of files that are corrupted in the migration store. If no algorithm is specified, the summary report is displayed as a default.
  • **all**. Returns a tab-delimited list of all of the files in the compressed migration store and the status for each file. Each line contains the file name followed by a tab spacing, and either **CORRUPTED** or **OK** depending on the status of the file. The last entry reports the corruption status of the **CATALOG** of the store. A catalog file contains metadata for all files in a migration store. The **LoadState** tool requires a valid catalog file in order to open the migration store. Returns "OK" if the catalog file is intact and **LoadState** can open the migration store and "CORRUPTED" if the migration store is corrupted.
  • **failureonly**. Returns a tab-delimited list of only the files that are corrupted in the compressed migration store.
  • **Catalog**. Returns only the status of the catalog file.
| -| **/l:**
*<logfilePath>* | Specifies the location and name of the log file. | -| **/v:** *<VerbosityLevel>* | **(Verbosity)**

Enables verbose output in the **UsmtUtils** log file. The default value is 0.

You can set the *VerbosityLevel* to one of the following levels:
  • **0** - Only the default errors and warnings are enabled.
  • **1** - Enables verbose output.
  • **4** - Enables error and status output.
  • **5** - Enables verbose and status output.
  • **8** - Enables error output to a debugger.
  • **9** - Enables verbose output to a debugger.
  • **12** - Enables error and status output to a debugger.
  • **13** - Enables verbose, status, and debugger output.
| -| **/decrypt** *<AlgID>* **/**:*<KeyString>*
or
**/decrypt** *<AlgID>* **/**:*<"Key String">*
or
**/decrypt:** *<AlgID>* **/keyfile**:*<FileName>* | Specifies that the `/encrypt` option was used to create the migration store with the **ScanState** tool. To decrypt the migration store, specify a `/key` or `/keyfile` option as follows:
  • *<AlgID>* specifies the cryptographic algorithm that was used to create the migration store on the `ScanState.exe` command line. If no algorithm is specified, **ScanState** and **UsmtUtils** use the 3DES algorithm as a default.
    *<AlgID>* valid values include: `AES_128`, `AES_192`, `AES_256`, `3DES`, or `3DES_112`.
  • `/key:` *<KeyString>* specifies the encryption key. If there's a space in *<KeyString>*, you must surround the argument with quotation marks.
  • `/keyfile`: *<FileName>* specifies the location and name of a text (.txt) file that contains the encryption key.

For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md) | +| *\* | Specifies whether to report on all files, corrupted files only, or the status of the catalog.
  • **Summary**. Returns both the number of files that are intact and the number of files that are corrupted in the migration store. If no algorithm is specified, the summary report is displayed as a default.
  • **all**. Returns a tab-delimited list of all of the files in the compressed migration store and the status for each file. Each line contains the file name followed by a tab spacing, and either **CORRUPTED** or **OK** depending on the status of the file. The last entry reports the corruption status of the **CATALOG** of the store. A catalog file contains metadata for all files in a migration store. The **LoadState** tool requires a valid catalog file in order to open the migration store. Returns "OK" if the catalog file is intact and **LoadState** can open the migration store and "CORRUPTED" if the migration store is corrupted.
  • **failureonly**. Returns a tab-delimited list of only the files that are corrupted in the compressed migration store.
  • **Catalog**. Returns only the status of the catalog file.
| +| **/l:**
*\* | Specifies the location and name of the log file. | +| **/v:** *\* | **(Verbosity)**

Enables verbose output in the **UsmtUtils** log file. The default value is 0.

The *VerbosityLevel* can be set to one of the following levels:
  • **0** - Only the default errors and warnings are enabled.
  • **1** - Enables verbose output.
  • **4** - Enables error and status output.
  • **5** - Enables verbose and status output.
  • **8** - Enables error output to a debugger.
  • **9** - Enables verbose output to a debugger.
  • **12** - Enables error and status output to a debugger.
  • **13** - Enables verbose, status, and debugger output.
| +| **/decrypt** *\* **/**:*\*
or
**/decrypt** *\* **/**:*\<"Key String"\>*
or
**/decrypt:** *\* **/keyfile**:*\* | Specifies that the `/encrypt` option was used to create the migration store with the **ScanState** tool. To decrypt the migration store, specify a `/key` or `/keyfile` option as follows:
  • *\* specifies the cryptographic algorithm that was used to create the migration store on the `ScanState.exe` command line. If no algorithm is specified, **ScanState** and **UsmtUtils** use the 3DES algorithm as a default.
    *\* valid values include: `AES_128`, `AES_192`, `AES_256`, `3DES`, or `3DES_112`.
  • `/key:` *\* specifies the encryption key. If there's a space in *\*, the argument must be surrounded with quotation marks.
  • `/keyfile`: *\* specifies the location and name of a text (.txt) file that contains the encryption key.

For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md). | Some examples of `/verify` commands: @@ -65,21 +69,21 @@ Some examples of `/verify` commands: ## Extract options -Use the `/extract` option to recover files from a compressed USMT migration store if it will not restore normally with **LoadState**. For more information on how to use the `/extract` option, see [Extract files from a compressed USMT migration store](usmt-extract-files-from-a-compressed-migration-store.md). +Use the `/extract` option to recover files from a compressed USMT migration store if it doesn't restore normally with **LoadState**. For more information on how to use the `/extract` option, see [Extract files from a compressed USMT migration store](usmt-extract-files-from-a-compressed-migration-store.md). The syntax for `/extract` is: -> /extract *<filePath>* *<destinationPath>* \[/i:*<includePattern>*\] \[/e: *<excludePattern>*\] \[/l: *<logfile>*\] \[/v: *VerbosityLevel>*\] \[/decrypt\[:*<AlgID>*\] {key: *<keystring>* | /keyfile: *<filename>*}\] \[/o\] +> /extract *\* *\* \[/i:*\*\] \[/e: *\*\] \[/l: *\*\] \[/v: *VerbosityLevel\>*\] \[/decrypt\[:*\*\] {key: *\* | /keyfile: *\*}\] \[/o\] | Command-line Option | Description | |-------|-----| -| *<filePath>* | Path to the USMT migration store.

For example:
`D:\MyMigrationStore\USMT\store.mig` | -| *<destinationPath>* | Path to the folder where the tool puts the individual files. | -| **/i**:*<includePattern>* | Specifies a pattern for files to include in the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use `/i`: *<includePattern>* and `/e`: *<excludePattern>* options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns. | -| **/e**:*<excludePattern>* | Specifies a pattern for files to omit from the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use `/i`: *<includePattern>* and `/e`: *<excludePattern>* options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns. | -| **/l**:*<logfilePath>* | Specifies the location and name of the log file. | -| **/v:***<VerbosityLevel>* | **(Verbosity)**

Enables verbose output in the **UsmtUtils** log file. The default value is 0.

You can set the *VerbosityLevel* to one of the following levels:
  • **0** - Only the default errors and warnings are enabled.
  • **1** - Enables verbose output.
  • **4** - Enables error and status output.
  • **5** - Enables verbose and status output.
  • **8** - Enables error output to a debugger.
  • **9** - Enables verbose output to a debugger.
  • **12** - Enables error and status output to a debugger.
  • **13** - Enables verbose, status, and debugger output.
| -| **/decrypt***<AlgID>***/key**:*<KeyString>*
or
**/decrypt***<AlgID>***/**:*<"Key String">*
or
**/decrypt:***<AlgID>***/keyfile**:*<FileName>* | Specifies that the `/encrypt` option was used to create the migration store with the **ScanState** tool. To decrypt the migration store, you must also specify the `/key` or `/keyfile` option as follows:
  • *<AlgID>* specifies the cryptographic algorithm that was used to create the migration store on the `ScanState.exe` command line. If no algorithm is specified, **ScanState** and **UsmtUtils** use the 3DES algorithm as a default.
    *<AlgID>* valid values include: `AES_128`, `AES_192`, `AES_256`, `3DES`, or `3DES_112`.
  • `/key`: *<KeyString>* specifies the encryption key. If there's a space in *<KeyString>*, you must surround the argument with quotation marks.
  • `/keyfile`:*<FileName>* specifies a text (.txt) file that contains the encryption key

For more information about supported encryption algorithms, see [Migration store encryption](usmt-migration-store-encryption.md). | +| *\* | Path to the USMT migration store.

For example:
`D:\MyMigrationStore\USMT\store.mig` | +| *\* | Path to the folder where the tool puts the individual files. | +| **/i**:*\* | Specifies a pattern for files to include in the extraction. More than one pattern can be specified. Separate patterns with a comma or a semicolon. The `/i`: *\* and `/e`: *\* options can be used in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns. | +| **/e**:*\* | Specifies a pattern for files to omit from the extraction. More than one pattern can be specified. Separate patterns with a comma or a semicolon. The `/i`: *\* and `/e`: *\* options can be used in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns. | +| **/l**:*\* | Specifies the location and name of the log file. | +| **/v:***\* | **(Verbosity)**

Enables verbose output in the **UsmtUtils** log file. The default value is 0.

The *VerbosityLevel* can be set to one of the following levels:
  • **0** - Only the default errors and warnings are enabled.
  • **1** - Enables verbose output.
  • **4** - Enables error and status output.
  • **5** - Enables verbose and status output.
  • **8** - Enables error output to a debugger.
  • **9** - Enables verbose output to a debugger.
  • **12** - Enables error and status output to a debugger.
  • **13** - Enables verbose, status, and debugger output.
| +| **/decrypt***\***/key**:*\*
or
**/decrypt***\***/**:*\<"Key String"\>*
or
**/decrypt:***\***/keyfile**:*\* | Specifies that the `/encrypt` option was used to create the migration store with the **ScanState** tool. To decrypt the migration store, the `/key` or `/keyfile` option must also be specified as follows:
  • *\* specifies the cryptographic algorithm that was used to create the migration store on the `ScanState.exe` command line. If no algorithm is specified, **ScanState** and **UsmtUtils** use the 3DES algorithm as a default.
    *\* valid values include: `AES_128`, `AES_192`, `AES_256`, `3DES`, or `3DES_112`.
  • `/key`: *\* specifies the encryption key. If there's a space in *\*, the argument must be surrounded with quotation marks.
  • `/keyfile`:*\* specifies a text (.txt) file that contains the encryption key

For more information about supported encryption algorithms, see [Migration store encryption](usmt-migration-store-encryption.md). | | **/o** | Overwrites existing output files. | Some examples of `/extract` commands: @@ -94,6 +98,5 @@ Some examples of `/extract` commands: ## Related articles -[User State Migration Tool (USMT) command-line syntax](usmt-command-line-syntax.md) - -[Return codes](/troubleshoot/windows-client/deployment/usmt-return-codes) +- [User State Migration Tool (USMT) command-line syntax](usmt-command-line-syntax.md). +- [Return codes](/troubleshoot/windows-client/deployment/usmt-return-codes). diff --git a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md index e32b8c614c..85b57065ed 100644 --- a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md +++ b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md @@ -1,28 +1,32 @@ --- -title: What does USMT migrate (Windows 10) -description: Learn how User State Migration Tool (USMT) 10.0 is designed so that an IT engineer can precisely define migrations using the USMT .xml scripting language. +title: What does USMT migrate +description: Learn how User State Migration Tool (USMT) is designed so that an IT engineer can precisely define migrations using the USMT .xml scripting language. +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/23/2022 +ms.date: 01/18/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # What does USMT migrate? ## Default migration scripts -The User State Migration Tool (USMT) 10.0 is designed so that an IT engineer can precisely define migrations using the USMT .xml scripting language. USMT provides the following sample scripts: +The User State Migration Tool (USMT) is designed so that an IT engineer can precisely define migrations using the USMT **.xml** scripting language. USMT provides the following sample scripts: - **MigApp.XML** - Rules to migrate application settings. -- **MigDocs.XML** - Rules that use the **MigXmlHelper.GenerateDocPatterns** helper function, which can be used to automatically find user documents on a computer without the need to author extensive custom migration .xml files. +- **MigDocs.XML** - Rules that use the **MigXmlHelper.GenerateDocPatterns** helper function, which can be used to automatically find user documents on a computer without the need to author extensive custom migration **.xml** files. - **MigUser.XML** - Rules to migrate user profiles and user data. - `MigUser.xml` gathers everything in a user's profile and then does a file extension- based search of most of the system for other user data. If data doesn't match either of these criteria, the data won't be migrated. Usually, this file describes a core migration. + `MigUser.xml` gathers everything in a user's profile and then does a file extension- based search of most of the system for other user data. If data doesn't match either of these criteria, the data isn't migrated. Usually, this file describes a core migration. The following data doesn't migrate with `MigUser.xml`: @@ -33,28 +37,29 @@ The User State Migration Tool (USMT) 10.0 is designed so that an IT engineer can This section describes the user data that USMT migrates by default, using the `MigUser.xml` file. It also defines how to migrate access control lists (ACLs). -- **Folders from each user profile.** When you specify the `MigUser.xml` file, USMT migrates everything in a user's profiles including the following items: +- **Folders from each user profile.** When the `MigUser.xml` file is specified, USMT migrates everything in a user's profiles including the following folder items: - - My Documents + - Documents. - - My Video + - Videos. - - My Music + - Music. - - My Pictures + - Pictures. - - Desktop files + - Desktop files. - - Start menu + - Start menu. - - Quick Launch settings + - Quick Launch settings. - - Favorites + - Favorites. > [!IMPORTANT] - > Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](/troubleshoot/windows-client/deployment/usmt-common-issues#usmt-doesnt-migrate-the-start-layout). + > + > USMT doesn't migrate the Start menu layout. To migrate a user's Start menu, settings must be exported and then imported using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](/troubleshoot/windows-client/deployment/usmt-common-issues#usmt-doesnt-migrate-the-start-layout). -- **Folders from the All Users and Public profiles.** When you specify the `MigUser.xml` file, USMT also migrates the following from the **Public** profile in Windows Vista, Windows 7, Windows 8, or Windows 10: +- **Folders from the All Users and Public profiles.** When the `MigUser.xml` file is specified, USMT also migrates the following from the **Public** profile in Windows: - Shared Documents @@ -70,161 +75,120 @@ This section describes the user data that USMT migrates by default, using the `M - Shared Favorites -- **File types.** When you specify the `MigUser.xml` file, the **ScanState** tool searches the fixed drives, collects, and then migrates files with any of the following file extensions: +- **File types.** When the `MigUser.xml` file is specified, the **ScanState** tool searches the fixed drives, collects, and then migrates files with any of the following file extensions: `.accdb`, `.ch3`, `.csv`, `.dif`, `.doc*`, `.dot*`, `.dqy`, `.iqy`, `.mcw`, `.mdb*`, `.mpp`, `.one*`, `.oqy`, `.or6`, `.pot*`, `.ppa`, `.pps*`, `.ppt*`, `.pre`, `.pst`, `.pub`, `.qdf`, `.qel`, `.qph`, `.qsd`, `.rqy`, `.rtf`, `.scd`, `.sh3`, `.slk`, `.txt`, `.vl*`, `.vsd`, `.wk*`, `.wpd`, `.wps`, `.wq1`, `.wri`, `.xl*`, `.xla`, `.xlb`, `.xls*` > [!NOTE] + > > The asterisk (`*`) stands for zero or more characters. > [!NOTE] + > > The OpenDocument extensions (`*.odt`, `*.odp`, `*.ods`) that Microsoft Office applications can use aren't migrated by default. -- **Access control lists.** USMT migrates access control lists (ACLs) for specified files and folders from computers running both Windows® XP and Windows Vista. For example, if you migrate a file named `File1.txt` that is **read-only** for **User1** and **read/write** for **User2**, these settings will still apply on the destination computer after the migration. +- **Access control lists.** USMT migrates access control lists (ACLs) for specified files and folders from computers running Windows. For example, if a file named `File1.txt` that is **read-only** for **User1** and **read/write** for **User2** is migrated, these settings will still apply on the destination computer after the migration. > [!IMPORTANT] - > To migrate ACLs, you must specify the directory to migrate in the MigUser.xml file. Using file patterns like \*.doc will not migrate a directory. The source ACL information is migrated only when you explicitly specify the directory. For example, `c:\test docs`. + > + > To migrate ACLs, the directory to migrate must be specified in the `MigUser.xml` file. Using file patterns like \*.doc won't migrate a directory. The source ACL information is migrated only when the directory is explicitly specified. For example, `c:\test docs`. ## Operating-system components -USMT migrates operating-system components to a destination computer from computers running Windows 7 and Windows 8 +USMT migrates operating-system components to a destination computer. The following components are migrated by default using the manifest files: -The following components are migrated by default using the manifest files: +- Accessibility settings. -- Accessibility settings +- Address book. -- Address book +- Command-prompt settings. -- Command-prompt settings +- Desktop wallpaper. **¹** -- Desktop wallpaper **¹** +- EFS files. -- EFS files +- Favorites. -- Favorites +- Folder options. -- Folder options +- Fonts. -- Fonts +- Group membership. USMT migrates users' group settings. To view what groups a user belongs to: -- Group membership. USMT migrates users' group settings. The groups to which a user belongs can be found by right-clicking **My Computer** on the Start menu and then selecting **Manage**. When running an offline migration, the use of a **<ProfileControl>** section in the `Config.xml` file is required. + 1. Right-clicking on the Start menu and then selecting **Computer Management**. + 1. In the **Computer Management** console, expand **System tools** > **Local Users and Groups** > **Groups**. + 1. Inspect the individual groups in the results pane to see what users belong to what groups. + + The use of a **\** section in the `Config.xml` file is required when running an offline migration. -- Windows Internet Explorer® settings **¹** +- Microsoft Open Database Connectivity (ODBC) settings. -- Microsoft® Open Database Connectivity (ODBC) settings +- Mouse and keyboard settings. -- Mouse and keyboard settings +- Network drive mapping. -- Network drive mapping +- Network printer mapping. **¹** -- Network printer mapping **¹** +- Offline files. **¹** -- Offline files **¹** +- Phone and modem options. **¹** -- Phone and modem options **¹** +- RAS connection and phone book (.pbk) files. -- RAS connection and phone book (.pbk) files +- Regional settings. **¹** -- Regional settings **¹** +- Remote Access. -- Remote Access +- Taskbar settings. **¹** -- Taskbar settings **¹** +- User personal certificates (all). -- User personal certificates (all) +- Windows Mail. -- Windows Mail +- Windows Media Player. **¹** -- Windows Media Player **¹** - -- Windows Rights Management +- Windows Rights Management. **¹** These settings aren't available for an offline migration. For more information, see [Offline migration reference](offline-migration-reference.md). > [!IMPORTANT] -> This list may not be complete. There may be additional components that are migrated. +> +> This list might not be complete. There might be additional components that are migrated. > [!NOTE] -> Some settings, such as fonts, aren't applied by the **LoadState** tool until after the destination computer has been restarted. For this reason, restart the destination computer after you run the **LoadState** tool. +> +> Some settings, such as fonts, aren't applied by the **LoadState** tool until after the destination computer is restarted. For this reason, restart the destination computer after running the **LoadState** tool. ## Supported applications -Even though it's not required for all applications, it's good practice to install all applications on the destination computer before restoring the user state. Installing applications before migrating settings helps to ensure that migrated settings aren't overwritten by the application installers. +Even though it isn't required for all applications, it's good practice to install all applications on the destination computer before restoring the user state. Installing applications before migrating settings helps to ensure application installers don't overwrite settings that were migrated. > [!NOTE] -> The versions of installed applications must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. +> +> The versions of installed applications must match on the source and destination computers. USMT doesn't support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. > [!NOTE] -> USMT migrates only the settings that have been used or modified by the user. If there is an application setting on the source computer that was not touched by the user, the setting may not migrate. +> +> USMT only migrates settings that are modified on the source computer. If an application setting isn't modified from the default on the source computer, the setting might not migrate. -When you specify the `MigApp.xml` file, USMT migrates the settings for the following applications: - -|Product|Version| -|--- |--- | -|Adobe Acrobat Reader|9| -|AOL Instant Messenger|6.8| -|Adobe Creative Suite|2| -|Adobe Photoshop CS|8, 9| -|Adobe ImageReady CS|| -|Apple iTunes|6, 7, 8| -|Apple QuickTime Player|5, 6, 7| -|Apple Safari|3.1.2| -|Google Chrome|beta| -|Google Picasa|3| -|Google Talk|beta| -|IBM Lotus 1-2-3|9| -|IBM Lotus Notes|6, 7, 8| -|IBM Lotus Organizer|5| -|IBM Lotus WordPro|9.9| -|Intuit Quicken Deluxe|2009| -|Money Plus Business|2008| -|Money Plus Home|2008| -|Mozilla Firefox|3| -|Microsoft Office|2003, 2007, 2010| -|Microsoft Office Access®|2003, 2007, 2010| -|Microsoft Office Excel®|2003, 2007, 2010| -|Microsoft Office FrontPage®|2003, 2007, 2010| -|Microsoft Office OneNote®|2003, 2007, 2010| -|Microsoft Office Outlook®|2003, 2007, 2010| -|Microsoft Office PowerPoint®|2003, 2007, 2010| -|Microsoft Office Publisher|2003, 2007, 2010| -|Microsoft Office Word|2003, 2007, 2010| -|Opera Software Opera|9.5| -|Microsoft Outlook Express|(only mailbox file)| -|Microsoft Project|2003, 2007| -|Microsoft Office Visio®|2003, 2007| -|RealPlayer Basic|11| -|Sage Peachtree|2009| -|Skype|3.8| -|Windows Live Mail|12, 14| -|Windows Live Messenger|8.5, 14| -|Windows Live MovieMaker|14| -|Windows Live Photo Gallery|12, 14| -|Windows Live Writer|12, 14| -|Windows Mail|(Windows 7 and 8)| -|Microsoft Works|9| -|Yahoo Messenger|9| -|Microsoft Zune™ Software|3| +When the `MigApp.xml` file is specified, USMT migrates the settings for specific applications defined in the `MigApp.xml` file. Consult the `MigApp.xml` file for applications are supported. ## What USMT doesn't migrate -The following items are settings that USMT doesn't migrate. If you're having a problem that isn't listed here, see [Common issues](/troubleshoot/windows-client/deployment/usmt-common-issues). +The following items are settings that USMT doesn't migrate. If having a problem that isn't listed here, see [Common issues](/troubleshoot/windows-client/deployment/usmt-common-issues). ### Application settings USMT doesn't migrate the following application settings: +- Settings for Microsoft Store applications. + - Settings from earlier versions of an application. The versions of each application must match on the source and destination computers. USMT doesn't support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. USMT can migrate from an earlier version of Microsoft Office to a later version. -- Application settings and some operating-system settings when a local account is created. For example, if you run `/lac` to create a local account on the destination computer, USMT will migrate the user data, but only some of the operating-system settings, such as wallpaper and screensaver settings, and no application settings will migrate. +- Application settings and some operating-system settings when a local account is created. For example, if `/lac` is specified to create a local account on the destination computer, USMT migrates the user data, but doesn't migrate: -- Microsoft Project settings, when migrating from Office 2003 to Office 2007 system. - -- ICQ Pro settings, if ICQ Pro is installed in a different location on the destination computer. To successfully migrate the settings of ICQ Pro, you must install ICQ Pro in the same location on the destination computer as it was on the source computer. Otherwise, after you run the **LoadState** tool, the application won't start. You may encounter problems when: - - - You change the default installation location on 32-bit destination computers. - - - You attempt to migrate from a 32-bit computer to a 64-bit computer. Attempting to migrate settings between different architectures doesn't work because the ICQ Pro default installation directory is different on the two types of computers. When you install ICQ Pro on a 32-bit computer, the default location is `C:\Program Files\...`. The ICQ Pro default installation directory on an x64-based computer, however, is `C:\Program Files (x86)\...`. + - Some operating system settings - Only some operating-system settings, such as wallpaper and screensaver settings, are migrated. + - Application settings. ### Operating-System settings @@ -232,28 +196,29 @@ USMT doesn't migrate the following operating-system settings. - Local printers, hardware-related settings, drivers, passwords, application binary files, synchronization files, DLL files, or other executable files. -- Permissions for shared folders. After migration, you must manually re-share any folders that were shared on the source computer. +- Permissions for shared folders. After migration, any folders that were shared on the source computer must be manually re-shared. - Files and settings migrating between operating systems with different languages. The operating system of the source computer must match the language of the operating system on the destination computer. -- Customized icons for shortcuts may not migrate. +- Customized icons for shortcuts might not migrate. -You should also note the following items: +Also note the following items: -- You should run USMT from an account with administrative credentials. Otherwise, some data won't migrate. When running the **ScanState** and **LoadState** tools, you must run the tools in Administrator mode from an account with administrative credentials. If you don't run USMT in Administrator mode, only the user profile that is logged on will be included in the migration. +- Run USMT from an account with administrative credentials. Otherwise, some data doesn't migrate. When the **ScanState** and **LoadState** tools are run, the tools must be run in Administrator mode from an account with administrative credentials. If USMT isn't run in Administrator mode, only the user profile that is logged on is included in the migration. -- You can use the `/localonly` option to exclude the data from removable drives and network drives mapped on the source computer. For more information about what is excluded when you specify `/localonly`, see [ScanState syntax](usmt-scanstate-syntax.md). +- Use the `/localonly` option to exclude the data from removable drives and network drives mapped on the source computer. For more information about what is excluded when `/localonly` is specified, see [ScanState syntax](usmt-scanstate-syntax.md). ### Start menu layout -Starting in Windows 10, version 1607 the USMT doesn't migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](/troubleshoot/windows-client/deployment/usmt-common-issues#usmt-doesnt-migrate-the-start-layout). - - +USMT doesn't migrate the Start menu layout. To migrate a user's Start menu, settings must be exported and then imported using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](/troubleshoot/windows-client/deployment/usmt-common-issues#usmt-doesnt-migrate-the-start-layout). ### User profiles from Active Directory to Microsoft Entra ID -USMT doesn't support migrating user profiles from Active Directory to Microsoft Entra ID. +- USMT doesn't support migrating user profiles from Active Directory domain joined devices to Microsoft Entra joined devices. +- USMT doesn't support migrating user profiles from Microsoft Entra joined devices to Active Directory domain joined devices. +- USMT doesn't support migrating user profiles between Microsoft Entra joined devices. +- USMT might work when migrating user profiles between Microsoft Entra hybrid joined devices or between Active Directory domain joined devices and Microsoft Entra hybrid joined devices, but it's not a tested scenario so therefore unsupported. ## Related articles -[Plan your migration](usmt-plan-your-migration.md) +- [Plan the migration](usmt-plan-your-migration.md). diff --git a/windows/deployment/usmt/usmt-xml-elements-library.md b/windows/deployment/usmt/usmt-xml-elements-library.md index e669804e3e..5f4ace10bf 100644 --- a/windows/deployment/usmt/usmt-xml-elements-library.md +++ b/windows/deployment/usmt/usmt-xml-elements-library.md @@ -1,40 +1,48 @@ --- -title: XML Elements Library (Windows 10) -description: Learn about the XML elements and helper functions that you can employ to author migration .xml files to use with User State Migration Tool (USMT). +title: XML Elements Library +description: Learn about the XML elements and helper functions that can be employed to author migration .xml files to use with User State Migration Tool (USMT). +ms.reviewer: kevinmi,warrenw manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 01/09/2024 ms.topic: article ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # XML elements library -This topic describes the XML elements and helper functions that you can employ to author migration .xml files to use with User State Migration Tool (USMT). It is assumed that you understand the basics of XML. +This article describes the XML elements and helper functions that can be employed to author migration **.xml** files to use with User State Migration Tool (USMT). This article assumes a basic knowledge of XML. -In addition to XML elements and helper functions, this article describes how to specify encoded locations and locations patterns, functions that are for internal USMT use only, and the version tags that you can use with helper functions. +In addition to XML elements and helper functions, this article: + +- Describes how to specify encoded locations and locations patterns. +- Functions that are for internal USMT use only. +- The version tags that can be used with helper functions. ## Elements and helper functions -The following table describes the XML elements and helper functions you can use with USMT. +The following table describes the XML elements and helper functions can be used with USMT. | Elements A-K | Elements L-Z | Helper functions | |-----|----|-----| -| [<addObjects>](#addobjects)
[<attributes>](#attributes)
[<bytes>](#bytes)
[<commandLine>](#commandline)
[<component>](#component)
[<condition>](#condition)
[<conditions>](#conditions)
[<content>](#content)
[<contentModify>](#contentmodify)
[<description>](#description)
[<destinationCleanup>](#destinationcleanup)
[<detect>](#detect)
[<detects>](#detects)
[<detection>](#detection)
[<displayName>](#displayname)
[<environment>](#environment)
[<exclude>](#exclude)
[<excludeAttributes>](#excludeattributes)
[<extensions>](#extensions)
[<extension>](#extension)
[<externalProcess>](#externalprocess)
[<icon>](#icon)
[<include>](#include)
[<includeAttribute>](#includeattributes) | [<library>](#library)
[<location>](#location)
[<locationModify>](#locationmodify)
[<_locDefinition>](#_locdefinition)
[<manufacturer>](#manufacturer)
[<merge>](#merge)
[<migration>](#migration)
[<namedElements>](#namedelements)
[<object>](#object)
[<objectSet>](#objectset)
[<path>](#path)
[<paths>](#paths)
[<pattern>](#pattern)
[<processing>](#processing)
[<plugin>](#plugin)
[<role>](#role)
[<rules>](#rules)
[<script>](#script)
[<text>](#text)
[<unconditionalExclude>](#unconditionalexclude)
[<variable>](#variable)
[<version>](#version)
[<windowsObjects>](#windowsobjects) | [<condition> functions](#condition-functions)
[<content> functions](#content-functions)
[<contentModify> functions](#contentmodify-functions)
[<include> and <exclude> filter functions](#include-and-exclude-filter-functions)
[<locationModify> functions](#locationmodify-functions)
[<merge> functions](#merge-functions)
[<script> functions](#script-functions)
[Internal USMT functions](#internal-usmt-functions) | +| [\](#addobjects)
[\](#attributes)
[\](#bytes)
[\](#commandline)
[\](#component)
[\](#condition)
[\](#conditions)
[\](#content)
[\](#contentmodify)
[\](#description)
[\](#destinationcleanup)
[\](#detect)
[\](#detects)
[\](#detection)
[\](#displayname)
[\](#environment)
[\](#exclude)
[\](#excludeattributes)
[\](#extensions)
[\](#extension)
[\](#externalprocess)
[\](#icon)
[\](#include)
[\](#includeattributes) | [\](#library)
[\](#location)
[\](#locationmodify)
[\<_locDefinition\>](#_locdefinition)
[\](#manufacturer)
[\](#merge)
[\](#migration)
[\](#namedelements)
[\](#object)
[\](#objectset)
[\](#path)
[\](#paths)
[\](#pattern)
[\](#processing)
[\](#plugin)
[\](#role)
[\](#rules)
[\](#script)
[\](#text)
[\](#unconditionalexclude)
[\](#variable)
[\](#version)
[\](#windowsobjects) | [\ functions](#condition-functions)
[\ functions](#content-functions)
[\ functions](#contentmodify-functions)
[\ and \ filter functions](#include-and-exclude-filter-functions)
[\ functions](#locationmodify-functions)
[\ functions](#merge-functions)
[\ functions](#script-functions)
[Internal USMT functions](#internal-usmt-functions) | -## <addObjects> +## \ -The **<addObjects>** element emulates the existence of one or more objects on the source computer. The child **<object>** elements provide the details of the emulated objects. If the content is a **<script>** element, the result of the invocation will be an array of objects. +The **\** element emulates the existence of one or more objects on the source computer. The child **\** elements provide the details of the emulated objects. If the content is a **\** element, the result of the invocation is an array of objects. - **Number of occurrences:** unlimited -- **Parent elements:** [<rules>](#rules) +- **Parent elements:** [\](#rules) -- **Required child elements:** [<object>](#object) In addition, you must specify [<location>](#location) and [<attribute>](#attributes) as child elements of this **<object>** element. +- **Required child elements:** [\](#object) In addition, [\](#location) and [\](#attributes) must be specified as child elements of this **\** element. -- **Optional child elements:** [<conditions>](#conditions), [<condition>](#condition), [<script>](#script) +- **Optional child elements:** [\](#conditions), [\](#condition), [\](#script) Syntax: @@ -48,25 +56,25 @@ The following example is from the `MigApp.xml` file: ```xml - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [UpgradeVersion] + %HklmWowSoftware%\Microsoft\Office\16.0\Common\Migration\Office [UpgradeVersion] DWORD 0B000000 - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] + %HklmWowSoftware%\Microsoft\Office\16.0\Common\Migration\Office [Lang] DWORD 00000000 ``` -## <attributes> +## \ -The **<attributes>** element defines the attributes for a registry key or file. +The **\** element defines the attributes for a registry key or file. -- **Number of occurrences:** once for each [<object>](#object) +- **Number of occurrences:** once for each [\](#object) -- **Parent elements:** [<object>](#object) +- **Parent elements:** [\](#object) - **Child elements:** none @@ -78,25 +86,25 @@ Syntax: | Setting | Required? | Value | |------|-----|----| -| *Content* | Yes | The content depends on the type of object specified.
  • For files, the content can be a string containing any of the following attributes separated by commas:
    • Archive
    • Read-only
    • System
    • Hidden
  • For registry keys, the content can be one of the following types:
    • None
    • String
    • ExpandString
    • Binary
    • Dword
    • REG_SZ
| +| *Content* | Yes | The content depends on the type of object specified.
  • For files, the content can be a string containing any of the following attributes separated by commas:
    • Archive
    • Read-only
    • System
    • Hidden
  • For registry keys, the content can be one of the following types:
    • None
    • String
    • ExpandString
    • Binary
    • Dword
    • REG_SZ
| The following example is from the `MigApp.xml` file: ```xml - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] + %HklmWowSoftware%\Microsoft\Office\16.0\Common\Migration\Office [Lang] DWORD 00000000 ``` -## <bytes> +## \ -You must specify the **<bytes>** element only for files because, if **<location>** corresponds to a registry key or a directory, then **<bytes>** will be ignored. +The **\** element can only be specified for files because, if **\** corresponds to a registry key or a directory, then **\** is ignored. - **Number of occurrences:** zero or one -- **Parent elements:** [<object>](#object) +- **Parent elements:** [\](#object) - **Child elements:** none @@ -109,26 +117,26 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | |string|No, default is No|Determines whether *Content* should be interpreted as a string or as bytes.| -|expand|No (default = Yes|When the expand parameter is **Yes**, the content of the **<bytes>** element is first expanded in the context of the source computer and then interpreted.| -|*Content*|Yes|Depends on the value of the string.
  • When the string is **Yes**: the content of the **<bytes>** element is interpreted as a string.
  • When the string is **No**: the content of the **<bytes>** element is interpreted as bytes. Each two characters represent the hexadecimal value of a byte. For example, `616263` is the representation for the `abc` ANSI string. A complete representation of the UNICODE string `abc` including the string terminator would be: `6100620063000000`.
| +|expand|No (default = Yes|When the expand parameter is **Yes**, the content of the **\** element is first expanded in the context of the source computer and then interpreted.| +|*Content*|Yes|Depends on the value of the string.
  • When the string is **Yes**: the content of the **\** element is interpreted as a string.
  • When the string is **No**: the content of the **\** element is interpreted as bytes. Every two characters represent the hexadecimal value of a byte. For example, `616263` is the representation for the `abc` ANSI string. A complete representation of the UNICODE string `abc` including the string terminator would be: `6100620063000000`.
| The following example is from the `MigApp.xml` file: ```xml - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] + %HklmWowSoftware%\Microsoft\Office\16.0\Common\Migration\Office [Lang] DWORD 00000000 ``` -## <commandLine> +## \ -You might want to use the **<commandLine>** element if you want to start or stop a service or application before or after you run the **ScanState** and **LoadState** tools. +The **\** element might be used to start or stop a service or application before or after running the **ScanState** and **LoadState** tools. - **Number of occurrences:** unlimited -- **Parent elements:** [<externalProcess>](#externalprocess) +- **Parent elements:** [\](#externalprocess) - **Child elements:** none @@ -142,22 +150,22 @@ Syntax: |--- |--- |--- | |*CommandLineString*|Yes|A valid command line.| -## <component> +## \ -The **<component>** element is required in a custom .xml file. This element defines the most basic construct of a migration .xml file. For example, in the `MigApp.xml` file, "Microsoft Office 2003" is a component that contains another component, "Microsoft Office Access 2003". You can use the child elements to define the component. +The **\** element is required in a custom **.xml** file. This element defines the most basic construct of a migration **.xml** file. For example, in the `MigApp.xml` file, **Microsoft Office 2016** is a component that contains another component, **Microsoft Office Access 2016**. The child elements can be used to define the component. -A component can be nested inside another component; that is, the **<component>** element can be a child of the **<role>** element within the **<component>** element in two cases: +A component can be nested inside another component; that is, the **\** element can be a child of the **\** element within the **\** element in two cases: -1. When the parent **<component>** element is a container -2. If the child **<component>** element has the same role as the parent **<component>** element. +1. When the parent **\** element is a container +1. If the child **\** element has the same role as the parent **\** element. - **Number of occurrences:** Unlimited -- **Parent elements:** [<migration>](#migration), [<role>](#role) +- **Parent elements:** [\](#migration), [\](#role) -- **Required child elements:** [<role>](#role), [<displayName>](#displayname) +- **Required child elements:** [\](#role), [\](#displayname) -- **Optional child elements:** [<manufacturer>](#manufacturer), [<version>](#version), [<description>](#description), [<paths>](#paths), [<icon>](#icon), [<environment>](#environment), [<extensions>](#extensions) +- **Optional child elements:** [\](#manufacturer), [\](#version), [\](#description), [\](#paths), [\](#icon), [\](#environment), [\](#extensions) Syntax: @@ -169,26 +177,26 @@ hidden="Yes|No"> |Setting|Required?|Value| |--- |--- |--- | -| type | Yes | You can use the following to group settings, and define the type of the component.
  • **System:** Operating system settings. All Windows components are defined by this type.
    When **type="System"** and **defaultSupported="FALSE"** the settings will not migrate unless there is an equivalent component in the .xml files that is specified on the `LoadState.exe` command line. For example, the default `MigSys.xml` file contains components with **type="System"** and **defaultSupported="FALSE"**. If you specify this file on the `ScanState.exe` command line, you must also specify the file on the `LoadState.exe` command line for the settings to migrate. This is because the `LoadState.exe` tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name. Otherwise, the **LoadState** tool will not migrate those settings from the store. This is helpful because you can use the same store for destination computers that are the same version of Windows and a different version of Windows as the source computer.
  • **Application:** Settings for an application.
  • **Device:** Settings for a device.
  • **Documents:** Specifies files.
| -| context | No
Default = UserAndSystem | Defines the scope of this parameter; that is, whether to process this component in the context of the specific user, across the entire operating system, or both.
The largest possible scope is set by the **<component>** element. For example, if a **<component>** element has a context of **User** and a **<rules>** element had a context of **UserAndSystem**, then the **<rules>** element would act as though it has a context of **User**. If a **<rules>** element has a context of **System**, it would act as though the **<rules>** element is not there.
  • **User**: Evaluates the component for each user.
  • **System**: Evaluates the component only once for the system.
  • **UserAndSystem**: Evaluates the component for the entire operating system and each user.
| -| defaultSupported | No
(default = TRUE) | Can be any of **TRUE**, **FALSE**, **YES**, or **NO**. If this parameter is **FALSE** (or **NO**), the component will not be migrated unless there is an equivalent component on the destination computer.
When **type="System"** and **defaultSupported="FALSE"** the settings will not migrate unless there is an equivalent component in the .xml files that are specified on the `LoadState.exe` command line. For example, the default `MigSys.xml` file contains components with **type="System"** and **defaultSupported="FALSE"**. If you specify this file on the `ScanState.exe` command line, you must also specify the file on the `LoadState.exe` command line for the settings to migrate. This is because the **LoadState** tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name or the **LoadState** tool will not migrate those settings from the store. This is helpful because you can use the same store for destination computers that are the same version of Windows and a different version of Windows as the source computer. | +| type | Yes | The following items can be used to group settings, and define the type of the component.
  • **System:** Operating system settings. All Windows components are defined by this type.
    When **type="System"** and **defaultSupported="FALSE"**, the settings don't migrate unless there's an equivalent component in the **.xml** files that is specified on the `LoadState.exe` command line. For example, the default `MigSys.xml` file contains components with **type="System"** and **defaultSupported="FALSE"**. If this file is specified on the `ScanState.exe` command line, the file must also be specified on the `LoadState.exe` command line for the settings to migrate. The file must be specified because the `LoadState.exe` tool must detect an equivalent component. That is, the component must have the same migration urlid of the **.xml** file and an identical display name. Otherwise, the **LoadState** tool doesn't migrate those settings from the store. This setting is helpful because a store can be used for destination computers that are the same or different version of Windows as the source computer.
  • **Application:** Settings for an application.
  • **Device:** Settings for a device.
  • **Documents:** Specifies files.
| +| context | No
Default = UserAndSystem | Defines the scope of this parameter; that is, whether to process this component in the context of the specific user, across the entire operating system, or both.
The largest possible scope is set by the **\** element. For example, if a **\** element has a context of **User** and a **\** element had a context of **UserAndSystem**, then the **\** element would act as though it has a context of **User**. If a **\** element has a context of **System**, it would act as though the **\** element isn't there.
  • **User**: Evaluates the component for each user.
  • **System**: Evaluates the component only once for the system.
  • **UserAndSystem**: Evaluates the component for the entire operating system and each user.
| +| defaultSupported | No
(default = TRUE) | Can be any of **TRUE**, **FALSE**, **YES**, or **NO**. If this parameter is **FALSE** (or **NO**), the component isn't migrated unless there's an equivalent component on the destination computer.
When **type="System"** and **defaultSupported="FALSE"**, the settings aren't migrated unless there's an equivalent component in the **.xml** files that are specified on the `LoadState.exe` command line. For example, the default `MigSys.xml` file contains components with **type="System"** and **defaultSupported="FALSE"**. If this file is specified on the `ScanState.exe` command line, the file must also be specified on the `LoadState.exe` command line for the settings to migrate. The file has to be specified in both command lines because the **LoadState** tool must detect an equivalent component. That is, the component must have the same migration urlid of the **.xml** file and an identical display name or the **LoadState** tool doesn't migrate those settings from the store. This setting is helpful because a store can be used for destination computers that are the same or different version of Windows as the source computer. | | hidden | | This parameter is for internal USMT use only. | -For an example, see any of the default migration .xml files. +For an example, see any of the default migration **.xml** files. -## <condition> +## \ -Although the **<condition>** element under the **<detect>**, **<objectSet>**, and **<addObjects>** elements is still supported, it is recommend to no longer use the **<condition>** element because it may be deprecated in future versions of USMT. If the **<condition>** element were depecated, it would require a rewrite of any scripts that use the **<condition>** element. Instead, if you need to use a condition within the **<objectSet>** and **<addObjects>** elements, it is recommended to use the more powerful **[<conditions>](#conditions)** element. The **<conditions>** element allows for formulation of complex Boolean statements. +Although the **\** element under the **\**, **\**, and **\** elements is still supported, Microsoft recommends to no longer use the **\** element because it might be deprecated in future versions of USMT. If the **\** element is deprecated, it would require a rewrite of any scripts that use the **\** element. Instead, if a condition needs to be used within the **\** and **\** elements, Microsoft recommends using the more powerful **[\](#conditions)** element. The **\** element allows for formulation of complex Boolean statements. -The **<condition>** element has a Boolean result. You can use this element to specify the conditions in which the parent element will be evaluated. If any of the present conditions return **FALSE**, the parent element will not be evaluated. +The **\** element has a Boolean result. This element can be used to specify the conditions in which the parent element is evaluated. If any of the present conditions return **FALSE**, the parent element isn't be evaluated. - **Number of occurrences:** unlimited. -- **Parent elements:** [<conditions>](#conditions), [<detect>](#detect), [<objectSet>](#objectset), [<addObjects>](#addobjects) +- **Parent elements:** [\](#conditions), [\](#detect), [\](#objectset), [\](#addobjects) - **Child elements:** none -- **Helper functions:** You can use the following [<condition> functions](#condition-functions) with this element: `DoesOSMatch`, `IsNative64Bit()`, `IsOSLaterThan`, `IsOSEarlierThan`, `DoesObjectExist`, `DoesFileVersionMatch`, `IsFileVersionAbove`, `IsFileVersionBelow`, `IsSystemContext`, `DoesStringContentEqual`, `DoesStringContentContain`, `IsSameObject`, `IsSameContent`, and `IsSameStringContent`. +- **Helper functions:** The following [\ functions](#condition-functions) can be used with this element: `DoesOSMatch`, `IsNative64Bit()`, `IsOSLaterThan`, `IsOSEarlierThan`, `DoesObjectExist`, `DoesFileVersionMatch`, `IsFileVersionAbove`, `IsFileVersionBelow`, `IsSystemContext`, `DoesStringContentEqual`, `DoesStringContentContain`, `IsSameObject`, `IsSameContent`, and `IsSameStringContent`. Syntax: @@ -198,10 +206,10 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -|negation|No
Default = No|**"Yes"** reverses the True/False value of the condition.| -|*ScriptName*|Yes|A script that has been defined within this migration section.| +|negation|No
Default = No|**"Yes"** reverses the True/False value of the condition.| +|*ScriptName*|Yes|A script that is defined within this migration section.| -For example, in the code sample below, the **<condition>** elements, **A** and **B**, are joined together by the **AND** operator because they are in separate **<conditions>** sections: +For example, in the following code sample, the **\** elements, **A** and **B**, are joined together by the **AND** operator because they are in separate **\** sections: ```xml @@ -214,7 +222,7 @@ For example, in the code sample below, the **<condition>** elements, **A** ``` -However, in the code sample below, the **<condition>** elements, **A** and **B**, are joined together by the **OR** operator because they are in the same **<conditions>** section. +However, in the following code sample, the **\** elements, **A** and **B**, are joined together by the **OR** operator because they are in the same **\** section. ```xml @@ -225,9 +233,9 @@ However, in the code sample below, the **<condition>** elements, **A** and ``` -### <condition> functions +### \ functions -The **<condition>** functions return a Boolean value. You can use these elements in **<addObjects>** conditions. +The **\** functions return a Boolean value. These elements can be used in **\** conditions. - [Operating system version functions](#operating-system-version-functions) @@ -243,8 +251,8 @@ The **<condition>** functions return a Boolean value. You can use these el |Setting|Required?|Value| |--- |--- |--- | - |*OSType*|Yes|The only valid value for this setting is **NT**. Note, however, that you must set this setting for the **<condition>** functions to work correctly.| - |*OSVersion*|Yes|The major version, minor version, build number and corrected service diskette version separated by periods. For example, `5.0.2600.Service Pack 1`. You can also specify partial specification of the version with a pattern such as `5.0.*`.| + |*OSType*|Yes|The only valid value for this setting is **NT**. However, this setting must be set for the **\** functions to work correctly.| + |*OSVersion*|Yes|The major version, minor version, build number and corrected service diskette version separated by periods. For example, `5.0.2600.Service Pack 1`. Partial specification of the version can also be specified with a pattern such as `5.0.*`.| For example: @@ -264,8 +272,8 @@ The **<condition>** functions return a Boolean value. You can use these el |Setting|Required?|Value| |--- |--- |--- | - |*OSType*|Yes|Can be **9x** or **NT**. If *OSType* does not match the type of the current operating system, then it returns **FALSE**. For example, if the current operating system is Windows NT-based and *OSType* is **"9x"**, the result will be **FALSE**.| - |*OSVersion*|Yes|The major version, minor version, build number, and corrected service diskette version separated by periods. For example, `5.0.2600.Service Pack 1`. You can also specify partial specification of the version but no pattern is allowed such as `5.0`.

The **IsOSLaterThan** function returns **TRUE** if the current operating system is later than or equal to *OSVersion*.| + |*OSType*|Yes|Can be **9x** or **NT**. If *OSType* doesn't match the type of the current operating system, then it returns **FALSE**. For example, if the current operating system is Windows NT-based and *OSType* is **"9x"**, the result is **FALSE**.| + |*OSVersion*|Yes|The major version, minor version, build number, and corrected service diskette version separated by periods. For example, `5.0.2600.Service Pack 1`. Partial specification of the version can also be specified but no pattern is allowed such as `5.0`.

The **IsOSLaterThan** function returns **TRUE** if the current operating system is later than or equal to *OSVersion*.| For example: @@ -281,8 +289,8 @@ The **<condition>** functions return a Boolean value. You can use these el |Setting|Required?|Value| |--- |--- |--- | - |*OSType*|Yes|Can be **9x** or **NT**. If *OSType* does not match the type of the current operating system, then it returns **FALSE**. For example, if the current operating system is Windows NT-based and *OSType* is **"9x"** the result will be **FALSE**.| - |*OSVersion*|Yes|The major version, minor version, build number, and corrected service diskette version separated by periods. For example, `5.0.2600.Service Pack 1`. You can also specify partial specification of the version but no pattern is allowed such as `5.0`.

The **IsOSEarlierThan** function returns **TRUE** if the current operating system is earlier than *OSVersion*.| + |*OSType*|Yes|Can be **9x** or **NT**. If *OSType* doesn't match the type of the current operating system, then it returns **FALSE**. For example, if the current operating system is Windows NT-based and *OSType* is **"9x"** the result is **FALSE**.| + |*OSVersion*|Yes|The major version, minor version, build number, and corrected service diskette version separated by periods. For example, `5.0.2600.Service Pack 1`. Partial specification of the version can also be specified but no pattern is allowed such as `5.0`.

The **IsOSEarlierThan** function returns **TRUE** if the current operating system is earlier than *OSVersion*.| ### Object content functions @@ -307,8 +315,8 @@ The **<condition>** functions return a Boolean value. You can use these el |Setting|Required?|Value| |--- |--- |--- | - |*EncodedFileLocation*|Yes|The **[location pattern](#specifying-locations)** for the file that will be checked. Environment variables are allowed.| - |*VersionTag*|Yes|The **[version tag](#valid-version-tags)** value that will be checked.| + |*EncodedFileLocation*|Yes|The **[location pattern](#specifying-locations)** for the file that is checked. Environment variables are allowed.| + |*VersionTag*|Yes|The **[version tag](#valid-version-tags)** value that is checked.| |*VersionValue*|Yes|A string pattern. For example, "Microsoft*".| For example: @@ -325,9 +333,9 @@ The **<condition>** functions return a Boolean value. You can use these el |Setting|Required?|Value| |--- |--- |--- | - |*EncodedFileLocation*|Yes|The **[location pattern](#specifying-locations)** for the file that will be checked. Environment variables are allowed.| - |*VersionTag*|Yes|The **[version tag](#valid-version-tags)** value that will be checked.| - |*VersionValue*|Yes|The value to compare to. You cannot specify a pattern.| + |*EncodedFileLocation*|Yes|The **[location pattern](#specifying-locations)** for the file that is checked. Environment variables are allowed.| + |*VersionTag*|Yes|The **[version tag](#valid-version-tags)** value that is checked.| + |*VersionValue*|Yes|The value to compare to. A pattern can't be specified.| - **IsFileVersionBelow** @@ -335,9 +343,9 @@ The **<condition>** functions return a Boolean value. You can use these el |Setting|Required?|Value| |--- |--- |--- | - |*EncodedFileLocation*|Yes|The **[location pattern](#specifying-locations)** for the file that will be checked. Environment variables are allowed.| - |*VersionTag*|Yes|The **[version tag](#valid-version-tags)** value that will be checked.| - |*VersionValue*|Yes|The value to compare to. You cannot specify a pattern.| + |*EncodedFileLocation*|Yes|The **[location pattern](#specifying-locations)** for the file that is checked. Environment variables are allowed.| + |*VersionTag*|Yes|The **[version tag](#valid-version-tags)** value that is checked.| + |*VersionValue*|Yes|The value to compare to. A pattern can't be specified.| - **IsSystemContext** @@ -354,8 +362,8 @@ The **<condition>** functions return a Boolean value. You can use these el |Setting|Required?|Value| |--- |--- |--- | |*ObjectType*|Yes|Defines the type of object. Can be File or Registry.| - |*EncodedLocationPattern*|Yes|The **[encoded location](#specifying-locations)** for the object that will be examined. You can specify environment variables.| - |StringContent|Yes|The string that will be checked against.| + |*EncodedLocationPattern*|Yes|The **[encoded location](#specifying-locations)** for the object that is examined. Environment variables can be specified.| + |StringContent|Yes|The string that is checked against.| For example: @@ -372,8 +380,8 @@ The **<condition>** functions return a Boolean value. You can use these el |Setting|Required?|Value| |--- |--- |--- | |*ObjectType*|Yes|Defines the type of object. Can be File or Registry.| - |*EncodedLocationPattern*|Yes|The **[encoded location](#specifying-locations)** for the object that will be examined. You can specify environment variables.| - |*StrToFind*|Yes|A string that will be searched inside the content of the given object.| + |*EncodedLocationPattern*|Yes|The **[encoded location](#specifying-locations)** for the object that is examined. Environment variables can be specified.| + |*StrToFind*|Yes|A string that is searched inside the content of the given object.| - **IsSameObject** @@ -384,8 +392,8 @@ The **<condition>** functions return a Boolean value. You can use these el |Setting|Required?|Value| |--- |--- |--- | |*ObjectType*|Yes|Defines the type of object. Can be File or Registry.| - |*EncodedLocation1*|Yes|The **[encoded location](#specifying-locations)** for the first object. You can specify environment variables.| - |*EncodedLocation2*|Yes|The **[encoded location](#specifying-locations)** for the second object. You can specify environment variables.| + |*EncodedLocation1*|Yes|The **[encoded location](#specifying-locations)** for the first object. Environment variables can be specified.| + |*EncodedLocation2*|Yes|The **[encoded location](#specifying-locations)** for the second object. Environment variables can be specified.| For example: @@ -398,39 +406,39 @@ The **<condition>** functions return a Boolean value. You can use these el - **IsSameContent** - The **IsSameContent** function returns **TRUE** if the given objects have the same content. Otherwise, it returns **FALSE**. The content will be compared byte by byte. + The **IsSameContent** function returns **TRUE** if the given objects have the same content. Otherwise, it returns **FALSE**. The content is compared byte by byte. Syntax: `IsSameContent("ObjectType1","EncodedLocation1","ObjectType2","EncodedLocation2")` |Setting|Required?|Value| |--- |--- |--- | |*ObjectType1*|Yes|Defines the type of the first object. Can be File or Registry.| - |*EncodedLocation1*|Yes|The **[encoded location](#specifying-locations)** for the first object. You can specify environment variables.| + |*EncodedLocation1*|Yes|The **[encoded location](#specifying-locations)** for the first object. Environment variables can be specified.| |*ObjectType2*|Yes|Defines the type of the second object. Can be File or Registry.| - |*EncodedLocation2*|Yes|The **[encoded location](#specifying-locations)** for the second object. You can specify environment variables.| + |*EncodedLocation2*|Yes|The **[encoded location](#specifying-locations)** for the second object. Environment variables can be specified.| - **IsSameStringContent** - The **IsSameStringContent** function returns **TRUE** if the given objects have the same content. Otherwise, it returns **FALSE**. The content will be interpreted as a string. + The **IsSameStringContent** function returns **TRUE** if the given objects have the same content. Otherwise, it returns **FALSE**. The content is interpreted as a string. Syntax: `IsSameStringContent("ObjectType1","EncodedLocation1","ObjectType2","EncodedLocation2")` |Setting|Required?|Value| |--- |--- |--- | |*ObjectType1*|Yes|Defines the type of the first object. Can be File or Registry.| - |*EncodedLocation1*|Yes|The **[encoded location](#specifying-locations)** for the first object. You can specify environment variables.| + |*EncodedLocation1*|Yes|The **[encoded location](#specifying-locations)** for the first object. Environment variables can be specified.| |*ObjectType2*|Yes|Defines the type of the second object. Can be File or Registry.| - |*EncodedLocation2*|Yes|The **[encoded location](#specifying-locations)** for the second object. You can specify environment variables.| + |*EncodedLocation2*|Yes|The **[encoded location](#specifying-locations)** for the second object. Environment variables can be specified.| -## <conditions> +## \ -The **<conditions>** element returns a Boolean result that is used to specify the conditions in which the parent element is evaluated. USMT evaluates the child elements, and then joins their results using the operators **AND** or **OR** according to the operation parameter. +The **\** element returns a Boolean result that is used to specify the conditions in which the parent element is evaluated. USMT evaluates the child elements, and then joins their results using the operators **AND** or **OR** according to the operation parameter. -- **Number of occurrences:** Unlimited inside another **<conditions>** element. Limited to one occurrence in [<detection>](#detection), [<rules>](#rules), [<addObjects>](#addobjects), and [<objectSet>](#objectset) +- **Number of occurrences:** Unlimited inside another **\** element. Limited to one occurrence in [\](#detection), [\](#rules), [\](#addobjects), and [\](#objectset) -- **Parent elements:** [<conditions>](#conditions), [<detection>](#detection), [<environment>](#environment), [<rules>](#rules), [<addObjects>](#addobjects), and [<objectSet>](#objectset) +- **Parent elements:** [\](#conditions), [\](#detection), [\](#environment), [\](#rules), [\](#addobjects), and [\](#objectset) -- **Child elements:** [<conditions>](#conditions), [<condition>](#condition) +- **Child elements:** [\](#conditions), [\](#condition) Syntax: @@ -456,17 +464,17 @@ The following example is from the `MigApp.xml` file: ``` -## <content> +## \ -You can use the **<content>** element to specify a list of object patterns to obtain an object set from the source computer. Each **<objectSet>** within a **<content>** element is evaluated. For each resulting object pattern list, the objects that match it are enumerated and their content is filtered by the filter parameter. The resulting string array is the output for the **<content>** element. The filter script returns an array of locations. The parent **<objectSet>** element can contain multiple child **<content>** elements. +The **\** element can be used to specify a list of object patterns to obtain an object set from the source computer. Each **\** within a **\** element is evaluated. For each resulting object pattern list, the objects that match it are enumerated and their content is filtered by the filter parameter. The resulting string array is the output for the **\** element. The filter script returns an array of locations. The parent **\** element can contain multiple child **\** elements. - **Number of occurrences:** unlimited -- **Parent elements:** [<objectSet>](#objectset) +- **Parent elements:** [\](#objectset) -- **Child elements:** [<objectSet>](#objectset) +- **Child elements:** [\](#objectset) -- **Helper functions:** You can use the following [<content> functions](#content-functions) with this element: `ExtractSingleFile`, `ExtractMultipleFiles`, and `ExtractDirectory`. +- **Helper functions:** The following [\ functions](#content-functions) can be used with this element: `ExtractSingleFile`, `ExtractMultipleFiles`, and `ExtractDirectory`. Syntax: @@ -477,22 +485,22 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -|filter|Yes|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.
The script is called for each object that is enumerated by the object sets in the **<include>** rule. The filter script returns a Boolean value. If the return value is **TRUE**, the object will be migrated. If it is **FALSE**, it will not be migrated.| +|filter|Yes|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.
The script is called for each object that is enumerated by the object sets in the **\** rule. The filter script returns a Boolean value. If the return value is **TRUE**, the object is migrated. If it's **FALSE**, it isn't migrated.| -### <content> functions +### \ functions -The following functions generate patterns out of the content of an object. These functions are called for every object that the parent **<ObjectSet>** element is enumerating. +The following functions generate patterns out of the content of an object. These functions are called for every object that the parent **\** element is enumerating. - **ExtractSingleFile** - If the registry value is a **MULTI-SZ**, only the first segment is processed. The returned pattern is the encoded location for a file that must exist on the system. If the specification is correct in the registry value, but the file does not exist, this function returns **NULL**. + If the registry value is a **MULTI-SZ**, only the first segment is processed. The returned pattern is the encoded location for a file that must exist on the system. If the specification is correct in the registry value, but the file doesn't exist, this function returns **NULL**. Syntax: `ExtractSingleFile(Separators,PathHints)` |Setting|Required?|Value| |--- |--- |--- | - |*Separators*|Yes|A list of possible separators that might follow the file specification in this registry value name. For example, if the content is **"C:\Windows\Notepad.exe,-2"**, the separator is a comma. You can specify **NULL**.| - |*PathHints*|Yes|A list of extra paths, separated by colons (`;`), where the function will look for a file matching the current content. For example, if the content is **"Notepad.exe"** and the path is the **%Path%** environment variable, the function will find **Notepad.exe** in `%windir%` and returns **"c:\Windows [Notepad.exe]"**. You can specify **NULL**.| + |*Separators*|Yes|A list of possible separators that might follow the file specification in this registry value name. For example, if the content is **"C:\Windows\Notepad.exe,-2"**, the separator is a comma. **NULL** can be specified.| + |*PathHints*|Yes|A list of extra paths, separated by colons (`;`), where the function looks for a file matching the current content. For example, if the content is **"Notepad.exe"** and the path is the **%Path%** environment variable, the function finds **Notepad.exe** in `%windir%` and returns **"c:\Windows [Notepad.exe]"**. **NULL** can be specified.| For example: @@ -508,27 +516,27 @@ The following functions generate patterns out of the content of an object. These - **ExtractMultipleFiles** - The **ExtractMultipleFiles** function returns multiple patterns, one for each file that is found in the content of the given registry value. If the registry value is a **MULTI-SZ**, the **MULTI-SZ** separator is considered a separator by default. therefore, for **MULTI-SZ**, the **<Separators>** argument must be **NULL**. + The **ExtractMultipleFiles** function returns multiple patterns, one for each file that is found in the content of the given registry value. If the registry value is a **MULTI-SZ**, the **MULTI-SZ** separator is considered a separator by default. therefore, for **MULTI-SZ**, the **\** argument must be **NULL**. - The returned patterns are the encoded locations for files that must exist on the source computer. If the specification is correct in the registry value but the file does not exist, it will not be included in the resulting list. + The returned patterns are the encoded locations for files that must exist on the source computer. If the specification is correct in the registry value but the file doesn't exist, it isn't included in the resulting list. Syntax: `ExtractMultipleFiles(Separators,PathHints)` |Setting|Required?|Value| |--- |--- |--- | |*Separators*|Yes|A list of possible separators that might follow the file specification in this registry value name. For example, if the content is **"C:\Windows\Notepad.exe,-2"**, the separator is a comma. This parameter must be NULL when processing **MULTI-SZ** registry values.| - |*PathHints*|Yes|A list of extra paths, separated by colons (`;`), where the function will look for a file matching the current content. For example, if the content is **"Notepad.exe"** and the path is the **%Path%** environment variable, the function will find **Notepad.exe** in `%windir%` and returns **"c:\Windows [Notepad.exe]"**. You can specify **NULL**.| + |*PathHints*|Yes|A list of extra paths, separated by colons (`;`), where the function looks for a file matching the current content. For example, if the content is **"Notepad.exe"** and the path is the **%Path%** environment variable, the function finds **Notepad.exe** in `%windir%` and returns **"c:\Windows [Notepad.exe]"**. **NULL** can be specified.| - **ExtractDirectory** - The **ExtractDirectory** function returns a pattern that is the encoded location for a directory that must exist on the source computer. If the specification is correct in the registry value, but the directory does not exist, this function returns **NULL**. If it is processing a registry value that is a **MULTI-SZ**, only the first segment will be processed. + The **ExtractDirectory** function returns a pattern that is the encoded location for a directory that must exist on the source computer. If the specification is correct in the registry value, but the directory doesn't exist, this function returns **NULL**. If it's processing a registry value that is a **MULTI-SZ**, only the first segment is processed. Syntax: `ExtractDirectory(Separators,LevelsToTrim,PatternSuffix)` |Setting|Required?|Value| |--- |--- |--- | - |*Separators*|No|A list of possible separators that might follow the file specification in this registry value name. For example, if the content is **"C:\Windows\Notepad.exe,-2"**, the separator is a comma. You must specify **NULL** when processing **MULTI-SZ** registry values.| - |*LevelsToTrim*|Yes|The number of levels to delete from the end of the directory specification. Use this function to extract a root directory when you have a registry value that points inside that root directory in a known location.| + |*Separators*|No|A list of possible separators that might follow the file specification in this registry value name. For example, if the content is **"C:\Windows\Notepad.exe,-2"**, the separator is a comma. **NULL** must be specified when processing **MULTI-SZ** registry values.| + |*LevelsToTrim*|Yes|The number of levels to delete from the end of the directory specification. Use this function to extract a root directory when there's a registry value that points inside that root directory in a known location.| |*PatternSuffix*|Yes|The pattern to add to the directory specification. For example, `* [*]`.| For example: @@ -543,17 +551,17 @@ The following functions generate patterns out of the content of an object. These ``` -## <contentModify> +## \ -The **<contentModify>** element modifies the content of an object before it is written to the destination computer. For each **<contentModify>** element there can be multiple **<objectSet>** elements. This element returns the new content of the object that is being processed. +The **\** element modifies the content of an object before the object is written to the destination computer. For each **\** element, there can be multiple **\** elements. This element returns the new content of the object that is being processed. - **Number of occurrences:** Unlimited -- **Parent elements:** [<rules>](#rules) +- **Parent elements:** [\](#rules) -- **Required child elements:** [<objectSet>](#objectset) +- **Required child elements:** [\](#objectset) -- **Helper functions**: You can use the following [<contentModify> functions](#contentmodify-functions) with this element: **ConvertToDWORD**, **ConvertToString**, **ConvertToBinary**, **KeepExisting**, **OffsetValue**, **SetValueByTable**, **MergeMultiSzContent**, and **MergeDelimitedContent**. +- **Helper functions**: The following [\ functions](#contentmodify-functions) can be used with this element: **ConvertToDWORD**, **ConvertToString**, **ConvertToBinary**, **KeepExisting**, **OffsetValue**, **SetValueByTable**, **MergeMultiSzContent**, and **MergeDelimitedContent**. Syntax: @@ -564,31 +572,31 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -|script|Yes|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2").`

The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is **TRUE**, the object will be migrated. If it is **FALSE**, it will not be migrated.| +|script|Yes|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2").`

The script is called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is **TRUE**, the object is migrated. If it's **FALSE**, it isn't migrated.| -### <contentModify> functions +### \ functions -The following functions change the content of objects as they are migrated. These functions are called for every object that the parent **<ObjectSet>** element is enumerating. +The following functions change the content of objects as they're migrated. These functions are called for every object that the parent **\** element is enumerating. - **ConvertToDWORD** - The **ConvertToDWORD** function converts the content of registry values that are enumerated by the parent **<ObjectSet>** element to a DWORD. For example, **ConvertToDWORD** will convert the string `"1"` to the DWORD `0x00000001`. If the conversion fails, then the value of **DefaultValueOnError** will be applied. + The **ConvertToDWORD** function converts the content of registry values that are enumerated by the parent **\** element to a DWORD. For example, **ConvertToDWORD** converts the string `"1"` to the DWORD `0x00000001`. If the conversion fails, then the value of **DefaultValueOnError** is applied. Syntax: `ConvertToDWORD(DefaultValueOnError)` |Setting|Required?|Value| |--- |--- |--- | - |*DefaultValueOnError*|No|The value that will be written into the value name if the conversion fails. You can specify **NULL**, and `0` will be written if the conversion fails.| + |*DefaultValueOnError*|No|The value that is written into the value name if the conversion fails. **NULL** can be specified, and `0` is written if the conversion fails.| - **ConvertToString** - The **ConvertToString** function converts the content of registry values that match the parent **<ObjectSet>** element to a string. For example, it will convert the DWORD `0x00000001` to the string **"1"**. If the conversion fails, then the value of **DefaultValueOnError** will be applied. + The **ConvertToString** function converts the content of registry values that match the parent **\** element to a string. For example, it converts the DWORD `0x00000001` to the string **"1"**. If the conversion fails, then the value of **DefaultValueOnError** is applied. Syntax: `ConvertToString(DefaultValueOnError)` |Setting|Required?|Value| |--- |--- |--- | - |*DefaultValueOnError*|No|The value that will be written into the value name if the conversion fails. You can specify **NULL**, and `0` will be written if the conversion fails.| + |*DefaultValueOnError*|No|The value that is written into the value name if the conversion fails. **NULL** can be specified, and `0` is written if the conversion fails.| For example: @@ -602,7 +610,7 @@ The following functions change the content of objects as they are migrated. Thes - **ConvertToBinary** - The **ConvertToBinary** function converts the content of registry values that match the parent **<ObjectSet>** element to a binary type. + The **ConvertToBinary** function converts the content of registry values that match the parent **\** element to a binary type. Syntax: `ConvertToBinary ()` @@ -618,7 +626,7 @@ The following functions change the content of objects as they are migrated. Thes - **SetValueByTable** - The **SetValueByTable** function matches the value from the source computer to the source table. If the value is there, the equivalent value in the destination table will be applied. If the value is not there, or if the destination table has no equivalent value, the *DefaultValueOnError* will be applied. + The **SetValueByTable** function matches the value from the source computer to the source table. If the value is there, the equivalent value in the destination table is applied. If the value isn't there, or if the destination table has no equivalent value, the *DefaultValueOnError* is applied. Syntax: `SetValueByTable(SourceTable,DestinationTable,DefaultValueOnError)` @@ -626,48 +634,48 @@ The following functions change the content of objects as they are migrated. Thes |--- |--- |--- | |*SourceTable*|Yes|A list of values separated by commas that are possible for the source registry values.| |*DestinationTable*|No|A list of translated values separated by commas.| - |*DefaultValueOnError*|No|The value that will be applied to the destination computer if either
  1. The value for the source computer does not match *SourceTable*
  2. *DestinationTable* has no equivalent value.

If **DefaultValueOnError** is **NULL**, the value will not be changed on the destination computer.| + |*DefaultValueOnError*|No|The value that is applied to the destination computer if either
  1. The value for the source computer doesn't match *SourceTable*
  2. *DestinationTable* has no equivalent value.

If **DefaultValueOnError** is **NULL**, the value isn't changed on the destination computer.| - **KeepExisting** - You can use the **KeepExisting** function when there are conflicts on the destination computer. This function will keep (not overwrite) the specified attributes for the object that is on the destination computer. + The **KeepExisting** function can be used when there are conflicts on the destination computer. This function keeps (not overwrites) the specified attributes for the object that is on the destination computer. Syntax: `KeepExisting("OptionString","OptionString","OptionString",…)` |Setting|Required?|Value| |--- |--- |--- | - | *OptionString* | Yes | *OptionString* can be **Security**, **TimeFields**, or **FileAttrib**:*Letter*. You can specify one of each type of *OptionStrings*. Do not specify multiple *OptionStrings* with the same value. If you do, the right-most option of that type will be kept. For example, do not specify **("FileAttrib:H", "FileAttrib:R")** because only Read-only will be evaluated. Instead specify **("FileAttrib:HR")** and both Hidden and Read-only attributes will be kept on the destination computer.
  • **Security**: Keeps the destination object's security descriptor if it exists.
  • **TimeFields**: Keeps the destination object's time stamps. This parameter is for files only.
  • **FileAttrib:<Letter>**: Keeps the destination object's attribute value, either **ON** or **OFF**, for the specified set of file attributes. This parameter is for files only. The following are case-insensitive, but USMT will ignore any values that are invalid, repeated, or if there is a space after **FileAttrib:**. You can specify any combination of the following attributes:
    • **A** = Archive
    • **C** = Compressed
    • **E** = Encrypted
    • **H** = Hidden
    • **I** = Not Content Indexed
    • **O** = Offline
    • **R** = Read-Only
    • **S** = System
    • **T** = Temporary
| + | *OptionString* | Yes | *OptionString* can be **Security**, **TimeFields**, or **FileAttrib**:*Letter*. One of each type of *OptionStrings* can be specified. Don't specify multiple *OptionStrings* with the same value. If multiple *OptionStrings* with the same value are specified, the right-most option of that type is kept. For example, don't specify **("FileAttrib:H", "FileAttrib:R")** because only Read-only is evaluated. Instead specify **("FileAttrib:HR")** and both Hidden and Read-only attributes are kept on the destination computer.
  • **Security**: Keeps the destination object's security descriptor if it exists.
  • **TimeFields**: Keeps the destination object's time stamps. This parameter is for files only.
  • **FileAttrib:\**: Keeps the destination object's attribute value, either **ON** or **OFF**, for the specified set of file attributes. This parameter is for files only. The following are case-insensitive, but USMT will ignore any values that are invalid, repeated, or if there's a space after **FileAttrib:**. Any combination of the following attributes can be specified:
    • **A** = Archive
    • **C** = Compressed
    • **E** = Encrypted
    • **H** = Hidden
    • **I** = Not Content Indexed
    • **O** = Offline
    • **R** = Read-Only
    • **S** = System
    • **T** = Temporary
| - **MergeMultiSzContent** - The **MergeMultiSzContent** function merges the **MULTI-SZ** content of the registry values that are enumerated by the parent **<ObjectSet>** element with the content of the equivalent registry values that already exist on the destination computer. `Instruction` and `String` either remove or add content to the resulting **MULTI-SZ**. Duplicate elements will be removed. + The **MergeMultiSzContent** function merges the **MULTI-SZ** content of the registry values that are enumerated by the parent **\** element with the content of the equivalent registry values that already exist on the destination computer. `Instruction` and `String` either remove or add content to the resulting **MULTI-SZ**. Duplicate elements are removed. Syntax: `MergeMultiSzContent (Instruction,String,Instruction,String,…)` |Setting|Required?|Value| |--- |--- |--- | - | *Instruction* | Yes | Can be one of the following:
  • **Add**. Adds the corresponding String to the resulting MULTI-SZ if it is not already there.
  • **Remove**. Removes the corresponding String from the resulting MULTI-SZ.
| + | *Instruction* | Yes | Can be one of the following values:
  • **Add**. Adds the corresponding String to the resulting MULTI-SZ if it isn't already there.
  • **Remove**. Removes the corresponding String from the resulting MULTI-SZ.
| | *String* | Yes | The string to be added or removed. | - **MergeDelimitedContent** - The **MergeDelimitedContent** function merges the content of the registry values that are enumerated by the parent **<ObjectSet>** element with the content of the equivalent registry values that already exist on the destination computer. The content is considered a list of elements separated by one of the characters in the Delimiters parameter. Duplicate elements will be removed. + The **MergeDelimitedContent** function merges the content of the registry values that are enumerated by the parent **\** element with the content of the equivalent registry values that already exist on the destination computer. The content is considered a list of elements separated by one of the characters in the Delimiters parameter. Duplicate elements are removed. Syntax: `MergeDelimitedContent(Delimiters,Instruction,String,…)` |Setting|Required?|Value| |--- |--- |--- | - | *Delimiters* | Yes | A single character that will be used to separate the content of the object that is being processed. The content will be considered as a list of elements that is separated by the *Delimiters*.
For example, `"."` will separate the string based on a period. | - | *Instruction* | Yes | Can be one of the following:
  • **Add**: Adds *String* to the resulting MULTI-SZ if it is not already there.
  • **Remove**: Removes *String* from the resulting MULTI-SZ.
| + | *Delimiters* | Yes | A single character that is used to separate the content of the object that is being processed. The content is considered as a list of elements that is separated by the *Delimiters*.
For example, `"."` separates the string based on a period. | + | *Instruction* | Yes | Can be one of the following values:
  • **Add**: Adds *String* to the resulting MULTI-SZ if it isn't already there.
  • **Remove**: Removes *String* from the resulting MULTI-SZ.
| | *String* | Yes | The string to be added or removed. | -## <description> +## \ -The **<description>** element defines a description for the component but does not affect the migration. +The **\** element defines a description for the component but doesn't affect the migration. - **Number of occurrences:** zero or one -- **Parent elements:** [<component>](#component) +- **Parent elements:** [\](#component) - **Child elements:** none @@ -681,26 +689,26 @@ Syntax: |--- |--- |--- | |*ComponentDescription*|Yes|The description of the component.| -The following code sample shows how the <description> element defines the "My custom component" description.: +The following code sample shows how the \ element defines the "My custom component" description: ```xml My custom component ``` -## <destinationCleanup> +## \ -The **<destinationCleanup>** element deletes objects, such as files and registry keys, from the destination computer before applying the objects from the source computer. This element is evaluated only when the **LoadState** tool is run on the destination computer. That is, this element is ignored by the **ScanState** tool. +The **\** element deletes objects, such as files and registry keys, from the destination computer before applying the objects from the source computer. This element is evaluated only when the **LoadState** tool is run on the destination computer. That is, this element is ignored by the **ScanState** tool. > [!IMPORTANT] > Use this option with extreme caution because it will delete objects from the destination computer. -For each **<destinationCleanup>** element there can be multiple **<objectSet>** elements. A common use for this element is if there is a missing registry key on the source computer and you want to ensure that a component is migrated. In this case, you can delete all of the component's registry keys before migrating the source registry keys. This will ensure that if there is a missing key on the source computer, it will also be missing on the destination computer. +For each **\** element, there can be multiple **\** elements. A common use for this element is if there's a missing registry key on the source computer but the component still needs to be migrated. In this case, all of the component's registry keys can be deleted before migrating the source registry keys. Deleting all of the component's registry keys ensures that if there's a missing key on the source computer, it will also be missing on the destination computer. - **Number of occurrences:** Unlimited -- **Parent elements:** [<rules>](#rules) +- **Parent elements:** [\](#rules) -- **Child elements:** [<objectSet>](#objectset) (Note that the destination computer will delete all child elements.) +- **Child elements:** [\](#objectset) (The destination computer deletes all child elements.) Syntax: @@ -711,7 +719,7 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -|filter|Yes|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.

The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is **TRUE**, the object will be migrated. If it is **FALSE**, it will not be migrated.| +|filter|Yes|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.

The script is called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is **TRUE**, the object is migrated. If it's **FALSE**, it isn't migrated.| For example: @@ -724,21 +732,21 @@ For example: ``` -## <detect> +## \ -Although the **<detect>** element is still supported, it is recommend to no longer use the **<detect>** element because it may be deprecated in future versions of USMT. If the **<detect>** element were depecated, it would require a rewrite of any scripts that use the **<detect>** element. Instead, it is recommend to use the **[<detection>](#detection)** element. The **<detection>** element allows for more clearly formulated complex Boolean statements +Although the **\** element is still supported, Microsoft recommends no longer using the **\** element because it might be deprecated in future versions of USMT. If the **\** element is deprecated, it would require a rewrite of any scripts that use the **\** element. Instead, Microsoft recommends using the **[\](#detection)** element. The **\** element allows for more clearly formulated complex Boolean statements -The **<detect>** element can be used to determine if the component is present on a system. If all child **<detect>** elements within a **<detect>** element resolve to **TRUE**, then the **<detect>** element resolves to **TRUE**. If any child **<detect>** elements resolve to **FALSE**, then their parent **<detect>** element resolves to **FALSE**. If there is no **<detect>** element section, then USMT will assume that the component is present. +The **\** element can be used to determine if the component is present on a system. If all child **\** elements within a **\** element resolve to **TRUE**, then the **\** element resolves to **TRUE**. If any child **\** elements resolve to **FALSE**, then their parent **\** element resolves to **FALSE**. If there's no **\** element section, then USMT assumes that the component is present. -For each **<detect>** element there can be multiple child **<condition>** or **<objectSet>** elements, which will be logically joined by an **OR** operator. If at least one **<condition>** or **<objectSet>** element evaluates to **TRUE**, then the **<detect>** element evaluates to **TRUE**. +For each **\** element there can be multiple children **\** or **\** elements, which are logically joined by an **OR** operator. If at least one **\** or **\** element evaluates to **TRUE**, then the **\** element evaluates to **TRUE**. - **Number of occurrences:** unlimited -- **Parent elements:** [<detects>](#detects), [<namedElements>](#namedelements) +- **Parent elements:** [\](#detects), [\](#namedelements) -- **Required child elements:** [<condition>](#condition) +- **Required child elements:** [\](#condition) -- **Optional child elements:** [<objectSet>](#objectset) +- **Optional child elements:** [\](#objectset) Syntax: @@ -749,16 +757,16 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -| name | Yes, when **<detect>** is a child to **<namedElements>**
No, when **<detect>** is a child to <detects> | When *ID* is specified, any child elements are not processed. Instead, any other **<detect>** elements with the same name that are declared within the **<namedElements>** element are processed. | -| context | No
(default = UserAndSystem) | Defines the scope of this parameter which are whether to process this component in the context of the specific user, across the entire operating system, or both.
The largest possible scope is set by the component element. For example, if a **<component>** element has a context of **User**, and a **<rules>** element had a context of **UserAndSystem**, then the **<rules>** element would act as though it had a context of **User**. If the **<rules>** element had a context of **System**, it would act as though the **<rules>** element were not there.
  • **User**: Evaluates the variables for each user.
  • **System**: Evaluates the variables only once for the system.
  • **UserAndSystem**: Evaluates the variables for the entire operating system and each user.
| +| name | Yes, when **\** is a child to **\**
No, when **\** is a child to \ | When *ID* is specified, any child elements aren't processed. Instead, any other **\** elements with the same name that are declared within the **\** element are processed. | +| context | No
(default = UserAndSystem) | Defines the scope of this parameter, which is whether to process this component in the context of the specific user, across the entire operating system, or both.
The largest possible scope is set by the component element. For example, if a **\** element has a context of **User**, and a **\** element had a context of **UserAndSystem**, then the **\** element would act as though it had a context of **User**. If the **\** element had a context of **System**, it would act as though the **\** element weren't there.
  • **User**: Evaluates the variables for each user.
  • **System**: Evaluates the variables only once for the system.
  • **UserAndSystem**: Evaluates the variables for the entire operating system and each user.
| -For examples, see the examples for [<detection>](#detection). +For examples, see the examples for [\](#detection). -## <detects> +## \ -Although the **<detects>** element is still supported, it is recommend to no longer use the **<detects>** element because it may be deprecated in future versions of USMT. If the **<detects>** element were deprecated, it would require a rewrite of any scripts that use the **<detects>** element. Instead, it is recommend to use the **[<detection>](#detection)** element if the parent element is **<role>** or **<namedElements>**, or use the **[<conditions>](#conditions)** element if the parent element is **<rules>**. The **<detection>** element allows for more clearly formulated complex Boolean statements and the **<conditions>** element allows for formulation of complex Boolean statements. +Although the **\** element is still supported, Microsoft recommends no longer using the **\** element because it might be deprecated in future versions of USMT. If the **\** element is deprecated, it would require a rewrite of any scripts that use the **\** element. Instead, Microsoft recommends using the **[\](#detection)** element if the parent element is **\** or **\**, or use the **[\](#conditions)** element if the parent element is **\**. The **\** element allows for more clearly formulated complex Boolean statements and the **\** element allows for formulation of complex Boolean statements. -The **<detects>** element is a container for one or more **<detect>** elements. If all of the child **<detect>** elements within a **<detects>** element resolve to **TRUE**, then **<detects>** resolves to **TRUE**. If any of the child **<detect>** elements resolve to **FALSE**, then **<detects>** resolves to **FALSE**. If you do not want to write the **<detects>** elements within a component, then you can create the **<detects>** element under the **<namedElements>** element, and then refer to it. If there is no **<detects>** element section, then USMT will assume that the component is present. The results from each **<detects>** element are joined together by the **OR** operator to form the rule used to detect the parent element. +The **\** element is a container for one or more **\** elements. If all of the child **\** elements within a **\** element resolve to **TRUE**, then **\** resolves to **TRUE**. If any of the child **\** elements resolve to **FALSE**, then **\** resolves to **FALSE**. To prevent the **\** element to be written within a component, create the **\** element under the **\** element, and then refer to it. If there's no **\** element section, then USMT assumes that the component is present. The results from each **\** element are joined together by the **OR** operator to form the rule used to detect the parent element. Syntax: @@ -769,14 +777,14 @@ Syntax: - **Number of occurrences:** Unlimited. -- **Parent elements:** [<role>](#role), [<rules>](#rules), [<namedElements>](#namedelements) +- **Parent elements:** [\](#role), [\](#rules), [\](#namedelements) -- **Required child elements:** [<detect>](#detect) +- **Required child elements:** [\](#detect) |Setting|Required?|Value| |--- |--- |--- | -| name | Yes, when <detects> is a child to **<namedElements>**
No, when <detects> is a child to **<role>** or **<rules>** | When *ID* is specified, no child **<detect>** elements are processed. Instead, any other **<detects>** elements with the same name that are declared within the **<namedElements>** element are processed. | -| context | No
(default = UserAndSystem) | Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.
The largest possible scope is set by the **<component element>**. For example, if a **<component>** element has a context of **User** and a **<rules>** element had a context of **UserAndSystem**, then the **<rules>** element would act as though it had a context of **User**. If the **<rules>** element had a context of **System**, it would act as though the **<rules>** element were not there.
  • **User**: Evaluates the variables for each user.
  • **System**: Evaluates the variables only once for the system.
  • **UserAndSystem**: Evaluates the variables for the entire operating system and each user.

The context parameter is ignored for **<detects>** elements that are inside **<rules>** elements. | +| name | Yes, when \ is a child to **\**
No, when \ is a child to **\** or **\** | When *ID* is specified, no child **\** elements are processed. Instead, any other **\** elements with the same name that are declared within the **\** element are processed. | +| context | No
(default = UserAndSystem) | Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.
The largest possible scope is set by the **\**. For example, if a **\** element has a context of **User** and a **\** element had a context of **UserAndSystem**, then the **\** element would act as though it had a context of **User**. If the **\** element had a context of **System**, it would act as though the **\** element weren't there.
  • **User**: Evaluates the variables for each user.
  • **System**: Evaluates the variables only once for the system.
  • **UserAndSystem**: Evaluates the variables for the entire operating system and each user.

The context parameter is ignored for **\** elements that are inside **\** elements. | The following example is from the `MigApp.xml` file. @@ -791,19 +799,19 @@ The following example is from the `MigApp.xml` file. ``` -## <detection> +## \ -The **<detection>** element is a container for one **<conditions>** element. The result of the child **<condition>** elements, located underneath the **<conditions>** element, determines the result of this element. For example, if all of the child **<conditions>** elements within the **<detection>** element resolve to **TRUE**, then the **<detection>** element resolves to **TRUE**. If any of the child **<conditions>** elements resolve to **FALSE**, then the **<detection>** element resolves to **FALSE**. +The **\** element is a container for one **\** element. The result of the child **\** elements, located underneath the **\** element, determines the result of this element. For example, if all of the child **\** elements within the **\** element resolve to **TRUE**, then the **\** element resolves to **TRUE**. If any of the child **\** elements resolve to **FALSE**, then the **\** element resolves to **FALSE**. -In addition, the results from each **<detection>** section within the **<role>** element are joined together by the **OR** operator to form the detection rule of the parent element. That is, if one of the **<detection>** sections resolves to **TRUE**, then the **<role>** element will be processed. Otherwise, the **<role>** element will not be processed. +In addition, the results from each **\** section within the **\** element are joined together by the **OR** operator to form the detection rule of the parent element. That is, if one of the **\** sections resolve to **TRUE**, then the **\** element is processed. Otherwise, the **\** element isn't processed. -Use the **<detection>** element under the **<namedElements>** element if you do not want to write it within a component. Then include a matching **<detection>** section under the **<role>** element to control whether the component is migrated. If there is not a **<detection>** section for a component, then USMT will assume that the component is present. +Use the **\** element under the **\** element to not write within a component. Then include a matching **\** section under the **\** element to control whether the component is migrated. If there isn't a **\** section for a component, then USMT assumes that the component is present. - **Number of occurrences:** Unlimited. -- **Parent elements:** [<role>](#role), [<namedElements>](#namedelements) +- **Parent elements:** [\](#role), [\](#namedelements) -- **Child elements:** [<conditions>](#conditions) +- **Child elements:** [\](#conditions) Syntax: @@ -814,7 +822,7 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -| name |
  • Yes, when **<detection>** is declared under **<namedElements>**
  • Optional, when declared under **<role>**
| If declared, the content of the **<detection>** element is ignored and the content of the **<detection>** element with the same name that is declared in the **<namedElements>** element will be evaluated. | +| name |
  • Yes, when **\** is declared under **\**
  • Optional, when declared under **\**
| If declared, the content of the **\** element is ignored and the content of the **\** element with the same name that is declared in the **\** element is evaluated. | | context | No, default = UserAndSystem | Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.
  • **User**: Evaluates the component for each user.
  • **System**: Evaluates the component only once for the system.
  • **UserAndSystem**: Evaluates the component for the entire operating system and each user.
| For example: @@ -840,13 +848,13 @@ and ``` -## <displayName> +## \ -The **<displayName>** element is a required field within each **<component>** element. +The **\** element is a required field within each **\** element. - **Number of occurrences:** once for each component -- **Parent elements:** [<component>](#component) +- **Parent elements:** [\](#component) - **Child elements:** none @@ -858,7 +866,7 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -|locID|No|This parameter is for internal USMT use. Do not use this parameter.| +|locID|No|This parameter is for internal USMT use. Don't use this parameter.| |*ComponentName*|Yes|The name for the component.| For example: @@ -867,17 +875,17 @@ For example: Command Prompt settings ``` -## <environment> +## \ -The **<environment>** element is a container for **<variable>** elements in which you can define variables to use in your .xml file. All environment variables defined this way will be private. That is, they will be available only for their child components and the component in which they were defined. For two example scenarios, see [Examples](#examples). +The **\** element is a container for **\** elements in which variables can be defined for use in an **.xml** file. All environment variables defined this way are private. That is, they're available only for their child components and the component in which they were defined. For two example scenarios, see [Examples](#examples). - **Number of occurrences:** unlimited -- **Parent elements:** [<role>](#role), [<component>](#component), [<namedElements>](#namedelements) +- **Parent elements:** [\](#role), [\](#component), [\](#namedelements) -- **Required child elements:** [<variable>](#variable) +- **Required child elements:** [\](#variable) -- **Optional child elements:** [<conditions>](#conditions) +- **Optional child elements:** [\](#conditions) Syntax: @@ -888,14 +896,14 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -| name | Yes, when **<environment>** is a child of **<namedElements>**
No, when **<environment>** is a child of **<role>** or **<component>** | When declared as a child of the **<role>** or **<component>** elements, if *ID* is declared, USMT ignores the content of the **<environment>** element and the content of the **<environment>** element with the same name declared in the **<namedElements>** element is processed. | -| context | No
(default = UserAndSystem) | Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.
The largest possible scope is set by the **<component>** element. For example, if a **<component>** element has a context of **User** and a **<rules>** element had a context of **UserAndSystem**, then the **<rules>** element would act as though it had a context of **User**. If the **<rules>** element had a context of **System**, it would act as though **<rules>** were not there.
  • **User**: Evaluates the variables for each user.
  • **System**: Evaluates the variables only once for the system.
  • **UserAndSystem**: Evaluates the variables for the entire operating system and each user.
| +| name | Yes, when **\** is a child of **\**
No, when **\** is a child of **\** or **\** | When declared as a child of the **\** or **\** elements, if *ID* is declared, USMT ignores the content of the **\** element and the content of the **\** element with the same name declared in the **\** element is processed. | +| context | No
(default = UserAndSystem) | Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.
The largest possible scope is set by the **\** element. For example, if a **\** element has a context of **User** and a **\** element had a context of **UserAndSystem**, then the **\** element would act as though it had a context of **User**. If the **\** element had a context of **System**, it would act as though **\** weren't there.
  • **User**: Evaluates the variables for each user.
  • **System**: Evaluates the variables only once for the system.
  • **UserAndSystem**: Evaluates the variables for the entire operating system and each user.
| ## Examples ### Example scenario 1 -In this scenario, you want to generate the location of objects at run time depending on the configuration of the destination computer. For example, you must do this if an application writes data in the directory where it is installed, and users can install the application anywhere on the computer. If the application writes a registry value `hklm\software\companyname\install [path\]` and then updates this value with the location where the application is installed, then the only way for you to migrate the required data correctly is to define an environment variable. For example: +In this scenario, generate the location of objects at run time depending on the configuration of the destination computer. For example, if an application writes data in the directory where the application is installed, and users can install the application anywhere on the computer. If the application writes a registry value `hklm\software\companyname\install [path\]` and then updates this value with the location where the application is installed, then the only way to migrate the required data correctly is to define an environment variable. For example: ```xml @@ -905,7 +913,7 @@ In this scenario, you want to generate the location of objects at run time depen ``` -Then you can use an include rule as follows. You can use any of the [<script> functions](#script-functions) to perform similar tasks. +Then an include rule can be used as follows. Any of the [\ functions](#script-functions) can be used to perform similar tasks. ```xml @@ -915,7 +923,7 @@ Then you can use an include rule as follows. You can use any of the [<script& ``` -Second, you can also filter registry values that contain data that you need. The following example extracts the first string (before the separator "`,`") in the value of the registry `Hklm\software\companyname\application\ [Path\]`. +Second, registry values can be filtered to contain the data that is needed. The following example extracts the first string (before the separator "`,`") in the value of the registry `Hklm\software\companyname\application\ [Path\]`. ```xml @@ -933,7 +941,7 @@ Second, you can also filter registry values that contain data that you need. The ### Example scenario 2 -In this scenario, you want to migrate five files named `File1.txt`, `File2.txt`, and so on, from `%SYSTEMDRIVE%\data\userdata\dir1\dir2\`. To do this you must have the following **<include>** rule in an .xml file: +In this scenario, five files named `File1.txt`, `File2.txt`, and so on, need to be migrated from `%SYSTEMDRIVE%\data\userdata\dir1\dir2\`. To migrate these files, the following **\** rule must be in an **.xml** file: ```xml @@ -947,7 +955,7 @@ In this scenario, you want to migrate five files named `File1.txt`, `File2.txt`, ``` -Instead of typing the path five times, you can create a variable for the location as follows: +Instead of typing the path five times, create a variable for the location as follows: ```xml @@ -957,7 +965,7 @@ Instead of typing the path five times, you can create a variable for the locatio ``` -Then, you can specify the variable in an **<include>** rule as follows: +Then, specify the variable in an **\** rule as follows: ```xml @@ -971,17 +979,17 @@ Then, you can specify the variable in an **<include>** rule as follows: ``` -## <exclude> +## \ -The **<exclude>** element determines what objects will not be migrated, unless there is a more specific **<include>** element that migrates an object. If there is an **<include>** and **<exclude>** element for the same object, the object will be included. For each **<exclude>** element there can be multiple child **<objectSet>** elements. +The **\** element determines what objects aren't migrated, unless there's a more specific **\** element that migrates an object. If there's an **\** and **\** element for the same object, the object is included. For each **\** element, there can be multiple child **\** elements. - **Number of occurrences:** Unlimited -- **Parent elements:** [<rules>](#rules) +- **Parent elements:** [\](#rules) -- **Child elements:** [<objectSet>](#objectset) +- **Child elements:** [\](#objectset) -- **Helper functions:** You can use the following [<exclude> filter functions](#include-and-exclude-filter-functions) with this element: `CompareStringContent`, `IgnoreIrrelevantLinks`, `AnswerNo`, `NeverRestore`, and `SameRegContent`. +- **Helper functions:** The following [\ filter functions](#include-and-exclude-filter-functions) can be used with this element: `CompareStringContent`, `IgnoreIrrelevantLinks`, `AnswerNo`, `NeverRestore`, and `SameRegContent`. Syntax: @@ -992,7 +1000,7 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -|filter|No
(default = No)|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.

The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is **TRUE**, the object will be migrated. If it is **FALSE**, it will not be migrated.| +|filter|No
(default = No)|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.

The script is called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is **TRUE**, the object is migrated. If it's **FALSE**, it isn't migrated.| For example, from the `MigUser.xml` file: @@ -1006,15 +1014,15 @@ For example, from the `MigUser.xml` file: ``` -## <excludeAttributes> +## \ -You can use the **<excludeAttributes>** element to determine which parameters associated with an object will not be migrated. If there are conflicts between the **<includeAttributes>** and **<excludeAttributes>** elements, the most specific pattern determines the patterns that will not be migrated. If an object does not have an **<includeAttributes>** or **<excludeAttributes>** element, then all of its parameters will be migrated. +The **\** element can be used to determine which parameters associated with an object aren't migrated. If there are conflicts between the **\** and **\** elements, the most specific pattern determines the patterns that aren't migrated. If an object doesn't have an **\** or **\** element, then all of its parameters are migrated. - **Number of occurrences:** Unlimited -- **Parent elements:** [<rules>](#rules) +- **Parent elements:** [\](#rules) -- **Child elements:** [<objectSet>](#objectset) +- **Child elements:** [\](#objectset) Syntax: @@ -1025,13 +1033,13 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -| attributes | Yes | Specifies the attributes to be excluded. You can specify one of the following, or both separated by quotes; for example, `"Security","TimeFields"`:
  • Security can be one of Owner, Group, DACL, or SACL.
  • TimeFields can be one of CreationTime, LastAccessTime and LastWrittenTime
| +| attributes | Yes | Specifies the attributes to be excluded. Either one of the following or both can be specified. If specifying both, they need to be separated by quotes. For example, `"Security","TimeFields"`:
  • Security can be one of Owner, Group, DACL, or SACL.
  • TimeFields can be one of CreationTime, LastAccessTime and LastWrittenTime
| Example: ```xml - + System Data @@ -1078,15 +1086,15 @@ Example: ``` -## <extensions> +## \ -The <extensions> element is a container for one or more <extension> elements. +The \ element is a container for one or more \ elements. - **Number of occurrences:** zero or one -- **Parent elements:** [<component>](#component) +- **Parent elements:** [\](#component) -- **Required child elements:** [<extension>](#extension) +- **Required child elements:** [\](#extension) Syntax: @@ -1095,13 +1103,13 @@ Syntax: ``` -## <extension> +## \ -You can use the <extension> element to specify documents of a specific extension. +The \ element can be used to specify documents of a specific extension. - **Number of occurrences:** unlimited -- **Parent elements:** [<extensions>](#extensions) +- **Parent elements:** [\](#extensions) - **Child elements:** none @@ -1115,7 +1123,7 @@ Syntax: |--- |--- |--- | |*FilenameExtension*|Yes|A file name extension.| -For example, if you want to migrate all \*.doc files from the source computer, specifying the following code under the **<component>** element: +For example, to migrate all \*.doc files from the source computer, specifying the following code under the **\** element: ```xml @@ -1123,7 +1131,7 @@ For example, if you want to migrate all \*.doc files from the source computer, s ``` -is the same as specifying the following code below the **<rules>** element: +is the same as specifying the following code below the **\** element: ```xml @@ -1133,17 +1141,17 @@ is the same as specifying the following code below the **<rules>** element ``` -For another example of how to use the <extension> element, see the example for [<excludeAttributes>](#excludeattributes). +For another example of how to use the \ element, see the example for [\](#excludeattributes). -## <externalProcess> +## \ -You can use the <externalProcess> element to run a command line during the migration process. For example, you may want to run a command after the **LoadState** process completes. +The \ element can be used to run a command line during the migration process. For example, a run a command might need to run after the **LoadState** process completes. - **Number of occurrences:** Unlimited -- **Parent elements:** [<rules>](#rules) +- **Parent elements:** [\](#rules) -- **Required child elements:** [<commandLine>](#commandline) +- **Required child elements:** [\](#commandline) Syntax: @@ -1154,25 +1162,25 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -| when | Yes | Indicates when the command line should be run. This value can be one of the following:
  • **pre-scan** before the scanning process begins.
  • **scan-success** after the scanning process has finished successfully.
  • **post-scan** after the scanning process has finished, whether it was successful or not.
  • **pre-apply** before the apply process begins.
  • **apply-success** after the apply process has finished successfully.
  • **post-apply** after the apply process has finished, whether it was successful or not.
| +| when | Yes | Indicates when the command line should be run. This value can be one of the following values:
  • **pre-scan** before the scanning process begins.
  • **scan-success** after the scanning process finishes successfully.
  • **post-scan** after the scanning process finished, whether it was successful or not.
  • **pre-apply** before the apply process begins.
  • **apply-success** after the apply process finishes successfully.
  • **post-apply** after the apply process finished, whether it was successful or not.
| -For an example of how to use the <externalProcess> element, see the example for [<excludeAttributes>](#excludeattributes). +For an example of how to use the \ element, see the example for [\](#excludeattributes). -## <icon> +## \ -This is an internal USMT element. Do not use this element. +This element is an internal USMT element. Don't use this element. -## <include> +## \ -The **<include>** element determines what to migrate, unless there is a more specific [<exclude>](#exclude) rule. You can specify a script to be more specific to extend the definition of what you want to collect. For each **<include>** element there can be multiple **<objectSet>** elements. +The **\** element determines what to migrate, unless there's a more specific [\](#exclude) rule. A script can be specified to be more specific to extend the definition of what want needs to be collected. For each **\** element, there can be multiple **\** elements. - **Number of occurrences:** Unlimited -- **Parent elements:** [<rules>](#rules) +- **Parent elements:** [\](#rules) -- **Required child element:** [<objectSet>](#objectset) +- **Required child element:** [\](#objectset) -- **Helper functions:** You can use the following [<include> filter functions](#include-and-exclude-filter-functions) with this element: `CompareStringContent`, `IgnoreIrrelevantLinks`, `AnswerNo`, and `NeverRestore`. +- **Helper functions:** The following [\ filter functions](#include-and-exclude-filter-functions) can be used with this element: `CompareStringContent`, `IgnoreIrrelevantLinks`, `AnswerNo`, and `NeverRestore`. Syntax: @@ -1183,9 +1191,9 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -| filter | No.
If this parameter is not specified, then all patterns that are inside the child **<objectSet>** element will be processed. | A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.
The script will be called for each object that is enumerated by the object sets in the **<include>** rule. The filter script returns a Boolean value. If the return value is **TRUE**, the object will be migrated. If it is **FALSE**, it will not be migrated. | +| filter | No.
If this parameter isn't specified, then all patterns that are inside the child **\** element are processed. | A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.
The script is called for each object that is enumerated by the object sets in the **\** rule. The filter script returns a Boolean value. If the return value is **TRUE**, the object is migrated. If it's **FALSE**, it isn't migrated. | -The following example is from the MigUser.xml file: +The following example is from the `MigUser.xml` file: ```xml @@ -1215,9 +1223,9 @@ The following example is from the MigUser.xml file: ``` -### <include> and **<exclude>** filter functions +### \ and **\** filter functions -The following functions return a Boolean value. You can use them to migrate certain objects based on when certain conditions are met. +The following functions return a Boolean value. They can be used to migrate certain objects based on when certain conditions are met. - **AnswerNo** @@ -1232,11 +1240,11 @@ The following functions return a Boolean value. You can use them to migrate cert |Setting|Required?|Value| |--- |--- |--- | | *StringContent* | Yes | The string to check against. | - | *CompareType* | Yes | A string. Use one of the following values:
  • **Equal** (case insensitive). The function returns **TRUE** if the string representation of the current object that is processed by the migration engine is identical to `StringContent`.
  • **NULL** **or any other value**. The function returns **TRUE** if the string representation of the current object that is processed by the migration engine does not match `StringContent`.
| + | *CompareType* | Yes | A string. Use one of the following values:
  • **Equal** (case insensitive). The function returns **TRUE** if the string representation of the current object that is processed by the migration engine is identical to `StringContent`.
  • **NULL** **or any other value**. The function returns **TRUE** if the string representation of the current object that is processed by the migration engine doesn't match `StringContent`.
| - **IgnoreIrrelevantLinks** - This filter screens out the .lnk files that point to an object that is not valid on the destination computer. Note that the screening takes place on the destination computer, so all .lnk files will be saved to the store during **ScanState**. Then they will be screened out when you run the **LoadState** tool. + This filter screens out the **.lnk** files that point to an object that isn't valid on the destination computer. The screening takes place on the destination computer, so all **.lnk** files are saved to the store during **ScanState**. Then they're screened out when the **LoadState** tool runs. Syntax: `IgnoreIrrelevantLinks ()` @@ -1252,11 +1260,11 @@ The following functions return a Boolean value. You can use them to migrate cert - **NeverRestore** - You can use this function to collect the specified objects from the source computer but then not migrate the objects to the destination computer. When run with the **ScanState** tool, this function evaluates to **TRUE**. When run with the **LoadState** tool, this function evaluates to **FALSE**. You may want to use this function when you want to check an object's value on the destination computer but do not intend to migrate the object to the destination. + This function can be used to collect the specified objects from the source computer but then not migrate the objects to the destination computer. When run with the **ScanState** tool, this function evaluates to **TRUE**. When run with the **LoadState** tool, this function evaluates to **FALSE**. This function might be used to check an object's value on the destination computer but there's no intention to migrate the object to the destination. Syntax: `NeverRestore()` - In the following example, HKCU\\Control Panel\\International \[Locale\] will be included in the store, but it will not be migrated to the destination computer: + In the following example, HKCU\\Control Panel\\International \[Locale\] is included in the store, but it isn't migrated to the destination computer: ```xml @@ -1266,15 +1274,15 @@ The following functions return a Boolean value. You can use them to migrate cert ``` -## <includeAttributes> +## \ -You can use the **<includeAttributes>** element to determine whether certain parameters associated with an object will be migrated along with the object itself. If there are conflicts between the **<includeAttributes>** and **<excludeAttributes>** elements, the most specific pattern will determine which parameters will be migrated. If an object does not have an **<includeAttributes>** or **<excludeAttributes>** element, then all of its parameters will be migrated. +The **\** element can be used to determine whether certain parameters associated with an object are migrated along with the object itself. If there are conflicts between the **\** and **\** elements, the most specific pattern determines which parameters are migrated. If an object doesn't have an **\** or **\** element, then all of its parameters are migrated. - **Number of occurrences:** unlimited -- **Parent elements:** [<rules>](#rules) +- **Parent elements:** [\](#rules) -- **Child elements:** [<objectSet>](#objectset) +- **Child elements:** [\](#objectset) Syntax: @@ -1285,23 +1293,23 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -| attributes | Yes | Specifies the attributes to be included with a migrated object. You can specify one of the following, or both separated by quotes; for example, `"Security","TimeFields"`:
  • Security can be one of the following values:
    • **Owner**: The owner of the object (SID).
    • **Group**: The primary group for the object (SID).
    • **DACL** (discretionary access control list): An access control list that is controlled by the owner of an object and that specifies the access particular users or groups can have to the object.
    • **SACL** (system access control list): An ACL that controls the generation of audit messages for attempts to access a securable object. The ability to get or set an object's SACL is controlled by a privilege typically held only by system administrators.
  • TimeFields can be one of the following:
    • **CreationTime**: Specifies when the file or directory was created.
    • **LastAccessTime**: Specifies when the file is last read from, written to, or, in the case of executable files, run.
    • **LastWrittenTime**: Specifies when the file is last written to, truncated, or overwritten.
| +| attributes | Yes | Specifies the attributes to be included with a migrated object. Either one of the following or both can be specified. If specifying both, they need to be separated by quotes. For example, `"Security","TimeFields"`:
  • Security can be one of the following values:
    • **Owner**: The owner of the object (SID).
    • **Group**: The primary group for the object (SID).
    • **DACL** (discretionary access control list): An access control list that is controlled by the owner of an object and that specifies the access particular users or groups can have to the object.
    • **SACL** (system access control list): An ACL that controls the generation of audit messages for attempts to access a securable object. The ability to get or set an object's SACL is controlled by a privilege typically held only by system administrators.
  • TimeFields can be one of the following values:
    • **CreationTime**: Specifies when the file or directory was created.
    • **LastAccessTime**: Specifies when the file is last read from, written to, or for executable files, run.
    • **LastWrittenTime**: Specifies when the file is last written to, truncated, or overwritten.
| -For an example of how to use the **<includeAttributes>** element, see the example for [<excludeAttributes>](#excludeattributes). +For an example of how to use the **\** element, see the example for [\](#excludeattributes). -## <library> +## \ -This is an internal USMT element. Do not use this element. +This element is an internal USMT element. Don't use this element. -## <location> +## \ -The **<location>** element defines the location of the **<object>** element. +The **\** element defines the location of the **\** element. -- **Number of occurrences:** once for each **<object>** +- **Number of occurrences:** once for each **\** -- **Parent elements:** [<object>](#object) +- **Parent elements:** [\](#object) -- **Child elements:** [<script>](#script) +- **Child elements:** [\](#script) Syntax: @@ -1319,29 +1327,29 @@ The following example is from the `MigApp.xml` file: ```xml - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [UpgradeVersion] + %HklmWowSoftware%\Microsoft\Office\16.0\Common\Migration\Office [UpgradeVersion] DWORD 0B000000 - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] + %HklmWowSoftware%\Microsoft\Office\16.0\Common\Migration\Office [Lang] DWORD 00000000 ``` -## <locationModify> +## \ -You can use the **<locationModify>** element to change the location and name of an object before it is migrated to the destination computer. The **<locationModify>** element is processed only when the **LoadState** tool is run on the destination computer. In other words, this element is ignored by the **ScanState** tool. The **<locationModify>** element will create the appropriate folder on the destination computer if it does not already exist. +The **\** element can be used to change the location and name of an object before the object is migrated to the destination computer. The **\** element is processed only when the **LoadState** tool is run on the destination computer. In other words, this element is ignored by the **ScanState** tool. The **\** element creates the appropriate folder on the destination computer if it doesn't already exist. **Number of occurrences:** Unlimited -- **Parent elements:** [<rules>](#rules) +- **Parent elements:** [\](#rules) -- **Required child element:** [<objectSet>](#objectset) +- **Required child element:** [\](#objectset) -- **Helper functions:** You can use the following [<locationModify> functions](#locationmodify-functions) with this element: `ExactMove`, `RelativeMove`, and `Move`. +- **Helper functions:** The following [\ functions](#locationmodify-functions) can be used with this element: `ExactMove`, `RelativeMove`, and `Move`. Syntax: @@ -1352,7 +1360,7 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -|script|Yes|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.

The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is **TRUE**, the object will be migrated. If it is **FALSE**, it will not be migrated.| +|script|Yes|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.

The script is called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is **TRUE**, the object is migrated. If it's **FALSE**, it isn't migrated.| The following example is from the `MigApp.xml` file: @@ -1364,13 +1372,13 @@ The following example is from the `MigApp.xml` file: ``` -### <locationModify> functions +### \ functions -The following functions change the location of objects as they are migrated when using the **<locationModify>** element. These functions are called for every object that the parent **<objectSet>** element is enumerating. The **<locationModify>** element will create the appropriate folder on the destination computer if it does not already exist. +The following functions change the location of objects as they're migrated when using the **\** element. These functions are called for every object that the parent **\** element is enumerating. The **\** element creates the appropriate folder on the destination computer if it doesn't already exist. - **ExactMove** - The ExactMove function moves all of the objects that are matched by the parent **<objectSet>** element into the given *ObjectEncodedLocation*. You can use this function when you want to move a single file to a different location on the destination computer. If the destination location is a node, all of the matching source objects will be written to the node without any subdirectories. If the destination location is a leaf, the migration engine will migrate all of the matching source objects to the same location. If a collision occurs, the normal collision algorithms will apply. + The ExactMove function moves all of the objects that are matched by the parent **\** element into the given *ObjectEncodedLocation*. This function can be used to move a single file to a different location on the destination computer. If the destination location is a node, all of the matching source objects are written to the node without any subdirectories. If the destination location is a leaf, the migration engine migrates all of the matching source objects to the same location. If a collision occurs, the normal collision algorithms apply. Syntax: `ExactMove(ObjectEncodedLocation)` @@ -1396,18 +1404,18 @@ The following functions change the location of objects as they are migrated when |Setting|Required?|Value| |--- |--- |--- | - |*DestinationRoot*|Yes|The location where the source objects will be moved. If needed, this function will create any subdirectories that were above the longest CSIDL in the source object name.| + |*DestinationRoot*|Yes|The location where the source objects are moved. If needed, this function creates any subdirectories that were above the longest CSIDL in the source object name.| - **RelativeMove** - You can use the RelativeMove function to collect and move data. Note that you can use environment variables in source and destination roots, but they may be defined differently on the source and destination computers. + The RelativeMove function can be used to collect and move data. Environment variables can be used in source and destination roots, but they might be defined differently on the source and destination computers. Syntax: `RelativeMove(SourceRoot,DestinationRoot)` |Setting|Required?|Value| |--- |--- |--- | - |*SourceRoot*|Yes|The location from where the objects will be moved. Any source objects that are enumerated by the parent **<objectSet>** element that are not in this location will not be moved.| - |*DestinationRoot*|Yes|The location where the source objects will be moved to on the destination computer. If needed, this function will create any subdirectories that were above *SourceRoot*.| + |*SourceRoot*|Yes|The location where the objects are moved from. Any source objects that are enumerated by the parent **\** element that aren't in this location aren't moved.| + |*DestinationRoot*|Yes|The location where the source objects are moved to on the destination computer. If needed, this function creates any subdirectories that were above *SourceRoot*.| For example: @@ -1424,17 +1432,17 @@ For example: ``` -## <\_locDefinition> +## \<\_locDefinition\> -This is an internal USMT element. Do not use this element. +This element is an internal USMT element. Don't use this element. -## <manufacturer> +## \ -The **<manufacturer>** element defines the manufacturer for the component, but does not affect the migration. +The **\** element defines the manufacturer for the component, but doesn't affect the migration. - **Number of occurrences:** zero or one -- **Parent elements:** [<component>](#component) +- **Parent elements:** [\](#component) - **Child elements:** none @@ -1448,19 +1456,19 @@ Syntax: |--- |--- |--- | |*Name*|Yes|The name of the manufacturer for the component.| -## <merge> +## \ -The **<merge>** element determines what will happen when a collision occurs. A collision is when an object that is migrated is already present on the destination computer. If you do not specify this element, the default behavior for the registry is for the source object to overwrite the destination object. The default behavior for files is for the source file to be renamed to `OriginalFileName(1).OriginalExtension`. This element specifies only what should be done when a collision occurs. It does not include objects. Therefore, for your objects to migrate, you must specify **<include>** rules along with the **<merge>** element. When an object is processed and a collision is detected, USMT will select the most specific merge rule and apply it to resolve the conflict. For example, if you have a **<merge>** rule `C:\* [*]` set to **<sourcePriority>** and a **<merge>** rule `C:\subfolder\* [*]` set to **<destinationPriority>**, then USMT would use the **<destinationPriority>** rule because it is the more specific. +The **\** element determines what happens when a collision occurs. A collision is when an object that is migrated is already present on the destination computer. If this element isn't specified, the default behavior for the registry is for the source object to overwrite the destination object. The default behavior for files is for the source file to be renamed to `OriginalFileName(1).OriginalExtension`. This element specifies only what should be done when a collision occurs. It doesn't include objects. Therefore, for the objects to migrate, **\** rules must be specified along with the **\** element. When an object is processed and a collision is detected, USMT selects the most specific merge rule. It then applies the rule to resolve the conflict. For example, if a **\** rule `C:\* [*]` is set to **\** and a **\** rule `C:\subfolder\* [*]` is set to **\**, then USMT would use the **\** rule because it's the more specific. For an example of this element, see [Conflicts and precedence](usmt-conflicts-and-precedence.md). - **Number of occurrences:** Unlimited -- **Parent elements:** [<rules>](#rules) +- **Parent elements:** [\](#rules) -- **Required child element:** [<objectSet>](#objectset) +- **Required child element:** [\](#objectset) -- **Helper functions:** You can use the following [<merge> functions](#merge-functions) with this element: `SourcePriority`, `DestinationPriority`, `FindFilePlaceByPattern`, `LeafPattern`, `NewestVersion`, `HigherValue()`, and `LowerValue()`. +- **Helper functions:** The following [\ functions](#merge-functions) can be used with this element: `SourcePriority`, `DestinationPriority`, `FindFilePlaceByPattern`, `LeafPattern`, `NewestVersion`, `HigherValue()`, and `LowerValue()`. Syntax: @@ -1471,9 +1479,9 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -|script|Yes|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.

The script will be called for each object that is enumerated by the object sets in the **<include>** rule. The filter script returns a Boolean value. If the return value is **TRUE**, the object will be migrated. If it is **FALSE**, it will not be migrated.| +|script|Yes|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.

The script is called for each object that is enumerated by the object sets in the **\** rule. The filter script returns a Boolean value. If the return value is **TRUE**, the object is migrated. If it's **FALSE**, it isn't migrated.| -The following example is from the MigUser.xml file: +The following example is from the `MigUser.xml` file: ```xml @@ -1490,7 +1498,7 @@ The following example is from the MigUser.xml file: ``` -### <merge> functions +### \ functions These functions control how collisions are resolved. @@ -1503,40 +1511,40 @@ These functions control how collisions are resolved. ```xml - HKCU\Software\Microsoft\Office\9.0\PhotoDraw\ [MyPictures] - HKCU\Software\Microsoft\Office\9.0\PhotoDraw\Settings\ [PicturesPath] - HKCU\Software\Microsoft\Office\9.0\PhotoDraw\Settings\ [AdditionalPlugInPath] + HKCU\Software\Microsoft\Office\16.0\PhotoDraw\ [MyPictures] + HKCU\Software\Microsoft\Office\16.0\PhotoDraw\Settings\ [PicturesPath] + HKCU\Software\Microsoft\Office\16.0\PhotoDraw\Settings\ [AdditionalPlugInPath] ``` - **FindFilePlaceByPattern** - The FindFilePlaceByPattern function saves files with an incrementing counter when a collision occurs. It is a string that contains one of each constructs: **<F>**, **<E>**, **<N>** in any order. + The FindFilePlaceByPattern function saves files with an incrementing counter when a collision occurs. It's a string that contains one of each construct: **\**, **\**, **\** in any order. Syntax: `FindFilePlaceByPattern(FilePattern)` |Setting|Required?|Value| |--- |--- |--- | - | *FilePattern* | Yes |
  • **<F>** will be replaced by the original file name.
  • **<N>** will be replaced by an incrementing counter until there is no collision with the objects on the destination computer.
  • **<E>** will be replaced by the original file name extension.

For example, ` ().` will change the source file `MyDocument.doc` into `MyDocument (1).doc` on the destination computer. | + | *FilePattern* | Yes |
  • **\** is replaced by the original file name.
  • **\** is replaced by an incrementing counter until there's no collision with the objects on the destination computer.
  • **\** is replaced by the original file name extension.

For example, ` ().` changes the source file `MyDocument.doc` into `MyDocument (1).doc` on the destination computer. | - **NewestVersion** - The NewestVersion function will resolve conflicts on the destination computer based on the version of the file. + The NewestVersion function resolves conflicts on the destination computer based on the version of the file. Syntax: `NewestVersion(VersionTag)` |Setting|Required?|Value| |--- |--- |--- | - |*VersionTag*|Yes|The version field that will be checked. This can be `FileVersion` or `ProductVersion`. The file with the highest *VersionTag* version determines which conflicts will be resolved based on the file's version. For example, if `Myfile.txt` contains FileVersion 1 and the same file on the destination computer contains FileVersion 2, the file on destination will remain.| + |*VersionTag*|Yes|The version field that is checked. This field can be `FileVersion` or `ProductVersion`. The file with the highest *VersionTag* version determines which conflicts are resolved based on the file's version. For example, if `Myfile.txt` contains FileVersion 1 and the same file on the destination computer contains FileVersion 2, the file on destination remains.| - **HigherValue()** - You can use this function for merging registry values. The registry values will be evaluated as numeric values, and the one with the higher value will determine which registry values will be merged. + This function can be used for merging registry values. The registry values are evaluated as numeric values, and the one with the higher value determines which registry values are merged. - **LowerValue()** - You can use this function for merging registry values. The registry values will be evaluated as numeric values and the one with the lower value will determine which registry values will be merged. + This function can be used for merging registry values. The registry values are evaluated as numeric values and the one with the lower value determines which registry values are merged. - **SourcePriority** @@ -1547,24 +1555,24 @@ These functions control how collisions are resolved. ```xml - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Publisher [UpgradeVersion] - %HklmWowSoftware%\Microsoft\Office\11.0\Common\Migration\Publisher [UpgradeVersion] - %HklmWowSoftware%\Microsoft\Office\10.0\Common\Migration\Publisher [UpgradeVersion] + %HklmWowSoftware%\Microsoft\Office\14.0\Common\Migration\Publisher [UpgradeVersion] + %HklmWowSoftware%\Microsoft\Office\15.0\Common\Migration\Publisher [UpgradeVersion] + %HklmWowSoftware%\Microsoft\Office\16.0\Common\Migration\Publisher [UpgradeVersion] ``` -## <migration> +## \ -The **<migration>** element is the single root element of a migration .xml file and is required. Each .xml file must have a unique migration urlid. The urlid of each file that you specify on the command line must be unique. This is because USMT uses the urlid to define the components within the file. For example, you must specify the following at the beginning of each file: <CustomFileName> is the name of the file; for example, "CustomApp". +The **\** element is the single root element of a migration **.xml** file and is required. Each **.xml** file must have a unique migration urlid. The urlid of each file that is specified on the command line must be unique. The urlids must be unique because USMT uses the urlid to define the components within the file. - **Number of occurrences:** one - **Parent elements:** none -- **Required child elements:** [<component>](#component) +- **Required child elements:** [\](#component) -- **Optional child elements:** [<library>](#library), [<namedElements>](#namedelements) +- **Optional child elements:** [\](#library), [\](#namedelements) Syntax: @@ -1575,8 +1583,8 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -|urlid|Yes|*UrlID* is a string identifier that uniquely identifies this .xml file. This parameter must be a no-colon-name as defined by the XML Namespaces specification. Each migration .xml file must have a unique urlid. If two migration .xml files have the same urlid, the second .xml file that is specified on the command line will not be processed. For more information about XML Namespaces, see [Use XML Namespaces](/previous-versions/windows/desktop/ms754539(v=vs.85)).| -|Name|No|Although not required, it is good practice to use the name of the .xml file.| +|urlid|Yes|*UrlID* is a string identifier that uniquely identifies this **.xml** file. This parameter must be a no-colon-name as defined by the XML Namespaces specification. Each migration **.xml** file must have a unique urlid. If two migration **.xml** files have the same urlid, the second **.xml** file that is specified on the command line isn't processed. For more information about XML Namespaces, see [Use XML Namespaces](/previous-versions/windows/desktop/ms754539(v=vs.85)).| +|Name|No|Although not required, it's good practice to use the name of the **.xml** file.| The following example is from the `MigApp.xml` file: @@ -1593,7 +1601,7 @@ This filter helper function can be used to filter the migration of files based o |--- |--- | |Property|filesize, dateCreated, dateModified, dateAccessed| |Operator|range, neq, lte, lt, eq, gte, gt| -|valueToCompare|The value we are comparing. For example:
Date: "2008/05/15-2005/05/17", "2008/05/15"
Size: A numeral with B, KB, MB, or GB at the end. "5GB", "1KB-1MB"| +|valueToCompare|The value that is being compared. For example:
Date: "2023/05/15-2020/05/17", "2023/05/15"
Size: A numeral with B, KB, MB, or GB at the end. "5GB", "1KB-1MB"| ```xml @@ -1601,7 +1609,7 @@ This filter helper function can be used to filter the migration of files based o - + %SYSTEMDRIVE%\DOCS\* [*] @@ -1611,9 +1619,9 @@ This filter helper function can be used to filter the migration of files based o ``` -## <namedElements> +## \ -You can use the **<namedElements>** element to define named elements. You can use these elements in any component throughout your .xml file. For an example of how to use this element, see the `MigApp.xml` file. +The **\** element can be used to define named elements. These elements can be used in any component throughout the **.xml** file. For an example of how to use this element, see the `MigApp.xml` file. Syntax: @@ -1624,23 +1632,23 @@ Syntax: - **Number of occurrences:** Unlimited -- **Parent elements:** [<migration>](#migration) +- **Parent elements:** [\](#migration) -- **Child elements:** [<environment>](#environment), [<rules>](#rules), [<conditions>](#conditions), [<detection>](#detection), [<detects>](#detects), [<detect>](#detect) +- **Child elements:** [\](#environment), [\](#rules), [\](#conditions), [\](#detection), [\](#detects), [\](#detect) For an example of this element, see the `MigApp.xml` file. -## <object> +## \ -The **<object>** element represents a file or registry key. +The **\** element represents a file or registry key. - **Number of occurrences:** Unlimited -- **Parent elements:** [<addObjects>](#addobjects) +- **Parent elements:** [\](#addobjects) -- **Required child elements:** [<location>](#location), [<attributes>](#attributes) +- **Required child elements:** [\](#location), [\](#attributes) -- **Optional child elements:** [<bytes>](#bytes) +- **Optional child elements:** [\](#bytes) Syntax: @@ -1654,29 +1662,29 @@ The following example is from the `MigApp.xml` file: ```xml - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [UpgradeVersion] + %HklmWowSoftware%\Microsoft\Office\16.0\Common\Migration\Office [UpgradeVersion] DWORD 0B000000 - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] + %HklmWowSoftware%\Microsoft\Office\16.0\Common\Migration\Office [Lang] DWORD 00000000 ``` -## <objectSet> +## \ -The **<objectSet>** element contains a list of object patterns ; for example, file paths, registry locations, and so on. Any child **<conditions>** elements will be evaluated first. If all child **<conditions>** elements return **FALSE**, the **<objectSet>** element will evaluate to an empty set. For each parent element, there can be only multiple **<objectSet>** elements. +The **\** element contains a list of object patterns; for example, file paths, registry locations, and so on. Any child **\** elements are evaluated first. If all child **\** elements return **FALSE**, the **\** element evaluates to an empty set. For each parent element, there can be only multiple **\** elements. - **Number of occurrences:** Unlimited -- **Parent elements:** [<variable>](#variable), [<content>](#content), [<include>](#include), [<exclude>](#exclude), [<merge>](#merge), [<contentModify>](#contentmodify), [<locationModify>](#locationmodify), [<destinationCleanup>](#destinationcleanup), [<includeAttributes>](#includeattributes), [<excludeAttributes>](#excludeattributes), [<unconditionalExclude>](#unconditionalexclude), [<detect>](#detect) +- **Parent elements:** [\](#variable), [\](#content), [\](#include), [\](#exclude), [\](#merge), [\](#contentmodify), [\](#locationmodify), [\](#destinationcleanup), [\](#includeattributes), [\](#excludeattributes), [\](#unconditionalexclude), [\](#detect) -- **Required child elements:** either [<script>](#script) or [<pattern>](#pattern) +- **Required child elements:** either [\](#script) or [\](#pattern) -- **Optional child elements:** [<content>](#content), [<conditions>](#conditions), [<condition>](#condition) +- **Optional child elements:** [\](#content), [\](#conditions), [\](#condition) Syntax: @@ -1685,7 +1693,7 @@ Syntax: ``` -The following example is from the MigUser.xml file: +The following example is from the `MigUser.xml` file: ```xml @@ -1715,17 +1723,17 @@ The following example is from the MigUser.xml file: ``` -## <path> +## \ -This is an internal USMT element. Do not use this element. +This element is an internal USMT element. Don't use this element. -## <paths> +## \ -This is an internal USMT element. Do not use this element. +This element is an internal USMT element. Don't use this element. -## <pattern> +## \ -You can use this element to specify multiple objects. You can specify multiple **<pattern>** elements for each **<objectSet>** element and they will be combined. If you are specifying files, you may want to use `GenerateDrivePatterns` with **<script>** instead. `GenerateDrivePatterns` is basically the same as a **<pattern>** rule, without the drive letter specification. For example, the following two lines of code are similar: +This element can be used to specify multiple objects. Multiple **\** elements can be used for each **\** element and they're combined. If specifying files, Microsoft recommends using `GenerateDrivePatterns` with **\** instead. `GenerateDrivePatterns` is basically the same as a **\** rule, without the drive letter specification. For example, the following two lines of code are similar: ```xml C:\Folder\* [Sample.doc] @@ -1734,7 +1742,7 @@ You can use this element to specify multiple objects. You can specify multiple * - **Number of occurrences:** Unlimited -- **Parent elements:** [<objectSet>](#objectset) +- **Parent elements:** [\](#objectset) - **Child elements:** none but *Path* \[*object*\] must be valid. @@ -1746,8 +1754,8 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -| type | Yes | *typeID* can be Registry, File, or Ini. If *typeId* is Ini, then you cannot have a space between *Path* and *object*. For example, the following is correct when type="Ini":
**<pattern type="Ini">%WinAmp5InstPath%\Winamp.ini|WinAmp[keeponscreen]</pattern>** | -| *Path* [*object*] | Yes | A valid registry or file path pattern, followed by at least one space, followed by brackets [] that contain the object to be migrated.
  • *Path* can contain the asterisk (`*`) wildcard character or can be an [Recognized environment variables](usmt-recognized-environment-variables.md). You cannot use the question mark as a wildcard character. You can use `HKCU` and `HKLM` to refer to `HKEY_CURRENT_USER` and `HKEY_LOCAL_MACHINE` respectively.
  • *Object* can contain the asterisk (`*`) wildcard character. However, you cannot use the question mark as a wildcard character. For example:
    **`C:\Folder\ [*]`** enumerates all files in `C:\Folder` but no subfolders of `C:\Folder`.
    **`C:\Folder* [*]`** enumerates all files and subfolders of `C:\Folder`.
    **`C:\Folder\ [*.mp3]`** enumerates all `.mp3` files in `C:\Folder`.
    **`C:\Folder\ [Sample.doc]`** enumerates only the `Sample.doc` file located in C:\Folder.
    **Note**
    If you are migrating a file that has a square bracket character ([ or ]) in the file name, you must insert the carrot (^) character directly before the bracket for it to be valid. For example, if there is a file named "file].txt", you must specify `c:\documents\mydocs [file^].txt]` instead of `c:\documents\mydocs [file].txt]`.
| +| type | Yes | *typeID* can be Registry, File, or Ini. If *typeId* is Ini, then a space between *Path* and *object* isn't allowed. For example, the following format is correct when type="Ini":
**\%WinAmp5InstPath%\Winamp.ini|WinAmp[keeponscreen]\
** | +| *Path* [*object*] | Yes | A valid registry or file path pattern, followed by at least one space, followed by brackets [] that contain the object to be migrated.
  • *Path* can contain the asterisk (`*`) wildcard character or can be an [Recognized environment variables](usmt-recognized-environment-variables.md). The question mark can't be used as a wildcard character. `HKCU` and `HKLM` can be used to refer to `HKEY_CURRENT_USER` and `HKEY_LOCAL_MACHINE` respectively.
  • *Object* can contain the asterisk (`*`) wildcard character. However, the question mark can't be used as a wildcard character. For example:
    **`C:\Folder\ [*]`** enumerates all files in `C:\Folder` but no subfolders of `C:\Folder`.
    **`C:\Folder* [*]`** enumerates all files and subfolders of `C:\Folder`.
    **`C:\Folder\ [*.mp3]`** enumerates all `.mp3` files in `C:\Folder`.
    **`C:\Folder\ [Sample.doc]`** enumerates only the `Sample.doc` file located in C:\Folder.
    **Note**
    If migrating a file that has a square bracket character ([ or ]) in the file name, a carrot (^) character must be inserted directly before the bracket for it to be valid. For example, if there's a file named "file].txt", `c:\documents\mydocs [file^].txt]` must be specified instead of `c:\documents\mydocs [file].txt]`.
| For example: @@ -1773,7 +1781,7 @@ For example: C:\EngineeringDrafts\ [Sample.doc] ``` -- To migrate the `Sample.doc` file from where ever it exists on the C: drive use pattern in the following way. If multiple files exist with the same name on the C: drive, then all of these files will be migrated. +- To migrate the `Sample.doc` file from where ever it exists on the C: drive use pattern in the following way. If multiple files exist with the same name on the C: drive, then all of these files are migrated. ```xml C:\* [Sample.doc] @@ -1781,15 +1789,15 @@ For example: - For more examples of how to use this element, see [Exclude files and settings](usmt-exclude-files-and-settings.md), [Reroute files and settings](usmt-reroute-files-and-settings.md), [Include files and settings](usmt-include-files-and-settings.md), and [Custom XML examples](usmt-custom-xml-examples.md). -## <processing> +## \ -You can use this element to run a script during a specific point within the migration process. Return values are not expected from the scripts that you specify, and if there are return values, they will be ignored. +This element can be used to run a script during a specific point within the migration process. Return values aren't expected from the scripts that are specified. If there are return values, they're ignored. - **Number of occurrences:** unlimited -- **Parent elements:** [<rules>](#rules) +- **Parent elements:** [\](#rules) -- **Required child element:** [<script>](#script) +- **Required child element:** [\](#script) Syntax: @@ -1800,23 +1808,23 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -| when | Yes | Indicates when the script should be run. This value can be one of the following:
  • **pre-scan** means before the scanning process begins.
  • **scan-success** means after the scanning process has finished successfully.
  • **post-scan** means after the scanning process has finished, whether it was successful or not.
  • **pre-apply** means before the apply process begins.
  • **apply-success** means after the apply process has finished successfully.
  • **post-apply** means after the apply process has finished, whether it was successful or not.
| +| when | Yes | Indicates when the script should be run. This value can be one of the following values:
  • **pre-scan** means before the scanning process begins.
  • **scan-success** means after the scanning process finishes successfully.
  • **post-scan** means after the scanning process finished, whether it was successful or not.
  • **pre-apply** means before the apply process begins.
  • **apply-success** means after the apply process finishes successfully.
  • **post-apply** means after the apply process finished, whether it was successful or not.
| -## <plugin> +## \ -This is an internal USMT element. Do not use this element. +This element is an internal USMT element. Don't use this element. -## <role> +## \ -The **<role>** element is required in a custom .xml file. By specifying the **<role>** element, you can create a concrete component. The component will be defined by the parameters specified at the **<component>** level, and with the role that you specify here. +The **\** element is required in a custom **.xml** file. When the **\** element is specified, a concrete component can be created. The component is defined by the parameters specified at the **\** level, and with the role that is specified here. -- **Number of occurrences:** Each **<component>** can have one, two or three child **<role>** elements. +- **Number of occurrences:** Each **\** can have one, two or three child **\** elements. -- **Parent elements:** [<component>](#component), [<role>](#role) +- **Parent elements:** [\](#component), [\](#role) -- **Required child elements:** [<rules>](#rules) +- **Required child elements:** [\](#rules) -- **Optional child elements:** [<environment>](#environment), [<detection>](#detection), [<component>](#component), [<role>](#role), [<detects>](#detects), [<plugin>](#plugin) +- **Optional child elements:** [\](#environment), [\](#detection), [\](#component), [\](#role), [\](#detects), [\](#plugin) Syntax: @@ -1827,9 +1835,9 @@ Syntax: |Setting|Required?|Value| |--- |--- |--- | -| role | Yes | Defines the role for the component. Role can be one of:
  • **Container**
  • **Binaries**
  • **Settings**
  • **Data**
You can either:
  1. Specify up to three **<role>** elements within a **<component>** — one "Binaries" role element, one "Settings" role element and one "Data" role element. These parameters do not change the migration behavior — their only purpose is to help you categorize the settings that you are migrating. You can nest these **<role>** elements, but each nested element must be of the same role parameter.
  2. Specify one "Container" **<role>** element within a **<component>** element. In this case, you cannot specify any child **<rules>** elements, only other **<component>** elements. And each child **<component>** element must have the same type as that of parent **<component>** element. For example:
<component context="UserAndSystem" type="Application"> 
<displayName _locID="migapp.msoffice2003">Microsoft Office 2003</displayName>
<environment name="GlobalEnv" />
<role role="Container">
<detection name="AnyOffice2003Version" />
<detection name="FrontPage2003" />
<!--
Office 2003 Common Settings
-->
<component context="UserAndSystem" type="Application">
| +| role | Yes | Defines the role for the component. Role can be one of:
  • **Container**
  • **Binaries**
  • **Settings**
  • **Data**
One of the following items can be specified:
  1. Up to three **\** elements within a **\** - one "Binaries" role element, one "Settings" role element and one "Data" role element. These parameters don't change the migration behavior - their only purpose is to help categorize the settings that are migrating. These **\** elements can be nested, but each nested element must be of the same role parameter.
  2. One "Container" **\** element within a **\** element. In this case, any child **\** elements can't be specified, only other **\** elements. And each child **\** element must have the same type as that of parent **\** element. For example:
\
\Microsoft Office 2016\
\
\
\
\
\ -This topic describes the result of applying AppLocker rule exceptions to rule collections. +This article describes the result of applying AppLocker rule exceptions to rule collections. -You can apply AppLocker rules to individual users or a group of users. If you apply a rule to a group of users, all users in that group are affected by that rule. If you need to allow a subset of a user group to use an app, you can create a special rule for that subset. +You can apply AppLocker rules to individual users or a group of users. If you apply a rule to a group of users, the rule affects all users in that group. If you need to allow a subset of a user group to use an app, you can create a special rule for that subset. For example, the rule "Allow Everyone to run Windows except Registry Editor" allows Everyone to run Windows binaries, but doesn't allow anyone to run Registry Editor (by adding %WINDIR%\regedit.exe as a Path Exception for the rule). The effect of this rule would prevent users such as Helpdesk personnel from running the Registry Editor, a program that is necessary for their support tasks. -To resolve this problem, create a second rule that applies to the Helpdesk user group: "Allow Helpdesk to run Registry Editor" and add %WINDIR%\regedit.exe as an allowed path. If you create a deny rule that doesn't allow any users to run Registry Editor, the deny rule will override the second rule that allows the Helpdesk user group to run Registry Editor. +To resolve this problem, create a second rule that applies to the Helpdesk user group: "Allow Helpdesk to run Registry Editor" and add %WINDIR%\regedit.exe as an allowed path. If you create a deny rule that blocks Registry Editor for all users, the deny rule overrides the second rule that allows the Helpdesk user group to run Registry Editor. -## Related topics +## Related articles - [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md index 9c95ff5c19..9937009a5e 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md @@ -1,26 +1,23 @@ --- title: Understanding the file hash rule condition in AppLocker -description: This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it's applied. +description: This article explains how to use the AppLocker file hash rule condition and its advantages and disadvantages. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 09/21/2017 +ms.date: 12/23/2023 --- # Understanding the file hash rule condition in AppLocker ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). +This article explains how to use the AppLocker file hash rule condition and its advantages and disadvantages. -This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it's applied. - -File hash rules use a system-computed cryptographic hash of the identified file. For files that aren't digitally signed, file hash rules are more secure than path rules. The following table describes the advantages and disadvantages of the file hash condition. +File hash rules use a system-computed Authenticode cryptographic hash of the identified file. For files that aren't digitally signed, file hash rules are more secure than path rules. The following table describes the advantages and disadvantages of the file hash condition. | File hash condition advantages | File hash condition disadvantages | -| - | - | -| Because each file has a unique hash, a file hash condition applies to only one file. | Each time that the file is updated (such as a security update or upgrade), the file's hash will change. As a result, you must manually update file hash rules.| - -For an overview of the three types of AppLocker rule conditions and explanations of the advantages and disadvantages of each, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). +| --- | --- | +| Because each file has a unique hash, a file hash condition applies to only one file. | Each time that the file is updated (such as a security update or upgrade), the file's Authenticode hash changes. As a result, you must manually update file hash rules. | -## Related topics +For an overview of the three types of AppLocker rule conditions and their advantages and disadvantages of each, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). + +## Related articles - [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md index 4a28e77011..2d1d4b9cae 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md @@ -1,29 +1,26 @@ --- title: Understanding the path rule condition in AppLocker -description: This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it's applied. +description: This article explains how to apply the AppLocker path rule condition and its advantages and disadvantages. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 09/21/2017 +ms.date: 12/23/2023 --- # Understanding the path rule condition in AppLocker ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). - -This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it's applied. +This article explains how to apply the AppLocker path rule condition and its advantages and disadvantages. The path condition identifies an application by its location in the file system of the computer or on the network. -When creating a rule that uses a deny action, path conditions are less secure than publisher and file hash conditions for preventing access to a file because a user could easily copy the file to a different location than the location specified in the rule. Because path rules specify locations within the file system, you should ensure that there are no subdirectories that are writable by non-administrators. For example, if you create a path rule for C:\\ with the allow action, any file under that location will be allowed to run, including within users' profiles. The following table describes the advantages and disadvantages of the path condition. +Path rules that use the deny action, are less effective than other types of rules, because a user (or malware acting as a user) can easily copy the file to a different location to run it. Because path rules specify locations within the file system, you should ensure that there are no subdirectories that are writable by nonadministrators. For example, if you create a path rule using the allow action for C:\\, any file under that location can run, including file within users' profiles. The following table describes the advantages and disadvantages of the path condition. |Path condition advantages|Path condition disadvantages| -|--- |--- | -|
  • You can easily control many folders or a single file.
  • You can use the asterisk (*) as a wildcard character within path rules.|
  • It might be less secure if a rule that is configured to use a folder path contains subfolders that are writable by non-administrators.
  • You must specify the full path to a file or folder when creating path rules so that the rule will be properly enforced.| +| --- | --- | +|
  • You can easily control many folders or a single file.
  • You can use the asterisk (*) as a wildcard character within path rules. |
  • It might be less secure if a rule that is configured to use a folder path contains subfolders that are writable by nonadministrators.
  • You must specify the full path to a file or folder when creating path rules so that the rule is properly enforced. | -AppLocker doesn't enforce rules that specify paths with short names. You should always specify the full path to a file or folder when creating path rules so that the rule will be properly enforced. +AppLocker doesn't enforce rules that specify paths with short names. You should always specify the full path to a file or folder when creating path rules so that the rule is properly enforced. -The asterisk (\*) wildcard character can be used within **Path** field. The asterisk (\*) character used by itself represents any path. When combined with any string value, the rule is limited to the path of the file and all the files under that path. For example, %ProgramFiles%\\Internet Explorer\\\* indicates that all files and subfolders within the Internet Explorer folder will be affected by the rule. +The asterisk (\*) wildcard character can be used within **Path** field. The asterisk (\*) character used by itself represents any path. When combined with any string value, the rule is limited to the path of the file and all the files under that path. For example, %ProgramFiles%\\Internet Explorer\\\* indicates that the rule affects all files and subfolders within the Internet Explorer folder. AppLocker uses path variables for well-known directories in Windows. Path variables aren't environment variables. The AppLocker engine can only interpret AppLocker path variables. The following table details these path variables. @@ -36,8 +33,8 @@ AppLocker uses path variables for well-known directories in Windows. Path variab | Removable media (for example, CD or DVD) | %REMOVABLE% | | | Removable storage device (for example, USB flash drive) | %HOT% | | -For an overview of the three types of AppLocker rule conditions and explanations of the advantages and disadvantages of each, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). +For an overview of the three types of AppLocker rule conditions and their advantages and disadvantages of each, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). -## Related topics +## Related articles - [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md index a915c31c36..171ef6e3f1 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md @@ -1,63 +1,58 @@ --- title: Understanding the publisher rule condition in AppLocker -description: This topic explains the AppLocker publisher rule condition, what controls are available, and how it's applied. +description: This article explains how to apply the AppLocker publisher rule condition and what controls are available. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 09/21/2017 +ms.date: 12/23/2023 --- # Understanding the publisher rule condition in AppLocker ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). +This article explains how to apply the AppLocker publisher rule condition and what controls are available. -This topic explains the AppLocker publisher rule condition, what controls are available, and how it's applied. - -Publisher conditions can be made only for files that are digitally signed; this condition identifies an app based on its digital signature and extended attributes. The digital signature contains information about the company that created the app (the publisher). The extended attributes, which are obtained from the binary resource, contain the name of the product that the app is part of and the version number of the app. The publisher may be a software development company, such as Microsoft, or the Information Technology department of your organization. -Publisher conditions are easier to maintain than file hash conditions and are more secure than path conditions. Rules that are specified to the version level might have to be updated when a new version of the file is released. The following table describes the advantages and disadvantages -of the publisher condition. +Publisher conditions can be made only for files that are digitally signed. This condition identifies an app's file based on its digital signature and extended attributes. The digital signature contains information about the company that created the app (the publisher). The extended attributes, which are obtained from the binary resource, contain the name of the product that the app is part of and the version number of the app. The publisher can be a software development company, such as Microsoft, or the Information Technology department of your organization. Publisher conditions are easier to maintain than file hash conditions and are more secure than path conditions. Rules that are specified to the version level might have to be updated when a new version of the file is released. The following table describes the advantages and disadvantages of the publisher condition. |Publisher condition advantages|Publisher condition disadvantages| -|--- |--- | -|
  • Frequent updating isn't required.
  • You can apply different values within a certificate.
  • A single rule can be used to allow an entire product suite.
  • You can use the asterisk (*) wildcard character within a publisher rule to specify that any value should be matched.|
  • The file must be signed.
  • Although a single rule can be used to allow an entire product suite, all files in the suite must be signed uniformly.| - +| --- | --- | +|
  • Frequent updating isn't required.
  • You can apply different values within a certificate.
  • A single rule can be used to allow an entire product suite.
  • You can use the asterisk (*) wildcard character within a publisher rule to specify that any value should be matched.|
  • The file must be signed.
  • Although a single rule can be used to allow an entire product suite, all files in the suite must be signed uniformly.| + Wildcard characters can be used as values in the publisher rule fields according to the following specifications: -- **Publisher** +- **Publisher** - The asterisk (\*) character used by itself represents any publisher. When combined with any string value, the rule is limited to the publisher with a value in the signed certificate that matches the character string. In other words, the asterisk isn't treated as a wildcard character if used with other characters in this field. For example, using the characters "M\*" limits the publisher name to only a publisher with the name "M\*." Using the characters "\*x\*" limits the publisher name only to the name "\*x\*". A question mark (?) isn't a valid wildcard character in this field. + The asterisk (\*) character used by itself represents any publisher. When combined with any string value, the rule is limited to the publisher with a value in the signed certificate that matches the character string. In other words, the asterisk isn't treated as a wildcard character if used with other characters in this field. For example, using the characters "M\*" limits the publisher name to only a publisher with the name "M\*." Using the characters "\*x\*" limits the publisher name only to the name "\*x\*." A question mark (?) isn't a valid wildcard character in this field. -- **Product name** +- **Product name** The asterisk (\*) character used by itself represents any product name. When combined with any string value, the rule is limited to the product of the publisher with a value in the signed certificate that matches the character string. In other words, the asterisk isn't treated as a wildcard character if used with other characters in this field. A question mark (?) isn't a valid wildcard character in this field. -- **File name** +- **File name** - Either the asterisk (\*) or question mark (?) characters used by themselves represent any and all file names. When combined with any string value, the string is matched with any file name containing that string. + Either the asterisk (\*) or question mark (?) characters used by themselves represent any file names. When combined with any string value, the string is matched with any file name containing that string. -- **File version** +- **File version** The asterisk (\*) character used by itself represents any file version. If you want to limit the file version to a specific version or as a starting point, you can state the file version and then use the following options to apply limits: - - **Exactly**. The rule applies only to this version of the app - - **And above**. The rule applies to this version and all later versions. - - **And Below**. The rule applies to this version and all earlier versions. + - **Exactly**. The rule applies only to this version of the app + - **And above**. The rule applies to this version and all later versions. + - **And Below**. The rule applies to this version and all earlier versions. The following table describes how a publisher condition is applied. | Option | The publisher condition allows or denies...| -| - | - | -| **All signed files** | All files that are signed by a publisher.| -| **Publisher only** | All files that are signed by the named publisher.| -| **Publisher and product name** | All files for the specified product that are signed by the named publisher.| -| **Publisher, product name, and file name** | Any version of the named file for the named product that is signed by the publisher.| -| **Publisher, product name, file name, and file version** | **Exactly**
    The specified version of the named file for the named product that is signed by the publisher.| -| **Publisher, product name, file name, and file version** | **And above**
    The specified version of the named file and any new releases for the product that are signed by the publisher.| -| **Publisher, product name, file name, and file version**| **And below**
    The specified version of the named file and any older versions for the product that are signed by the publisher.| -| **Custom** | You can edit the **Publisher**, **Product name**, **File name**, and **Version** fields to create a custom rule.| - -For an overview of the three types of AppLocker rule conditions and explanations of the advantages and disadvantages of each, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). +| --- | --- | +| **All signed files** | All files signed by a publisher. | +| **Publisher only** | All files signed by the named publisher. | +| **Publisher and product name** | All files for the specified product signed by the named publisher. | +| **Publisher, product name, and file name** | Any version of the named file for the named product and signed by the publisher. | +| **Publisher, product name, file name, and file version** | **Exactly**
    The specified version of the named file for the named product signed by the publisher. | +| **Publisher, product name, file name, and file version** | **And above**
    The specified version of the named file and any later versions of the file for the named product signed by the publisher. | +| **Publisher, product name, file name, and file version**| **And below**
    The specified version of the named file and any older versions for the named product signed by the publisher. | +| **Custom** | You can edit the **Publisher**, **Product name**, **File name**, and **Version** fields to create a custom rule. | -## Related topics +For an overview of the three types of AppLocker rule conditions and their advantages and disadvantages, see [Understanding AppLocker rule condition types](understanding-applocker-rule-condition-types.md). + +## Related articles - [How AppLocker works](how-applocker-works-techref.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md index c86f226134..47b1b1388d 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md @@ -1,17 +1,14 @@ --- title: Use a reference device to create and maintain AppLocker policies -description: This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. +description: This article for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 09/21/2017 +ms.date: 12/22/2023 --- # Use a reference device to create and maintain AppLocker policies ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). - -This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. +This article for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. ## Background and prerequisites @@ -19,51 +16,52 @@ An AppLocker reference device is a baseline device you can use to configure poli An AppLocker reference device that is used to create and maintain AppLocker policies should contain the corresponding apps for each organizational unit (OU) to mimic your production environment. ->**Important:** The reference device must be running one of the supported editions of Windows. For information about operating system requirements for AppLocker, see [Requirements to use AppLocker](requirements-to-use-applocker.md). - -You can perform AppLocker policy testing on the reference device by using the **Audit only** enforcement setting or Windows PowerShell cmdlets. You can also use the reference device as part of a testing configuration that includes policies that are created by using Software Restriction Policies. +You can perform AppLocker policy testing on the reference device by using the **Audit only** enforcement mode setting or Windows PowerShell cmdlets. ## Step 1: Automatically generate rules on the reference device With AppLocker, you can automatically generate rules for all files within a folder. AppLocker scans the specified folder and creates the condition types that you choose for each file in that folder. For information on how to automatically generate rules, see [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md). ->**Note:** If you run this wizard to create your first rules for a Group Policy Object (GPO), after you complete the wizard, you will be prompted to create the default rules, which allow critical system files to run. You can edit the default rules at any time. If your organization has decided to edit the default rules or create custom rules to allow the Windows system files to run, ensure that you delete the default rules after you replace them with your custom rules. - +> [!NOTE] +> If you run this wizard to create your first rules for a Group Policy Object (GPO), you will be prompted to create the default rules which allow critical system files to run. You can edit the default rules at any time. If your organization uses custom rules to allow the Windows system files to run, ensure that you delete the default rules after you create your custom rules. + ## Step 2: Create the default rules on the reference device AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. You must run the default rules for each rule collection. For info about default rules and considerations for using them, see [Understanding AppLocker default rules](understanding-applocker-default-rules.md). For the procedure to create default rules, see [Create AppLocker default rules](create-applocker-default-rules.md). ->**Important:** You can use the default rules as a template when you create your own rules. This allows files within the Windows directory to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. - +> [!IMPORTANT] +> You can use the default rules as a template when you create your own rules. This allows files within the Windows directory to run. However, these rules are only meant to function as a starter policy when you are first testing AppLocker rules. + ## Step 3: Modify rules and the rule collection on the reference device -If AppLocker policies are currently running in your production environment, export the policies from the corresponding GPOs and save them to the reference device. For information on how to export and save the policies, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md). If no AppLocker policies have been deployed, create the rules and develop the policies by using the following procedures: +If AppLocker policies are currently running in your production environment, export the policies from the corresponding GPOs and save them to the reference device. For information on how to export and save the policies, see [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md). If no AppLocker policies are deployed, create the rules and develop the policies by using the following procedures: -- [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) -- [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) -- [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) -- [Edit AppLocker rules](edit-applocker-rules.md) -- [Add exceptions for an AppLocker rule](configure-exceptions-for-an-applocker-rule.md) -- [Delete an AppLocker rule](delete-an-applocker-rule.md) -- [Enable the DLL rule collection](enable-the-dll-rule-collection.md) -- [Enforce AppLocker rules](enforce-applocker-rules.md) +- [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) +- [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) +- [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) +- [Edit AppLocker rules](edit-applocker-rules.md) +- [Add exceptions for an AppLocker rule](configure-exceptions-for-an-applocker-rule.md) +- [Delete an AppLocker rule](delete-an-applocker-rule.md) +- [Enable the DLL rule collection](enable-the-dll-rule-collection.md) +- [Enforce AppLocker rules](enforce-applocker-rules.md) ## Step 4: Test and update AppLocker policy on the reference device -You should test each set of rules to ensure that they perform as intended. The **Test-AppLockerPolicy** Windows PowerShell cmdlet can be used to determine whether any of the rules in your rule collection will be blocked on your reference device. Perform the steps on each reference device that you used to define the AppLocker policy. Ensure that the reference device is joined to the domain and that it's receiving the AppLocker policy from the appropriate GPO. Because AppLocker rules are inherited from linked GPOs, you should deploy all of the rules to simultaneously test all of your test GPOs. Use the following procedures to complete this step: +You should test each set of rules to ensure that they perform as intended. The **Test-AppLockerPolicy** Windows PowerShell cmdlet can be used to determine whether any apps on your reference device are blocked by the rules in your rule collections. Perform the steps on each reference device that you used to define the AppLocker policy. Ensure that the reference device is joined to the domain and that it's receiving the AppLocker policy from the appropriate GPO. Because AppLocker rules are inherited from linked GPOs, you should deploy all of the rules to simultaneously test all of your test GPOs. Use the following procedures to complete this step: -- [Test an AppLocker Policy with Test-AppLockerPolicy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791772(v=ws.10)) -- [Discover the Effect of an AppLocker Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791823(v=ws.10)) +- [Test an AppLocker Policy with Test-AppLockerPolicy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791772(v=ws.10)) +- [Discover the Effect of an AppLocker Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791823(v=ws.10)) + +> [!WARNING] +> If you have set the enforcement mode setting on the rule collection to **Enforce rules** or **Not configured**, the policy will be enforced upon completing the next step. Set the enforcement mode setting on the rule collection to **Audit only** if you aren't ready to block any files from running. ->**Caution:** If you have set the enforcement setting on the rule collection to **Enforce rules** or you have not configured the rule collection, the policy will be implemented when the GPO is updated in the next step. If you have set the enforcement setting on the rule collection to **Audit only**, application access events are written to the AppLocker log, and the policy will not take effect. - ## Step 5: Export and import the policy into production -When the AppLocker policy has been tested successfully, it can be imported into the GPO (or imported into individual computers that aren't managed by Group Policy) and checked for its intended effectiveness. To do these tasks, perform the following procedures: +After you test your AppLocker policy, you can import it into the GPO (or imported into individual computers not managed by Group Policy) and checked for its intended effectiveness. To do these tasks, perform the following procedures: -- [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) -- [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md) or -- [Discover the Effect of an AppLocker Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791823(v=ws.10)) +- [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) +- [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md) or +- [Discover the Effect of an AppLocker Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791823(v=ws.10)) If the AppLocker policy enforcement setting is **Audit only** and you're satisfied that the policy is fulfilling your intent, you can change it to **Enforce rules**. For info about how to change the enforcement setting, see [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md). @@ -71,9 +69,9 @@ If the AppLocker policy enforcement setting is **Audit only** and you're satisfi If more refinements or updates are necessary after a policy is deployed, use the appropriate following procedures to monitor and update the policy: -- [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) -- [Edit an AppLocker policy](edit-an-applocker-policy.md) -- [Refresh an AppLocker policy](refresh-an-applocker-policy.md) +- [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) +- [Edit an AppLocker policy](edit-an-applocker-policy.md) +- [Refresh an AppLocker policy](refresh-an-applocker-policy.md) ## See also diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md deleted file mode 100644 index a8a22bcdb4..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Use AppLocker and Software Restriction Policies in the same domain -description: This article for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. -ms.localizationpriority: medium -ms.topic: conceptual -ms.date: 11/07/2022 ---- - -# Use AppLocker and Software Restriction Policies in the same domain - -This article for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. - -> [!IMPORTANT] -> Software Restriction Policies were deprecated beginning with Windows 10 build 1803 and above, and also applies to Windows Server 2019 and above. You should use Windows Defender Application Control (WDAC) or AppLocker to control what software runs. - -## Using AppLocker and Software Restriction Policies in the same domain - -AppLocker is supported on systems running Windows 8.1. Software Restriction Policies (SRP) is supported on systems running Windows Vista or earlier. You can continue to use SRP for application control on your pre-Windows 7 computers, but use AppLocker for computers running Windows Server 2008 R2, Windows 7 and later. It's recommended that you author AppLocker and SRP rules in separate GPOs and target the GPO with SRP policies to systems running Windows Vista or earlier. When both SRP and AppLocker policies are applied to computers running Windows Server 2008 R2, Windows 7 and later, the SRP policies are ignored. - -The following table compares the features and functions of Software Restriction Policies (SRP) and AppLocker. - -|Application control function|SRP|AppLocker| -|--- |--- |--- | -|Scope|SRP policies can be applied to all Windows operating systems beginning with Windows XP and Windows Server 2003.|AppLocker policies apply only to Windows Server 2008 R2, Windows 7, and later.| -|Policy creation|SRP policies are maintained through Group Policy and only the administrator of the GPO can update the SRP policy. The administrator on the local computer can modify the SRP policies defined in the local GPO.|AppLocker policies are maintained through Group Policy and only the administrator of the GPO can update the policy. The administrator on the local computer can modify the AppLocker policies defined in the local GPO.

    AppLocker permits customization of error messages to direct users to a Web page for help.| -|Policy maintenance|SRP policies must be updated by using the Local Security Policy snap-in (if the policies are created locally) or the Group Policy Management Console (GPMC).|AppLocker policies can be updated by using the Local Security Policy snap-in (if the policies are created locally), or the GPMC, or the Windows PowerShell AppLocker cmdlets.| -|Policy application|SRP policies are distributed through Group Policy.|AppLocker policies are distributed through Group Policy.| -|Enforcement mode|SRP works in the "blocklist mode" where administrators can create rules for files that they don't want to allow in this Enterprise whereas the rest of the file is allowed to run by default.

    SRP can also be configured in the "allowlist mode" so that by default all files are blocked. In "allowlist mode", administrators need to create allow rules for files that they want to run.|AppLocker by default works in the "allowlist mode" where only those files are allowed to run for which there's a matching allow rule.| -|File types that can be controlled|SRP can control the following file types:
  • Executables
  • Dlls
  • Scripts
  • Windows Installers

    SRP can't control each file type separately. All SRP rules are in a single rule collection.|AppLocker can control the following file types:
  • Executables
  • Dlls
  • Scripts
  • Windows Installers
  • Packaged apps and installers

    AppLocker maintains a separate rule collection for each of the five file types.| -|Designated file types|SRP supports an extensible list of file types that are considered executable. Administrators can add extensions for files that should be considered executable.|AppLocker currently supports the following file extensions:
  • Executables (.exe, .com)
  • Dlls (.ocx, .dll)
  • Scripts (.vbs, .js, .ps1, .cmd, .bat)
  • Windows Installers (.msi, .mst, .msp)
  • Packaged app installers (.appx)| -|Rule types|SRP supports four types of rules:
  • Hash
  • Path
  • Signature
  • Internet zone|AppLocker supports three types of rules:
  • File hash
  • Path
  • Publisher| -|Editing the hash value|In Windows XP, you could use SRP to provide custom hash values.

    Beginning with Windows 7 and Windows Server 2008 R2, you can only select the file to hash, and not provide the hash value.|AppLocker computes the hash value itself. Internally, it uses the SHA2 Authenticode hash for Portable Executables (exe and dll) and Windows Installers and an SHA2 flat file hash for the rest.| -|Support for different security levels|With SRP, you can specify the permissions with which an app can run. So, you can configure a rule such that Notepad always runs with restricted permissions and never with administrative privileges.

    SRP on Windows Vista and earlier supported multiple security levels. On Windows 7, that list was restricted to just two levels: Disallowed and Unrestricted (Basic User translates to Disallowed).|AppLocker doesn't support security levels.| -|Manage Packaged apps and Packaged app installers.|Not supported|.appx is a valid file type which AppLocker can manage.| -|Targeting a rule to a user or a group of users|SRP rules apply to all users on a particular computer.|AppLocker rules can be targeted to a specific user or a group of users.| -|Support for rule exceptions|SRP doesn't support rule exceptions.|AppLocker rules can have exceptions, which allow you to create rules such as "Allow everything from Windows except for regedit.exe".| -|Support for audit mode|SRP doesn't support audit mode. The only way to test SRP policies is to set up a test environment and run a few experiments.|AppLocker supports audit mode, which allows you to test the effect of their policy in the real production environment without impacting the user experience. Once you're satisfied with the results, you can start enforcing the policy.| -|Support for exporting and importing policies|SRP doesn't support policy import/export.|AppLocker supports the importing and exporting of policies. This support by AppLocker allows you to create AppLocker policy on a sample device, test it out and then export that policy and import it back into the desired GPO.| -|Rule enforcement|Internally, SRP rules enforcement happens in the user-mode, which is less secure.|Internally, AppLocker rules for .exe and .dll files are enforced in the kernel-mode, which is more secure than enforcing them in the user-mode.| diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md index aed93b7f33..ffefd947e7 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md @@ -1,31 +1,26 @@ --- title: Use the AppLocker Windows PowerShell cmdlets -description: This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. +description: This article for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 09/21/2017 +ms.date: 12/19/2023 --- # Use the AppLocker Windows PowerShell cmdlets ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). - -This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. +This article for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. ## AppLocker Windows PowerShell cmdlets -The five AppLocker cmdlets are designed to streamline the administration of an AppLocker policy. They can be used to help create, test, maintain, and troubleshoot an AppLocker policy. The cmdlets are intended to be used in conjunction with the AppLocker user interface that is accessed through the -Microsoft Management Console (MMC) snap-in extension to the Local Security Policy snap-in and Group Policy Management Console. +The five AppLocker cmdlets are designed to streamline the administration of an AppLocker policy. They can be used to help create, test, maintain, and troubleshoot an AppLocker policy. The cmdlets are intended to be used along with the AppLocker user interface that is accessed through the Microsoft Management Console (MMC) snap-in extension to the Local Security Policy snap-in and Group Policy Management Console. -To edit or update a Group Policy Object (GPO) by using the AppLocker cmdlets, you must have Edit Setting permission. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. To perform tasks by using the -Local Security policy snap-in, you must be a member of the local **Administrators** group, or equivalent, on the computer. +To edit or update a Group Policy Object (GPO) by using the AppLocker cmdlets, you must have Edit Setting permission. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. To perform tasks by using the Local Security policy snap-in, you must be a member of the local **Administrators** group, or equivalent, on the computer. ### Retrieve application information The [Get-AppLockerFileInformation](/powershell/module/applocker/get-applockerfileinformation) cmdlet retrieves the AppLocker file information from a list of files or from an event log. File information that is retrieved can include publisher information, file hash information, and file path information. -File information from an event log may not contain all of these fields. Files that aren't signed don't have any publisher information. +File information from an event log might not contain all of these fields. Files that aren't signed don't have any publisher information. ### Set AppLocker policy @@ -37,8 +32,7 @@ The [Get-AppLockerPolicy](/powershell/module/applocker/get-applockerpolicy) cmdl ### Generate rules for a given user or group -The [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy) cmdlet uses a list of file information to automatically generate rules for a given user or group. It can generate rules based on publisher, hash, or path information. Use **Get-AppLockerFileInformation** to create the -list of file information. +The [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy) cmdlet uses a list of file information to automatically generate rules for a given user or group. It can generate rules based on publisher, hash, or path information. Use **Get-AppLockerFileInformation** to create the list of file information. ### Test the AppLocker Policy against a file set @@ -46,4 +40,4 @@ The [Test-AppLockerPolicy](/powershell/module/applocker/test-applockerpolicy) cm ## Other resources -- For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). +- For steps to perform other AppLocker policy tasks, see [Administer AppLocker](administer-applocker.md). diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md index f237a5b23c..19b2256345 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md @@ -3,17 +3,16 @@ title: Using Event Viewer with AppLocker description: This article lists AppLocker events and describes how to use Event Viewer with AppLocker. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 02/02/2023 +ms.date: 12/23/2023 --- + + # Using Event Viewer with AppLocker ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). - This article lists AppLocker events and describes how to use Event Viewer with AppLocker. -The AppLocker log contains information about applications that are affected by AppLocker rules. Each event in the log contains details such as the following information: +The AppLocker log contains information about applications affected by AppLocker rules. Each event in the log contains details such as the following information: - Which file is affected and the path of that file - Which packaged app is affected and the package identifier of the app @@ -22,53 +21,52 @@ The AppLocker log contains information about applications that are affected by A - The rule name - The security identifier (SID) for the user or group identified in the rule -Review the entries in the Event Viewer to determine if any applications aren't included in the rules that you automatically generated. For instance, some line-of-business apps are installed to non-standard locations, such as the root of the active drive (for example, `%SystemDrive%`). +Review the entries in the Event Viewer to determine if any applications aren't included in the rules that you automatically generated. For instance, some line-of-business apps are installed to nonstandard locations, such as the root of the active drive (for example, `%SystemDrive%`). For info about what to look for in the AppLocker event logs, see [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md). > [!NOTE] > The AppLocker event logs are very verbose and can result in a large number of events depending on the policies deployed, particularly in the *AppLocker - EXE and DLL* event log. If you're using an event forwarding and collection service, like LogAnalytics, you may want to adjust the configuration for that event log to only collect Error events or stop collecting events from that log altogether. -**To review the AppLocker log in Event Viewer** +## Review the AppLocker logs in Windows Event Viewer 1. Open Event Viewer. 2. In the console tree under **Application and Services Logs\\Microsoft\\Windows**, select **AppLocker**. -The following table contains information about the events that you can use to determine which apps are affected by AppLocker rules. +The following table contains information about the events that you can use to determine the apps affected by AppLocker rules. | Event ID | Level | Event message | Description | | --- | --- | --- | --- | -| 8000 | Error| AppID policy conversion failed. Status * <%1> *| Indicates that the policy wasn't applied correctly to the computer. The status message is provided for troubleshooting purposes.| -| 8001 | Information| The AppLocker policy was applied successfully to this computer.| Indicates that the AppLocker policy was successfully applied to the computer.| -| 8002 | Information| *<File name> * was allowed to run.| Specifies that the .exe or .dll file is allowed by an AppLocker rule.| -| 8003 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Applied only when the **Audit only** enforcement mode is enabled. Specifies that the .exe or .dll file would be blocked if the **Enforce rules** enforcement mode were enabled. | -| 8004 | Error| *<File name> * was prevented from running.| Access to *<file name>* is restricted by the administrator. Applied only when the **Enforce rules** enforcement mode is set either directly or indirectly through Group Policy inheritance. The .exe or .dll file can't run.| -| 8005| Information| *<File name> * was allowed to run.| Specifies that the script or .msi file is allowed by an AppLocker rule.| -| 8006 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Applied only when the **Audit only** enforcement mode is enabled. Specifies that the script or .msi file would be blocked if the **Enforce rules** enforcement mode were enabled. | -| 8007 | Error| *<File name> * was prevented from running.| Access to *<file name>* is restricted by the administrator. Applied only when the **Enforce rules** enforcement mode is set either directly or indirectly through Group Policy inheritance. The script or .msi file can't run.| -| 8008| Warning| *<File name> *: AppLocker component not available on this SKU.| Added in Windows Server 2012 and Windows 8.| -| 8020| Information| *<File name> * was allowed to run.| Added in Windows Server 2012 and Windows 8.| -| 8021| Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Added in Windows Server 2012 and Windows 8.| -| 8022| Error| *<File name> * was prevented from running.| Added in Windows Server 2012 and Windows 8.| -| 8023 | Information| *<File name> * was allowed to be installed.| Added in Windows Server 2012 and Windows 8.| -| 8024 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Added in Windows Server 2012 and Windows 8.| -| 8025 | Error| *<File name> * was prevented from running.| Added in Windows Server 2012 and Windows 8.| -| 8027 | Error| No packaged apps can be executed while Exe rules are being enforced and no Packaged app rules have been configured.| Added in Windows Server 2012 and Windows 8.| -| 8028 | Warning | *<File name> * was allowed to run but would have been prevented if the Config CI policy were enforced.| Added in Windows Server 2016 and Windows 10.| -| 8029 | Error | *<File name> * was prevented from running due to Config CI policy.| Added in Windows Server 2016 and Windows 10.| -| 8030 | Information | ManagedInstaller check SUCCEEDED during Appid verification of * | Added in Windows Server 2016 and Windows 10.| -| 8031 | Information | SmartlockerFilter detected file * being written by process * | Added in Windows Server 2016 and Windows 10.| -| 8032 | Error | ManagedInstaller check FAILED during Appid verification of * | Added in Windows Server 2016 and Windows 10.| -| 8033 | Warning | ManagedInstaller check FAILED during Appid verification of * . Allowed to run due to Audit AppLocker Policy. | Added in Windows Server 2016 and Windows 10.| -| 8034 | Information | ManagedInstaller Script check FAILED during Appid verification of * | Added in Windows Server 2016 and Windows 10.| -| 8035 | Error | ManagedInstaller Script check SUCCEEDED during Appid verification of * | Added in Windows Server 2016 and Windows 10.| -| 8036 | Error | * was prevented from running due to Config CI policy | Added in Windows Server 2016 and Windows 10.| -| 8037 | Information | * passed Config CI policy and was allowed to run.| Added in Windows Server 2016 and Windows 10.| -| 8038 | Information | Publisher info: Subject: * Issuer: * Signature index * (* total) | Added in Windows Server 2016 and Windows 10.| -| 8039 | Warning | Package family name * version * was allowed to install or update but would have been prevented if the Config CI policy | Added in Windows Server 2016 and Windows 10.| -| 8040 | Error | Package family name * version * was prevented from installing or updating due to Config CI policy | Added in Windows Server 2016 and Windows 10.| +| 8000 | Error | AppID policy conversion failed. Status * <%1> * | Indicates that the policy wasn't applied correctly to the computer. The status message is provided for troubleshooting purposes. | +| 8001 | Information | The AppLocker policy was applied successfully to this computer. | Indicates that the AppLocker policy was successfully applied to the computer. | +| 8002 | Information | *<File name> * was allowed to run. | Indicates an AppLocker rule allowed the .exe or .dll file. | +| 8003 | Warning | *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced. | Shown only when the **Audit only** enforcement mode is enabled. Indicates that the AppLocker policy would block the .exe or .dll file if the enforcement mode setting was **Enforce rules**. | +| 8004 | Error | *<File name> * was prevented from running. | AppLocker blocked the named EXE or DLL file. Shown only when the **Enforce rules** enforcement mode is enabled. | +| 8005| Information | *<File name> * was allowed to run. | Indicates an AppLocker rule allowed the script or .msi file. | +| 8006 | Warning | *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced. | Shown only when the **Audit only** enforcement mode is enabled. Indicates that the AppLocker policy would block the script or .msi file if the **Enforce rules** enforcement mode was enabled. | +| 8007 | Error | *<File name> * was prevented from running. | AppLocker blocked the named Script or MSI. Shown only when the **Enforce rules** enforcement mode is enabled. | +| 8008| Warning | *<File name> *: AppLocker component not available on this SKU. | Indicates an edition of Windows that doesn't support AppLocker. | +| 8020| Information | *<File name> * was allowed to run. | Added in Windows Server 2012 and Windows 8. | +| 8021| Warning | *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced. | Added in Windows Server 2012 and Windows 8. | +| 8022| Error | *<File name> * was prevented from running. | Added in Windows Server 2012 and Windows 8. | +| 8023 | Information | *<File name> * was allowed to be installed. | Added in Windows Server 2012 and Windows 8. | +| 8024 | Warning | *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced. | Added in Windows Server 2012 and Windows 8. | +| 8025 | Error | *<File name> * was prevented from running. | Added in Windows Server 2012 and Windows 8. | +| 8027 | Error | No packaged apps can be executed while Exe rules are being enforced and no Packaged app rules have been configured. | Added in Windows Server 2012 and Windows 8. | +| 8028 | Warning | *<File name> * was allowed to run but would have been prevented if the Config CI policy were enforced. | Added in Windows Server 2016 and Windows 10. | +| 8029 | Error | *<File name> * was prevented from running due to Config CI policy. | Added in Windows Server 2016 and Windows 10. | +| 8030 | Information | ManagedInstaller check SUCCEEDED during Appid verification of * | Added in Windows Server 2016 and Windows 10. | +| 8031 | Information | SmartlockerFilter detected file * being written by process * | Added in Windows Server 2016 and Windows 10. | +| 8032 | Error | ManagedInstaller check FAILED during Appid verification of * | Added in Windows Server 2016 and Windows 10. | +| 8033 | Warning | ManagedInstaller check FAILED during Appid verification of * . Allowed to run due to Audit AppLocker Policy. | Added in Windows Server 2016 and Windows 10. | +| 8034 | Information | ManagedInstaller Script check FAILED during Appid verification of * | Added in Windows Server 2016 and Windows 10. | +| 8035 | Error | ManagedInstaller Script check SUCCEEDED during Appid verification of * | Added in Windows Server 2016 and Windows 10. | +| 8036 | Error | * was prevented from running due to Config CI policy | Added in Windows Server 2016 and Windows 10. | +| 8037 | Information | * passed Config CI policy and was allowed to run. | Added in Windows Server 2016 and Windows 10. | +| 8038 | Information | Publisher info: Subject: * Issuer: * Signature index * (* total) | Added in Windows Server 2016 and Windows 10. | +| 8039 | Warning | Package family name * version * was allowed to install or update but would have been prevented if the Config CI policy | Added in Windows Server 2016 and Windows 10. | +| 8040 | Error | Package family name * version * was prevented from installing or updating due to Config CI policy | Added in Windows Server 2016 and Windows 10. | - ## Related articles - [Tools to use with AppLocker](tools-to-use-with-applocker.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md deleted file mode 100644 index e822da9f1b..0000000000 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Use Software Restriction Policies and AppLocker policies -description: This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. -ms.localizationpriority: medium -ms.topic: conceptual -ms.date: 09/21/2017 ---- - -# Use Software Restriction Policies and AppLocker policies - ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). - -This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. - -## Understand the difference between SRP and AppLocker - -You might want to deploy application control policies in Windows operating systems earlier than Windows Server 2008 R2 or Windows 7. You can use AppLocker policies only on the supported versions and editions of Windows as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). However, you can use SRP on those supported editions of Windows plus Windows Server 2003 and Windows XP. To compare features and functions in SRP and AppLocker so that you can determine when to use each technology to meet your application control objectives, see [Determine your application control objectives](determine-your-application-control-objectives.md). - -## Use SRP and AppLocker in the same domain - -SRP and AppLocker use Group Policy for domain management. However, when policies are generated by SRP and AppLocker exist in the same domain, and they're applied through Group Policy, AppLocker policies take precedence over policies generated by SRP on computers that are running an operating system that supports AppLocker. For info about how inheritance in Group Policy applies to AppLocker policies and policies generated by SRP, see [Understand AppLocker rules and enforcement setting inheritance in Group Policy](understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md). - ->**Important:** As a best practice, use separate Group Policy Objects to implement your SRP and AppLocker policies. To reduce troubleshooting issues, do not combine them in the same GPO. - -The following scenario provides an example of how each type of policy would affect a bank teller software app, where the app is deployed on different Windows desktop operating systems and managed by the Tellers GPO. - -| Operating system | Tellers GPO with AppLocker policy | Tellers GPO with SRP | Tellers GPO with AppLocker policy and SRP | -| - | - | - | - | -| Windows 10, Windows 8.1, Windows 8, and Windows 7 | AppLocker policies in the GPO are applied, and they supersede any local AppLocker policies.| Local AppLocker policies supersede policies generated by SRP that are applied through the GPO. | AppLocker policies in the GPO are applied, and they supersede the policies generated by SRP in the GPO and local AppLocker policies or policies generated by SRP.| -| Windows Vista| AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP.AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.| -| Windows XP| AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies aren't applied.| Policies generated by SRP in the GPO are applied, and they supersede local policies generated by SRP. AppLocker policies not applied.| - ->**Note:** For info about supported versions and editions of the Windows operating system, see [Requirements to use AppLocker](requirements-to-use-applocker.md). - -## Test and validate SRPs and AppLocker policies that are deployed in the same environment - -Because SRPs and AppLocker policies function differently, they shouldn't be implemented in the same GPO. This rule, when implemented, makes testing the result of the policy straightforward, which is critical to successfully controlling application usage in the organization. Configuring a testing and policy distribution system can help you understand the result of a policy. The effects of policies generated by SRP and AppLocker policies need to be tested separately and by using different tools. - -### Step 1: Test the effect of SRPs - -You can use the Group Policy Management Console (GPMC) or the Resultant Set of Policy (RSoP) snap-in to determine the effect of applying SRPs by using GPOs. - -### Step 2: Test the effect of AppLocker policies - -You can test AppLocker policies by using Windows PowerShell cmdlets. For info about investigating the result of a policy, see: - -- [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md) -- [Monitor app usage with AppLocker](monitor-application-usage-with-applocker.md) - -Another method to use when determining the result of a policy is to set the enforcement mode to **Audit only**. When the policy is deployed, events will be written to the AppLocker logs as if the policy was enforced. For info about using the **Audit only** mode, see: - -- [Understand AppLocker enforcement settings](understand-applocker-enforcement-settings.md) -- [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) - -## See also - -- [AppLocker deployment guide](applocker-policies-deployment-guide.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker.md index e976eb85b8..256c416dbf 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker.md @@ -1,68 +1,31 @@ --- title: What Is AppLocker -description: This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. +description: This article for the IT professional describes what AppLocker is. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 09/21/2017 +ms.date: 12/23/2023 --- # What Is AppLocker? ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). +This article for the IT professional describes what AppLocker is. -This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. +Windows includes two technologies that can be used for application control, depending on your organization's specific scenarios and requirements: Windows Defender Application Control (WDAC) and AppLocker. For information to help you choose when to use WDAC or AppLocker, see [WDAC and AppLocker overview](/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview). -AppLocker advances the app control features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to allow or deny apps from running based on unique identities of files and to specify which users or groups can run those apps. +AppLocker helps you create rules to allow or deny apps from running based on information about the apps' files. You can also use AppLocker to control which users or groups can run those apps. Using AppLocker, you can: -- Control the following types of apps: executable files (.exe and .com), scripts (.js, .ps1, .vbs, .cmd, and .bat), Windows Installer files (.mst, .msi and .msp), and DLL files (.dll and .ocx), and packaged apps and packaged app installers (appx). -- Define rules based on file attributes derived from the digital signature, including the publisher, product name, file name, and file version. For example, you can create rules based on the publisher attribute that is persistent through updates, or you can create rules for a specific version of a file. -- Assign a rule to a security group or an individual user. -- Create exceptions to rules. For example, you can create a rule that allows all Windows processes to run except Registry Editor (Regedit.exe). -- Use audit-only mode to deploy the policy and understand its impact before enforcing it. -- Import and export rules. The import and export affects the entire policy. For example, if you export a policy, all of the rules from all of the rule collections are exported, including the enforcement settings for the rule collections. If you import a policy, all criteria in the existing policy are overwritten. -- Streamline creating and managing AppLocker rules by using Windows PowerShell cmdlets. - -AppLocker helps reduce administrative overhead and helps reduce the organization's cost of managing computing resources by decreasing the number of help desk calls that result from users running unapproved apps +- Control the following types of apps and files: executable files (.exe and .com), scripts (.js, .ps1, .vbs, .cmd, and .bat), Windows Installer files (.mst, .msi and .msp), and DLL files (.dll and .ocx), and packaged apps and packaged app installers (appx). +- Define rules based on file attributes derived from the digital signature, including the publisher, product name, file name, and file version. For example, you can create rules based on the publisher attribute that is persistent through updates, or you can create rules for a specific version of a file. +- Assign a rule to a security group or an individual user. +- Create exceptions to rules. For example, you can create a rule that allows all Windows processes to run except Registry Editor (Regedit.exe). +- Use audit-only mode to deploy the policy and understand its effect before enforcing it. +- Import and export rules. The import and export affects the entire policy. For example, if you export a policy, all of the rules from all of the rule collections are exported, including the enforcement settings for the rule collections. If you import a policy, all criteria in the existing policy are overwritten. +- Streamline creating and managing AppLocker rules by using Windows PowerShell cmdlets. For information about the application control scenarios that AppLocker addresses, see [AppLocker policy use scenarios](applocker-policy-use-scenarios.md). -## What features are different between Software Restriction Policies and AppLocker? - -**Feature differences** - -The following table compares AppLocker to Software Restriction Policies. - -|Feature|Software Restriction Policies|AppLocker| -|--- |--- |--- | -|Rule scope|All users|Specific user or group| -|Rule conditions provided|File hash, path, certificate, registry path, and Internet zone|File hash, path, and publisher| -|Rule types provided|Defined by the security levels:
  • Disallowed
  • Basic User
  • Unrestricted|Allow and deny| -|Default rule action|Unrestricted|Implicit deny| -|Audit-only mode|No|Yes| -|Wizard to create multiple rules at one time|No|Yes| -|Policy import or export|No|Yes| -|Rule collection|No|Yes| -|Windows PowerShell support|No|Yes| -|Custom error messages|No|Yes| - -Application control function differences - -The following table compares the application control functions of Software Restriction Policies (SRP) and AppLocker. - -|Application control function|SRP|AppLocker| -|--- |--- |--- | -|Operating system scope|SRP policies can be applied to all Windows operating systems beginning with Windows XP and Windows Server 2003.|AppLocker policies apply only to those supported operating system versions and editions listed in [Requirements to use AppLocker](requirements-to-use-applocker.md). But these systems can also use SRP.
    **Note:** Use different GPOs for SRP and AppLocker rules.
    | -|User support|SRP allows users to install applications as an administrator.|AppLocker policies are maintained through Group Policy, and only the administrator of the device can update an AppLocker policy.

    AppLocker permits customization of error messages to direct users to a Web page for help.| -|Policy maintenance|SRP policies are updated by using the Local Security Policy snap-in or the Group Policy Management Console (GPMC).|AppLocker policies are updated by using the Local Security Policy snap-in or the GPMC.

    AppLocker supports a small set of PowerShell cmdlets to aid in administration and maintenance.| -|Policy management infrastructure|To manage SRP policies, SRP uses Group Policy within a domain and the Local Security Policy snap-in for a local computer.|To manage AppLocker policies, AppLocker uses Group Policy within a domain and the Local Security Policy snap-in for a local computer.| -|Block malicious scripts|Rules for blocking malicious scripts prevent all scripts associated with the Windows Script Host from running, except those scripts that are digitally signed by your organization.|AppLocker rules can control the following file formats: .ps1, .bat, .cmd, .vbs, and .js. In addition, you can set exceptions to allow specific files to run.| -|Manage software installation|SRP can prevent all Windows Installer packages from installing. It allows .msi files that are digitally signed by your organization to be installed.|The Windows Installer rule collection is a set of rules created for Windows Installer file types (.mst, .msi and .msp) to allow you to control the installation of files on client computers and servers.| -|Manage all software on the computer|All software is managed in one rule set. By default, the policy for managing all software on a device disallows all software on the user's device, except software that is installed in the Windows folder, Program Files folder, or subfolders.|Unlike SRP, each AppLocker rule collection functions as an allowed list of files. Only the files that are listed within the rule collection will be allowed to run. This configuration makes it easier for administrators to determine what will occur when an AppLocker rule is applied.| -|Different policies for different users|Rules are applied uniformly to all users on a particular device.|On a device that is shared by multiple users, an administrator can specify the groups of users who can access the installed software. An administrator uses AppLocker to specify the user to whom a specific rule should apply.| - -## Related topics +## Related articles - [AppLocker technical reference](applocker-technical-reference.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md index 9f51d9f474..e64e6e97ff 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md @@ -1,32 +1,29 @@ --- title: Windows Installer rules in AppLocker -description: This topic describes the file formats and available default rules for the Windows Installer rule collection. +description: This article describes the file formats and available default rules for the Windows Installer rule collection. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 09/21/2017 +ms.date: 12/24/2023 --- # Windows Installer rules in AppLocker ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). - -This topic describes the file formats and available default rules for the Windows Installer rule collection. +This article describes the file formats and available default rules for the Windows Installer rule collection. AppLocker defines Windows Installer rules to include only the following file formats: -- .msi -- .msp -- .mst +- .msi +- .msp +- .mst The purpose of this collection is to allow you to control the installation of files on client computers and servers through Group Policy or the Local Security Policy snap-in. The following table lists the default rules that are available for the Windows Installer rule collection. | Purpose | Name | User | Rule condition type | -| - | - | - | - | -| Allow members of the local Administrators group to run all Windows Installer files| (Default Rule) All Windows Installer files| BUILTIN\Administrators| Path: *| -| Allow all users to run Windows Installer files that are digitally signed | (Default Rule) All digitally signed Windows Installer files| Everyone| Publisher: * (all signed files)| -| Allow all users to run Windows Installer files that are located in the Windows Installer folder | (Default Rule) All Windows Installer files in %systemdrive%\Windows\Installer| Everyone| Path: %windir%\Installer\*| - -## Related topics +| --- | --- | --- | --- | +| Allow members of the local Administrators group to run all Windows Installer files| (Default Rule) All Windows Installer files| BUILTIN\Administrators| Path: *| +| Allow all users to run Windows Installer files that are digitally signed | (Default Rule) All digitally signed Windows Installer files| Everyone| Publisher: * (all signed files)| +| Allow all users to run Windows Installer files that are located in the Windows Installer folder | (Default Rule) All Windows Installer files in %systemdrive%\Windows\Installer| Everyone| Path: %windir%\Installer\*| + +## Related articles - [Understanding AppLocker default rules](understanding-applocker-default-rules.md) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-policies.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-policies.md index 0f287537b8..189d8f1654 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-policies.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-policies.md @@ -1,32 +1,29 @@ --- title: Working with AppLocker policies -description: This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies. +description: This article for IT professionals provides links to procedural articles about creating, maintaining, and testing AppLocker policies. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 09/21/2017 +ms.date: 12/21/2023 --- # Working with AppLocker policies ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). - -This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies. +This article for IT professionals provides links to procedural articles about creating, maintaining, and testing AppLocker policies. ## In this section -| Topic | Description | +| Article | Description | | - | - | -| [Configure the Application Identity service](configure-the-application-identity-service.md) | This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually.| -| [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) | This topic for IT professionals describes how to set AppLocker policies to **Audit only** within your IT environment by using AppLocker.| -| [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md) | This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting.| -| [Display a custom URL message when users try to run a blocked app](display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md) | This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app.| -| [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md) | This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified.| -| [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) | This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing.| -| [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md) | This topic for IT professionals describes how to import an AppLocker policy.| -| [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md) | This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO).| -| [Add rules for packaged apps to existing AppLocker rule-set](add-rules-for-packaged-apps-to-existing-applocker-rule-set.md) | This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT).| -| [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md) | This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell.| -| [Merge AppLocker policies manually](merge-applocker-policies-manually.md) | This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO).| -| [Refresh an AppLocker policy](refresh-an-applocker-policy.md) | This topic for IT professionals describes the steps to force an update for an AppLocker policy.| -| [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md) | This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer.| +| [Configure the Application Identity service](configure-the-application-identity-service.md) | This article for IT professionals shows how to configure the Application Identity service to start automatically or manually. | +| [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) | This article for IT professionals describes how to set AppLocker policies to **Audit only** within your IT environment by using AppLocker. | +| [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md) | This article for IT professionals describes the steps to enable the AppLocker policy enforcement setting. | +| [Display a custom URL message when users try to run a blocked app](display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md) | This article for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app. | +| [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md) | This article for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified. | +| [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md) | This article for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing. | +| [Import an AppLocker policy from another computer](import-an-applocker-policy-from-another-computer.md) | This article for IT professionals describes how to import an AppLocker policy. | +| [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md) | This article for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO). | +| [Add rules for packaged apps to existing AppLocker rule-set](add-rules-for-packaged-apps-to-existing-applocker-rule-set.md) | This article for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT). | +| [Merge AppLocker policies by using Set-ApplockerPolicy](merge-applocker-policies-by-using-set-applockerpolicy.md) | This article for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell. | +| [Merge AppLocker policies manually](merge-applocker-policies-manually.md) | This article for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO). | +| [Refresh an AppLocker policy](refresh-an-applocker-policy.md) | This article for IT professionals describes the steps to force an update for an AppLocker policy. | +| [Test an AppLocker policy by using Test-AppLockerPolicy](test-an-applocker-policy-by-using-test-applockerpolicy.md) | This article for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer.| diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-rules.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-rules.md index 57c5eaa7cd..e06ef57ede 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-rules.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/working-with-applocker-rules.md @@ -1,104 +1,92 @@ --- title: Working with AppLocker rules -description: This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies. +description: This article for IT professionals describes AppLocker rule types and how to work with them for your application control policies. ms.localizationpriority: medium -msauthor: v-anbic -ms.date: 08/27/2018 +msauthor: jsuther +ms.date: 12/21/2023 ms.topic: conceptual --- # Working with AppLocker rules ->[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). +This article for IT professionals describes AppLocker rule types and how to work with them for your application control policies. -This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies. - -## In this section - -| Topic | Description | -| - | - | -| [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) | This topic for IT professionals shows how to create an AppLocker rule with a file hash condition.| -| [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) | This topic for IT professionals shows how to create an AppLocker rule with a path condition.| -| [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) | This topic for IT professionals shows how to create an AppLocker rule with a publisher condition.| -| [Create AppLocker default rules](create-applocker-default-rules.md) | This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run.| -| [Add exceptions for an AppLocker rule](configure-exceptions-for-an-applocker-rule.md) | This topic for IT professionals describes the steps to specify which apps can or can't run as exceptions to an AppLocker rule.| -| [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md) | This topic for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition.| -| [Delete an AppLocker rule](delete-an-applocker-rule.md) | This topic for IT professionals describes the steps to delete an AppLocker rule.| -| [Edit AppLocker rules](edit-applocker-rules.md) | This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker.| -| [Enable the DLL rule collection](enable-the-dll-rule-collection.md) | This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker.| -| [Enforce AppLocker rules](enforce-applocker-rules.md) | This topic for IT professionals describes how to enforce application control rules by using AppLocker.| -| [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md) | This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device.| - -The three AppLocker enforcement modes are described in the following table. The enforcement mode setting defined here can be overwritten by the setting derived from a linked Group Policy Object (GPO) with a higher precedence. - -| Enforcement mode | Description | -| - | - | -| **Not configured** | This is the default setting, which means that the rules defined here will be enforced unless a linked GPO with a higher precedence has a different value for this setting.| -| **Enforce rules** | Rules are enforced.| -| **Audit only** | Rules are audited but not enforced. When a user runs an app that is affected by an AppLocker rule, the app is allowed to run and the info about the app is added to the AppLocker event log. The Audit-only enforcement mode helps you determine which apps will be affected by the policy before the policy is enforced. When the AppLocker policy for a rule collection is set to **Audit only**, rules for that rule collection aren't enforced| - -When AppLocker policies from various GPOs are merged, the rules from all the GPOs are merged, and the enforcement mode setting of the winning GPO is applied. ## Rule collections -The AppLocker console is organized into rule collections, which are executable files, scripts, Windows Installer files, packaged apps and packaged app installers, and DLL files. These collections give you an easy way to differentiate the rules for different types of apps. The following table lists the file formats that are included in each rule collection. +AppLocker policies are organized into rule collections, including executable files, scripts, Windows Installer files, packaged apps and packaged app installers, and DLL files. These collections give you an easy way to differentiate the rules for different types of apps. The following table lists the file formats that are included in each rule collection. | Rule collection | Associated file formats | | - | - | -| Executable files | .exe
    .com| -| Scripts| .ps1
    .bat
    .cmd
    .vbs
    .js| -| Windows Installer files | .msi
    .msp
    .mst| -| Packaged apps and packaged app installers | .appx| -| DLL files | .dll
    .ocx| - ->**Important:** If you use DLL rules, you need to create an allow rule for each DLL that is used by all of the allowed apps. +| Executable files | .exe
    .com | +| Scripts| .ps1
    .bat
    .cmd
    .vbs
    .js | +| Windows Installer files | .msi
    .msp
    .mst | +| Packaged apps and packaged app installers | .appx | +| DLL files | .dll
    .ocx | -When DLL rules are used, AppLocker must check each DLL that an application loads. Therefore, users may experience a reduction in performance if DLL rules are used. +> [!NOTE] +> AppLocker rules for executable files actually apply to all portable executable (PE) files, regardless of the file's extension which attackers can easily change. The file extension information listed in the preceding table for executable files is illustrative only. -The DLL rule collection isn't enabled by default. To learn how to enable the DLL rule collection, see [DLL rule collections](#bkmk-dllrulecollections). +The DLL rule collection isn't enabled by default. To learn how to enable the DLL rule collection, see [DLL rule collections](#dll-rule-collection). + +> [!Important] +> If you use DLL rules, you need to create an allow rule that covers every DLL used by all allowed apps. +> +> When DLL rules are used, AppLocker must check each DLL that an application loads. Therefore, users may experience a reduction in performance if DLL rules are used. However, this performance impact is usually imperceptible unless a device is already resource constrained. + +## Enforcement modes + +AppLocker policies set an **enforcement mode** for each rule collection included in the policy. These enforcement modes are described in the following table. + +| Enforcement mode | Description | +| --- | --- | +| **Not configured** | Despite the name, this enforcement mode **doesn't** mean the rules are ignored. On the contrary, if any rules exist in a rule collection that is "not configured", the rules **will be enforced** unless a policy with a higher precedence changes the enforcement mode to Audit only. Since this enforcement mode can be confusing for policy authors, you should avoid using this value in your AppLocker policies. Instead, you should choose explicitly between the remaining two options. | +| **Enforce rules** | Rules are enforced. When a user runs an app affected by an AppLocker rule, the app binary is blocked. Info about the binary is added to the AppLocker event log. | +| **Audit only** | Rules are audited but not enforced. When a user runs an app affected by an AppLocker rule, the app binary is allowed to run. However, the info about the binary is added to the AppLocker event log. The Audit-only enforcement mode helps you identify the apps affected by the policy before the policy is enforced. | + +When AppLocker policies are merged, the rules from all the policies are added to the effective policy and a single enforcement mode is selected for each rule collection. If multiple AppLocker policies are applied to a device through Group Policy, the enforcement mode setting applied is selected based on Group Policy precedence. If you apply an AppLocker policy locally using the Set-AppLockerPolicy PowerShell cmdlet with the *-merge* option, the more restrictive enforcement mode is chosen between the existing local policy and the policy being merged. -EXE rules apply to portable executable (PE) files. AppLocker checks whether a file is a valid PE file, rather than just applying rules based on file extension, which attackers can easily change. Regardless of the file extension, the AppLocker EXE rule collection will work on a file as long as it's a valid PE file. - ## Rule conditions Rule conditions are criteria that help AppLocker identify the apps to which the rule applies. The three primary rule conditions are publisher, path, and file hash. -- [Publisher](#bkmk-publisher): Identifies an app based on its digital signature -- [Path](#bkmk-path): Identifies an app by its location in the file system of the computer or on the network -- [File hash](#bkmk-filehash): Represents the system computed cryptographic hash of the identified file +- [Publisher](#publisher): Identifies an app based on its digital signature +- [Path](#path): Identifies an app by its location in the file system of the computer or on the network +- [File hash](#file-hash): Represents the system computed cryptographic Authenticode hash of the identified file -### Publisher +### Publisher -This condition identifies an app based on its digital signature and extended attributes when available. The digital signature contains info about the company that created the app (the publisher). Executable files, dlls, Windows installers, packaged apps and packaged app installers also have extended attributes, which are obtained from the binary resource. If there's executable files, dlls and Windows installers, these attributes contain the name of the product that the file is a part of, the original name of the file as supplied by the publisher, and the version number of the file. If there are packaged apps and packaged app installers, these extended attributes contain the name and the version of the app package. +This condition identifies an app based on its digital signature and extended attributes when available. The digital signature contains info about the company that created the app (the publisher). Executable files, dlls, Windows installers, packaged apps and packaged app installers also include extended attributes, which are obtained from the binary resource. These attributes often include the name of the product, the original file name, and the version number of the file as defined by the publisher. If there are packaged apps and packaged app installers, these extended attributes contain the name and the version of the app package. + +> [!NOTE] +> Rules created in the packaged apps and packaged app installers rule collection can only have publisher conditions since Windows does not support unsigned packaged apps and packaged app installers. +> +> Use a publisher rule condition when possible because they are more resilient to app updates as well as a change in the location of files. -> **Note:** Rules created in the packaged apps and packaged app installers rule collection can only have publisher conditions since Windows does not support unsigned packaged apps and packaged app installers. -> -> **Note:** Use a publisher rule condition when possible because they can survive app updates as well as a change in the location of files. - When you select a reference file for a publisher condition, the wizard creates a rule that specifies the publisher, product, file name, and version number. You can make the rule more generic by moving up the slider or by using a wildcard character (\*) in the product, file name, or version number fields. ->**Note:** To enter custom values for any of the fields of a publisher rule condition in the Create Rules Wizard, you must select the **Use custom values** check box. When this check box is selected, you cannot use the slider. - +> [!NOTE] +> To enter custom values for any of the fields of a publisher rule condition in the Create Rules Wizard, you must select the **Use custom values** check box. When this check box is selected, you cannot use the slider. + The **File version** and **Package version** control whether a user can run a specific version, earlier versions, or later versions of the app. You can choose a version number and then configure the following options: -- **Exactly.** The rule applies only to this version of the app -- **And above.** The rule applies to this version and all later versions. -- **And below.** The rule applies to this version and all earlier versions. +- **Exactly.** The rule applies only to this version of the app +- **And above.** The rule applies to this version and all later versions. +- **And below.** The rule applies to this version and all earlier versions. The following table describes how a publisher condition is applied. | Option | The publisher condition allows or denies... | -|---|---| -| **All signed files** | All files that are signed by any publisher.| -| **Publisher only**| All files that are signed by the named publisher.| -| **Publisher and product name**| All files for the specified product that are signed by the named publisher.| -| **Publisher and product name, and file name**| Any version of the named file or package for the named product that is signed by the publisher.| -| **Publisher, product name, file name, and file version**| **Exactly**
    The specified version of the named file or package for the named product that is signed by the publisher.| -| **Publisher, product name, file name, and file version**| **And above**
    The specified version of the named file or package and any new releases for the product that are signed by the publisher.| -| **Publisher, product name, file name, and file version**| **And below**
    The specified version of the named file or package and any earlier versions for the product that are signed by the publisher.| -| **Custom**| You can edit the **Publisher**, **Product name**, **File name**, **Version** **Package name**, and **Package version** fields to create a custom rule.| +| --- | --- | +| **All signed files** | All files signed by any publisher. | +| **Publisher only** | All files signed by the named publisher. | +| **Publisher and product name** | All files for the specified product signed by the named publisher. | +| **Publisher and product name, and file name** | Any version of the named file or package for the named product signed by the publisher. | +| **Publisher, product name, file name, and file version** | **Exactly**
    The specified version of the named file or package for the named product signed by the publisher. | +| **Publisher, product name, file name, and file version** | **And above**
    The specified version of the named file or package and any new releases for the product signed by the publisher. | +| **Publisher, product name, file name, and file version** | **And below**
    The specified version of the named file or package and any earlier versions for the product signed by the publisher. | +| **Custom** | You can edit the **Publisher**, **Product name**, **File name**, **Version** **Package name**, and **Package version** fields to create a custom rule. | -### Path +### Path This rule condition identifies an application by its location in the file system of the computer or on the network. @@ -107,106 +95,116 @@ AppLocker uses custom path variables for well-known paths, such as Program Files The following table details these path variables. | Windows directory or disk | AppLocker path variable | Windows environment variable | -| - | - | - | -| Windows| %WINDIR%| %SystemRoot%| -| System32 and SysWOW64| %SYSTEM32%| %SystemDirectory%| -| Windows installation directory| %OSDRIVE%| %SystemDrive%| -| Program Files| %PROGRAMFILES%| %ProgramFiles% and %ProgramFiles(x86)% | -| Removable media (for example, a CD or DVD)| %REMOVABLE%| | -| Removable storage device (for example, a USB flash drive)| %HOT% | | - ->**Important:** Because a path rule condition can be configured to include a large number of folders and files, path conditions should be carefully planned. For example, if an allow rule with a path condition includes a folder location that non-administrators are allowed to write data into, a user can copy unapproved files into that location and run the files. For this reason, it is a best practice to not create path conditions for standard user writable locations, such as a user profile. - -### File hash +| --- | --- | --- | +| Windows | %WINDIR%| %SystemRoot%| +| System32 and SysWOW64 | %SYSTEM32%| %SystemDirectory%| +| Windows installation directory | %OSDRIVE%| %SystemDrive%| +| Program Files | %PROGRAMFILES% | %ProgramFiles% and %ProgramFiles(x86)% | +| Removable media (for example, a CD or DVD) | %REMOVABLE% | | +| Removable storage device (for example, a USB flash drive) | %HOT% | | -When you choose the file hash rule condition, the system computes a cryptographic hash of the identified file. The advantage of this rule condition is that because each file has a unique hash, a file hash rule condition applies to only one file. The disadvantage is that each time the file is updated (such as a security update or upgrade) the file's hash will change. As a result, you must manually update file hash rules. +> [!IMPORTANT] +> Because a path rule condition can be configured to include a large number of folders and files, path conditions should be carefully planned. For example, if a path rule includes a folder location that lets non-administrators write data, a user (or malware running as a standard user) can copy unapproved files into that location and run the files. For this reason, you should avoid creating path conditions for standard user writable locations, such as a user profile. + +### File hash + +When you choose the file hash rule condition, the system computes the Authenticode cryptographic hash of the identified file. The advantage of this rule condition is that because each file has a unique hash, a file hash rule condition applies to only one file. The disadvantage is that each time the file is updated (such as a security update or upgrade) the file's hash changes. As a result, you must manually update file hash rules. ## AppLocker default rules -AppLocker includes default rules, which are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. For background, see [Understanding AppLocker default rules](understanding-applocker-default-rules.md), and for steps, see [Create AppLocker default rules](create-applocker-default-rules.md). +AppLocker policies created using the AppLocker Group Policy editor can include default rules. Default rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection. For background, see [Understanding AppLocker default rules](understanding-applocker-default-rules.md), and for steps, see [Create AppLocker default rules](create-applocker-default-rules.md). Executable default rule types include: -- Allow members of the local **Administrators** group to run all apps. -- Allow members of the **Everyone** group to run apps that are located in the Windows folder. -- Allow members of the **Everyone** group to run apps that are located in the Program Files folder. +- Allow members of the local **Administrators** group to run all apps. +- Allow members of the **Everyone** group to run apps that are located in the Windows folder. +- Allow members of the **Everyone** group to run apps that are located in the Program Files folder. Script default rule types include: -- Allow members of the local **Administrators** group to run all scripts. -- Allow members of the **Everyone** group to run scripts that are located in the Program Files folder. -- Allow members of the **Everyone** group to run scripts that are located in the Windows folder. +- Allow members of the local **Administrators** group to run all scripts. +- Allow members of the **Everyone** group to run scripts that are located in the Program Files folder. +- Allow members of the **Everyone** group to run scripts that are located in the Windows folder. Windows Installer default rule types include: -- Allow members of the local **Administrators** group to run all Windows Installer files. -- Allow members of the **Everyone** group to run all digitally signed Windows Installer files. -- Allow members of the **Everyone** group to run all Windows Installer files that are located in the Windows\\Installer folder. +- Allow members of the local **Administrators** group to run all Windows Installer files. +- Allow members of the **Everyone** group to run all digitally signed Windows Installer files. +- Allow members of the **Everyone** group to run all Windows Installer files that are located in the Windows\\Installer folder. DLL default rule types: -- Allow members of the local **Administrators** group to run all DLLs. -- Allow members of the **Everyone** group to run DLLs that are located in the Program Files folder. -- Allow members of the **Everyone** group to run DLLs that are located in the Windows folder. +- Allow members of the local **Administrators** group to run all DLLs. +- Allow members of the **Everyone** group to run DLLs that are located in the Program Files folder. +- Allow members of the **Everyone** group to run DLLs that are located in the Windows folder. Packaged apps default rule types: -- Allow members of the **Everyone** group to install and run all signed packaged apps and packaged app installers. +- Allow members of the **Everyone** group to install and run all signed packaged apps and packaged app installers. ## AppLocker rule behavior -If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For example, if you create an executable rule that allows .exe files in *%SystemDrive%\\FilePath* to run, only executable files located in that path are allowed to run. +If no AppLocker rules are defined for a specific rule collection, all files covered by that rule collection are allowed to run. However, if any rule exists for a specific rule collection, then *only* those files matching at least one allow rule and not matching any deny rules run. For example, if you create an executable rule that allows .exe files in *%SystemDrive%\\FilePath* to run, only executable files located in that path are allowed to run. A rule can be configured to use allow or deny actions: -- **Allow.** You can specify which files are allowed to run in your environment, and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. -- **Deny.** You can specify which files are *not* allowed to run in your environment, and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. +- **Allow.** You can specify which files are allowed to run in your environment, and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. +- **Deny.** You can specify which files *aren't* allowed to run in your environment, and for which users or groups of users. You can also configure exceptions to identify files that are excluded from the rule. + +For a best practice, use allow actions with exceptions. Although you can use a combination of allow and deny actions, deny actions always win. You can't use any other rule to allow a file that matches a deny rule. -> **Important:** For a best practice, use allow actions with exceptions. You can use a combination of allow and deny actions but understand that deny actions override allow actions in all cases, and can be circumvented. -> -> **Important:** If you join a computer running at least Windows Server 2012 or Windows 8 to a domain that already enforces AppLocker rules for executable files, users will not be able to run any packaged apps unless you also create rules for packaged apps. If you want to allow any packaged apps in your environment while continuing to control executable files, you should create the default rules for packaged apps and set the enforcement mode to Audit-only for the packaged apps rule collection. - ## Rule exceptions -You can apply AppLocker rules to individual users or to a group of users. If you apply a rule to a group of users, all users in that group are affected by that rule. If you need to allow a subset of a user group to use an app, you can create a special rule for that subset. For example, the rule "Allow everyone to run Windows except Registry Editor" allows everyone in the organization to run the Windows operating system, but it doesn't allow anyone to run Registry Editor. +You can apply AppLocker rules to individual users or to a group of users. If you apply a rule to a group of users, the rule affects all users in that group. If you need to allow a subset of a user group to use an app, you can create a special rule for that subset. For example, the rule "Allow everyone to run Windows except Registry Editor" allows everyone in the organization to run the Windows operating system, but it doesn't allow anyone to run Registry Editor. -The effect of this rule would prevent users such as Help Desk personnel from running a program that is necessary for their support tasks. To resolve this problem, create a second rule that applies to the Help Desk user group: "Allow Help Desk to run Registry Editor." If you create a deny rule that doesn't allow any users to run Registry Editor, the deny rule will override the second rule that allows the Help Desk user group to run Registry Editor. +The effect of this rule would prevent users such as Help Desk personnel from running a program that is necessary for their support tasks. To resolve this problem, create a second rule that applies to the Help Desk user group: "Allow Help Desk to run Registry Editor." If you instead used a deny rule that blocks all users from running Registry Editor, the second rule wouldn't actually let the help desk users run Registry Editor. -## DLL rule collection +## DLL rule collection Because the DLL rule collection isn't enabled by default, you must perform the following procedure before you can create and enforce DLL rules. Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. -**To enable the DLL rule collection** +### To enable the DLL rule collection -1. Click **Start**, type **secpol.msc**, and then press ENTER. -2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. -3. In the console tree, double-click **Application Control Policies**, right-click **AppLocker**, and then click **Properties**. -4. Click the **Advanced** tab, select the **Enable the DLL rule collection** check box, and then click **OK**. +1. Select **Start**, type **secpol.msc**, and then select ENTER. +2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. +3. In the console tree, double-click **Application Control Policies**, right-click **AppLocker**, and then select **Properties**. +4. Select the **Advanced** tab, select the **Enable the DLL rule collection** check box, and then select **OK**. + + > [!IMPORTANT] + > Before you enforce DLL rules, make sure that there are allow rules for every DLL that is needed by all allowed apps. - >**Important:** Before you enforce DLL rules, make sure that there are allow rules for each DLL that is used by any of the allowed apps. - ## AppLocker wizards You can create rules by using two AppLocker wizards: -1. The Create Rules Wizard enables you to create one rule at a time. -2. The Automatically Generate Rules Wizard allows you to create multiple rules at one time. You can either select a folder and let the wizard create rules for the relevant files within that folder or if there are packaged apps let the wizard create rules for all packaged apps installed on the computer. You can also specify the user or group to which to apply the rules. This wizard automatically generates allow rules only. +1. The Create Rules Wizard enables you to create one rule at a time. +2. The Automatically Generate Rules Wizard allows you to create multiple rules at one time. You can select a folder and let the wizard create rules for any relevant files found. Or, for packaged apps, let the wizard create rules for all packaged apps installed on the computer. You can also specify the user or group to which to apply the rules. This wizard automatically generates allow rules only. ## Other considerations -- By default, AppLocker rules don't allow users to open or run any files that aren't allowed. Administrators should maintain an up-to-date list of allowed applications. -- There are two types of AppLocker conditions that don't persist following an update of an app: +- By default, AppLocker rules don't allow users to open or run any files that aren't allowed. Administrators should maintain an up-to-date list of allowed applications. +- There are two types of AppLocker conditions that don't persist following an update of an app: + - **A file hash condition** File hash rule conditions can be used with any app because a cryptographic hash value of the app file is generated at the time the rule is created. However, the hash value is specific to that exact version of the file. If you need to allow multiple versions of the file, you need individual file hash conditions for each version of the file. + - **A publisher condition with a specific product version set** If you create a publisher rule condition that uses the **Exactly** version option, the rule can't persist if a new version of the app is installed. A new publisher condition must be created, or the version must be edited in the rule to be made less specific. +- If an app isn't digitally signed, you can't use a publisher rule condition for that app. +- If any rules are enforced for the EXE rule collection, you must create rules in the packaged apps and packaged app installers rule collection. Otherwise, all packaged apps and packaged app installers are blocked. +- A custom configured URL can be included in the message that is displayed when an app is blocked. +- Expect an increase in the number of Help Desk calls when users encounter apps that aren't allowed. - - **A file hash condition** File hash rule conditions can be used with any app because a cryptographic hash value of the app is generated at the time the rule is created. However, the hash value is specific to that exact version of the app. If there are several versions of the application in use within the organization, you need to create file hash conditions for each version in use and for any new versions that are released. +## In this section - - **A publisher condition with a specific product version set** If you create a publisher rule condition that uses the **Exactly** version option, the rule can't persist if a new version of the app is installed. A new publisher condition must be created, or the version must be edited in the rule to be made less specific. - -- If an app isn't digitally signed, you can't use a publisher rule condition for that app. -- AppLocker rules can't be used to manage computers running a Windows operating system earlier than Windows Server 2008 R2 or Windows 7. Software Restriction Policies must be used instead. If AppLocker rules are defined in a Group Policy Object (GPO), only those rules are applied. To ensure interoperability between Software Restriction Policies rules and AppLocker rules, define Software Restriction Policies rules and AppLocker rules in different GPOs. -- The packaged apps and packaged apps installer rule collection is available on devices running at least Windows Server 2012 and Windows 8. -- When the rules for the executable rule collection are enforced and the packaged apps and packaged app installers rule collection doesn't contain any rules, no packaged apps and packaged app installers are allowed to run. In order to allow any packaged apps and packaged app installers, you must create rules for the packaged apps and packaged app installers rule collection. -- When an AppLocker rule collection is set to **Audit only**, the rules aren't enforced. When a user runs an application that is included in the rule, the app is opened and runs normally, and information about that app is added to the AppLocker event log. -- A custom configured URL can be included in the message that is displayed when an app is blocked. -- Expect an increase in the number of Help Desk calls initially because of blocked apps until users understand that they can't run apps that aren't allowed. +| Article | Description | +| - | - | +| [Create a rule that uses a file hash condition](create-a-rule-that-uses-a-file-hash-condition.md) | This article for IT professionals shows how to create an AppLocker rule with a file hash condition.| +| [Create a rule that uses a path condition](create-a-rule-that-uses-a-path-condition.md) | This article for IT professionals shows how to create an AppLocker rule with a path condition.| +| [Create a rule that uses a publisher condition](create-a-rule-that-uses-a-publisher-condition.md) | This article for IT professionals shows how to create an AppLocker rule with a publisher condition.| +| [Create AppLocker default rules](create-applocker-default-rules.md) | This article for IT professionals describes the steps to create a standard set of AppLocker rules that allow Windows system files to run.| +| [Add exceptions for an AppLocker rule](configure-exceptions-for-an-applocker-rule.md) | This article for IT professionals describes the steps to specify which apps can or can't run as exceptions to an AppLocker rule.| +| [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md) | This article for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition.| +| [Delete an AppLocker rule](delete-an-applocker-rule.md) | This article for IT professionals describes the steps to delete an AppLocker rule.| +| [Edit AppLocker rules](edit-applocker-rules.md) | This article for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker.| +| [Enable the DLL rule collection](enable-the-dll-rule-collection.md) | This article for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker.| +| [Enforce AppLocker rules](enforce-applocker-rules.md) | This article for IT professionals describes how to enforce application control rules by using AppLocker.| +| [Run the Automatically Generate Rules wizard](run-the-automatically-generate-rules-wizard.md) | This article for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device.| diff --git a/windows/security/application-security/application-control/windows-defender-application-control/feature-availability.md b/windows/security/application-security/application-control/windows-defender-application-control/feature-availability.md index 4797a379d3..c029680d19 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/feature-availability.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/feature-availability.md @@ -2,29 +2,29 @@ title: Windows Defender Application Control feature availability description: Compare Windows Defender Application Control (WDAC) and AppLocker feature availability. ms.localizationpriority: medium -ms.date: 05/26/2023 +ms.date: 12/21/2023 ms.topic: overview --- # Windows Defender Application Control and AppLocker feature availability > [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. See below to learn more. +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Review the following table to learn more. | Capability | Windows Defender Application Control | AppLocker | |-------------|------|-------------| | Platform support | Available on Windows 10, Windows 11, and Windows Server 2016 or later. | Available on Windows 8 or later. | -| SKU availability | Available on Windows 10, Windows 11, and Windows Server 2016 or later.
    WDAC PowerShell cmdlets aren't available on Home edition, but policies are effective on all editions. | Policies are supported on all editions Windows 10 version 2004 and newer with [KB 5024351](https://support.microsoft.com/help/5024351).

    Windows versions older than version 2004, including Windows Server 2019:

    • Policies deployed through GP are only supported on Enterprise and Server editions.
    • Policies deployed through MDM are supported on all editions.
    | +| Edition availability | Available on Windows 10, Windows 11, and Windows Server 2016 or later.
    WDAC PowerShell cmdlets aren't available on Home edition, but policies are effective on all editions. | Policies are supported on all editions Windows 10 version 2004 and newer with [KB 5024351](https://support.microsoft.com/help/5024351).

    Windows versions older than version 2004, including Windows Server 2019:
    • Policies deployed through GP are only supported on Enterprise and Server editions.
    • Policies deployed through MDM are supported on all editions.
    | | Management solutions |
    • [Intune](deployment/deploy-wdac-policies-using-intune.md)
    • [Microsoft Configuration Manager](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) (limited built-in policies or custom policy deployment via software distribution)
    • [Group policy](deployment/deploy-wdac-policies-using-group-policy.md)
    • [Script](/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script)
    |
    • [Intune](/windows/client-management/mdm/applocker-csp) (custom policy deployment via OMA-URI only)
    • Configuration Manager (custom policy deployment via software distribution only)
    • [Group Policy](applocker/determine-group-policy-structure-and-rule-enforcement.md)
    • PowerShell
      • | -| Per-User and Per-User group rules | Not available (policies are device-wide). | Available on Windows 8+. | +| Per-user and Per-user group rules | Not available (policies are device-wide). | Available on Windows 8+. | | Kernel mode policies | Available on Windows 10, Windows 11, and Windows Server 2016 or later. | Not available. | -| [Rule option 11 - Disabled:Script Enforcement](/windows/security/threat-protection/windows-defender-application-control/design/script-enforcement) | Available on all versions of Windows 10 except 1607 LTSB, Windows 11, and Windows Server 2019 and above. **Disabled:Script Enforcement** is not supported on **Windows Server 2016** or on **Windows 10 1607 LTSB** and should not be used on those platforms. Doing so will result in unexpected script enforcement behaviors. | MSI and Script rule collection is separately configurable. | +| [Rule option 11 - Disabled:Script Enforcement](/windows/security/threat-protection/windows-defender-application-control/design/script-enforcement) | Available on all versions of Windows 10 except 1607 LTSB, Windows 11, and Windows Server 2019 and above. **Disabled:Script Enforcement** isn't supported on **Windows Server 2016** or on **Windows 10 1607 LTSB** and shouldn't be used on those platforms. Doing so results in unexpected script enforcement behaviors. | MSI and Script rule collection is separately configurable. | | [Per-app rules](/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules) | Available on Windows 10, Windows 11, and Windows Server 2019 or later. | Not available. | | [Managed Installer (MI)](/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer) | Available on Windows 10, Windows 11, and Windows Server 2019 or later. | Not available. | | [Reputation-Based intelligence](/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph) | Available on Windows 10, Windows 11, and Windows Server 2019 or later. | Not available. | | [Multiple policy support](/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies) | Available on Windows 10, version 1903 and above, Windows 11, and Windows Server 2022. | Not available. | -| [Path-based rules](/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create) | Available on Windows 10, version 1903 and above, Windows 11, and Windows Server 2019 or later. Exclusions aren't supported. Runtime user-writeability checks enforced by default. | Available on Windows 8+. Exclusions are supported. No runtime user-writeability check. | +| [Path-based rules](/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create) | Available on Windows 10, version 1903 and above, Windows 11, and Windows Server 2022 or later. Exclusions aren't supported. Runtime user-writeability checks enforced by default. | Available on Windows 8+. Exclusions are supported. No runtime user-writeability check. | | [COM object allowlisting](/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy) | Available on Windows 10, Windows 11, and Windows Server 2019 or later. | Not available. | | [Packaged app rules](/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control) | Available on Windows 10, Windows 11, and Windows Server 2019 or later. | Available on Windows 8+. | | Enforceable file types |
        • Driver files: .sys
        • Executable files: .exe and .com
        • DLLs: .dll and .ocx
        • Windows Installer files: .msi, .mst, and .msp
        • Scripts: .ps1, .vbs, and .js
        • Packaged apps and packaged app installers: .appx
        |
        • Executable files: .exe and .com
        • [Optional] DLLs: .dll, .rll and .ocx
        • Windows Installer files: .msi, .mst, and .msp
        • Scripts: .ps1, .bat, .cmd, .vbs, and .js
        • Packaged apps and packaged app installers: .appx
        | -| [Application ID (AppId) Tagging](/windows/security/threat-protection/windows-defender-application-control/AppIdTagging/windows-defender-application-control-appid-tagging-guide) | Available on Windows 10, version 20H1 and above, and Windows 11. | Not available. | +| [Application ID (AppId) Tagging](/windows/security/threat-protection/windows-defender-application-control/AppIdTagging/windows-defender-application-control-appid-tagging-guide) | Available on Windows 10, version 20H1 and later, and Windows 11. | Not available. | diff --git a/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview.md b/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview.md index ef5997b774..b6495d2d01 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/wdac-and-applocker-overview.md @@ -2,22 +2,22 @@ title: WDAC and AppLocker Overview description: Compare Windows application control technologies. ms.localizationpriority: medium -ms.date: 04/04/2023 +ms.date: 12/19/2023 ms.topic: article --- # Windows Defender Application Control and AppLocker Overview > [!NOTE] -> Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md). +> Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [WDAC feature availability](feature-availability.md). Windows 10 and Windows 11 include two technologies that can be used for application control, depending on your organization's specific scenarios and requirements: Windows Defender Application Control (WDAC) and AppLocker. ## Windows Defender Application Control -Windows Defender Application Control was introduced with Windows 10 and allows organizations to control which drivers and applications are allowed to run on their Windows clients. It was designed as a security feature under the [servicing criteria](https://www.microsoft.com/msrc/windows-security-servicing-criteria), defined by the Microsoft Security Response Center (MSRC). +WDAC was introduced with Windows 10 and allows organizations to control which drivers and applications are allowed to run on their Windows clients. It was designed as a security feature under the [servicing criteria](https://www.microsoft.com/msrc/windows-security-servicing-criteria), defined by the Microsoft Security Response Center (MSRC). -Windows Defender Application Control policies apply to the managed computer as a whole and affects all users of the device. WDAC rules can be defined based on: +WDAC policies apply to the managed computer as a whole and affects all users of the device. WDAC rules can be defined based on: - Attributes of the codesigning certificate(s) used to sign an app and its binaries - Attributes of the app's binaries that come from the signed metadata for the files, such as Original Filename and version, or the hash of the file @@ -31,7 +31,7 @@ Windows Defender Application Control policies apply to the managed computer as a ### WDAC System Requirements -Windows Defender Application Control (WDAC) policies can be created and applied on any client edition of Windows 10 or Windows 11, or on Windows Server 2016 and higher. WDAC policies can be deployed via a Mobile Device Management (MDM) solution, for example, Intune; a management interface such as Configuration Manager; or a script host such as PowerShell. Group Policy can also be used to deploy WDAC policies, but is limited to single-policy format policies that work on Windows Server 2016 and 2019. +WDAC policies can be created and applied on any client edition of Windows 10 or Windows 11, or on Windows Server 2016 and higher. WDAC policies can be deployed via a Mobile Device Management (MDM) solution, for example, Intune; a management interface such as Configuration Manager; or a script host such as PowerShell. Group Policy can also be used to deploy WDAC policies, but is limited to single-policy format policies that work on Windows Server 2016 and 2019. For more information on which individual WDAC features are available on specific WDAC builds, see [WDAC feature availability](feature-availability.md). @@ -45,6 +45,8 @@ AppLocker policies can apply to all users on a computer, or to individual users - Attributes of the app's binaries that come from the signed metadata for the files, such as Original Filename and version, or the hash of the file. - The path from which the app or file is launched. +AppLocker is also used by some features of WDAC, including [managed installer](/windows/security/application-security/application-control/windows-defender-application-control/design/configure-authorized-apps-deployed-with-a-managed-installer) and the [Intelligent Security Graph](/windows/security/application-security/application-control/windows-defender-application-control/design/use-wdac-with-intelligent-security-graph). + ### AppLocker System Requirements AppLocker policies can only be configured on and applied to devices that are running on the supported versions and editions of the Windows operating system. For more info, see [Requirements to Use AppLocker](applocker/requirements-to-use-applocker.md). @@ -52,13 +54,12 @@ AppLocker policies can be deployed using Group Policy or MDM. ## Choose when to use WDAC or AppLocker -Generally, it's recommended that customers, who are able to implement application control using Windows Defender Application Control rather than AppLocker, do so. WDAC is undergoing continual improvements, and is getting added support from Microsoft management platforms. Although AppLocker continues to receive security fixes, it isn't getting new feature improvements. +Generally, customers who are able to implement application control using WDAC, rather than AppLocker, should do so. WDAC is undergoing continual improvements, and is getting added support from Microsoft management platforms. Although AppLocker continues to receive security fixes, it isn't getting new feature improvements. -However, in some cases, AppLocker may be the more appropriate technology for your organization. AppLocker is best when: +However, in some cases, AppLocker might be the more appropriate technology for your organization. AppLocker is best when: - You have a mixed Windows operating system (OS) environment and need to apply the same policy controls to Windows 10 and earlier versions of the OS. - You need to apply different policies for different users or groups on shared computers. - You don't want to enforce application control on application files such as DLLs or drivers. -AppLocker can also be deployed as a complement to Windows Defender Application Control (WDAC) to add user or group-specific rules for shared device scenarios, where it's important to prevent some users from running specific apps. -As a best practice, you should enforce WDAC at the most restrictive level possible for your organization, and then you can use AppLocker to further fine-tune the restrictions. +AppLocker can also be deployed as a complement to WDAC to add user or group-specific rules for shared device scenarios, where it's important to prevent some users from running specific apps. As a best practice, you should enforce WDAC at the most restrictive level possible for your organization, and then you can use AppLocker to further fine-tune the restrictions. diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/configure-md-app-guard.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/configure-md-app-guard.md index 5b544490b0..2a40f36ead 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/configure-md-app-guard.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/configure-md-app-guard.md @@ -2,12 +2,15 @@ title: Configure the Group Policy settings for Microsoft Defender Application Guard description: Learn about the available Group Policy settings for Microsoft Defender Application Guard. ms.localizationpriority: medium -ms.date: 07/11/2023 +ms.date: 12/12/2023 ms.topic: how-to --- + # Configure Microsoft Defender Application Guard policy settings +[!INCLUDE [mdag-edge-deprecation-notice](../../../includes/mdag-edge-deprecation-notice.md)] + Microsoft Defender Application Guard (Application Guard) works with Group Policy to help you manage your organization's computer settings. By using Group Policy, you can configure a setting once, and then copy it onto many computers. For example, you can set up multiple security settings in a Group Policy Object, which is linked to a domain, and then apply all those settings to every endpoint in the domain. Application Guard uses both network isolation and application-specific settings. diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml index 5f3515a26b..43f2f31197 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml @@ -1,14 +1,16 @@ ### YamlMime:FAQ metadata: - title: FAQ - Microsoft Defender Application Guard (Windows 10) + title: FAQ - Microsoft Defender Application Guard description: Learn about the commonly asked questions and answers for Microsoft Defender Application Guard. ms.localizationpriority: medium ms.topic: faq - ms.date: 07/11/2023 + ms.date: 12/12/2023 title: Frequently asked questions - Microsoft Defender Application Guard summary: | + [!INCLUDE [mdag-edge-deprecation-notice](../../../includes/mdag-edge-deprecation-notice.md)] + This article lists frequently asked questions with answers for Microsoft Defender Application Guard (Application Guard). Questions span features, integration with the Windows operating system, and general configuration. ## Frequently Asked Questions diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md index 5deab8192a..33375dd2a1 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md @@ -1,12 +1,14 @@ --- title: Enable hardware-based isolation for Microsoft Edge description: Learn about the Microsoft Defender Application Guard modes (Standalone or Enterprise-managed), and how to install Application Guard in your enterprise. -ms.date: 07/11/2023 +ms.date: 12/12/2023 ms.topic: how-to --- # Prepare to install Microsoft Defender Application Guard +[!INCLUDE [mdag-edge-deprecation-notice](../../../includes/mdag-edge-deprecation-notice.md)] + Before you continue, review [System requirements for Microsoft Defender Application Guard](reqs-md-app-guard.md) to review the hardware and software installation requirements for Microsoft Defender Application Guard. > [!NOTE] diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-browser-extension.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-browser-extension.md index 79a92c0c24..f841705678 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-browser-extension.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-browser-extension.md @@ -2,12 +2,14 @@ title: Microsoft Defender Application Guard Extension description: Learn about the Microsoft Defender Application Guard browser extension, which extends Application Guard's protection to more web browsers. ms.localizationpriority: medium -ms.date: 07/11/2023 +ms.date: 12/12/2023 ms.topic: conceptual --- # Microsoft Defender Application Guard Extension +[!INCLUDE [mdag-edge-deprecation-notice](../../../includes/mdag-edge-deprecation-notice.md)] + [Microsoft Defender Application Guard Extension](https://www.microsoft.com/security/blog/2019/05/23/new-browser-extensions-for-integrating-microsofts-hardware-based-isolation/) is a web browser add-on available for [Chrome](https://chrome.google.com/webstore/detail/application-guard-extensi/mfjnknhkkiafjajicegabkbimfhplplj/) and [Firefox](https://addons.mozilla.org/en-US/firefox/addon/application-guard-extension/). [Microsoft Defender Application Guard](md-app-guard-overview.md) provides Hyper-V isolation on Windows 10 and Windows 11, to protect users from potentially harmful content on the web. The extension helps Application Guard protect users running other web browsers. diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md index 8b2235111a..109331df35 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md @@ -1,12 +1,14 @@ --- title: Microsoft Defender Application Guard description: Learn about Microsoft Defender Application Guard and how it helps combat malicious content and malware out on the Internet. -ms.date: 07/11/2023 +ms.date: 12/12/2023 ms.topic: conceptual --- # Microsoft Defender Application Guard overview +[!INCLUDE [mdag-edge-deprecation-notice](../../../includes/mdag-edge-deprecation-notice.md)] + Microsoft Defender Application Guard (MDAG) is designed to help prevent old and newly emerging attacks to help keep employees productive. Using our unique hardware isolation approach, our goal is to destroy the playbook that attackers use by making current attack methods obsolete. ## What is Application Guard and how does it work? diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/reqs-md-app-guard.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/reqs-md-app-guard.md index e27e886eea..ff5414fd19 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/reqs-md-app-guard.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/reqs-md-app-guard.md @@ -3,11 +3,13 @@ title: System requirements for Microsoft Defender Application Guard description: Learn about the system requirements for installing and running Microsoft Defender Application Guard. ms.topic: overview ms.localizationpriority: medium -ms.date: 07/11/2023 +ms.date: 12/12/2023 --- # System requirements for Microsoft Defender Application Guard +[!INCLUDE [mdag-edge-deprecation-notice](../../../includes/mdag-edge-deprecation-notice.md)] + The threat landscape is continually evolving. While hackers are busy developing new techniques to breach enterprise networks by compromising workstations, phishing schemes remain one of the top ways to lure employees into social engineering attacks. Microsoft Defender Application Guard is designed to help prevent old, and newly emerging attacks, to help keep employees productive. > [!NOTE] diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/test-scenarios-md-app-guard.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/test-scenarios-md-app-guard.md index 03756108fa..f63bfb9f1f 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/test-scenarios-md-app-guard.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/test-scenarios-md-app-guard.md @@ -2,12 +2,14 @@ title: Testing scenarios with Microsoft Defender Application Guard description: Suggested testing scenarios for Microsoft Defender Application Guard, showing how it works in both Standalone and Enterprise-managed mode. ms.localizationpriority: medium -ms.date: 07/11/2023 +ms.date: 12/12/2023 ms.topic: conceptual --- # Application Guard testing scenarios +[!INCLUDE [mdag-edge-deprecation-notice](../../../includes/mdag-edge-deprecation-notice.md)] + We've come up with a list of scenarios that you can use to test hardware-based isolation in your organization. ## Application Guard in standalone mode diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 21e56b80c7..62c1b9f07b 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -33,6 +33,8 @@ "overwrite": [], "externalReference": [], "globalMetadata": { + "ms.subservice": "itpro-security", + "ms.service": "windows-client", "recommendations": true, "adobe-target": true, "ms.collection": [ @@ -42,8 +44,6 @@ "zone_pivot_group_filename": "resources/zone-pivot-groups.json", "uhfHeaderId": "MSDocsHeader-Windows", "ms.localizationpriority": "medium", - "ms.prod": "windows-client", - "ms.technology": "itpro-security", "manager": "aaroncz", "feedback_system": "Standard", "feedback_product_url": "https://support.microsoft.com/windows/send-feedback-to-microsoft-with-the-feedback-hub-app-f59187f8-8739-22d6-ba93-f66612949332", @@ -193,7 +193,7 @@ "operating-system-security/data-protection/personal-data-encryption/*.yml": [ "✅ Windows 11" ], - "operating-system-security/device-management/windows-security-configuration-framework/**/*.md": [ + "operating-system-security/device-management/**/*.md": [ "✅ Windows 11", "✅ Windows 10", "✅ Windows Server 2022", diff --git a/windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows.md b/windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows.md index d5451404d1..e68ce7f0d5 100644 --- a/windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows.md +++ b/windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows.md @@ -1,16 +1,16 @@ --- -title: How Windows Defender System Guard helps protect Windows -description: Learn how Windows Defender System Guard reorganizes the existing Windows system integrity features under one roof. +title: How System Guard helps protect Windows +description: Learn how System Guard reorganizes the existing Windows system integrity features under one roof. ms.localizationpriority: medium -ms.date: 10/25/2023 +ms.date: 01/16/2024 ms.topic: conceptual --- -# Windows Defender System Guard: How a hardware-based root of trust helps protect Windows +# System Guard: How a hardware-based root of trust helps protect Windows To protect critical resources such as the Windows authentication stack, single sign-on tokens, the Windows Hello biometric stack, and the Virtual Trusted Platform Module, a system's firmware and hardware must be trustworthy. -Windows Defender System Guard reorganizes the existing Windows system integrity features under one roof and sets up the next set of investments in Windows security. It's designed to make these security guarantees: +System Guard reorganizes the existing Windows system integrity features under one roof and sets up the next set of investments in Windows security. It's designed to make these security guarantees: - Protect and maintain the integrity of the system as it starts up - Validate that system integrity has truly been maintained through local and remote attestation @@ -33,7 +33,7 @@ Also, a bug fix for UEFI code can take a long time to design, build, retest, val ### Secure Launch—the Dynamic Root of Trust for Measurement (DRTM) -[Windows Defender System Guard Secure Launch](system-guard-secure-launch-and-smm-protection.md), first introduced in Windows 10 version 1809, aims to alleviate these issues by leveraging a technology known as the Dynamic Root of Trust for Measurement (DRTM). DRTM lets the system freely boot into untrusted code initially, but shortly after launches the system into a trusted state by taking control of all CPUs and forcing them down a well-known and measured code path. This has the benefit of allowing untrusted early UEFI code to boot the system, but then being able to securely transition into a trusted and measured state. +[System Guard Secure Launch](system-guard-secure-launch-and-smm-protection.md), first introduced in Windows 10 version 1809, aims to alleviate these issues by leveraging a technology known as the Dynamic Root of Trust for Measurement (DRTM). DRTM lets the system freely boot into untrusted code initially, but shortly after launches the system into a trusted state by taking control of all CPUs and forcing them down a well-known and measured code path. This has the benefit of allowing untrusted early UEFI code to boot the system, but then being able to securely transition into a trusted and measured state. ![System Guard Secure Launch.](images/system-guard-secure-launch.png) @@ -56,15 +56,15 @@ SMM protection is built on top of the Secure Launch technology and requires it t ## Validating platform integrity after Windows is running (run time) -While Windows Defender System Guard provides advanced protection that will help protect and maintain the integrity of the platform during boot and at run time, the reality is that we must apply an "assume breach" mentality to even our most sophisticated security technologies. We can trust that the technologies are successfully doing their jobs, but we also need the ability to verify that they were successful in achieving their goals. For platform integrity, we can't just trust the platform, which potentially could be compromised, to self-attest to its security state. So Windows Defender System Guard includes a series of technologies that enable remote analysis of the device's integrity. +While System Guard provides advanced protection that will help protect and maintain the integrity of the platform during boot and at run time, the reality is that we must apply an "assume breach" mentality to even our most sophisticated security technologies. We can trust that the technologies are successfully doing their jobs, but we also need the ability to verify that they were successful in achieving their goals. For platform integrity, we can't just trust the platform, which potentially could be compromised, to self-attest to its security state. So System Guard includes a series of technologies that enable remote analysis of the device's integrity. -As Windows boots, a series of integrity measurements are taken by Windows Defender System Guard using the device's Trusted Platform Module 2.0 (TPM 2.0). System Guard Secure Launch doesn't support earlier TPM versions, such as TPM 1.2. This process and data are hardware-isolated away from Windows to help ensure that the measurement data isn't subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device's firmware, hardware configuration state, and Windows boot-related components, to name a few. +As Windows boots, a series of integrity measurements are taken by System Guard using the device's Trusted Platform Module 2.0 (TPM 2.0). System Guard Secure Launch doesn't support earlier TPM versions, such as TPM 1.2. This process and data are hardware-isolated away from Windows to help ensure that the measurement data isn't subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device's firmware, hardware configuration state, and Windows boot-related components, to name a few. -![Boot time integrity.](images/windows-defender-system-guard-boot-time-integrity.png) +![Boot time integrity.](images/system-guard-boot-time-integrity.png) -After the system boots, Windows Defender System Guard signs and seals these measurements using the TPM. Upon request, a management system like Intune or Microsoft Configuration Manager can acquire them for remote analysis. If Windows Defender System Guard indicates that the device lacks integrity, the management system can take a series of actions, such as denying the device access to resources. +After the system boots, System Guard signs and seals these measurements using the TPM. Upon request, a management system like Intune or Microsoft Configuration Manager can acquire them for remote analysis. If System Guard indicates that the device lacks integrity, the management system can take a series of actions, such as denying the device access to resources. -[!INCLUDE [windows-defender-system-guard](../../../includes/licensing/windows-defender-system-guard.md)] +[!INCLUDE [system-guard](../../../includes/licensing/system-guard.md)] ## System requirements for System Guard @@ -78,7 +78,7 @@ This feature is available for the following processors: |Name|Description| |--------|-----------| -|64-bit CPU|A 64-bit computer with minimum four cores (logical processors) is required for hypervisor and virtualization-based security (VBS). For more information about Hyper-V, see [Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/about/). For more information about hypervisor, see [Hypervisor Specifications](/virtualization/hyper-v-on-windows/reference/tlfs).| +|64-bit CPU|A 64-bit computer with minimum four cores (logical processors) is required for hypervisor and Virtualization-based security (VBS). For more information about Hyper-V, see [Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/about/). For more information about hypervisor, see [Hypervisor Specifications](/virtualization/hyper-v-on-windows/reference/tlfs).| |Trusted Platform Module (TPM) 2.0|Platforms must support a discrete TPM 2.0. Integrated/firmware TPMs aren't supported, except Intel chips that support Platform Trust Technology (PTT), which is a type of integrated hardware TPM that meets the TPM 2.0 spec.| |Windows DMA Protection|Platforms must meet the Windows DMA Protection Specification (all external DMA ports must be off by default until the OS explicitly powers them).| |SMM communication buffers| All SMM communication buffers must be implemented in EfiRuntimeServicesData, EfiRuntimeServicesCode, EfiACPIMemoryNVS, or EfiReservedMemoryType memory types. | @@ -94,7 +94,7 @@ This feature is available for the following processors: |Name|Description| |--------|-----------| -|64-bit CPU|A 64-bit computer with minimum four cores (logical processors) is required for hypervisor and virtualization-based security (VBS). For more information about Hyper-V, see [Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/about/). For more information about hypervisor, see [Hypervisor Specifications](/virtualization/hyper-v-on-windows/reference/tlfs).| +|64-bit CPU|A 64-bit computer with minimum four cores (logical processors) is required for hypervisor and Virtualization-based security (VBS). For more information about Hyper-V, see [Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/about/). For more information about hypervisor, see [Hypervisor Specifications](/virtualization/hyper-v-on-windows/reference/tlfs).| |Trusted Platform Module (TPM) 2.0|Platforms must support a discrete TPM 2.0 OR Microsoft Pluton TPM.| |Windows DMA Protection|Platforms must meet the Windows DMA Protection Specification (all external DMA ports must be off by default until the OS explicitly powers them).| |SMM communication buffers| All SMM communication buffers must be implemented in EfiRuntimeServicesData, EfiRuntimeServicesCode, EfiACPIMemoryNVS, or EfiReservedMemoryType memory types. | diff --git a/windows/security/hardware-security/images/system-guard-boot-time-integrity.png b/windows/security/hardware-security/images/system-guard-boot-time-integrity.png new file mode 100644 index 0000000000..2dc989f2ef Binary files /dev/null and b/windows/security/hardware-security/images/system-guard-boot-time-integrity.png differ diff --git a/windows/security/hardware-security/images/system-guard-secure-launch.png b/windows/security/hardware-security/images/system-guard-secure-launch.png index b8167afbdc..9d02a7e2f3 100644 Binary files a/windows/security/hardware-security/images/system-guard-secure-launch.png and b/windows/security/hardware-security/images/system-guard-secure-launch.png differ diff --git a/windows/security/hardware-security/images/windows-defender-system-guard-boot-time-integrity.png b/windows/security/hardware-security/images/windows-defender-system-guard-boot-time-integrity.png deleted file mode 100644 index 1761e2e539..0000000000 Binary files a/windows/security/hardware-security/images/windows-defender-system-guard-boot-time-integrity.png and /dev/null differ diff --git a/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md b/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md index f4092a1bc3..6b5201c81c 100644 --- a/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md @@ -4,15 +4,14 @@ description: Learn how Kernel DMA Protection protects Windows devices against dr ms.collection: - tier1 ms.topic: conceptual -ms.date: 07/31/2023 +ms.date: 01/09/2024 --- # Kernel DMA Protection -Kernel DMA Protection is a Windows security feature that protects against external peripherals from gaining unauthorized access to memory. +Kernel Direct Memory Access (DMA) Protection is a Windows security feature that protects against external peripherals from gaining unauthorized access to memory. -PCIe hot plug devices such as Thunderbolt, USB4, and CFexpress allow users to attach classes of external peripherals, including graphics cards, to their devices with the plug-and-play ease of USB.\ -These devices are DMA-capable, and can access system memory and perform read and write operations without the need for the system processor's involvement. This capability is the reason behind the exceptional performance of PCI devices, but it also makes them susceptible to *drive-by DMA attacks*. +PCIe hot plug devices such as Thunderbolt, USB4, and CFexpress allow users to attach classes of external peripherals, including graphics cards, to their devices with the plug-and-play ease of USB. These devices are DMA-capable, and can access system memory and perform read and write operations without the need for the system processor's involvement. This capability is the reason behind the exceptional performance of PCI devices, but it also makes them susceptible to *drive-by DMA attacks*. Drive-by DMA attacks are attacks that occur while the owner of the system isn't present and usually take just a few minutes, with simple-to-moderate attacking tools (affordable, off-the-shelf hardware and software), that don't require the disassembly of the device. For example, attackers can plug in a USB-like device while the device owner is on a break, and walk away with all the secrets on the machine, or inject a malware that allows them to have full control over the device remotely while bypassing the lock screen. @@ -21,8 +20,7 @@ Drive-by DMA attacks are attacks that occur while the owner of the system isn't ## How Windows protects against DMA drive-by attacks -Windows uses the system *Input/Output Memory Management Unit (IOMMU)* to block external peripherals from starting and performing DMA, unless the drivers for these peripherals support memory isolation (such as DMA-remapping). -Peripherals with [DMA Remapping compatible drivers][LINK-1] will be automatically enumerated, started, and allowed to perform DMA to their assigned memory regions. +Windows uses the system *Input/Output Memory Management Unit (IOMMU)* to block external peripherals from starting and performing DMA, unless the drivers for these peripherals support memory isolation (such as DMA-remapping). Peripherals with [DMA Remapping compatible drivers][LINK-1] will be automatically enumerated, started, and allowed to perform DMA to their assigned memory regions. By default, peripherals with DMA Remapping incompatible drivers will be blocked from starting and performing DMA until an authorized user signs into the system or unlocks the screen. IT administrators can modify the default behavior applied to devices with DMA Remapping incompatible drivers using MDM or group policies. @@ -83,8 +81,7 @@ No, Kernel DMA Protection only protects against drive-by DMA attacks after the O ### How can I check if a certain driver supports DMA-remapping? -Not all devices and drivers support DMA-remapping. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of **0** or **1** means that the device driver doesn't support DMA-remapping. A value of **2** means that the device driver supports DMA-remapping. If the property isn't available, then the device driver doesn't support DMA-remapping. -Check the driver instance for the device you're testing. Some drivers may have varying values depending on the location of the device (internal vs. external). +Not all devices and drivers support DMA-remapping. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of **0** or **1** means that the device driver doesn't support DMA-remapping. A value of **2** means that the device driver supports DMA-remapping. If the property isn't available, then the device driver doesn't support DMA-remapping. Check the driver instance for the device you're testing. Some drivers may have varying values depending on the location of the device (internal vs. external). :::image type="content" source="images/device-details.png" alt-text="Screenshot of device details for a Thunderbolt controller showing a value of 2." border="false"::: diff --git a/windows/security/hardware-security/toc.yml b/windows/security/hardware-security/toc.yml index c941dc715a..92e9f40c56 100644 --- a/windows/security/hardware-security/toc.yml +++ b/windows/security/hardware-security/toc.yml @@ -3,7 +3,7 @@ items: href: index.md - name: Hardware root of trust items: - - name: Windows Defender System Guard + - name: System Guard href: how-hardware-based-root-of-trust-helps-protect-windows.md - name: Trusted Platform Module href: tpm/trusted-platform-module-overview.md diff --git a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md b/windows/security/identity-protection/hello-for-business/deploy/cloud.md similarity index 94% rename from windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md rename to windows/security/identity-protection/hello-for-business/deploy/cloud.md index 58eac4892c..ca409fc0b7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md +++ b/windows/security/identity-protection/hello-for-business/deploy/cloud.md @@ -6,7 +6,7 @@ ms.topic: how-to --- # Cloud-only deployment -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-cloud.md)] +[!INCLUDE [apply-to-cloud](includes/apply-to-cloud.md)] ## Introduction @@ -21,7 +21,7 @@ You may wish to disable the automatic Windows Hello for Business enrollment prom Cloud only deployments will use Microsoft Entra multifactor authentication (MFA) during Windows Hello for Business enrollment, and there's no additional MFA configuration needed. If you aren't already registered in MFA, you'll be guided through the MFA registration as part of the Windows Hello for Business enrollment process. -The necessary Windows Hello for Business prerequisites are located at [Cloud Only Deployment](hello-identity-verification.md#azure-ad-cloud-only-deployment). +The necessary Windows Hello for Business prerequisites are located at [Cloud Only Deployment](requirements.md#azure-ad-cloud-only-deployment). It's possible for federated domains to configure the *FederatedIdpMfaBehavior* flag. The flag instructs Microsoft Entra ID to accept, enforce, or reject the MFA challenge from the federated IdP. For more information, see [federatedIdpMfaBehavior values](/graph/api/resources/internaldomainfederation#federatedidpmfabehavior-values). To check this setting, use the following PowerShell command: @@ -54,7 +54,7 @@ The following method explains how to disable Windows Hello for Business enrollme When disabled, users can't provision Windows Hello for Business. When set to Disabled, you can still configure the subsequent settings for Windows Hello for Business even though this policy won't enable Windows Hello for Business. > [!NOTE] -> This policy is only applied during new device enrollments. For currently enrolled devices, you can [set the same settings in a device configuration policy](hello-manage-in-organization.md). +> This policy is only applied during new device enrollments. For currently enrolled devices, you can [set the same settings in a device configuration policy](../hello-manage-in-organization.md). ## Disable Windows Hello for Business enrollment without Intune @@ -62,7 +62,7 @@ If you don't use Intune in your organization, then you can disable Windows Hello Intune uses the following registry keys: **`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\PassportForWork\\Device\Policies`** -To look up your Tenant ID, see [How to find your Microsoft Entra tenant ID](/azure/active-directory/fundamentals/how-to-find-tenant) or try the following, ensuring to sign-in with your organization's account: +To look up your Tenant ID, see [How to find your Microsoft Entra tenant ID](/azure/active-directory/fundamentals/how-to-find-tenant) or try the following, ensuring to sign in with your organization's account: ```msgraph-interactive GET https://graph.microsoft.com/v1.0/organization?$select=id diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-adfs.md similarity index 96% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-adfs.md index 2a40af9e7f..c5e4939fc8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-adfs.md @@ -1,7 +1,7 @@ --- title: Configure Active Directory Federation Services in a hybrid certificate trust model description: Learn how to configure Active Directory Federation Services to support the Windows Hello for Business hybrid certificate trust model. -ms.date: 01/03/2023 +ms.date: 12/15/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -10,9 +10,10 @@ appliesto: - ✅ Windows Server 2016 ms.topic: tutorial --- + # Configure Active Directory Federation Services - hybrid certificate trust -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cert-trust.md)] +[!INCLUDE [apply-to-hybrid-cert-trust](includes/apply-to-hybrid-cert-trust.md)] The Windows Hello for Business certificate-based deployments use AD FS as the certificate registration authority (CRA). The CRA is responsible for issuing and revoking certificates to users. Once the registration authority verifies the certificate request, it signs the certificate request using its enrollment agent certificate and sends it to the certificate authority.\ @@ -80,4 +81,4 @@ Before moving to the next section, ensure the following steps are complete: > - Update group memberships for the AD FS service account > [!div class="nextstepaction"] -> [Next: configure policy settings >](/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision) +> [Next: configure policy settings >](hybrid-cert-trust-enroll.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md similarity index 87% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md index 0d5ed158f7..a9363c8a74 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-enroll.md @@ -1,19 +1,25 @@ --- -title: Windows Hello for Business hybrid certificate trust clients configuration and enrollment +title: Configure and provision Windows Hello for Business in a hybrid certificate trust model description: Learn how to configure devices and enroll them in Windows Hello for Business in a hybrid certificate trust scenario. -ms.date: 01/03/2023 +ms.date: 12/15/2023 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- # Configure and provision Windows Hello for Business - hybrid certificate trust -[!INCLUDE [hello-hybrid-certificate-trust](./includes/hello-hybrid-cert-trust.md)] +[!INCLUDE [apply-to-hybrid-cert-trust](includes/apply-to-hybrid-cert-trust.md)] ## Policy Configuration After the prerequisites are met and the PKI and AD FS configurations are validated, Windows Hello for business must be enabled on the Windows devices. Follow the instructions below to configure your devices using either Microsoft Intune or group policy (GPO). -#### [:::image type="icon" source="../../images/icons/group-policy.svg"::: **GPO**](#tab/gpo) +# [:::image type="icon" source="images/group-policy.svg"::: **GPO**](#tab/gpo) > [!IMPORTANT] > The information in this section applies to Microsoft Entra hybrid joined devices only. @@ -41,7 +47,7 @@ Windows Hello for Business provisioning performs the initial enrollment of the W The process requires no user interaction, provided the user signs-in using Windows Hello for Business. The certificate is renewed in the background before it expires. -### Enable and configure Windows Hello for Business +### Enable and configure Windows Hello for Business with group policy Sign-in a domain controller or management workstations with *Domain Admin* equivalent credentials. @@ -64,8 +70,8 @@ Sign-in a domain controller or management workstations with *Domain Admin* equiv > [!NOTE] > Windows Hello for Business can be configured using different policies. These policies are optional to configure, but it's recommended to enable *Use a hardware security device*. -> -> For more information about these policies, see [Group Policy settings for Windows Hello for Business](hello-manage-in-organization.md#group-policy-settings-for-windows-hello-for-business). +> +> For more information about these policies, see [Group Policy settings for Windows Hello for Business](../hello-manage-in-organization.md#group-policy-settings-for-windows-hello-for-business). ### Configure security for GPO @@ -90,14 +96,15 @@ The application of Group Policy object uses security group filtering. This solut Users (or devices) must receive the Windows Hello for Business group policy settings and have the proper permission to provision Windows Hello for Business. You can provide users with these settings and permissions by adding members to the *Windows Hello for Business Users* group. Users and groups who aren't members of this group won't attempt to enroll for Windows Hello for Business. -#### [:::image type="icon" source="../../images/icons/intune.svg"::: **Intune**](#tab/intune) +# [:::image type="icon" source="images/intune.svg"::: **Intune**](#tab/intune) ## Configure Windows Hello for Business using Microsoft Intune > [!IMPORTANT] > The information in this section applies to Microsoft Entra joined devices managed by Intune. Before proceeding, ensure that you completed the steps described in: -> - [Configure single sign-on for Microsoft Entra joined devices](hello-hybrid-aadj-sso.md) -> - [Using Certificates for AADJ On-premises Single-sign On](hello-hybrid-aadj-sso-cert.md) +> +> - [Configure single sign-on for Microsoft Entra joined devices](../hello-hybrid-aadj-sso.md) +> - [Using Certificates for AADJ On-premises Single-sign On](../hello-hybrid-aadj-sso-cert.md) For Microsoft Entra joined devices enrolled in Intune, you can use Intune policies to manage Windows Hello for Business. @@ -106,7 +113,7 @@ There are different ways to enable and configure Windows Hello for Business in I - Using a policy applied at the tenant level. The tenant policy: - Is only applied at enrollment time, and any changes to its configuration won't apply to devices already enrolled in Intune - It applies to *all devices* getting enrolled in Intune. For this reason, the policy is usually disabled and Windows Hello for Business is enabled using a policy targeted to a security group -- A device configuration policy that is applied *after* device enrollment. Any changes to the policy will be applied to the devices during regular policy refresh intervals. Chose from the following policy types: +- A device configuration policy that is applied *after* device enrollment. Any changes to the policy will be applied to the devices during regular policy refresh intervals. Choose from the following policy types: - [Settings catalog][MEM-1] - [Security baselines][MEM-2] - [Custom policy][MEM-3], via the [PassportForWork CSP][MEM-4] @@ -122,7 +129,7 @@ To check the Windows Hello for Business policy applied at enrollment time: 1. Select **Windows Hello for Business** 1. Verify the status of **Configure Windows Hello for Business** and any settings that may be configured -:::image type="content" source="images/whfb-intune-disable.png" alt-text="Disablement of Windows Hello for Business from Microsoft Intune admin center." lightbox="images/whfb-intune-disable.png"::: +:::image type="content" source="images/whfb-intune-disable.png" alt-text="Screenshot that shows disablement of Windows Hello for Business from Microsoft Intune admin center." lightbox="images/whfb-intune-disable.png"::: If the tenant-wide policy is enabled and configured to your needs, you can skip to [Enroll in Windows Hello for Business](#enroll-in-windows-hello-for-business). Otherwise, follow the instructions below to create a policy using an *account protection* policy. @@ -138,14 +145,14 @@ To configure Windows Hello for Business using an *account protection* policy: 1. Specify a **Name** and, optionally, a **Description** > **Next** 1. Under *Block Windows Hello for Business*, select **Disabled** and multiple policies become available - These policies are optional to configure, but it's recommended to configure *Enable to use a Trusted Platform Module (TPM)* to **Yes** - - For more information about these policies, see [MDM policy settings for Windows Hello for Business](hello-manage-in-organization.md#mdm-policy-settings-for-windows-hello-for-business) + - For more information about these policies, see [MDM policy settings for Windows Hello for Business](../hello-manage-in-organization.md#mdm-policy-settings-for-windows-hello-for-business) 1. Under *Enable to certificate for on-premises resources*, select **YES** 1. Select **Next** 1. Optionally, add *scope tags* > **Next** 1. Assign the policy to a security group that contains as members the devices or users that you want to configure > **Next** 1. Review the policy configuration and select **Create** -:::image type="content" source="images/whfb-intune-account-protection-cert-enable.png" alt-text="Enablement of Windows Hello for Business from Microsoft Intune admin center using an account protection policy." lightbox="images/whfb-intune-account-protection-cert-enable.png"::: +:::image type="content" source="images/whfb-intune-account-protection-cert-enable.png" alt-text="Screenshot that shows enablement of Windows Hello for Business from Microsoft Intune admin center using an account protection policy." lightbox="images/whfb-intune-account-protection-cert-enable.png"::: --- @@ -165,12 +172,12 @@ This is the process that occurs after a user signs in, to enroll in Windows Hell 1. After a successful MFA, the provisioning flow asks the user to create and validate a PIN. This PIN must observe any PIN complexity policies configured on the device 1. The remainder of the provisioning includes Windows Hello for Business requesting an asymmetric key pair for the user, preferably from the TPM (or required if explicitly set through policy). Once the key pair is acquired, Windows communicates with Microsoft Entra ID to register the public key. When key registration completes, Windows Hello for Business provisioning informs the user they can use their PIN to sign-in. The user may close the provisioning application and see their desktop. While the user has completed provisioning, Microsoft Entra Connect synchronizes the user's key to Active Directory -:::image type="content" source="images/haadj-whfb-pin-provisioning.gif" alt-text="Animation showing a user logging on to an HAADJ device with a password, and being prompted to enroll in Windows Hello for Business."::: +:::image type="content" source="images/haadj-whfb-pin-provisioning.gif" alt-text="Screenshot that shows animation showing a user logging on to an HAADJ device with a password, and being prompted to enroll in Windows Hello for Business."::: > [!IMPORTANT] > The following is the enrollment behavior prior to Windows Server 2016 update [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). -> -> The minimum time needed to synchronize the user's public key from Microsoft Entra ID to the on-premises Active Directory is 30 minutes. The Microsoft Entra Connect scheduler controls the synchronization interval. +> +> The minimum time needed to synchronize the user's public key from Microsoft Entra ID to the on-premises Active Directory is 30 minutes. The Microsoft Entra Connect scheduler controls the synchronization interval. > **This synchronization latency delays the user's ability to authenticate and use on-premises resources until the user's public key has synchronized to Active Directory.** Once synchronized, the user can authenticate and use on-premises resources. > Read [Microsoft Entra Connect Sync: Scheduler](/azure/active-directory/connect/active-directory-aadconnectsync-feature-scheduler) to view and adjust the **synchronization cycle** for your organization. > @@ -188,7 +195,6 @@ The certificate authority validates the certificate was signed by the registrati [AZ-4]: /azure/active-directory/devices/troubleshoot-device-dsregcmd -[AZ-5]: /azure/active-directory/connect/active-directory-aadconnectsync-feature-scheduler [MEM-1]: /mem/intune/configuration/settings-catalog [MEM-2]: /mem/intune/protect/security-baselines diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki.md similarity index 89% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki.md index e3340a65c2..7ff5c70e48 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust-pki.md @@ -1,7 +1,7 @@ --- -title: Configure and validate the Public Key Infrastructure in an hybrid certificate trust model +title: Configure and validate the PKI in an hybrid certificate trust model description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in a hybrid certificate trust model. -ms.date: 01/03/2023 +ms.date: 12/15/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -10,9 +10,9 @@ appliesto: - ✅ Windows Server 2016 ms.topic: tutorial --- -# Configure and validate the Public Key Infrastructure - hybrid certificate trust +# Configure and validate the PKI in a hybrid certificate trust model -[!INCLUDE [hello-hybrid-cert-trust](./includes/hello-hybrid-cert-trust.md)] +[!INCLUDE [apply-to-hybrid-cert-trust](includes/apply-to-hybrid-cert-trust.md)] Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a *root of trust* for clients. The certificate ensures that clients don't communicate with rogue domain controllers. @@ -29,6 +29,7 @@ Hybrid certificate trust deployments issue users a sign-in certificate, enabling > [!IMPORTANT] > For Microsoft Entra joined devices to authenticate to on-premises resources, ensure to: +> > - Install the root CA certificate in the device's trusted root certificate store. See [how to deploy a trusted certificate profile](/mem/intune/protect/certificates-trusted-root#to-create-a-trusted-certificate-profile) via Intune > - Publish your certificate revocation list to a location that is available to Microsoft Entra joined devices, such as a web-based URL @@ -54,7 +55,7 @@ Sign in to the CA or management workstations with **Enterprise Admin** equivalen 1. Close the console > [!IMPORTANT] -> If you plan to deploy **Microsoft Entra joined** devices, and require single sign-on (SSO) to on-premises resources when signing in with Windows Hello for Business, follow the procedures to [update your CA to include an http-based CRL distribution point](hello-hybrid-aadj-sso.md). +> If you plan to deploy **Microsoft Entra joined** devices, and require single sign-on (SSO) to on-premises resources when signing in with Windows Hello for Business, follow the procedures to [update your CA to include an http-based CRL distribution point](../hello-hybrid-aadj-sso.md). ## Configure and deploy certificates to domain controllers @@ -66,9 +67,9 @@ Sign in to the CA or management workstations with **Enterprise Admin** equivalen ## Section review and next steps -Before moving to the next section, ensure the following steps are complete: - > [!div class="checklist"] +> Before moving to the next section, ensure the following steps are complete: +> > - Configure domain controller certificates > - Supersede existing domain controller certificates > - Unpublish superseded certificate templates @@ -79,7 +80,6 @@ Before moving to the next section, ensure the following steps are complete: > - Validate the domain controllers configuration > [!div class="nextstepaction"] -> [Next: configure AD FS >](hello-hybrid-cert-whfb-settings-adfs.md) +> [Next: configure AD FS >](hybrid-cert-trust-adfs.md) -[SERV-1]: /troubleshoot/windows-server/windows-security/requirements-domain-controller diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md similarity index 81% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md index 754b52a3a5..a9d49ebfec 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust.md @@ -1,39 +1,40 @@ --- title: Windows Hello for Business hybrid certificate trust deployment description: Learn how to deploy Windows Hello for Business in a hybrid certificate trust scenario. -ms.date: 03/16/2023 +ms.date: 12/15/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 - ✅ Windows Server 2022 - ✅ Windows Server 2019 - ✅ Windows Server 2016 -ms.topic: how-to +ms.topic: tutorial --- # Hybrid certificate trust deployment -[!INCLUDE [hello-hybrid-cert-trust](./includes/hello-hybrid-cert-trust.md)] +[!INCLUDE [apply-to-hybrid-cert-trust](includes/apply-to-hybrid-cert-trust.md)] Hybrid environments are distributed systems that enable organizations to use on-premises and Microsoft Entra protected resources. Windows Hello for Business uses the existing distributed system as a foundation on which organizations can provide two-factor authentication and single sign-on to modern resources. This deployment guide describes how to deploy Windows Hello for Business in a hybrid certificate trust scenario. > [!IMPORTANT] -> Windows Hello for Business *cloud Kerberos trust* is the recommended deployment model when compared to the *key trust model*. It is also the recommended deployment model if you don't need to deploy certificates to the end users. For more information, see [cloud Kerberos trust deployment](hello-hybrid-cloud-kerberos-trust.md). +> Windows Hello for Business *cloud Kerberos trust* is the recommended deployment model when compared to the *key trust model*. It is also the recommended deployment model if you don't need to deploy certificates to the end users. For more information, see [cloud Kerberos trust deployment](hybrid-cloud-kerberos-trust.md). -It's recommended that you review the [Windows Hello for Business planning guide](hello-planning-guide.md) prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. +It's recommended that you review the [Windows Hello for Business planning guide](../hello-planning-guide.md) prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. ## Prerequisites -The following prerequisites must be met for a hybrid certificate trust deployment: > [!div class="checklist"] -> * Directories and directory synchronization -> * Federated authentication to Microsoft Entra ID -> * Device registration -> * Public Key Infrastructure -> * Multifactor authentication -> * Device management +> The following prerequisites must be met for a hybrid certificate trust deployment: +> +> - Directories and directory synchronization +> - Federated authentication to Microsoft Entra ID +> - Device registration +> - Public Key Infrastructure +> - Multifactor authentication +> - Device management ### Directories and directory synchronization @@ -43,7 +44,7 @@ Hybrid Windows Hello for Business needs two directories: - A Microsoft Entra tenant with a Microsoft Entra ID P1 or P2 subscription The two directories must be synchronized with [Microsoft Entra Connect Sync][AZ-1], which synchronizes user accounts from the on-premises Active Directory to Microsoft Entra ID. -The hybrid-certificate trust deployment needs an *Microsoft Entra ID P1 or P2* subscription because it uses the device write-back synchronization feature. +The hybrid-certificate trust deployment needs a *Microsoft Entra ID P1 or P2* subscription because it uses the device write-back synchronization feature. > [!NOTE] > Windows Hello for Business hybrid certificate trust is not supported if the users' on-premises UPN suffix cannot be added as a verified domain in Microsoft Entra ID. @@ -51,8 +52,6 @@ The hybrid-certificate trust deployment needs an *Microsoft Entra ID P1 or P2* s > [!IMPORTANT] > Windows Hello for Business is tied between a user and a device. Both the user and device object must be synchronized between Microsoft Entra ID and Active Directory. - - ### Federated authentication to Microsoft Entra ID Windows Hello for Business hybrid certificate trust doesn't support Microsoft Entra ID *Pass-through Authentication* (PTA) or *password hash sync* (PHS).\ @@ -91,8 +90,6 @@ The enterprise PKI and a certificate registration authority (CRA) are required t During Windows Hello for Business provisioning, users receive a sign-in certificate through the CRA. - - ### Multifactor authentication The Windows Hello for Business provisioning process lets a user enroll in Windows Hello for Business using their user name and password as one factor, but requires a second factor of authentication.\ @@ -110,28 +107,23 @@ To configure Windows Hello for Business, devices can be configured through a mob ## Next steps -Once the prerequisites are met, deploying Windows Hello for Business with a hybrid key trust model consists of the following steps: - > [!div class="checklist"] -> * Configure and validate the PKI -> * Configure AD FS -> * Configure Windows Hello for Business settings -> * Provision Windows Hello for Business on Windows clients -> * Configure single sign-on (SSO) for Microsoft Entra joined devices +> Once the prerequisites are met, deploying Windows Hello for Business with a hybrid key trust model consists of the following steps: +> +> - Configure and validate the PKI +> - Configure AD FS +> - Configure Windows Hello for Business settings +> - Provision Windows Hello for Business on Windows clients +> - Configure single sign-on (SSO) for Microsoft Entra joined devices > [!div class="nextstepaction"] -> [Next: configure and validate the Public Key Infrastructure >](hello-hybrid-cert-trust-validate-pki.md) +> [Next: configure and validate the Public Key Infrastructure >](hybrid-cert-trust-pki.md) [AZ-1]: /azure/active-directory/hybrid/how-to-connect-sync-whatis [AZ-2]: /azure/multi-factor-authentication/multi-factor-authentication [AZ-3]: /azure/multi-factor-authentication/multi-factor-authentication-whats-next -[AZ-4]: /azure/active-directory/devices/troubleshoot-device-dsregcmd -[AZ-5]: /azure/active-directory/connect/active-directory-aadconnectsync-feature-scheduler -[AZ-6]: /azure/active-directory/hybrid/whatis-phs -[AZ-7]: /azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication [AZ-8]: /azure/active-directory/devices/hybrid-azuread-join-plan -[AZ-9]: /azure/active-directory/devices/hybrid-azuread-join-federated-domains [AZ-10]: /azure/active-directory/devices/howto-hybrid-azure-ad-join#federated-domains [AZ-11]: /azure/active-directory/devices/hybrid-azuread-join-manual diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust-enroll.md similarity index 96% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust-enroll.md index 7b4394d51f..da843f036d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust-provision.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust-enroll.md @@ -8,7 +8,7 @@ ms.topic: tutorial --- # Configure and provision Windows Hello for Business - cloud Kerberos trust -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cloudkerb-trust.md)] +[!INCLUDE [apply-to-hybrid-cloud-kerberos-trust](includes/apply-to-hybrid-cloud-kerberos-trust.md)] ## Deployment steps @@ -29,7 +29,7 @@ If you haven't deployed Microsoft Entra Kerberos, follow the instructions in the After setting up the Microsoft Entra Kerberos object, Windows Hello for business cloud Kerberos trust must be enabled on your Windows devices. Follow the instructions below to configure your devices using either Microsoft Intune or group policy (GPO). -#### [:::image type="icon" source="../../images/icons/intune.svg"::: **Intune**](#tab/intune) +#### [:::image type="icon" source="images/intune.svg"::: **Intune**](#tab/intune) For devices managed by Intune, you can use Intune policies to configure Windows Hello for Business. @@ -68,7 +68,7 @@ To configure Windows Hello for Business using an account protection policy: 1. Specify a **Name** and, optionally, a **Description** > **Next**. 1. Under **Block Windows Hello for Business**, select **Disabled** and multiple policies become available. - These policies are optional to configure, but it's recommended to configure **Enable to use a Trusted Platform Module (TPM)** to **Yes**. - - For more information about these policies, see [MDM policy settings for Windows Hello for Business](hello-manage-in-organization.md#mdm-policy-settings-for-windows-hello-for-business). + - For more information about these policies, see [MDM policy settings for Windows Hello for Business](../hello-manage-in-organization.md#mdm-policy-settings-for-windows-hello-for-business). 1. Under **Enable to certificate for on-premises resources**, select **Not configured** 1. Select **Next**. 1. Optionally, add **scope tags** and select **Next**. @@ -107,7 +107,7 @@ To configure the cloud Kerberos trust policy: 1. Assign the policy to a security group that contains as members the devices or users that you want to configure. -#### [:::image type="icon" source="../../images/icons/group-policy.svg"::: **GPO**](#tab/gpo) +#### [:::image type="icon" source="images/group-policy.svg"::: **GPO**](#tab/gpo) Microsoft Entra hybrid joined organizations can use Windows Hello for Business Group Policy to manage the feature. Group Policy can be configured to enable users to enroll and use Windows Hello for Business. @@ -118,7 +118,7 @@ You can configure the Enable Windows Hello for Business Group Policy setting for Cloud Kerberos trust requires setting a dedicated policy for it to be enabled. This policy is only available as a computer configuration. > [!NOTE] -> If you deployed Windows Hello for Business configuration using both Group Policy and Microsoft Intune, Group Policy settings will take precedence and Intune settings will be ignored. For more information about deploying Windows Hello for Business configuration using Microsoft Intune, see [Windows device settings to enable Windows Hello for Business in Intune][MEM-1] and [PassportForWork CSP](/windows/client-management/mdm/passportforwork-csp). For more information about policy conflicts, see [Policy conflicts from multiple policy sources](hello-manage-in-organization.md#policy-conflicts-from-multiple-policy-sources). +> If you deployed Windows Hello for Business configuration using both Group Policy and Microsoft Intune, Group Policy settings will take precedence and Intune settings will be ignored. For more information about deploying Windows Hello for Business configuration using Microsoft Intune, see [Windows device settings to enable Windows Hello for Business in Intune][MEM-1] and [PassportForWork CSP](/windows/client-management/mdm/passportforwork-csp). For more information about policy conflicts, see [Policy conflicts from multiple policy sources](../hello-manage-in-organization.md#policy-conflicts-from-multiple-policy-sources). #### Update administrative templates @@ -199,7 +199,7 @@ If you deployed Windows Hello for Business using the certificate trust model, an ## Frequently Asked Questions -For a list of frequently asked questions about Windows Hello for Business cloud Kerberos trust, see [Windows Hello for Business Frequently Asked Questions](hello-faq.yml#cloud-kerberos-trust). +For a list of frequently asked questions about Windows Hello for Business cloud Kerberos trust, see [Windows Hello for Business Frequently Asked Questions](../hello-faq.yml#cloud-kerberos-trust). diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md similarity index 96% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md index 464e918a1e..c53e872bb1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md @@ -8,7 +8,7 @@ ms.topic: tutorial --- # Cloud Kerberos trust deployment -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cloudkerb-trust.md)] +[!INCLUDE [apply-to-hybrid-cloud-kerberos-trust](includes/apply-to-hybrid-cloud-kerberos-trust.md)] Windows Hello for Business replaces password sign-in with strong authentication, using an asymmetric key pair. This deployment guide provides the information to deploy Windows Hello for Business in a *cloud Kerberos trust* scenario. @@ -45,7 +45,7 @@ When Microsoft Entra Kerberos is enabled in an Active Directory domain, an *Azur :::image type="content" source="images/azuread-kerberos-object.png" alt-text="Active Directory Users and Computers console, showing the computer object representing the Microsoft Entra Kerberos server "::: For more information about how Microsoft Entra Kerberos enables access to on-premises resources, see [enabling passwordless security key sign-in to on-premises resources][AZ-1].\ -For more information about how Microsoft Entra Kerberos works with Windows Hello for Business cloud Kerberos trust, see [Windows Hello for Business authentication technical deep dive](hello-how-it-works-authentication.md#hybrid-azure-ad-join-authentication-using-cloud-kerberos-trust). +For more information about how Microsoft Entra Kerberos works with Windows Hello for Business cloud Kerberos trust, see [Windows Hello for Business authentication technical deep dive](../hello-how-it-works-authentication.md#hybrid-azure-ad-join-authentication-using-cloud-kerberos-trust). > [!IMPORTANT] > When implementing the cloud Kerberos trust deployment model, you *must* ensure that you have an adequate number of *read-write domain controllers* in each Active Directory site where users will be authenticating with Windows Hello for Business. For more information, see [Capacity planning for Active Directory][SERV-1]. @@ -84,7 +84,7 @@ Once the prerequisites are met, deploying Windows Hello for Business with a clou > * Provision Windows Hello for Business on Windows clients > [!div class="nextstepaction"] -> [Next: configure and provision Windows Hello for Business >](hello-hybrid-cloud-kerberos-trust-provision.md) +> [Next: configure and provision Windows Hello for Business >](hybrid-cloud-kerberos-trust-enroll.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md similarity index 95% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md index dc8d3d3a24..10b8e56a94 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-provision.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md @@ -7,11 +7,11 @@ ms.topic: tutorial # Configure and enroll in Windows Hello for Business - hybrid key trust -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-key-trust.md)] +[!INCLUDE [apply-to-hybrid-key-trust](includes/apply-to-hybrid-key-trust.md)] After the prerequisites are met and the PKI configuration is validated, Windows Hello for business must be enabled on the Windows devices. Follow the instructions below to configure your devices using either Microsoft Intune or group policy (GPO). -#### [:::image type="icon" source="../../images/icons/intune.svg"::: **Intune**](#tab/intune) +#### [:::image type="icon" source="images/intune.svg"::: **Intune**](#tab/intune) ## Configure Windows Hello for Business using Microsoft Intune @@ -54,7 +54,7 @@ To configure Windows Hello for Business using an *account protection* policy: 1. Specify a **Name** and, optionally, a **Description** > **Next** 1. Under *Block Windows Hello for Business*, select **Disabled** and multiple policies become available - These policies are optional to configure, but it's recommended to configure *Enable to use a Trusted Platform Module (TPM)* to **Yes** - - For more information about these policies, see [MDM policy settings for Windows Hello for Business](hello-manage-in-organization.md#mdm-policy-settings-for-windows-hello-for-business) + - For more information about these policies, see [MDM policy settings for Windows Hello for Business](../hello-manage-in-organization.md#mdm-policy-settings-for-windows-hello-for-business) 1. Select **Next** 1. Optionally, add *scope tags* > **Next** 1. Assign the policy to a security group that contains as members the devices or users that you want to configure > **Next** @@ -62,7 +62,7 @@ To configure Windows Hello for Business using an *account protection* policy: :::image type="content" source="images/whfb-intune-account-protection-enable.png" alt-text="Enablement of Windows Hello for Business from Microsoft Intune admin center using an account protection policy." lightbox="images/whfb-intune-account-protection-enable.png"::: -#### [:::image type="icon" source="../../images/icons/group-policy.svg"::: **GPO**](#tab/gpo) +#### [:::image type="icon" source="images/group-policy.svg"::: **GPO**](#tab/gpo) ## Configure Windows Hello for Business using group policies @@ -72,7 +72,7 @@ It's suggested to create a security group (for example, *Windows Hello for Busin The Windows Hello for Business Group Policy object delivers the correct Group Policy settings to the user, which enables them to enroll and use Windows Hello for Business to authenticate to Azure and Active Directory > [!NOTE] -> If you deployed Windows Hello for Business configuration using both Group Policy and Intune, Group Policy settings will take precedence and Intune settings will be ignored. For more information about policy conflicts, see [Policy conflicts from multiple policy sources](hello-manage-in-organization.md#policy-conflicts-from-multiple-policy-sources) +> If you deployed Windows Hello for Business configuration using both Group Policy and Intune, Group Policy settings will take precedence and Intune settings will be ignored. For more information about policy conflicts, see [Policy conflicts from multiple policy sources](../hello-manage-in-organization.md#policy-conflicts-from-multiple-policy-sources) ### Enable Windows Hello for Business group policy setting @@ -100,8 +100,8 @@ Sign-in a domain controller or management workstations with *Domain Admin* equiv > [!NOTE] > Windows Hello for Business can be configured using different policies. These policies are optional to configure, but it's recommended to enable *Use a hardware security device*. -> -> For more information about these policies, see [Group Policy settings for Windows Hello for Business](hello-manage-in-organization.md#group-policy-settings-for-windows-hello-for-business). +> +> For more information about these policies, see [Group Policy settings for Windows Hello for Business](../hello-manage-in-organization.md#group-policy-settings-for-windows-hello-for-business). ### Configure security for GPO diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki.md similarity index 96% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki.md index f39545b8e8..2fa08c15c9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-pki.md @@ -1,6 +1,6 @@ --- -title: Configure and validate the Public Key Infrastructure in an hybrid key trust model -description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in an hybrid key trust model. +title: Configure and validate the Public Key Infrastructure in a hybrid key trust model +description: Configure and validate the Public Key Infrastructure when deploying Windows Hello for Business in a hybrid key trust model. ms.date: 01/03/2023 appliesto: - ✅ Windows 11 @@ -12,7 +12,7 @@ ms.topic: tutorial --- # Configure and validate the Public Key Infrastructure - hybrid key trust -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-key-trust.md)] +[!INCLUDE [apply-to-hybrid-key-trust](includes/apply-to-hybrid-key-trust.md)] Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* model. The domain controllers must have a certificate, which serves as a *root of trust* for clients. The certificate ensures that clients don't communicate with rogue domain controllers. @@ -53,6 +53,7 @@ Sign in using *Enterprise Administrator* equivalent credentials on a Windows Ser > [!IMPORTANT] > For Microsoft Entra joined devices to authenticate to on-premises resources, ensure to: +> > - Install the root CA certificate in the device's trusted root certificate store. See [how to deploy a trusted certificate profile](/mem/intune/protect/certificates-trusted-root#to-create-a-trusted-certificate-profile) via Intune > - Publish your certificate revocation list to a location that is available to Microsoft Entra joined devices, such as a web-based URL @@ -74,7 +75,7 @@ Sign in to the CA or management workstations with **Enterprise Admin** equivalen 1. Close the console > [!IMPORTANT] -> If you plan to deploy **Microsoft Entra joined** devices, and require single sign-on (SSO) to on-premises resources when signing in with Windows Hello for Business, follow the procedures to [update your CA to include an http-based CRL distribution point](hello-hybrid-aadj-sso.md). +> If you plan to deploy **Microsoft Entra joined** devices, and require single sign-on (SSO) to on-premises resources when signing in with Windows Hello for Business, follow the procedures to [update your CA to include an http-based CRL distribution point](../hello-hybrid-aadj-sso.md). ## Configure and deploy certificates to domain controllers @@ -89,6 +90,7 @@ Sign in to the CA or management workstations with **Enterprise Admin** equivalen Before moving to the next section, ensure the following steps are complete: > [!div class="checklist"] +> > - Configure domain controller certificates > - Supersede existing domain controller certificates > - Unpublish superseded certificate templates @@ -97,7 +99,7 @@ Before moving to the next section, ensure the following steps are complete: > - Validate the domain controllers configuration > [!div class="nextstepaction"] -> [Next: configure and provision Windows Hello for Business >](hello-hybrid-key-trust-provision.md) +> [Next: configure and provision Windows Hello for Business >](hybrid-key-trust-enroll.md) [SERV-1]: /troubleshoot/windows-server/windows-security/requirements-domain-controller diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md similarity index 92% rename from windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md rename to windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md index a0a36f2cc0..2b0ec7021d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md @@ -12,16 +12,16 @@ ms.topic: how-to --- # Hybrid key trust deployment -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-key-trust.md)] +[!INCLUDE [apply-to-hybrid-key-trust](includes/apply-to-hybrid-key-trust.md)] Hybrid environments are distributed systems that enable organizations to use on-premises and Microsoft Entra protected resources. Windows Hello for Business uses the existing distributed system as a foundation on which organizations can provide two-factor authentication and single sign-on to modern resources. This deployment guide describes how to deploy Windows Hello for Business in a hybrid key trust scenario. > [!IMPORTANT] -> Windows Hello for Business *cloud Kerberos trust* is the recommended deployment model when compared to the *key trust model*. For more information, see [cloud Kerberos trust deployment](hello-hybrid-cloud-kerberos-trust.md). +> Windows Hello for Business *cloud Kerberos trust* is the recommended deployment model when compared to the *key trust model*. For more information, see [cloud Kerberos trust deployment](hybrid-cloud-kerberos-trust.md). -It is recommended that you review the [Windows Hello for Business planning guide](hello-planning-guide.md) prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. +It is recommended that you review the [Windows Hello for Business planning guide](../hello-planning-guide.md) prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. ## Prerequisites @@ -94,7 +94,7 @@ Once the prerequisites are met, deploying Windows Hello for Business with a hybr > * Configure single sign-on (SSO) for Microsoft Entra joined devices > [!div class="nextstepaction"] -> [Next: configure and validate the Public Key Infrastructure >](hello-hybrid-key-trust-validate-pki.md) +> [Next: configure and validate the Public Key Infrastructure >](hybrid-key-trust-pki.md) [AZ-1]: /azure/active-directory/hybrid/how-to-connect-sync-whatis diff --git a/windows/security/identity-protection/hello-for-business/images/adfs-device-registration.png b/windows/security/identity-protection/hello-for-business/deploy/images/adfs-device-registration.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/adfs-device-registration.png rename to windows/security/identity-protection/hello-for-business/deploy/images/adfs-device-registration.png diff --git a/windows/security/identity-protection/hello-for-business/images/adfs-scp.png b/windows/security/identity-protection/hello-for-business/deploy/images/adfs-scp.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/adfs-scp.png rename to windows/security/identity-protection/hello-for-business/deploy/images/adfs-scp.png diff --git a/windows/security/identity-protection/hello-for-business/images/azuread-kerberos-object.png b/windows/security/identity-protection/hello-for-business/deploy/images/azuread-kerberos-object.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/azuread-kerberos-object.png rename to windows/security/identity-protection/hello-for-business/deploy/images/azuread-kerberos-object.png diff --git a/windows/security/identity-protection/hello-for-business/images/cloud-trust-prereq-check.png b/windows/security/identity-protection/hello-for-business/deploy/images/cloud-trust-prereq-check.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/cloud-trust-prereq-check.png rename to windows/security/identity-protection/hello-for-business/deploy/images/cloud-trust-prereq-check.png diff --git a/windows/security/identity-protection/hello-for-business/images/event358.png b/windows/security/identity-protection/hello-for-business/deploy/images/event358.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/event358.png rename to windows/security/identity-protection/hello-for-business/deploy/images/event358.png diff --git a/windows/security/identity-protection/hello-for-business/deploy/images/group-policy.svg b/windows/security/identity-protection/hello-for-business/deploy/images/group-policy.svg new file mode 100644 index 0000000000..ace95add6b --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/images/group-policy.svg @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/images/haadj-whfb-pin-provisioning.gif b/windows/security/identity-protection/hello-for-business/deploy/images/haadj-whfb-pin-provisioning.gif similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/haadj-whfb-pin-provisioning.gif rename to windows/security/identity-protection/hello-for-business/deploy/images/haadj-whfb-pin-provisioning.gif diff --git a/windows/security/identity-protection/hello-for-business/images/hello-cloud-trust-intune-large.png b/windows/security/identity-protection/hello-for-business/deploy/images/hello-cloud-trust-intune-large.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/hello-cloud-trust-intune-large.png rename to windows/security/identity-protection/hello-for-business/deploy/images/hello-cloud-trust-intune-large.png diff --git a/windows/security/identity-protection/hello-for-business/images/hello-cloud-trust-intune.png b/windows/security/identity-protection/hello-for-business/deploy/images/hello-cloud-trust-intune.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/hello-cloud-trust-intune.png rename to windows/security/identity-protection/hello-for-business/deploy/images/hello-cloud-trust-intune.png diff --git a/windows/security/identity-protection/hello-for-business/images/hello-internal-web-server-cert.png b/windows/security/identity-protection/hello-for-business/deploy/images/hello-internal-web-server-cert.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/hello-internal-web-server-cert.png rename to windows/security/identity-protection/hello-for-business/deploy/images/hello-internal-web-server-cert.png diff --git a/windows/security/identity-protection/hello-for-business/deploy/images/information.svg b/windows/security/identity-protection/hello-for-business/deploy/images/information.svg new file mode 100644 index 0000000000..bc692eabb9 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/images/information.svg @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/images/intune.svg b/windows/security/identity-protection/hello-for-business/deploy/images/intune.svg new file mode 100644 index 0000000000..6e0d938aed --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/images/intune.svg @@ -0,0 +1,24 @@ + + + + + + + + + + + + + + + + Icon-intune-329 + + + + + + + + \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/images/whfb-intune-account-protection-cert-enable.png b/windows/security/identity-protection/hello-for-business/deploy/images/whfb-intune-account-protection-cert-enable.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/whfb-intune-account-protection-cert-enable.png rename to windows/security/identity-protection/hello-for-business/deploy/images/whfb-intune-account-protection-cert-enable.png diff --git a/windows/security/identity-protection/hello-for-business/images/whfb-intune-account-protection-enable.png b/windows/security/identity-protection/hello-for-business/deploy/images/whfb-intune-account-protection-enable.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/whfb-intune-account-protection-enable.png rename to windows/security/identity-protection/hello-for-business/deploy/images/whfb-intune-account-protection-enable.png diff --git a/windows/security/identity-protection/hello-for-business/images/whfb-intune-disable.png b/windows/security/identity-protection/hello-for-business/deploy/images/whfb-intune-disable.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/whfb-intune-disable.png rename to windows/security/identity-protection/hello-for-business/deploy/images/whfb-intune-disable.png diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-cloud.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-cloud.md new file mode 100644 index 0000000000..69c159b0a2 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-cloud.md @@ -0,0 +1,9 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-cloud](tooltip-deployment-cloud.md)] +- **Join type:** [!INCLUDE [tootip-join-entra](tooltip-join-entra.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust-entra.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust-entra.md new file mode 100644 index 0000000000..31073eae23 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust-entra.md @@ -0,0 +1,10 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-hybrid](tooltip-deployment-hybrid.md)] +- **Trust type:** [!INCLUDE [tooltip-cert-trust](tooltip-trust-cert.md)] +- **Join type:** [!INCLUDE [tooltip-join-entra](tooltip-join-entra.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust.md new file mode 100644 index 0000000000..4f8eb7e613 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cert-trust.md @@ -0,0 +1,10 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-hybrid](tooltip-deployment-hybrid.md)] +- **Trust type:** [!INCLUDE [tooltip-cert-trust](tooltip-trust-cert.md)] +- **Join type:** [!INCLUDE [tooltip-join-entra](tooltip-join-entra.md)], [!INCLUDE [tooltip-join-hybrid](tooltip-join-hybrid.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cloud-kerberos-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cloud-kerberos-trust.md new file mode 100644 index 0000000000..9fd4c16a63 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-cloud-kerberos-trust.md @@ -0,0 +1,10 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-hybrid](tooltip-deployment-hybrid.md)] +- **Trust type:** [!INCLUDE [tooltip-trust-cloud-kerberos](tooltip-trust-cloud-kerberos.md)] +- **Join type:** [!INCLUDE [tooltip-join-entra](tooltip-join-entra.md)], [!INCLUDE [tooltip-join-hybrid](tooltip-join-hybrid.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-and-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-and-cert-trust.md new file mode 100644 index 0000000000..1a17ea9d1f --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-and-cert-trust.md @@ -0,0 +1,10 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-hybrid](tooltip-deployment-hybrid.md)] +- **Trust type:** [!INCLUDE [tooltip-trust-key](tooltip-trust-key.md)],[!INCLUDE [tooltip-cert-trust](tooltip-trust-cert.md)] +- **Join type:** [!INCLUDE [tooltip-join-entra](tooltip-join-entra.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-trust.md new file mode 100644 index 0000000000..a74e9ead78 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-hybrid-key-trust.md @@ -0,0 +1,10 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-hybrid](tooltip-deployment-hybrid.md)] +- **Trust type:** [!INCLUDE [tooltip-trust-key](tooltip-trust-key.md)] +- **Join type:** [!INCLUDE [tooltip-join-entra](tooltip-join-entra.md)], [!INCLUDE [tooltip-join-hybrid](tooltip-join-hybrid.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-cert-trust-entra.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-cert-trust-entra.md new file mode 100644 index 0000000000..e3c6bad7b3 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-cert-trust-entra.md @@ -0,0 +1,10 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-onpremises](tooltip-deployment-onpremises.md)] +- **Trust type:** [!INCLUDE [tooltip-cert-trust](tooltip-trust-cert.md)] +- **Join type:** [!INCLUDE [tooltip-join-domain](tooltip-join-domain.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-key-trust.md b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-key-trust.md new file mode 100644 index 0000000000..1966807ca5 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/apply-to-on-premises-key-trust.md @@ -0,0 +1,10 @@ +--- +ms.date: 12/08/2022 +ms.topic: include +--- + +[!INCLUDE [intro](intro.md)] +- **Deployment type:** [!INCLUDE [tooltip-deployment-onpremises](tooltip-deployment-onpremises.md)] +- **Trust type:** [!INCLUDE [tooltip-trust-key](tooltip-trust-key.md)] +- **Join type:** [!INCLUDE [tooltip-join-domain](tooltip-join-domain.md)] +--- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/auth-certificate-template.md b/windows/security/identity-protection/hello-for-business/deploy/includes/auth-certificate-template.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/includes/auth-certificate-template.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/auth-certificate-template.md diff --git a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-deployment.md b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-deployment.md similarity index 99% rename from windows/security/identity-protection/hello-for-business/includes/dc-certificate-deployment.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-deployment.md index 6059c8bb03..07d8c9cc38 100644 --- a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-deployment.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-deployment.md @@ -1,5 +1,5 @@ --- -ms.date: 12/28/2022 +ms.date: 12/15/2023 ms.topic: include --- diff --git a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-supersede.md b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-supersede.md similarity index 99% rename from windows/security/identity-protection/hello-for-business/includes/dc-certificate-supersede.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-supersede.md index 20f8012d88..92853ac52e 100644 --- a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-supersede.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-supersede.md @@ -1,5 +1,5 @@ --- -ms.date: 12/28/2022 +ms.date: 12/15/2023 ms.topic: include --- @@ -30,4 +30,3 @@ However, the certificate template and the superseding of certificate templates i >To see all certificates in the NTAuth store, use the following command: > > `Certutil -viewstore -enterprise NTAuth` - diff --git a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-template.md b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-template.md similarity index 71% rename from windows/security/identity-protection/hello-for-business/includes/dc-certificate-template.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-template.md index 1fff52b89c..9c85020231 100644 --- a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-template.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-template.md @@ -1,5 +1,5 @@ --- -ms.date: 12/28/2022 +ms.date: 12/15/2023 ms.topic: include --- @@ -27,25 +27,14 @@ Sign in to a CA or management workstations with *Domain Administrator* equivalen 1. Open the **Certification Authority** management console 1. Right-click **Certificate Templates > Manage** 1. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and select **Duplicate Template** -1. On the **Compatibility** tab: - - Clear the **Show resulting changes** check box - - Select **Windows Server 2016** from the **Certification Authority** list - - Select **Windows 10 / Windows Server 2016** from the **Certificate Recipient** list -1. On the **General** tab - - Type *Domain Controller Authentication (Kerberos)* in Template display name - - Adjust the validity and renewal period to meet your enterprise's needs - > [!NOTE] - > If you use different template names, you'll need to remember and substitute these names in different portions of the lab. -1. On the **Subject Name** tab: - - Select the **Build from this Active Directory information** button if it isn't already selected - - Select **None** from the **Subject name format** list - - Select **DNS name** from the **Include this information in alternate subject** list - - Clear all other items -1. On the **Cryptography** tab: - - Select **Key Storage Provider** from the **Provider Category** list - - Select **RSA** from the **Algorithm name** list - - Type *2048* in the **Minimum key size** text box - - Select **SHA256** from the **Request hash** list -1. Select **OK** -1. Close the console +1. Use the following table to configure the template: + | Tab Name | Configurations | + | --- | --- | + | *Compatibility* |
        • Clear the **Show resulting changes** check box
        • Select **Windows Server 2016** from the *Certification Authority list*
        • Select **Windows 10 / Windows Server 2016** from the *Certification Recipient list*
        | + | *General* |
        • Specify a **Template display name**, for example *Domain Controller Authentication (Kerberos)*
        • Set the validity period to the desired value
        • Take note of the template name for later, which should be the same as the Template display name minus spaces
        | + | *Subject Name* |
        • Select **Build from this Active Directory information**
        • Select **None** from the **Subject name format** list
        • Select **DNS name** from the **Include this information in alternate subject** list
        • Clear all other items
        | + |*Cryptography*|
        • Set the *Provider Category* to **Key Storage Provider**
        • Set the *Algorithm name* to **RSA**
        • Set the *minimum key size* to **2048**
        • Set the *Request hash* to **SHA256**
        • | + +1. Select **OK** to finalize your changes and create the new template +1. Close the console diff --git a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-validate.md b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-validate.md similarity index 98% rename from windows/security/identity-protection/hello-for-business/includes/dc-certificate-validate.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-validate.md index 5f8e4a5a88..ec0faae68f 100644 --- a/windows/security/identity-protection/hello-for-business/includes/dc-certificate-validate.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/dc-certificate-validate.md @@ -1,5 +1,5 @@ --- -ms.date: 12/28/2022 +ms.date: 12/15/2023 ms.topic: include --- diff --git a/windows/security/identity-protection/hello-for-business/includes/enrollment-agent-certificate-template.md b/windows/security/identity-protection/hello-for-business/deploy/includes/enrollment-agent-certificate-template.md similarity index 99% rename from windows/security/identity-protection/hello-for-business/includes/enrollment-agent-certificate-template.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/enrollment-agent-certificate-template.md index 0304c108d2..8e3cfc064b 100644 --- a/windows/security/identity-protection/hello-for-business/includes/enrollment-agent-certificate-template.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/enrollment-agent-certificate-template.md @@ -1,5 +1,5 @@ --- -ms.date: 01/03/2022 +ms.date: 12/15/2023 ms.topic: include --- diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-intro.md b/windows/security/identity-protection/hello-for-business/deploy/includes/intro.md similarity index 64% rename from windows/security/identity-protection/hello-for-business/includes/hello-intro.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/intro.md index b89d23afb8..89062e7d07 100644 --- a/windows/security/identity-protection/hello-for-business/includes/hello-intro.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/intro.md @@ -1,5 +1,5 @@ --- -ms.date: 12/08/2022 +ms.date: 12/15/2023 ms.topic: include --- diff --git a/windows/security/identity-protection/hello-for-business/includes/lab-based-pki-deploy.md b/windows/security/identity-protection/hello-for-business/deploy/includes/lab-based-pki-deploy.md similarity index 96% rename from windows/security/identity-protection/hello-for-business/includes/lab-based-pki-deploy.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/lab-based-pki-deploy.md index 5cc0341b05..2ccadb00cb 100644 --- a/windows/security/identity-protection/hello-for-business/includes/lab-based-pki-deploy.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/lab-based-pki-deploy.md @@ -1,5 +1,5 @@ --- -ms.date: 01/03/2023 +ms.date: 12/15/2023 ms.topic: include --- diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-cloud.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-cloud.md new file mode 100644 index 0000000000..fa5e9a3489 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-cloud.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[cloud :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#cloud-deployment "For organizations using Microsoft Entra-only identities. Device management is usually done via Intune/MDM") diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-hybrid.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-hybrid.md new file mode 100644 index 0000000000..d273002ddd --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-hybrid.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[hybrid :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#hybrid-deployment "For organizations using Active Directory identities synchronized to Microsoft Entra ID. Device management is usually done via Group Policy or Intune/MDM") diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-onpremises.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-onpremises.md new file mode 100644 index 0000000000..5594bf39dd --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-deployment-onpremises.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[on-premises :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#on-premises-deployment "For organizations using Active Directory identities, not synchronized to Microsoft Entra ID. Device management is usually done via Group Policy") diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-domain.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-domain.md new file mode 100644 index 0000000000..5e4dd851b9 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-domain.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[domain join :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md) diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-entra.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-entra.md new file mode 100644 index 0000000000..dbddf38006 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-entra.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[Microsoft Entra join :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#azure-active-directory-join "Devices that are Microsoft Entra joined do not have any dependencies on Active Directory. Only local users accounts and Microsoft Entra users can sign in to these devices") diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-hybrid.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-hybrid.md new file mode 100644 index 0000000000..206857ace8 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-join-hybrid.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[Microsoft Entra hybrid join :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are Microsoft Entra hybrid joined don't have any dependencies on Microsoft Entra ID. Only local users accounts and Active Directory users can sign in to these devices. Active Directory users that are synchronized to Microsoft Entra ID will have single-sign on to both Active Directory and Microsoft Entra protected resources") diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cert.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cert.md new file mode 100644 index 0000000000..8719e2a1cc --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cert.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +[certificate trust :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#certificate-trust "This trust type uses a certificate to authenticate the users to Active Directory. It's required to issue certificates to the users and to the domain controllers") \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cloud-kerberos.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cloud-kerberos.md new file mode 100644 index 0000000000..57fd74f5c3 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-cloud-kerberos.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/08/2022 +ms.topic: include +--- + +[cloud Kerberos trust :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#cloud-kerberos-trust "This trust type uses security keys to authenticate the users to Active Directory. It's not required to issue any certificates, making it the recommended choice for environments that don't need certificate authentication") \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-key.md b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-key.md new file mode 100644 index 0000000000..3bbbe2214f --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/tooltip-trust-key.md @@ -0,0 +1,6 @@ +--- +ms.date: 12/08/2022 +ms.topic: include +--- + +[key trust :::image type="icon" source="../images/information.svg" border="false":::](../../hello-how-it-works-technology.md#key-trust "This trust type uses a raw key to authenticate the users to Active Directory. It's not required to issue certificates to users, but it's required to deploy certificates to domain controllers") \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/unpublish-superseded-templates.md b/windows/security/identity-protection/hello-for-business/deploy/includes/unpublish-superseded-templates.md similarity index 98% rename from windows/security/identity-protection/hello-for-business/includes/unpublish-superseded-templates.md rename to windows/security/identity-protection/hello-for-business/deploy/includes/unpublish-superseded-templates.md index 5d8b4c3d0a..22db188040 100644 --- a/windows/security/identity-protection/hello-for-business/includes/unpublish-superseded-templates.md +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/unpublish-superseded-templates.md @@ -1,5 +1,5 @@ --- -ms.date: 12/28/2022 +ms.date: 12/15/2023 ms.topic: include --- @@ -15,4 +15,3 @@ Sign in to the CA or management workstation with *Enterprise Administrator* equi 1. Expand the parent node from the navigation pane > **Certificate Templates** 1. Right-click the *Domain Controller* certificate template and select **Delete**. Select **Yes** on the **Disable certificate templates** window 1. Repeat step 3 for the *Domain Controller Authentication* and *Kerberos Authentication* certificate templates - diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/web-server-certificate-template.md b/windows/security/identity-protection/hello-for-business/deploy/includes/web-server-certificate-template.md new file mode 100644 index 0000000000..1bde4860fe --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/web-server-certificate-template.md @@ -0,0 +1,27 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +### Configure an internal web server certificate template + +Windows clients communicate with AD FS via HTTPS. To meet this need, a *server authentication* certificate must be issued to all the nodes in the AD FS farm. On-premises deployments can use a *server authentication* certificate issued by the enterprise PKI. A *server authentication* certificate template must be configured, so the AD FS nodes can request a certificate. + +Sign in to a CA or management workstations with *Domain Administrator* equivalent credentials. + +1. Open the **Certification Authority** management console +1. Right-click **Certificate Templates > Manage** +1. In the **Certificate Template Console**, right-click the **Web Server** template in the details pane and select **Duplicate Template** +1. Use the following table to configure the template: + + | Tab Name | Configurations | + |--|--| + | *Compatibility* |
          • Clear the **Show resulting changes** check box
          • Select **Windows Server 2016** from the *Certification Authority list*
          • Select **Windows 10 / Windows Server 2016** from the *Certification Recipient list*
          | + | *General* |
          • Specify a **Template display name**, for example *Internal Web Server*
          • Set the validity period to the desired value
          • Take note of the template name for later, which should be the same as the Template display name minus spaces
          | + | *Request Handling* | Select **Allow private key to be exported** | + | *Subject Name* | Select **Supply in the request** | + | *Security* | Add **Domain Computers** with **Enroll** access | + | *Cryptography* |
          • Set the *Provider Category* to **Key Storage Provider**
          • Set the *Algorithm name* to **RSA**
          • Set the *minimum key size* to **2048**
          • Set the *Request hash* to **SHA256**
          • | + +1. Select **OK** to finalize your changes and create the new template +1. Close the console diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md b/windows/security/identity-protection/hello-for-business/deploy/index.md similarity index 80% rename from windows/security/identity-protection/hello-for-business/hello-deployment-guide.md rename to windows/security/identity-protection/hello-for-business/deploy/index.md index 3ecc3b1a4f..46c44a5c62 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md +++ b/windows/security/identity-protection/hello-for-business/deploy/index.md @@ -10,9 +10,9 @@ appliesto: Windows Hello for Business is the springboard to a world without passwords. It replaces username and password sign-in to Windows with strong user authentication based on an asymmetric key pair. -This deployment overview is to guide you through deploying Windows Hello for Business. Your first step should be to use the Passwordless Wizard in the [Microsoft 365 admin center](https://admin.microsoft.com/AdminPortal/Home#/modernonboarding/passwordlesssetup) or the [Planning a Windows Hello for Business Deployment](hello-planning-guide.md) guide to determine the right deployment model for your organization. +This deployment overview is to guide you through deploying Windows Hello for Business. Your first step should be to use the Passwordless Wizard in the [Microsoft 365 admin center](https://admin.microsoft.com/AdminPortal/Home#/modernonboarding/passwordlesssetup) or the [Planning a Windows Hello for Business Deployment](../hello-planning-guide.md) guide to determine the right deployment model for your organization. -Once you've chosen a deployment model, the deployment guide for that model will provide you with the information needed to successfully deploy Windows Hello for Business in your environment. Read the [Windows Hello for Business Deployment Prerequisite Overview](hello-identity-verification.md) for a summary of the prerequisites for each different Windows Hello for Business deployment model. +Once you've chosen a deployment model, the deployment guide for that model will provide you with the information needed to successfully deploy Windows Hello for Business in your environment. Read the [Windows Hello for Business Deployment Prerequisite Overview](requirements.md) for a summary of the prerequisites for each different Windows Hello for Business deployment model. ## Requirements @@ -44,18 +44,18 @@ The trust model determines how you want users to authenticate to the on-premises - The certificate trust model also supports enterprises, which aren't ready to deploy Windows Server 2016 Domain Controllers. > [!NOTE] -> RDP does not support authentication with Windows Hello for Business Key Trust or cloud Kerberos trust deployments as a supplied credential. RDP is only supported with certificate trust deployments as a supplied credential at this time. Windows Hello for Business Key Trust and cloud Kerberos trust can be used with [Remote Credential Guard](../remote-credential-guard.md). +> RDP does not support authentication with Windows Hello for Business Key Trust or cloud Kerberos trust deployments as a supplied credential. RDP is only supported with certificate trust deployments as a supplied credential at this time. Windows Hello for Business Key Trust and cloud Kerberos trust can be used with [Remote Credential Guard](../../remote-credential-guard.md). Following are the various deployment guides and models included in this topic: -- [Microsoft Entra hybrid joined cloud Kerberos trust Deployment](hello-hybrid-cloud-kerberos-trust.md) -- [Microsoft Entra hybrid joined Key Trust Deployment](hello-hybrid-key-trust.md) -- [Microsoft Entra hybrid joined Certificate Trust Deployment](hello-hybrid-cert-trust.md) -- [Microsoft Entra join Single Sign-on Deployment Guides](hello-hybrid-aadj-sso.md) -- [On Premises Key Trust Deployment](hello-deployment-key-trust.md) -- [On Premises Certificate Trust Deployment](hello-deployment-cert-trust.md) +- [Microsoft Entra hybrid joined cloud Kerberos trust Deployment](hybrid-cloud-kerberos-trust.md) +- [Microsoft Entra hybrid joined Key Trust Deployment](hybrid-key-trust.md) +- [Microsoft Entra hybrid joined Certificate Trust Deployment](hybrid-cert-trust.md) +- [Microsoft Entra join Single Sign-on Deployment Guides](../hello-hybrid-aadj-sso.md) +- [On Premises Key Trust Deployment](hybrid-cloud-kerberos-trust.md) +- [On Premises Certificate Trust Deployment](on-premises-cert-trust.md) -For Windows Hello for Business hybrid [certificate trust prerequisites](/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust#directory-synchronization) and [key trust prerequisites](/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust#directory-synchronization) deployments, you'll need Microsoft Entra Connect to synchronize user accounts in the on-premises Active Directory with Microsoft Entra ID. For on-premises deployments, both key and certificate trust, use the Azure MFA server where the credentials aren't synchronized to Microsoft Entra ID. Learn how to [deploy Multifactor Authentication Services (MFA) for key trust](hello-key-trust-validate-deploy-mfa.md) and [for certificate trust](hello-cert-trust-validate-deploy-mfa.md) deployments. +For Windows Hello for Business hybrid [certificate trust prerequisites](/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust#directory-synchronization) and [key trust prerequisites](/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust#directory-synchronization) deployments, you'll need Microsoft Entra Connect to synchronize user accounts in the on-premises Active Directory with Microsoft Entra ID. For on-premises deployments, both key and certificate trust, use the Azure MFA server where the credentials aren't synchronized to Microsoft Entra ID. Learn how to [deploy Multifactor Authentication Services (MFA) for key trust](on-premises-key-trust-mfa.md) and [for certificate trust](on-premises-cert-trust-mfa.md) deployments. ## Provisioning diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-adfs.md similarity index 97% rename from windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md rename to windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-adfs.md index dbdfe3cab6..1757f9c6b1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-adfs.md @@ -1,7 +1,7 @@ --- title: Prepare and deploy Active Directory Federation Services in an on-premises certificate trust model description: Learn how to configure Active Directory Federation Services to support the Windows Hello for Business on-premises certificate trust model. -ms.date: 09/07/2023 +ms.date: 12/15/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -10,9 +10,10 @@ appliesto: - ✅ Windows Server 2016 ms.topic: tutorial --- + # Prepare and deploy Active Directory Federation Services - on-premises certificate trust -[!INCLUDE [hello-on-premises-cert-trust](./includes/hello-on-premises-cert-trust.md)] +[!INCLUDE [apply-to-on-premises-cert-trust-entra](includes/apply-to-on-premises-cert-trust-entra.md)] Windows Hello for Business works exclusively with the Active Directory Federation Service (AD FS) role included with Windows Server. The on-premises certificate trust deployment model uses AD FS for *certificate enrollment* and *device registration*. @@ -29,6 +30,7 @@ Prepare the AD FS deployment by installing and **updating** two Windows Servers. Typically, a federation service is an edge facing role. However, the federation services and instance used with the on-premises deployment of Windows Hello for Business does not need Internet connectivity. The AD FS role needs a *server authentication* certificate for the federation services, and you can use a certificate issued by your enterprise (internal) CA. The server authentication certificate should have the following names included in the certificate, if you are requesting an individual certificate for each node in the federation farm: + - **Subject Name**: the internal FQDN of the federation server - **Subject Alternate Name**: the federation service name (e.g. *sts.corp.contoso.com*) or an appropriate wildcard entry (e.g. *\*.corp.contoso.com*) @@ -50,7 +52,7 @@ Sign-in the federation server with *domain administrator* equivalent credentials 1. Select **Next** on the **Select Certificate Enrollment Policy** page 1. On the **Request Certificates** page, select the **Internal Web Server** check box 1. Select the **⚠️ More information is required to enroll for this certificate. Click here to configure settings** link - :::image type="content" source="images/hello-internal-web-server-cert.png" lightbox="images/hello-internal-web-server-cert.png" alt-text="Example of Certificate Properties Subject Tab - This is what shows when you select the above link."::: + :::image type="content" source="images/hello-internal-web-server-cert.png" lightbox="images/hello-internal-web-server-cert.png" alt-text="Screenshot that shows example of Certificate Properties Subject Tab - This is what shows when you select the above link."::: 1. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the AD FS role and then select **Add** 1. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name that you will use for your federation services (*sts.corp.contoso.com*). The name you use here MUST match the name you use when configuring the AD FS server role. Select **Add** and **OK** when finished 1. Select **Enroll** @@ -159,11 +161,11 @@ Sign-in to the federation server with *Enterprise Administrator* equivalent cred 1. In the details pane, select **Configure device registration** 1. In the **Configure Device Registration** dialog, Select **OK** -:::image type="content" source="images/adfs-device-registration.png" lightbox="images/adfs-device-registration.png" alt-text="AD FS device registration: configuration of the service connection point."::: +:::image type="content" source="images/adfs-device-registration.png" lightbox="images/adfs-device-registration.png" alt-text="Screenshot that shows AD FS device registration: configuration of the service connection point."::: Triggering device registration from AD FS, creates the service connection point (SCP) in the Active Directory configuration partition. The SCP is used to store the device registration information that Windows clients will automatically discover. -:::image type="content" source="images/adfs-scp.png" lightbox="images/adfs-scp.png" alt-text="AD FS device registration: service connection point object created by AD FS."::: +:::image type="content" source="images/adfs-scp.png" lightbox="images/adfs-scp.png" alt-text="Screenshot that shows AD FS device registration: service connection point object created by AD FS."::: ## Review to validate the AD FS and Active Directory configuration @@ -318,4 +320,4 @@ Each file in this folder represents a certificate in the service account's Perso For detailed information about the certificate, use `Certutil -q -v `. > [!div class="nextstepaction"] -> [Next: validate and deploy multi-factor authentication (MFA)](hello-cert-trust-validate-deploy-mfa.md) \ No newline at end of file +> [Next: validate and deploy multi-factor authentication (MFA) >](on-premises-cert-trust-mfa.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll.md similarity index 92% rename from windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md rename to windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll.md index 830d49e11a..016c4b4c9e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-enroll.md @@ -1,14 +1,22 @@ --- title: Configure Windows Hello for Business Policy settings in an on-premises certificate trust description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises certificate trust scenario -ms.date: 09/07/2023 +ms.date: 12/15/2023 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 ms.topic: tutorial --- + # Configure Windows Hello for Business group policy settings - on-premises certificate Trust -[!INCLUDE [hello-on-premises-cert-trust](./includes/hello-on-premises-cert-trust.md)] +[!INCLUDE [apply-to-on-premises-cert-trust-entra](includes/apply-to-on-premises-cert-trust-entra.md)] On-premises certificate-based deployments of Windows Hello for Business need three Group Policy settings: + - Enable Windows Hello for Business - Use certificate for on-premises authentication - Enable automatic enrollment of certificates @@ -72,7 +80,7 @@ The application of the Windows Hello for Business Group Policy object uses secur ## Other Related Group Policy settings -There are other Windows Hello for Business policy settings you can configure to manage your Windows Hello for Business deployment. These policy settings are computer-based policy setting; so they are applicable to any user that sign-in from a computer with these policy settings. +There are other Windows Hello for Business policy settings you can configure to manage your Windows Hello for Business deployment. These policy settings are computer-based policy setting; so they are applicable to any user that sign-in from a computer with these policy settings. ### Use a hardware security device diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-mfa.md similarity index 91% rename from windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md rename to windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-mfa.md index 087d2813e3..35fd08dd4d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-mfa.md @@ -1,7 +1,7 @@ --- title: Validate and Deploy MFA for Windows Hello for Business with certificate trust description: Validate and deploy multifactor authentication (MFA) for Windows Hello for Business in an on-premises certificate trust model. -ms.date: 09/07/2023 +ms.date: 12/15/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -13,7 +13,7 @@ ms.topic: tutorial # Validate and deploy multifactor authentication - on-premises certificate trust -[!INCLUDE [hello-on-premises-cert-trust](./includes/hello-on-premises-cert-trust.md)] +[!INCLUDE [apply-to-on-premises-cert-trust-entra](includes/apply-to-on-premises-cert-trust-entra.md)] Windows Hello for Business requires users perform multifactor authentication (MFA) prior to enroll in the service. On-premises deployments can use, as MFA option: @@ -28,4 +28,4 @@ For information about third-party authentication methods, see [Configure Additio Follow the integration and deployment guide for the authentication provider you plan to integrate to AD FS. Make sure that the authentication provider is selected as a multifactor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies, see [Configure Authentication Policies](/windows-server/identity/ad-fs/operations/configure-authentication-policies). > [!div class="nextstepaction"] -> [Next: configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) +> [Next: configure Windows Hello for Business Policy settings >](on-premises-cert-trust-enroll.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-pki.md similarity index 95% rename from windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md rename to windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-pki.md index e98fede731..2c8db04a8f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust-pki.md @@ -1,7 +1,7 @@ --- title: Configure and validate the Public Key Infrastructure in an on-premises certificate trust model description: Configure and validate the Public Key Infrastructure the Public Key Infrastructure when deploying Windows Hello for Business in a certificate trust model. -ms.date: 09/07/2023 +ms.date: 12/15/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -10,9 +10,10 @@ appliesto: - ✅ Windows Server 2016 ms.topic: tutorial --- + # Configure and validate the Public Key Infrastructure - on-premises certificate trust -[!INCLUDE [hello-on-premises-cert-trust](./includes/hello-on-premises-cert-trust.md)] +[!INCLUDE [apply-to-on-premises-cert-trust-entra](includes/apply-to-on-premises-cert-trust-entra.md)] Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients. The certificate ensures that clients don't communicate with rogue domain controllers. The certificate trust model extends certificate issuance to client computers. During Windows Hello for Business provisioning, the user receives a sign-in certificate. @@ -56,4 +57,4 @@ Sign in to the CA or management workstations with **Enterprise Admin** equivalen [!INCLUDE [dc-certificate-validate](includes/dc-certificate-validate.md)] > [!div class="nextstepaction"] -> [Next: prepare and deploy AD FS >](hello-cert-trust-adfs.md) \ No newline at end of file +> [Next: prepare and deploy AD FS >](on-premises-cert-trust-adfs.md) \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust.md new file mode 100644 index 0000000000..4c3f3c04e8 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-cert-trust.md @@ -0,0 +1,43 @@ +--- +title: Deployment guide for the on-premises certificate trust model +description: Learn how to deploy Windows Hello for Business in an on-premises, certificate trust model. +ms.date: 12/15/2023 +appliesto: +- ✅ Windows 11 +- ✅ Windows 10 +- ✅ Windows Server 2022 +- ✅ Windows Server 2019 +- ✅ Windows Server 2016 +ms.topic: tutorial +--- + +# Deployment guide for the on-premises certificate trust model + +[!INCLUDE [apply-to-on-premises-cert-trust-entra](includes/apply-to-on-premises-cert-trust-entra.md)] + +Windows Hello for Business replaces username and password authentication to Windows with an asymmetric key pair. This deployment guide provides the information to deploy Windows Hello for Business in an on-premises environment. + +There are four steps to deploying Windows Hello for Business in an on-premises certificate trust model: + +1. [Validate and configure a PKI](on-premises-cert-trust-pki.md) +1. [Prepare and deploy AD FS](on-premises-cert-trust-adfs.md) +1. [Validate and deploy multi-factor authentication (MFA)](on-premises-cert-trust-mfa.md) +1. [Configure Windows Hello for Business Policy settings](on-premises-cert-trust-enroll.md) + +## Create the Windows Hello for Business Users security group + +While this is not a required step, it is recommended to create a security group to simplify the deployment. + +The *Windows Hello for Business Users* group is used to make it easy to deploy Windows Hello for Business in phases. You assign certificate templates and group policy permissions to this group to simplify the deployment by adding the users to the group. This provides users with the proper permissions to provision Windows Hello for Business. + +Sign-in to a domain controller or to a management workstation with a *Domain Administrator* equivalent credentials. + +1. Open **Active Directory Users and Computers** +1. Select **View > Advanced Features** +1. Expand the domain node from the navigation pane +1. Right-click the **Users** container. Select **New > Group** +1. Type *Windows Hello for Business Users* in the **Group Name** +1. Select **OK** + +> [!div class="nextstepaction"] +> [Next: validate and configure a PKI >](on-premises-cert-trust-pki.md) \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-adfs.md similarity index 99% rename from windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md rename to windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-adfs.md index cf93d23831..4446ced825 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-adfs.md @@ -12,7 +12,7 @@ ms.topic: tutorial --- # Prepare and deploy Active Directory Federation Services - on-premises key trust -[!INCLUDE [hello-on-premises-key-trust](./includes/hello-on-premises-key-trust.md)] +[!INCLUDE [apply-to-on-premises-key-trust](includes/apply-to-on-premises-key-trust.md)] Windows Hello for Business works exclusively with the Active Directory Federation Service (AD FS) role included with Windows Server. The on-premises key trust deployment model uses AD FS for *key registration* and *device registration*. @@ -261,4 +261,4 @@ Before you continue with the deployment, validate your deployment progress by re > * Confirm you created and deployed the Intranet Zone settings to prevent double authentication to the federation server > [!div class="nextstepaction"] -> [Next: validate and deploy multi-factor authentication (MFA)](hello-key-trust-validate-deploy-mfa.md) +> [Next: validate and deploy multi-factor authentication (MFA)](on-premises-key-trust-mfa.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll.md similarity index 99% rename from windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md rename to windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll.md index ed52f1c594..eca8d12e30 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-enroll.md @@ -9,7 +9,7 @@ ms.topic: tutorial --- # Configure Windows Hello for Business group policy settings - on-premises key trust -[!INCLUDE [hello-on-premises-key-trust](./includes/hello-on-premises-key-trust.md)] +[!INCLUDE [apply-to-on-premises-key-trust](includes/apply-to-on-premises-key-trust.md)] On-premises key trust deployments of Windows Hello for Business need one Group Policy setting: *Enable Windows Hello for Business*. The Group Policy setting determines whether users are allowed, and prompted, to enroll for Windows Hello for Business. It can be configured for computers or users. diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-mfa.md similarity index 93% rename from windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md rename to windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-mfa.md index 52c64523e9..bcc3c3b497 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-mfa.md @@ -13,7 +13,7 @@ ms.topic: tutorial # Validate and deploy multifactor authentication - on-premises key trust -[!INCLUDE [hello-on-premises-key-trust](./includes/hello-on-premises-key-trust.md)] +[!INCLUDE [apply-to-on-premises-key-trust](includes/apply-to-on-premises-key-trust.md)] Windows Hello for Business requires users perform multifactor authentication (MFA) prior to enroll in the service. On-premises deployments can use, as MFA option: @@ -29,4 +29,4 @@ For information on available third-party authentication methods see [Configure A Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multifactor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](/windows-server/identity/ad-fs/operations/configure-authentication-policies). > [!div class="nextstepaction"] -> [Next: configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) +> [Next: configure Windows Hello for Business Policy settings](on-premises-key-trust-enroll.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-pki.md similarity index 95% rename from windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md rename to windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-pki.md index ab932d9a99..6d7aef36c5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust-pki.md @@ -12,7 +12,7 @@ ms.topic: tutorial --- # Configure and validate the Public Key Infrastructure - on-premises key trust -[!INCLUDE [hello-on-premises-key-trust](./includes/hello-on-premises-key-trust.md)] +[!INCLUDE [apply-to-on-premises-key-trust](includes/apply-to-on-premises-key-trust.md)] Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients. The certificate ensures that clients don't communicate with rogue domain controllers. @@ -52,4 +52,4 @@ Sign in to the CA or management workstations with **Enterprise Admin** equivalen [!INCLUDE [dc-certificate-validate](includes/dc-certificate-validate.md)] > [!div class="nextstepaction"] -> [Next: prepare and deploy AD FS >](hello-key-trust-adfs.md) \ No newline at end of file +> [Next: prepare and deploy AD FS >](on-premises-key-trust-adfs.md) \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust.md b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust.md new file mode 100644 index 0000000000..961219b27e --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/on-premises-key-trust.md @@ -0,0 +1,35 @@ +--- +title: Windows Hello for Business deployment guide for the on-premises key trust model +description: Learn how to deploy Windows Hello for Business in an on-premises, key trust model. +ms.date: 12/12/2022 +ms.topic: tutorial +--- + +# Deployment guide overview - on-premises key trust + +[!INCLUDE [apply-to-on-premises-key-trust](includes/apply-to-on-premises-key-trust.md)] + +Windows Hello for Business replaces username and password authentication to Windows with an asymmetric key pair. This deployment guide provides the information to deploy Windows Hello for Business in an on-premises environment: + +1. [Validate and configure a PKI](on-premises-key-trust-pki.md) +1. [Prepare and deploy AD FS](on-premises-key-trust-adfs.md) +1. [Validate and deploy multifactor authentication (MFA)](on-premises-key-trust-mfa.md) +1. [Configure Windows Hello for Business Policy settings](on-premises-key-trust-enroll.md) + +## Create the Windows Hello for Business Users security group + +While this isn't a required step, it's recommended to create a security group to simplify the deployment. + +The *Windows Hello for Business Users* group is used to make it easy to deploy Windows Hello for Business in phases. You assign Group Policy permissions to this group to simplify the deployment by adding the users to the group. This provides users with the proper permissions to provision Windows Hello for Business. + +Sign-in to a domain controller or to a management workstation with a *Domain Administrator* equivalent credentials. + +1. Open **Active Directory Users and Computers** +1. Select **View > Advanced Features** +1. Expand the domain node from the navigation pane +1. Right-click the **Users** container. Select **New > Group** +1. Type *Windows Hello for Business Users* in the **Group Name** +1. Select **OK** + +> [!div class="nextstepaction"] +> [Next: validate and configure PKI >](on-premises-key-trust-pki.md) \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/deploy/requirements.md similarity index 100% rename from windows/security/identity-protection/hello-for-business/hello-identity-verification.md rename to windows/security/identity-protection/hello-for-business/deploy/requirements.md diff --git a/windows/security/identity-protection/hello-for-business/deploy/toc.yml b/windows/security/identity-protection/hello-for-business/deploy/toc.yml new file mode 100644 index 0000000000..87ab1eb026 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/toc.yml @@ -0,0 +1,77 @@ +items: +- name: Windows Hello for Business deployment overview + href: index.md +- name: Deployment prerequisite overview + href: requirements.md +- name: Cloud-only deployment + href: cloud.md +- name: Hybrid deployments + items: + - name: Cloud Kerberos trust deployment + items: + - name: Overview + href: hybrid-cloud-kerberos-trust.md + displayName: cloud Kerberos trust + - name: Configure and provision Windows Hello for Business + href: hybrid-cloud-kerberos-trust-enroll.md + displayName: cloud Kerberos trust + - name: Key trust deployment + items: + - name: Overview + href: hybrid-key-trust.md + displayName: key trust + - name: Configure and validate the PKI + href: hybrid-key-trust-pki.md + displayName: key trust + - name: Configure and provision Windows Hello for Business + href: hybrid-key-trust-enroll.md + displayName: key trust + - name: Configure SSO for Microsoft Entra joined devices + href: ../hello-hybrid-aadj-sso.md + displayName: key trust + - name: Certificate trust deployment + items: + - name: Overview + href: hybrid-cert-trust.md + displayName: certificate trust + - name: Configure and validate Public Key Infrastructure (PKI) + href: hybrid-cert-trust-pki.md + displayName: certificate trust + - name: Configure AD FS + href: hybrid-cert-trust-adfs.md + displayName: certificate trust + - name: Configure and enroll in Windows Hello for Business + href: hybrid-cert-trust-enroll.md + displayName: certificate trust + - name: Configure SSO for Microsoft Entra joined devices + href: ../hello-hybrid-aadj-sso.md + displayName: certificate trust + - name: Deploy certificates to Microsoft Entra joined devices + href: ../hello-hybrid-aadj-sso-cert.md + displayName: certificate trust +- name: On-premises deployments + items: + - name: Key trust deployment + items: + - name: Overview + href: hybrid-cloud-kerberos-trust.md + - name: Configure and validate the PKI + href: on-premises-key-trust-pki.md + - name: Prepare and deploy Active Directory Federation Services (AD FS) + href: on-premises-key-trust-adfs.md + - name: Validate and deploy multi-factor authentication (MFA) services + href: on-premises-key-trust-mfa.md + - name: Configure Windows Hello for Business policy settings + href: on-premises-key-trust-enroll.md + - name: Certificate trust deployment + items: + - name: Overview + href: on-premises-cert-trust.md + - name: Configure and validate Public Key Infrastructure (PKI) + href: on-premises-cert-trust-pki.md + - name: Prepare and Deploy Active Directory Federation Services (AD FS) + href: on-premises-cert-trust-adfs.md + - name: Validate and deploy multi-factor authentication (MFA) + href: on-premises-cert-trust-mfa.md + - name: Configure and enroll in Windows Hello for Business + href: on-premises-cert-trust-enroll.md diff --git a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md index 9067db991e..d80393b040 100644 --- a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md +++ b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md @@ -25,9 +25,7 @@ The Windows Hello authenticator works to authenticate and allow employees onto y Windows Hello provides many benefits, including: - It helps to strengthen your protections against credential theft. Because an attacker must have both the device and the biometric info or PIN, it's much more difficult to gain access without the employee's knowledge. - - Employees get a simple authentication method (backed up with a PIN) that's always with them, so there's nothing to lose. No more forgetting passwords! - - Support for Windows Hello is built into the operating system so you can add additional biometric devices and policies as part of a coordinated rollout or to individual employees or groups using Group Policy or Mobile Device Management (MDM) configurations service provider (CSP) policies.
            For more info about the available Group Policies and MDM CSPs, see the [Implement Windows Hello for Business in your organization](hello-manage-in-organization.md) topic. ## Where is Windows Hello data stored? @@ -80,7 +78,7 @@ To use Iris authentication, you'll need a [HoloLens 2 device](/hololens/). All H ## Related topics -- [Windows Hello for Business](hello-identity-verification.md) +- [Windows Hello for Business](deploy/requirements.md) - [How Windows Hello for Business works](hello-how-it-works.md) - [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) - [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md deleted file mode 100644 index 220079357a..0000000000 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: Validate Active Directory prerequisites in an on-premises certificate trust -description: Validate Active Directory prerequisites when deploying Windows Hello for Business in a certificate trust model. -ms.date: 09/07/2023 -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 -- ✅ Windows Server 2022 -- ✅ Windows Server 2019 -- ✅ Windows Server 2016 -ms.topic: tutorial ---- -# Validate Active Directory prerequisites - on-premises certificate trust - -[!INCLUDE [hello-on-premises-cert-trust](./includes/hello-on-premises-cert-trust.md)] - -The key registration process for the on-premises deployment of Windows Hello for Business requires the Windows Server 2016 Active Directory or later schema. - -## Create the Windows Hello for Business Users security group - -The *Windows Hello for Business Users* group is used to make it easy to deploy Windows Hello for Business in phases. You assign Group Policy permissions to this group to simplify the deployment by adding the users to the group. This provides users with the proper permissions to provision Windows Hello for Business. - -Sign-in to a domain controller or to a management workstation with a *Domain Administrator* equivalent credentials. - -1. Open **Active Directory Users and Computers** -1. Select **View > Advanced Features** -1. Expand the domain node from the navigation pane -1. Right-click the **Users** container. Select **New > Group** -1. Type *Windows Hello for Business Users* in the **Group Name** -1. Select **OK** - -> [!div class="nextstepaction"] -> [Next: validate and configure PKI >](hello-cert-trust-validate-pki.md) \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md deleted file mode 100644 index 04edf25531..0000000000 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -title: Windows Hello for Business deployment guide for the on-premises certificate trust model -description: Learn how to deploy Windows Hello for Business in an on-premises, certificate trust model. -ms.date: 09/07/2023 -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 -- ✅ Windows Server 2022 -- ✅ Windows Server 2019 -- ✅ Windows Server 2016 -ms.topic: tutorial ---- -# Deployment guide overview - on-premises certificate trust - -[!INCLUDE [hello-on-premises-cert-trust](./includes/hello-on-premises-cert-trust.md)] - -Windows Hello for Business replaces username and password authentication to Windows with an asymmetric key pair. This deployment guide provides the information to deploy Windows Hello for Business in an on-premises environment: - -1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) -2. [Validate and configure a PKI](hello-cert-trust-validate-pki.md) -3. [Prepare and deploy AD FS](hello-cert-trust-adfs.md) -4. [Validate and deploy multi-factor authentication (MFA)](hello-cert-trust-validate-deploy-mfa.md) -5. [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md deleted file mode 100644 index 56d613052d..0000000000 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -title: Windows Hello for Business deployment guide for the on-premises key trust model -description: Learn how to deploy Windows Hello for Business in an on-premises, key trust model. -ms.date: 12/12/2022 -ms.topic: tutorial ---- -# Deployment guide overview - on-premises key trust - -[!INCLUDE [hello-on-premises-key-trust](./includes/hello-on-premises-key-trust.md)] - -Windows Hello for Business replaces username and password authentication to Windows with an asymmetric key pair. This deployment guide provides the information to deploy Windows Hello for Business in an on-premises environment:: - -1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) -1. [Validate and configure a PKI](hello-key-trust-validate-pki.md) -1. [Prepare and deploy AD FS](hello-key-trust-adfs.md) -1. [Validate and deploy multi-factor authentication (MFA)](hello-key-trust-validate-deploy-mfa.md) -1. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index be3cce3029..3ed49353ea 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -106,7 +106,7 @@ In Windows 10 and Windows 11, cloud experience host is an application used while ### Related to cloud experience host -- [Windows Hello for Business](hello-identity-verification.md) +- [Windows Hello for Business](deploy/requirements.md) - [Managed Windows Hello in organization](hello-manage-in-organization.md) ### More information on cloud experience host @@ -131,7 +131,7 @@ Giving the simplicity offered by this model, cloud Kerberos trust is the recomme ### More information about cloud Kerberos trust -[Cloud Kerberos trust deployment](hello-hybrid-cloud-kerberos-trust.md) +[Cloud Kerberos trust deployment](deploy/hybrid-cloud-kerberos-trust.md) ## Deployment type diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md index ee893787c7..d8f299c354 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md @@ -44,7 +44,7 @@ For more information read [how authentication works](hello-how-it-works-authenti ## Related topics - [Technology and Terminology](hello-how-it-works-technology.md) -- [Windows Hello for Business](hello-identity-verification.md) +- [Windows Hello for Business](deploy/requirements.md) - [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) - [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) - [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index c522b57d52..ba06402421 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -7,7 +7,7 @@ ms.topic: how-to # Using Certificates for AADJ On-premises Single-sign On -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-cert-trust-aad.md)] +[!INCLUDE [apply-to-hybrid-cert-trust-entra](deploy/includes/apply-to-hybrid-cert-trust-entra.md)] If you plan to use certificates for on-premises single-sign on, then follow these **additional** steps to configure the environment to enroll Windows Hello for Business certificates for Microsoft Entra joined devices. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md index e4c13dae5d..4a2846f9e6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md @@ -6,7 +6,7 @@ ms.topic: how-to --- # Configure single sign-on for Microsoft Entra joined devices -[!INCLUDE [hello-hybrid-key-trust](./includes/hello-hybrid-keycert-trust-aad.md)] +[!INCLUDE [apply-to-hybrid-key-and-cert-trust](deploy/includes/apply-to-hybrid-key-and-cert-trust.md)] Windows Hello for Business combined with Microsoft Entra joined devices makes it easy for users to securely access cloud-based resources using a strong, two-factor credential. Some resources may remain on-premises as enterprises transition resources to the cloud and Microsoft Entra joined devices may need to access these resources. With additional configurations to the hybrid deployment, you can provide single sign-on to on-premises resources for Microsoft Entra joined devices using Windows Hello for Business, using a key or a certificate. @@ -203,7 +203,7 @@ With the CA properly configured with a valid HTTP-based CRL distribution point, 1. Repeat this procedure on all your domain controllers > [!NOTE] -> You can configure domain controllers to automatically enroll and renew their certificates. Automatic certificate enrollment helps prevent authentication outages due to expired certificates. Refer to the [Windows Hello Deployment Guides](hello-deployment-guide.md) to learn how to deploy automatic certificate enrollment for domain controllers. +> You can configure domain controllers to automatically enroll and renew their certificates. Automatic certificate enrollment helps prevent authentication outages due to expired certificates. Refer to the [Windows Hello Deployment Guides](index.md) to learn how to deploy automatic certificate enrollment for domain controllers. > [!IMPORTANT] > If you are not using automatic certificate enrollment, create a calendar reminder to alert you two months before the certificate expiration date. Send the reminder to multiple people in the organization to ensure more than one or two people know when these certificates expire. diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md deleted file mode 100644 index 2537513f37..0000000000 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Validate Active Directory prerequisites in an on-premises key trust -description: Validate Active Directory prerequisites when deploying Windows Hello for Business in a key trust model. -ms.date: 09/07/2023 -appliesto: -- ✅ Windows 11 -- ✅ Windows 10 -- ✅ Windows Server 2022 -- ✅ Windows Server 2019 -- ✅ Windows Server 2016 -ms.topic: tutorial ---- -# Validate Active Directory prerequisites - on-premises key trust - -[!INCLUDE [hello-on-premises-key-trust](./includes/hello-on-premises-key-trust.md)] - -Key trust deployments need an adequate number of domain controllers to ensure successful user authentication with Windows Hello for Business. To learn more about domain controller planning for key trust deployments, read the [Windows Hello for Business planning guide](hello-planning-guide.md) and the [Planning an adequate number of Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) section. - -The key registration process for the on-premises deployment of Windows Hello for Business requires the Windows Server 2016 Active Directory or later schema. - -## Create the Windows Hello for Business Users security group - -The *Windows Hello for Business Users* group is used to make it easy to deploy Windows Hello for Business in phases. You assign Group Policy permissions to this group to simplify the deployment by adding the users to the group. This provides users with the proper permissions to provision Windows Hello for Business. - -Sign-in to a domain controller or to a management workstation with a *Domain Administrator* equivalent credentials. - -1. Open **Active Directory Users and Computers** -1. Select **View > Advanced Features** -1. Expand the domain node from the navigation pane -1. Right-click the **Users** container. Select **New > Group** -1. Type *Windows Hello for Business Users* in the **Group Name** -1. Select **OK** - -> [!div class="nextstepaction"] -> [Next: validate and configure PKI >](hello-key-trust-validate-pki.md) \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index 459d5a8f44..55a70b9a89 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -82,7 +82,7 @@ It's fundamentally important to understand which deployment model to use for a s A deployment's trust type defines how each Windows Hello for Business client authenticates to the on-premises Active Directory. There are two trust types: key trust and certificate trust. > [!NOTE] -> Windows Hello for Business introduced a new trust model called cloud Kerberos trust, in early 2022. This model enables deployment of Windows Hello for Business using the infrastructure introduced for supporting [security key sign-in on Microsoft Entra hybrid joined devices and on-premises resource access on Microsoft Entra joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). For more information, see [Hybrid Cloud Kerberos Trust Deployment](hello-hybrid-cloud-kerberos-trust.md). +> Windows Hello for Business introduced a new trust model called cloud Kerberos trust, in early 2022. This model enables deployment of Windows Hello for Business using the infrastructure introduced for supporting [security key sign-in on Microsoft Entra hybrid joined devices and on-premises resource access on Microsoft Entra joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). For more information, see [Hybrid Cloud Kerberos Trust Deployment](deploy/hybrid-cloud-kerberos-trust.md). The key trust type doesn't require issuing authentication certificates to end users. Users authenticate using a hardware-bound key created during the built-in provisioning experience. This requires an adequate distribution of Windows Server 2016 or later domain controllers relative to your existing authentication and the number of users included in your Windows Hello for Business deployment. Read the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. diff --git a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md index 87cd5f6ea5..52459fe655 100644 --- a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md +++ b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md @@ -44,7 +44,7 @@ If your policy allows it, people can use biometrics (fingerprint, iris, and faci ## Related topics -- [Windows Hello for Business](hello-identity-verification.md) +- [Windows Hello for Business](deploy/requirements.md) - [How Windows Hello for Business works](hello-how-it-works.md) - [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) - [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-cloud.md b/windows/security/identity-protection/hello-for-business/includes/hello-cloud.md deleted file mode 100644 index 4724b9d6da..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-cloud.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[!INCLUDE [hello-intro](hello-intro.md)] -- **Deployment type:** [!INCLUDE [hello-deployment-cloud](hello-deployment-cloud.md)] -- **Join type:** [!INCLUDE [hello-join-aad](hello-join-aad.md)] ---- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-deployment-cloud.md b/windows/security/identity-protection/hello-for-business/includes/hello-deployment-cloud.md deleted file mode 100644 index 17dc33d7c4..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-deployment-cloud.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[cloud :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../hello-how-it-works-technology.md#cloud-deployment "For organizations using Microsoft Entra-only identities. Device management is usually done via Intune/MDM") diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-deployment-hybrid.md b/windows/security/identity-protection/hello-for-business/includes/hello-deployment-hybrid.md deleted file mode 100644 index a67cb2cf2b..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-deployment-hybrid.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[hybrid :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../hello-how-it-works-technology.md#hybrid-deployment "For organizations using Active Directory identities synchronized to Microsoft Entra ID. Device management is usually done via Group Policy or Intune/MDM") diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-deployment-onpremises.md b/windows/security/identity-protection/hello-for-business/includes/hello-deployment-onpremises.md deleted file mode 100644 index c33f3da2de..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-deployment-onpremises.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[on-premises :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../hello-how-it-works-technology.md#on-premises-deployment "For organizations using Active Directory identities, not synchronized to Microsoft Entra ID. Device management is usually done via Group Policy") diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-hybrid-cert-trust-aad.md b/windows/security/identity-protection/hello-for-business/includes/hello-hybrid-cert-trust-aad.md deleted file mode 100644 index 955f819fbf..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-hybrid-cert-trust-aad.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[!INCLUDE [hello-intro](hello-intro.md)] -- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] -- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] -- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)] ---- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/includes/hello-hybrid-cert-trust.md deleted file mode 100644 index 81e14489f5..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-hybrid-cert-trust.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[!INCLUDE [hello-intro](hello-intro.md)] -- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] -- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] -- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)] ---- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-hybrid-cloudkerb-trust.md b/windows/security/identity-protection/hello-for-business/includes/hello-hybrid-cloudkerb-trust.md deleted file mode 100644 index 302cbee601..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-hybrid-cloudkerb-trust.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[!INCLUDE [hello-intro](hello-intro.md)] -- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] -- **Trust type:** [!INCLUDE [hello-trust-cloud-kerberos](hello-trust-cloud-kerberos.md)] -- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)] ---- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/includes/hello-hybrid-key-trust.md deleted file mode 100644 index 72a7d5634b..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-hybrid-key-trust.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[!INCLUDE [hello-intro](hello-intro.md)] -- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] -- **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)] -- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)] ---- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/identity-protection/hello-for-business/includes/hello-hybrid-keycert-trust-aad.md deleted file mode 100644 index 40496f1006..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-hybrid-keycert-trust-aad.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[!INCLUDE [hello-intro](hello-intro.md)] -- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] -- **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)], [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] -- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)] ---- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-join-aad.md b/windows/security/identity-protection/hello-for-business/includes/hello-join-aad.md deleted file mode 100644 index 29b890c78b..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-join-aad.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[Microsoft Entra join :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../hello-how-it-works-technology.md#azure-active-directory-join "Devices that are Microsoft Entra joined do not have any dependencies on Active Directory. Only local users accounts and Microsoft Entra users can sign in to these devices") diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-join-domain.md b/windows/security/identity-protection/hello-for-business/includes/hello-join-domain.md deleted file mode 100644 index 7cc1a49b9a..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-join-domain.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[domain join :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../hello-how-it-works-technology.md) diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-join-hybrid.md b/windows/security/identity-protection/hello-for-business/includes/hello-join-hybrid.md deleted file mode 100644 index 80f9992cb8..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-join-hybrid.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[Microsoft Entra hybrid join :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are Microsoft Entra hybrid joined don't have any dependencies on Microsoft Entra ID. Only local users accounts and Active Directory users can sign in to these devices. Active Directory users that are synchronized to Microsoft Entra ID will have single-sign on to both Active Directory and Microsoft Entra protected resources") diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-on-premises-cert-trust.md b/windows/security/identity-protection/hello-for-business/includes/hello-on-premises-cert-trust.md deleted file mode 100644 index 06ab63397f..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-on-premises-cert-trust.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[!INCLUDE [hello-intro](hello-intro.md)] -- **Deployment type:** [!INCLUDE [hello-deployment-onpremises](hello-deployment-onpremises.md)] -- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] -- **Join type:** [!INCLUDE [hello-join-domain](hello-join-domain.md)] ---- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-on-premises-key-trust.md b/windows/security/identity-protection/hello-for-business/includes/hello-on-premises-key-trust.md deleted file mode 100644 index ef66939cb2..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-on-premises-key-trust.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[!INCLUDE [hello-intro](hello-intro.md)] -- **Deployment type:** [!INCLUDE [hello-deployment-onpremises](hello-deployment-onpremises.md)] -- **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)] -- **Join type:** [!INCLUDE [hello-join-domain](hello-join-domain.md)] ---- \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-trust-certificate.md b/windows/security/identity-protection/hello-for-business/includes/hello-trust-certificate.md deleted file mode 100644 index 3b89d756cf..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-trust-certificate.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[certificate trust :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../hello-how-it-works-technology.md#certificate-trust "This trust type uses a certificate to authenticate the users to Active Directory. It's required to issue certificates to the users and to the domain controllers") \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-trust-cloud-kerberos.md b/windows/security/identity-protection/hello-for-business/includes/hello-trust-cloud-kerberos.md deleted file mode 100644 index fa465e241c..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-trust-cloud-kerberos.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[cloud Kerberos trust :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../hello-how-it-works-technology.md#cloud-kerberos-trust "This trust type uses security keys to authenticate the users to Active Directory. It's not required to issue any certificates, making it the recommended choice for environments that do not need certificate authentication") \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/hello-trust-key.md b/windows/security/identity-protection/hello-for-business/includes/hello-trust-key.md deleted file mode 100644 index 3e4bdecccc..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/hello-trust-key.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -ms.date: 12/08/2022 -ms.topic: include ---- - -[key trust :::image type="icon" source="../../../images/icons/information.svg" border="false":::](../hello-how-it-works-technology.md#key-trust "This trust type uses a raw key to authenticate the users to Active Directory. It's not required to issue certificates to users, but it's required to deploy certificates to domain controllers") \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/includes/web-server-certificate-template.md b/windows/security/identity-protection/hello-for-business/includes/web-server-certificate-template.md deleted file mode 100644 index 601e29153a..0000000000 --- a/windows/security/identity-protection/hello-for-business/includes/web-server-certificate-template.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -ms.date: 01/23/2023 -ms.topic: include ---- - -### Configure an internal web server certificate template - -Windows clients communicate with AD FS via HTTPS. To meet this need, a *server authentication* certificate must be issued to all the nodes in the AD FS farm. On-premises deployments can use a *server authentication* certificate issued by the enterprise PKI. A *server authentication* certificate template must be configured, so the AD FS nodes can request a certificate. - -Sign in to a CA or management workstations with *Domain Administrator* equivalent credentials. - -1. Open the **Certification Authority** management console -1. Right-click **Certificate Templates** and select **Manage** -1. In the **Certificate Template Console**, right-click the **Web Server** template in the details pane and select **Duplicate Template** -1. On the **Compatibility** tab: - - Clear the **Show resulting changes** check box - - Select **Windows Server 2016** from the **Certification Authority** list - - Select **Windows 10 / Windows Server 2016** from the **Certificate Recipient** list -1. On the **General** tab: - - Type *Internal Web Server* in **Template display name** - - Adjust the validity and renewal period to meet your enterprise's needs - > [!NOTE] - > If you use different template names, you'll need to remember and substitute these names in different portions of the lab. -1. On the **Request Handling** tab, select **Allow private key to be exported** -1. On the **Subject** tab, select the **Supply in the request** button if it isn't already selected -1. On the **Security** tab: - - Select **Add** - - Type **Domain Computers** in the **Enter the object names to select** box - - Select **OK** - - Select the **Allow** check box next to the **Enroll** permission -1. On the **Cryptography** tab: - - Select **Key Storage Provider** from the **Provider Category** list - - Select **RSA** from the **Algorithm name** list - - Type *2048* in the **Minimum key size** text box - - Select **SHA256** from the **Request hash** list - - Select **OK** -1. Close the console - diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index a66a69f90c..fd387134b6 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -155,7 +155,7 @@ A successful transition relies on user acceptance testing. It's impossible for y #### Deploy Windows Hello for Business to test users -Next, you'll want to plan your Windows Hello for Business deployment. Your test users will need an alternative way to sign-in during step 2 of the journey to becoming password-less. Use the [Windows Hello for Business planning guide](hello-planning-guide.md) to help learning which deployment is best suited for your environment. Next, use the [Windows Hello for Business deployment guides](hello-deployment-guide.md) to deploy Windows Hello for Business. +Next, you'll want to plan your Windows Hello for Business deployment. Your test users will need an alternative way to sign-in during step 2 of the journey to becoming password-less. Use the [Windows Hello for Business planning guide](hello-planning-guide.md) to help learning which deployment is best suited for your environment. Next, use the [Windows Hello for Business deployment guides](index.md) to deploy Windows Hello for Business. With the Windows Hello for Business infrastructure in place, you can limit Windows Hello for Business enrollments to the targeted work personas. The great news is that you'll only need to deploy the infrastructure once. When other targeted work personas need to start using Windows Hello for Business, add them to a group. You'll use the first work persona to validate your Windows Hello for Business deployment. diff --git a/windows/security/identity-protection/hello-for-business/toc.yml b/windows/security/identity-protection/hello-for-business/toc.yml index 6afe1b2b78..61aa6291c3 100644 --- a/windows/security/identity-protection/hello-for-business/toc.yml +++ b/windows/security/identity-protection/hello-for-business/toc.yml @@ -10,90 +10,10 @@ items: href: hello-biometrics-in-enterprise.md - name: How Windows Hello for Business works href: hello-how-it-works.md +- name: Plan a Windows Hello for Business deployment + href: hello-planning-guide.md - name: Deployment guides - items: - - name: Windows Hello for Business deployment overview - href: hello-deployment-guide.md - - name: Planning a Windows Hello for Business deployment - href: hello-planning-guide.md - - name: Deployment prerequisite overview - href: hello-identity-verification.md - - name: Cloud-only deployment - href: hello-aad-join-cloud-only-deploy.md - - name: Hybrid deployments - items: - - name: Cloud Kerberos trust deployment - items: - - name: Overview - href: hello-hybrid-cloud-kerberos-trust.md - displayName: cloud Kerberos trust - - name: Configure and provision Windows Hello for Business - href: hello-hybrid-cloud-kerberos-trust-provision.md - displayName: cloud Kerberos trust - - name: Key trust deployment - items: - - name: Overview - href: hello-hybrid-key-trust.md - displayName: key trust - - name: Configure and validate the PKI - href: hello-hybrid-key-trust-validate-pki.md - displayName: key trust - - name: Configure and provision Windows Hello for Business - href: hello-hybrid-key-trust-provision.md - displayName: key trust - - name: Configure SSO for Microsoft Entra joined devices - href: hello-hybrid-aadj-sso.md - displayName: key trust - - name: Certificate trust deployment - items: - - name: Overview - href: hello-hybrid-cert-trust.md - displayName: certificate trust - - name: Configure and validate the PKI - href: hello-hybrid-cert-trust-validate-pki.md - displayName: certificate trust - - name: Configure AD FS - href: hello-hybrid-cert-whfb-settings-adfs.md - displayName: certificate trust - - name: Configure and provision Windows Hello for Business - href: hello-hybrid-cert-whfb-provision.md - displayName: certificate trust - - name: Configure SSO for Microsoft Entra joined devices - href: hello-hybrid-aadj-sso.md - displayName: certificate trust - - name: Deploy certificates to Microsoft Entra joined devices - href: hello-hybrid-aadj-sso-cert.md - displayName: certificate trust - - name: On-premises deployments - items: - - name: Key trust deployment - items: - - name: Overview - href: hello-deployment-key-trust.md - - name: Validate Active Directory prerequisites - href: hello-key-trust-validate-ad-prereq.md - - name: Configure and validate the PKI - href: hello-key-trust-validate-pki.md - - name: Prepare and deploy Active Directory Federation Services (AD FS) - href: hello-key-trust-adfs.md - - name: Validate and deploy multi-factor authentication (MFA) services - href: hello-key-trust-validate-deploy-mfa.md - - name: Configure Windows Hello for Business policy settings - href: hello-key-trust-policy-settings.md - - name: Certificate trust deployment - items: - - name: Overview - href: hello-deployment-cert-trust.md - - name: Validate Active Directory prerequisites - href: hello-cert-trust-validate-ad-prereq.md - - name: Configure and validate Public Key Infrastructure (PKI) - href: hello-cert-trust-validate-pki.md - - name: Prepare and Deploy Active Directory Federation Services (AD FS) - href: hello-cert-trust-adfs.md - - name: Validate and deploy multi-factor authentication (MFA) services - href: hello-cert-trust-validate-deploy-mfa.md - - name: Configure Windows Hello for Business policy settings - href: hello-cert-trust-policy-settings.md + href: deploy/toc.yml - name: How-to Guides items: - name: Prepare people to use Windows Hello diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index cb77691205..583823e56f 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -1,8 +1,8 @@ --- -ms.date: 11/22/2023 title: Smart Card and Remote Desktop Services description: This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in. ms.topic: concept-article +ms.date: 01/16/2024 --- # Smart Card and Remote Desktop Services diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 3fa6fe2bae..bd640b89fd 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -2,7 +2,7 @@ title: Smart Card Architecture description: This topic for the IT professional describes the system architecture that supports smart cards in the Windows operating system. ms.topic: reference-architecture -ms.date: 11/22/2023 +ms.date: 01/16/2024 --- # Smart Card Architecture diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index fe6f0b5c39..770de019ca 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -2,7 +2,7 @@ title: Certificate propagation service description: Learn about the certificate propagation service (CertPropSvc), which is used in smart card implementation. ms.topic: concept-article -ms.date: 11/22/2023 +ms.date: 01/16/2024 --- # Certificate propagation service diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index 9f8291d4a6..5b33c9f79c 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -2,7 +2,7 @@ title: Certificate Requirements and Enumeration description: This topic for the IT professional and smart card developers describes how certificates are managed and used for smart card sign-in. ms.topic: concept-article -ms.date: 11/22/2023 +ms.date: 01/16/2024 --- # Certificate Requirements and Enumeration diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md index d5df22275e..ce951db2a1 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md +++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md @@ -2,7 +2,7 @@ title: Smart Card Troubleshooting description: Describes the tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. ms.topic: troubleshooting -ms.date: 11/22/2023 +ms.date: 01/16/2024 --- # Smart Card Troubleshooting diff --git a/windows/security/identity-protection/smart-cards/smart-card-events.md b/windows/security/identity-protection/smart-cards/smart-card-events.md index 96a66ee27a..6aef6b3288 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-events.md +++ b/windows/security/identity-protection/smart-cards/smart-card-events.md @@ -2,7 +2,7 @@ title: Smart card events description: Learn about smart card deployment and development events. ms.topic: troubleshooting -ms.date: 11/22/2023 +ms.date: 01/16/2024 --- # Smart card events diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index d218b20bc5..79e5f674c9 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -2,7 +2,7 @@ title: Smart Card Group Policy and Registry Settings description: Discover the Group Policy, registry key, local security policy, and credential delegation policy settings that are available for configuring smart cards. ms.topic: reference -ms.date: 11/22/2023 +ms.date: 01/16/2024 --- # Smart Card Group Policy and Registry Settings @@ -373,7 +373,7 @@ The following smart card-related Group Policy settings are in **Computer Configu | Group Policy setting and registry key | Default | Description | |--|--|--| -| Interactive logon: Require smart card

            **scforceoption** | Disabled | This security policy setting requires users to sign in to a computer by using a smart card.

            **Enabled** Users can sign in to the computer only by using a smart card.
            **Disabled** Users can sign in to the computer by using any method.

            NOTE: the Windows LAPS-managed local account is exempted from this policy when Enabled. For more information see [Windows LAPS integration with smart card policy](/windows-server/identity/laps/laps-concepts#windows-laps-integration-with-smart-card-policy).
            | +| Interactive logon: Require smart card

            **scforceoption** | Disabled | This security policy setting requires users to sign in to a computer by using a smart card.

            **Enabled** Users can sign in to the computer only by using a smart card.
            **Disabled** Users can sign in to the computer by using any method.

            NOTE: the Windows LAPS-managed local account is exempted from this policy when Enabled. | | Interactive logon: Smart card removal behavior

            **scremoveoption** | This policy setting isn't defined, which means that the system treats it as **No Action**. | This setting determines what happens when the smart card for a signed-in user is removed from the smart card reader. The options are:
            **No Action**
            **Lock Workstation**: The workstation is locked when the smart card is removed, so users can leave the area, take their smart card with them, and still maintain a protected session.
            **Force Logoff**: The user is automatically signed out when the smart card is removed.
            **Disconnect if a Remote Desktop Services session**: Removal of the smart card disconnects the session without signing out the user. The user can reinsert the smart card and resume the session later, or at another computer that's equipped with a smart card reader, without having to sign in again. If the session is local, this policy setting functions identically to the **Lock Workstation** option. | From the Local Security Policy Editor (secpol.msc), you can edit and apply system policies to manage credential delegation for local or domain computers. diff --git a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md index 6727a73a66..6f23ce09a9 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md +++ b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md @@ -2,7 +2,7 @@ title: How Smart Card Sign-in Works in Windows description: This topic for IT professional provides links to resources about the implementation of smart card technologies in the Windows operating system. ms.topic: overview -ms.date: 11/22/2023 +ms.date: 01/16/2024 --- # How Smart Card Sign-in Works in Windows diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md index 7709e7524f..65933d65a1 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md @@ -2,7 +2,7 @@ title: Smart Card Removal Policy Service description: This topic for the IT professional describes the role of the removal policy service (ScPolicySvc) in smart card implementation. ms.topic: concept-article -ms.date: 11/22/2023 +ms.date: 01/16/2024 --- # Smart Card Removal Policy Service diff --git a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md index cf988e8549..ad2cd71fb9 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md @@ -2,7 +2,7 @@ title: Smart Cards for Windows Service description: This topic for the IT professional and smart card developers describes how the Smart Cards for Windows service manages readers and application interactions. ms.topic: concept-article -ms.date: 11/22/2023 +ms.date: 01/16/2024 --- # Smart Cards for Windows Service diff --git a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md index 0d0d5e8372..f703ec1f9c 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md @@ -2,7 +2,7 @@ title: Smart Card Tools and Settings description: This topic for the IT professional and smart card developer links to information about smart card debugging, settings, and events. ms.topic: get-started -ms.date: 11/22/2023 +ms.date: 01/16/2024 --- # Smart Card Tools and Settings diff --git a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md index da1a559648..d615e2079c 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md +++ b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md @@ -2,7 +2,7 @@ title: Smart Card Technical Reference description: Learn about the Windows smart card infrastructure for physical smart cards, and how smart card-related components work in Windows. ms.topic: overview -ms.date: 11/22/2023 +ms.date: 01/16/2024 --- # Smart Card Technical Reference diff --git a/windows/security/images/insider.png b/windows/security/images/insider.png new file mode 100644 index 0000000000..dbe00408cb Binary files /dev/null and b/windows/security/images/insider.png differ diff --git a/windows/security/includes/insider-note.md b/windows/security/includes/insider-note.md new file mode 100644 index 0000000000..a1160f8047 --- /dev/null +++ b/windows/security/includes/insider-note.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.topic: include +ms.date: 01/11/2024 +--- + +:::row::: +:::column span="1"::: +:::image type="content" source="../images/insider.png" alt-text="Logo of Windows Insider." border="false"::: +:::column-end::: +:::column span="3"::: +> [!IMPORTANT] +>This article describes features or settings that are under development and only applicable to [Windows Insider Preview builds](/windows-insider/). The content is subject to change and may have dependencies on other features or services in preview. +:::column-end::: +:::row-end::: diff --git a/windows/security/includes/mdag-edge-deprecation-notice.md b/windows/security/includes/mdag-edge-deprecation-notice.md new file mode 100644 index 0000000000..cc4103ac7a --- /dev/null +++ b/windows/security/includes/mdag-edge-deprecation-notice.md @@ -0,0 +1,9 @@ +--- +author: vinaypamnani-msft +ms.author: vinpa +ms.date: 12/13/2023 +ms.topic: include +--- + +> [!NOTE] +> Microsoft Defender Application Guard, including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), will be deprecated for Microsoft Edge for Business and [will no longer be updated](/windows/whats-new/feature-lifecycle). Please download the [Microsoft Edge For Business Security Whitepaper](https://edgestatic.azureedge.net/shared/cms/pdfs/Microsoft_Edge_Security_Whitepaper_v2.pdf) to learn more about Edge for Business security capabilities. \ No newline at end of file diff --git a/windows/security/index.yml b/windows/security/index.yml index 069ecf8fb7..99c0f44731 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -6,8 +6,6 @@ brand: windows metadata: ms.topic: hub-page - ms.prod: windows-client - ms.technology: itpro-security ms.collection: - tier1 author: paolomatarazzo diff --git a/windows/security/licensing-and-edition-requirements.md b/windows/security/licensing-and-edition-requirements.md index 5f18fd26da..ece47c14a8 100644 --- a/windows/security/licensing-and-edition-requirements.md +++ b/windows/security/licensing-and-edition-requirements.md @@ -7,7 +7,6 @@ appliesto: - ✅ Windows 11 ms.author: paoloma author: paolomatarazzo -ms.prod: windows-client --- # Windows security features licensing and edition requirements diff --git a/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md b/windows/security/operating-system-security/device-management/block-untrusted-fonts-in-enterprise.md similarity index 74% rename from windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md rename to windows/security/operating-system-security/device-management/block-untrusted-fonts-in-enterprise.md index 005fb7d07d..6e0afc3b28 100644 --- a/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md +++ b/windows/security/operating-system-security/device-management/block-untrusted-fonts-in-enterprise.md @@ -1,34 +1,24 @@ --- -title: Block untrusted fonts in an enterprise +title: Block untrusted fonts in an enterprise description: To help protect your company from attacks that may originate from untrusted or attacker controlled font files, we've created the Blocking Untrusted Fonts feature. -ms.reviewer: -ms.prod: windows-client -author: aczechowski -ms.author: aaroncz -manager: aaroncz -ms.date: 08/14/2017 ms.localizationpriority: medium -ms.technology: itpro-security -ms.topic: reference +ms.topic: how-to +ms.date: 12/22/2023 --- # Block untrusted fonts in an enterprise -**Applies to:** - -- Windows 10 - -> Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). - -To help protect your company from attacks that may originate from untrusted or attacker-controlled font files, we've created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the `%windir%/Fonts` directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. +To help protect your company from attacks that may originate from untrusted or attacker-controlled font files, we've created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the `%windir%\Fonts` directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. ## What does this mean for me? + Blocking untrusted fonts helps improve your network and employee protection against font-processing-related attacks. By default, this feature isn't turned on. ## How does this feature work? + There are three ways to use this feature: -- **On.** Helps stop any font processed using GDI from loading outside of the `%windir%/Fonts` directory. It also turns on event logging. +- **On.** Helps stop any font processed using GDI from loading outside of the `%windir%\Fonts` directory. It also turns on event logging. - **Audit.** Turns on event logging, but doesn't block fonts from loading, regardless of location. The name of the apps that use untrusted fonts appear in your event log. @@ -38,110 +28,95 @@ There are three ways to use this feature: - **Exclude apps to load untrusted fonts.** You can exclude specific apps, allowing them to load untrusted fonts, even while this feature is turned on. For instructions, see [Fix apps having problems because of blocked fonts](#fix-apps-having-problems-because-of-blocked-fonts). ## Potential reductions in functionality + After you turn on this feature, your employees might experience reduced functionality when: - Sending a print job to a remote printer server that uses this feature and where the spooler process hasn't been excluded. In this situation, any fonts that aren't already available in the server's %windir%/Fonts folder won't be used. - - Printing using fonts provided by the installed printer's graphics .dll file, outside of the %windir%/Fonts folder. For more information, see [Introduction to Printer Graphics DLLs](/windows-hardware/drivers/print/introduction-to-printer-graphics-dlls). - - Using first or third-party apps that use memory-based fonts. - - Using Internet Explorer to look at websites that use embedded fonts. In this situation, the feature blocks the embedded font, causing the website to use a default font. However, not all fonts have all of the characters, so the website might render differently. - - Using desktop Office to look at documents with embedded fonts. In this situation, content shows up using a default font picked by Office. ## Turn on and use the Blocking Untrusted Fonts feature + Use Group Policy or the registry to turn this feature on, off, or to use audit mode. **To turn on and use the Blocking Untrusted Fonts feature through Group Policy** + 1. Open the Group Policy editor (gpedit.msc) and go to `Computer Configuration\Administrative Templates\System\Mitigation Options\Untrusted Font Blocking`. - 2. Click **Enabled** to turn on the feature, and then click one of the following **Mitigation Options**: - - **Block untrusted fonts and log events.** Turns on the feature, blocking untrusted fonts and logging installation attempts to the event log. - - **Do not block untrusted fonts.** Turns on the feature, but doesn't block untrusted fonts nor does it log installation attempts to the event log. - - **Log events without blocking untrusted fonts**. Turns on the feature, logging installation attempts to the event log, but not blocking untrusted fonts. - 3. Click **OK**. **To turn on and use the Blocking Untrusted Fonts feature through the registry** + To turn this feature on, off, or to use audit mode: 1. Open the registry editor (regedit.exe) and go to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\`. - 2. If the **MitigationOptions** key isn't there, right-click and add a new **QWORD (64-bit) Value**, renaming it to **MitigationOptions**. - -3. Right click on the **MitigationOptions** key, and then click **Modify**. - - The **Edit QWORD (64-bit) Value** box opens. - +3. Right click on the **MitigationOptions** key, and then click **Modify**. The **Edit QWORD (64-bit) Value** box opens. 4. Make sure the **Base** option is **Hexadecimal**, and then update the **Value data**, making sure you keep your existing value, like in the important note below: - - **To turn this feature on.** Type **1000000000000**. - - **To turn this feature off.** Type **2000000000000**. - - **To audit with this feature.** Type **3000000000000**. - > [!Important] + > [!IMPORTANT] > Your existing **MitigationOptions** values should be saved during your update. For example, if the current value is *1000*, your updated value should be *1000000001000*. 5. Restart your computer. ## View the event log + After you turn on this feature, or start using Audit mode, you can look at your event logs for details. **To look at your event log** 1. Open the event viewer (eventvwr.exe) and go to **Application and Service Logs/Microsoft/Windows/Win32k/Operational**. - 2. Scroll down to **EventID: 260** and review the relevant events. - **Event Example 1 - MS Word**
            - WINWORD.EXE attempted loading a font that is restricted by font-loading policy.
            - FontType: Memory
            - FontPath:
            - Blocked: true + **Event Example 1 - MS Word** - > [!NOTE] - > Because the **FontType** is *Memory*, there's no associated **FontPath**. + > WINWORD.EXE attempted loading a font that is restricted by font-loading policy.
            + > FontType: Memory
            + > FontPath:
            + > Blocked: true
            - **Event Example 2 - Winlogon**
            - Winlogon.exe attempted loading a font that is restricted by font-loading policy.
            - FontType: File
            - FontPath: `\??\C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\EQUATION\MTEXTRA.TTF`
            - Blocked: true + > [!NOTE] + > Because the **FontType** is *Memory*, there's no associated **FontPath**. - > [!NOTE] - > Because the **FontType** is *File*, there's also an associated **FontPath**. + **Event Example 2 - Winlogon** - **Event Example 3 - Internet Explorer running in Audit mode**
            - Iexplore.exe attempted loading a font that is restricted by font-loading policy.
            - FontType: Memory
            - FontPath:
            - Blocked: false + > Winlogon.exe attempted loading a font that is restricted by font-loading policy.
            + > FontType: File
            + > FontPath: `\??\C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\EQUATION\MTEXTRA.TTF`
            + > Blocked: true
            - > [!NOTE] - > In Audit mode, the problem is recorded, but the font isn't blocked. + > [!NOTE] + > Because the **FontType** is *File*, there's also an associated **FontPath**. + + **Event Example 3 - Internet Explorer running in Audit mode** + + > Iexplore.exe attempted loading a font that is restricted by font-loading policy.
            + > FontType: Memory
            + > FontPath:
            + > Blocked: false
            + + > [!NOTE] + > In Audit mode, the problem is recorded, but the font isn't blocked. ## Fix apps having problems because of blocked fonts + Your company may still need apps that are having problems because of blocked fonts, so we suggest that you first run this feature in Audit mode to determine which fonts are causing the problems. After you figure out the problematic fonts, you can try to fix your apps in two ways: by directly installing the fonts into the %windir%/Fonts directory or by excluding the underlying processes and letting the fonts load. As the default solution, we highly recommend that you install the problematic font. Installing fonts is safer than excluding apps because excluded apps can load any font, trusted or untrusted. **To fix your apps by installing the problematic fonts (recommended)** -- On each computer with the app installed, right-click on the font name and click **Install**.

            The font should automatically install into your `%windir%/Fonts` directory. If it doesn't, you'll need to manually copy the font files into the **Fonts** directory and run the installation from there. +On each computer with the app installed, right-click on the font name and click **Install**. The font should automatically install into your `%windir%\Fonts` directory. If it doesn't, you'll need to manually copy the font files into the **Fonts** directory and run the installation from there. **To fix your apps by excluding processes** -1. On each computer with the app installed, open regedit.exe and go to `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\`.

            For example, if you want to exclude Microsoft Word processes, you'd use `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Winword.exe`. - +1. On each computer with the app installed, open regedit.exe and go to `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\`. For example, if you want to exclude Microsoft Word processes, you'd use `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Winword.exe`. 2. Add other processes that need to be excluded here, and then turn on the Blocking untrusted fonts feature, using the steps in [Turn on and use the Blocking Untrusted Fonts feature](#turn-on-and-use-the-blocking-untrusted-fonts-feature), earlier in this article. - - -## Related content - -- [Dropping the "Untrusted Font Blocking" setting](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/dropping-the-quot-untrusted-font-blocking-quot-setting/ba-p/701068/) \ No newline at end of file diff --git a/windows/security/threat-protection/images/capi-gpo.png b/windows/security/operating-system-security/device-management/images/capi-gpo.png similarity index 100% rename from windows/security/threat-protection/images/capi-gpo.png rename to windows/security/operating-system-security/device-management/images/capi-gpo.png diff --git a/windows/security/threat-protection/images/gp-process-mitigation-options-bit-flag-image.png b/windows/security/operating-system-security/device-management/images/gp-process-mitigation-options-bit-flag-image.png similarity index 100% rename from windows/security/threat-protection/images/gp-process-mitigation-options-bit-flag-image.png rename to windows/security/operating-system-security/device-management/images/gp-process-mitigation-options-bit-flag-image.png diff --git a/windows/security/threat-protection/images/gp-process-mitigation-options-show.png b/windows/security/operating-system-security/device-management/images/gp-process-mitigation-options-show.png similarity index 100% rename from windows/security/threat-protection/images/gp-process-mitigation-options-show.png rename to windows/security/operating-system-security/device-management/images/gp-process-mitigation-options-show.png diff --git a/windows/security/threat-protection/images/gp-process-mitigation-options.png b/windows/security/operating-system-security/device-management/images/gp-process-mitigation-options.png similarity index 100% rename from windows/security/threat-protection/images/gp-process-mitigation-options.png rename to windows/security/operating-system-security/device-management/images/gp-process-mitigation-options.png diff --git a/windows/security/threat-protection/images/runkey.png b/windows/security/operating-system-security/device-management/images/runkey.png similarity index 100% rename from windows/security/threat-protection/images/runkey.png rename to windows/security/operating-system-security/device-management/images/runkey.png diff --git a/windows/security/threat-protection/images/runoncekey.png b/windows/security/operating-system-security/device-management/images/runoncekey.png similarity index 100% rename from windows/security/threat-protection/images/runoncekey.png rename to windows/security/operating-system-security/device-management/images/runoncekey.png diff --git a/windows/security/threat-protection/images/wef-client-config.png b/windows/security/operating-system-security/device-management/images/wef-client-config.png similarity index 100% rename from windows/security/threat-protection/images/wef-client-config.png rename to windows/security/operating-system-security/device-management/images/wef-client-config.png diff --git a/windows/security/operating-system-security/device-management/override-mitigation-options-for-app-related-security-policies.md b/windows/security/operating-system-security/device-management/override-mitigation-options-for-app-related-security-policies.md new file mode 100644 index 0000000000..ada9f32a4e --- /dev/null +++ b/windows/security/operating-system-security/device-management/override-mitigation-options-for-app-related-security-policies.md @@ -0,0 +1,59 @@ +--- +title: Override Process Mitigation Options +description: How to use Group Policy to override individual Process Mitigation Options settings and to help enforce specific app-related security policies. +ms.localizationpriority: medium +ms.topic: how-to +ms.date: 12/22/2023 +--- + +# Override Process Mitigation Options to help enforce app-related security policies + +Windows includes group policy-configurable "Process Mitigation Options" that add advanced protections against memory-based attacks, that is, attacks where malware manipulates memory to gain control of a system. For example, malware might attempt to use buffer overruns to inject malicious executable code into memory, but Process Mitigation Options can prevent the running of the malicious code. + +> [!IMPORTANT] +> We recommend trying these mitigations in a test lab before deploying to your organization, to determine if they interfere with your organization's required apps. + +The Group Policy settings in this topic are related to three types of process mitigations. All three types are on by default for 64-bit applications, but by using the Group Policy settings described in this topic, you can configure more protections. The types of process mitigations are: + +- **Data Execution Prevention (DEP)** is a system-level memory protection feature that enables the operating system to mark one or more pages of memory as non-executable, preventing code from being run from that region of memory, to help prevent exploitation of buffer overruns. DEP helps prevent code from being run from data pages such as the default heap, stacks, and memory pools. For more information, see [Data Execution Prevention](../../threat-protection/overview-of-threat-mitigations-in-windows-10.md#data-execution-prevention). +- **Structured Exception Handling Overwrite Protection (SEHOP)** is designed to block exploits that use the Structured Exception Handler (SEH) overwrite technique. Because this protection mechanism is provided at run-time, it helps to protect apps regardless of whether they've been compiled with the latest improvements. For more information, see [Structured Exception Handling Overwrite Protection](../../threat-protection/overview-of-threat-mitigations-in-windows-10.md#structured-exception-handling-overwrite-protection). +- **Address Space Layout Randomization (ASLR)** loads DLLs into random memory addresses at boot time to mitigate against malware that's designed to attack specific memory locations, where specific DLLs are expected to be loaded. For more information, see [Address Space Layout Randomization](../../threat-protection/overview-of-threat-mitigations-in-windows-10.md#address-space-layout-randomization). To find more ASLR protections in the table below, look for `IMAGES` or `ASLR`. + +The following procedure describes how to use Group Policy to override individual **Process Mitigation Options** settings. + +**To modify Process Mitigation Options** + +1. Open your Group Policy editor and go to the **Administrative Templates\System\Mitigation Options\Process Mitigation Options** setting. + + ![Screenshot of the Group Policy editor: Process Mitigation Options with setting enabled and Show button active.](images/gp-process-mitigation-options.png) + +2. Click **Enabled**, and then in the **Options** area, click **Show** to open the **Show Contents** box, where you'll be able to add your apps and the appropriate bit flag values, as shown in the [Setting the bit field](#setting-the-bit-field) and [Example](#example) sections of this topic. + + > [!IMPORTANT] + > For each app you want to include, you must include: + > - **Value name.** The app file name, including the extension. For example, `iexplore.exe`. + > - **Value.** A bit field with a series of bit flags in particular positions. Bits can be set to `0` (where the setting is forced off), `1` (where the setting is forced on), or `?` (where the setting retains the previous, existing value). + > Setting bit flags in positions not specified here to anything other than `?` might cause undefined behavior. + + ![Screenshot of the Group Policy editor: Process Mitigation Options with Show Contents box and example text.](images/gp-process-mitigation-options-show.png) + +## Setting the bit field + +Here's a visual representation of the bit flag locations for the various Process Mitigation Options settings: + +![Visual representation of the bit flag locations for the Process Mitigation Options settings.](images/gp-process-mitigation-options-bit-flag-image.png) + +Where the bit flags are read from right to left and are defined as: + +| Flag | Bit location | Setting | Details | +|------|--------------|-----------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| A | 0 | `PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE (0x00000001)` | Turns on Data Execution Prevention (DEP) for child processes. | +| B | 1 | `PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE (0x00000002)` | Turns on DEP-ATL thunk emulation for child processes. DEP-ATL thunk emulation lets the system intercept non-executable (NX) faults that originate from the Active Template Library (ATL) thunk layer, and then emulate and handle the instructions so the process can continue to run. | +| C | 2 | `PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE (0x00000004)` | Turns on Structured Exception Handler Overwrite Protection (SEHOP) for child processes. SEHOP helps to block exploits that use the Structured Exception Handler (SEH) overwrite technique. | +| D | 8 | `PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON (0x00000100)` | Uses the force Address Space Layout Randomization (ASLR) setting to act as though an image base collision happened at load time, forcibly rebasing images that aren't dynamic base compatible. Images without the base relocation section won't be loaded if relocations are required. | +| E | 15 | `PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON (0x00010000)` | Turns on the bottom-up randomization policy, which includes stack randomization options and causes a random location to be used as the lowest user address. | +| F | 16 | `PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF (0x00020000)` | Turns off the bottom-up randomization policy, which includes stack randomization options and causes a random location to be used as the lowest user address. | + +### Example + +If you want to turn on the **PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE** and **PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON** settings, turn off the **PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF** setting, and leave everything else as the default values, you'd want to type a value of `???????????????0???????1???????1`. diff --git a/windows/security/operating-system-security/device-management/toc.yml b/windows/security/operating-system-security/device-management/toc.yml index 5af1dc4845..a8679a01ac 100644 --- a/windows/security/operating-system-security/device-management/toc.yml +++ b/windows/security/operating-system-security/device-management/toc.yml @@ -11,8 +11,8 @@ items: - name: More Windows security items: - name: Override Process Mitigation Options to help enforce app-related security policies - href: ../../threat-protection/override-mitigation-options-for-app-related-security-policies.md + href: override-mitigation-options-for-app-related-security-policies.md - name: Use Windows Event Forwarding to help with intrusion detection - href: ../../threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md + href: use-windows-event-forwarding-to-assist-in-intrusion-detection.md - name: Block untrusted fonts in an enterprise - href: ../../threat-protection/block-untrusted-fonts-in-enterprise.md + href: block-untrusted-fonts-in-enterprise.md diff --git a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md b/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection.md similarity index 91% rename from windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md rename to windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection.md index 3b1d1fd82f..100c5b8c1f 100644 --- a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md +++ b/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection.md @@ -1,22 +1,13 @@ --- -title: Use Windows Event Forwarding to help with intrusion detection +title: Use Windows Event Forwarding to help with intrusion detection description: Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. -ms.prod: windows-client -author: aczechowski -ms.author: aaroncz -manager: aaroncz -ms.date: 02/28/2019 ms.localizationpriority: medium -ms.technology: itpro-security ms.topic: how-to +ms.date: 12/22/2023 --- # Use Windows Event Forwarding to help with intrusion detection -**Applies to** -- Windows 10 -- Windows Server - Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. Windows Event Forwarding (WEF) reads any operational or administrative event log on a device in your organization and forwards the events you choose to a Windows Event Collector (WEC) server. @@ -36,13 +27,14 @@ Here's an approximate scaling guide for WEF events: | 0 - 5,000 | SQL or SEM | | 5,000 - 50,000 | SEM | | 50,000+ | Hadoop/HDInsight/Data Lake | - + Event generation on a device must be enabled either separately or as part of the GPO for the baseline WEF implementation, including enabling of disabled event logs and setting channel permissions. For more info, see [Appendix C - Event channel settings (enable and channel access) methods](#bkmk-appendixc). This condition is because WEF is a passive system regarding the event log. It can't change the size of event log files, enable disabled event channels, change channel permissions, or adjust a security audit policy. WEF only queries event channels for existing events. Additionally, having event generation already occurring on a device allows for more complete event collection building a complete history of system activity. Otherwise, you'll be limited to the speed of GPO and WEF subscription refresh cycles to make changes to what is being generated on the device. On modern devices, enabling more event channels and expanding the size of event log files hasn't resulted in noticeable performance differences. For the minimum recommended audit policy and registry system ACL settings, see [Appendix A - Minimum recommended minimum audit policy](#bkmk-appendixa) and [Appendix B - Recommended minimum registry system ACL policy](#bkmk-appendixb). ->**Note:**  These are only minimum values need to meet what the WEF subscription selects. - +> [!NOTE] +> These are only minimum values need to meet what the WEF subscription selects. + From a WEF subscription management perspective, the event queries provided should be used in two separate subscriptions for ease of maintenance; only machines meeting specific criteria would be allowed access to the targeted subscription, this access would be determined by an algorithm or an analysts' direction. All devices should have access to the Baseline subscription. This system of dual subscription means you would create two base subscriptions: @@ -52,9 +44,9 @@ This system of dual subscription means you would create two base subscriptions: Each using the respective event query below. For the Targeted subscription, enabling the "read existing events" option should be set to true to allow collection of existing events from systems. By default, WEF subscriptions will only forward events generated after the WEF subscription was received by the client. -In [Appendix E – Annotated Baseline Subscription Event Query](#bkmk-appendixe) and [Appendix F – Annotated Suspect Subscription Event Query](#bkmk-appendixf), the event query XML is included when creating WEF subscriptions. These subscriptions are annotated for query purpose and clarity. Individual <Query> element can be removed or edited without affecting the rest of the query. +In [Appendix E - Annotated Baseline Subscription Event Query](#bkmk-appendixe) and [Appendix F - Annotated Suspect Subscription Event Query](#bkmk-appendixf), the event query XML is included when creating WEF subscriptions. These subscriptions are annotated for query purpose and clarity. Individual `` element can be removed or edited without affecting the rest of the query. -### Common WEF questions +## Common WEF questions This section addresses common questions from IT pros and customers. @@ -91,13 +83,13 @@ The HTTPS option is available if certificate based authentication is used, in ca ### Do WEF Clients have a separate buffer for events? -The WEF client machines local event log is the buffer for WEF for when the connection to the WEC server is lost. To increase the "buffer size", increase the maximum file size of the specific event log file where events are being selected. For more info, see [Appendix C – Event Channel Settings (enable and Channel Access) methods](#bkmk-appendixc). +The WEF client machines local event log is the buffer for WEF for when the connection to the WEC server is lost. To increase the "buffer size", increase the maximum file size of the specific event log file where events are being selected. For more info, see [Appendix C - Event Channel Settings (enable and Channel Access) methods](#bkmk-appendixc). When the event log overwrites existing events (resulting in data loss if the device isn't connected to the Event Collector), there's no notification sent to the WEF collector that events are lost from the client. Neither is there an indicator that there was a gap encountered in the event stream. ### What format is used for forwarded events? -WEF has two modes for forwarded events. The default is "Rendered Text" that includes the textual description of the event as you would see it in Event Viewer. This description's inclusion means that the event size is effectively doubled or tripled depending on the size of the rendered description. The alternative mode is "Events" (also sometimes referred to as "Binary" format) – which is just the event XML itself sent in binary XML format (as it would be written to the evtx file.) This format is compact and can more than double the event volume a single WEC server can accommodate. +WEF has two modes for forwarded events. The default is "Rendered Text" that includes the textual description of the event as you would see it in Event Viewer. This description's inclusion means that the event size is effectively doubled or tripled depending on the size of the rendered description. The alternative mode is "Events" (also sometimes referred to as "Binary" format) - which is just the event XML itself sent in binary XML format (as it would be written to the evtx file.) This format is compact and can more than double the event volume a single WEC server can accommodate. A subscription "testSubscription" can be configured to use the Events format through the WECUTIL utility: @@ -108,21 +100,21 @@ Wecutil ss "testSubscription" /cf:Events ### How frequently are WEF events delivered? -Event delivery options are part of the WEF subscription configuration parameters – There are three built-in subscription delivery options: Normal, Minimize Bandwidth, and Minimize Latency. A fourth, catch-all called "Custom" is available but can't be selected or configured through the WEF UI by using Event Viewer. The Custom delivery option must be selected and configured using the WECUTIL.EXE command-line application. All subscription options define a maximum event count and maximum event age, if either limit is exceeded then the accumulated events are sent to the event collector. +Event delivery options are part of the WEF subscription configuration parameters - There are three built-in subscription delivery options: Normal, Minimize Bandwidth, and Minimize Latency. A fourth, catch-all called "Custom" is available but can't be selected or configured through the WEF UI by using Event Viewer. The Custom delivery option must be selected and configured using the WECUTIL.EXE command-line application. All subscription options define a maximum event count and maximum event age, if either limit is exceeded then the accumulated events are sent to the event collector. This table outlines the built-in delivery options: | Event delivery optimization options | Description | -| - | - | +|--|--| | Normal | This option ensures reliable delivery of events and doesn't attempt to conserve bandwidth. It's the appropriate choice unless you need tighter control over bandwidth usage or need forwarded events delivered as quickly as possible. It uses pull delivery mode, batches 5 items at a time and sets a batch timeout of 15 minutes. | | Minimize bandwidth | This option ensures that the use of network bandwidth for event delivery is strictly controlled. It's an appropriate choice if you want to limit the frequency of network connections made to deliver events. It uses push delivery mode and sets a batch timeout of 6 hours. In addition, it uses a heartbeat interval of 6 hours. | | Minimize latency | This option ensures that events are delivered with minimal delay. It's an appropriate choice if you're collecting alerts or critical events. It uses push delivery mode and sets a batch timeout of 30 seconds. | - + For more info about delivery options, see [Configure Advanced Subscription Settings](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc749167(v=ws.11)). The primary difference is in the latency which events are sent from the client. If none of the built-in options meet your requirements, you can set Custom event delivery options for a given subscription from an elevated command prompt: -``` syntax +```cmd @rem required to set the DeliveryMaxItems or DeliveryMaxLatencyTime Wecutil ss "SubscriptionNameGoesHere" /cm:Custom @rem set DeliveryMaxItems to 1 event @@ -134,13 +126,13 @@ Wecutil ss "SubscriptionNameGoesHere" /dmlt:10 For source initiated subscriptions: Each WEF subscription on a WEC server has its own ACL for machine accounts or security groups containing machine accounts (not user accounts) that are explicitly allowed to participate in that subscription or are explicitly denied access. This ACL applies to only a single WEF subscription (since there can be multiple WEF subscriptions on a given WEC server), other WEF Subscriptions have their own separate ACL. -For collector initiated subscriptions: The subscription contains the list of machines from which the WEC server is to collect events. This list is managed at the WEC server, and the credentials used for the subscription must have access to read event logs from the WEF Clients – the credentials can be either the machine account or a domain account. +For collector initiated subscriptions: The subscription contains the list of machines from which the WEC server is to collect events. This list is managed at the WEC server, and the credentials used for the subscription must have access to read event logs from the WEF Clients - the credentials can be either the machine account or a domain account. ### Can a client communicate to multiple WEF Event Collectors? Yes. If you desire a High-Availability environment, configure multiple WEC servers with the same subscription configuration and publish both WEC Server URIs to WEF clients. WEF Clients will forward events simultaneously to the configured subscriptions on the WEC servers, if they have the appropriate access. -### What are the WEC server's limitations? +### What are the WEC server's limitations? There are three factors that limit the scalability of WEC servers. The general rule for a stable WEC server on commodity hardware is planning for a total of 3,000 events per second on average for all configured subscriptions. @@ -158,7 +150,7 @@ Below lists all of the items that each subscription collects, the actual subscri ### Baseline subscription -While this subscription appears to be the largest subscription, it really is the lowest volume on a per-device basis. (Exceptions should be allowed for unusual devices – a device performing complex developer related tasks can be expected to create an unusually high volume of process create and AppLocker events.) This subscription doesn't require special configuration on client devices to enable event channels or modify channel permissions. +While this subscription appears to be the largest subscription, it really is the lowest volume on a per-device basis. (Exceptions should be allowed for unusual devices - a device performing complex developer related tasks can be expected to create an unusually high volume of process create and AppLocker events.) This subscription doesn't require special configuration on client devices to enable event channels or modify channel permissions. The subscription is essentially a collection of query statements applied to the Event Log. This subscription means that it's modular in nature and a given query statement can be removed or changed without impacting other query statement in the subscription. Additionally, suppress statements that filter out specific events, only apply within that query statement and aren't to the entire subscription. @@ -166,21 +158,21 @@ The subscription is essentially a collection of query statements applied to the To gain the most value out of the baseline subscription, we recommend having the following requirements set on the device to ensure that the clients are already generating the required events to be forwarded off the system. -- Apply a security audit policy that is a super-set of the recommended minimum audit policy. For more info, see [Appendix A – Minimum Recommended minimum Audit Policy](#bkmk-appendixa). This policy ensures that the security event log is generating the required events. +- Apply a security audit policy that is a super-set of the recommended minimum audit policy. For more info, see [Appendix A - Minimum Recommended minimum Audit Policy](#bkmk-appendixa). This policy ensures that the security event log is generating the required events. - Apply at least an Audit-Only AppLocker policy to devices. - If you're already allowing or restricting events by using AppLocker, then this requirement is met. - AppLocker events contain useful information, such as file hash and digital signature information for executables and scripts. - Enable disabled event channels and set the minimum size for modern event files. -- Currently, there's no GPO template for enabling or setting the maximum size for the modern event files. This threshold must be defined by using a GPO. For more info, see [Appendix C – Event Channel Settings (enable and Channel Access) methods](#bkmk-appendixc). +- Currently, there's no GPO template for enabling or setting the maximum size for the modern event files. This threshold must be defined by using a GPO. For more info, see [Appendix C - Event Channel Settings (enable and Channel Access) methods](#bkmk-appendixc). -The annotated event query can be found in the following. For more info, see [Appendix F – Annotated Suspect Subscription Event Query](#bkmk-appendixf). +The annotated event query can be found in the following. For more info, see [Appendix F - Annotated Suspect Subscription Event Query](#bkmk-appendixf). - Anti-malware events from Microsoft Antimalware or Windows Defender. These events can be configured for any given anti-malware product easily if it writes to the Windows event log. - Security event log Process Create events. - AppLocker Process Create events (EXE, script, packaged App installation and execution). -- Registry modification events. For more info, see [Appendix B – Recommended minimum Registry System ACL Policy](#bkmk-appendixb). +- Registry modification events. For more info, see [Appendix B - Recommended minimum Registry System ACL Policy](#bkmk-appendixb). - OS startup and shutdown - Startup events include operating system version, service pack level, QFE version, and boot mode. @@ -222,7 +214,7 @@ The annotated event query can be found in the following. For more info, see [App - Enables detection of unauthorized share creation. > [!NOTE] > All shares are re-created when the device starts. - + - Sign-in sessions - Sign-in success for interactive (local and Remote Interactive/Remote Desktop) @@ -367,7 +359,7 @@ If your organizational audit policy enables more auditing to meet its needs, tha | System | Security State Change | Success and Failure | | System | Security System Extension | Success and Failure | | System | System Integrity | Success and Failure | - + ## Appendix B - Recommended minimum registry system ACL policy The Run and RunOnce keys are useful for intruders and malware persistence. It allows code to be run (or run only once then removed, respectively) when a user signs in to the system. @@ -388,12 +380,12 @@ The recommended and most effective way to do this customization is configuring t The following GPO snippet performs the following tasks: -- Enables the **Microsoft-Windows-Capi2/Operational** event channel. -- Sets the maximum file size for **Microsoft-Windows-Capi2/Operational** to 100MB. -- Sets the maximum file size for **Microsoft-Windows-AppLocker/EXE and DLL** to 100 MB. -- Sets the maximum channel access for **Microsoft-Windows-Capi2/Operational** to include the built-in Event Log Readers security group. -- Enables the **Microsoft-Windows-DriverFrameworks-UserMode/Operational** event channel. -- Sets the maximum file size for **Microsoft-Windows-DriverFrameworks-UserMode/Operational** to 50 MB. +- Enables the **Microsoft-Windows-Capi2/Operational** event channel. +- Sets the maximum file size for **Microsoft-Windows-Capi2/Operational** to 100MB. +- Sets the maximum file size for **Microsoft-Windows-AppLocker/EXE and DLL** to 100 MB. +- Sets the maximum channel access for **Microsoft-Windows-Capi2/Operational** to include the built-in Event Log Readers security group. +- Enables the **Microsoft-Windows-DriverFrameworks-UserMode/Operational** event channel. +- Sets the maximum file size for **Microsoft-Windows-DriverFrameworks-UserMode/Operational** to 50 MB. ![configure event channels.](images/capi-gpo.png) @@ -418,7 +410,7 @@ Here are the minimum steps for WEF to operate: ![configure the wef client.](images/wef-client-config.png) -## Appendix E – Annotated baseline subscription event query +## Appendix E - Annotated baseline subscription event query ```xml @@ -588,7 +580,7 @@ Here are the minimum steps for WEF to operate: ``` -## Appendix F – Annotated Suspect Subscription Event Query +## Appendix F - Annotated Suspect Subscription Event Query ```xml @@ -617,7 +609,7 @@ Here are the minimum steps for WEF to operate: - + @@ -658,12 +650,11 @@ Here are the minimum steps for WEF to operate: ``` -## Appendix G - Online resources +## Appendix G - Online resources You can get more info with the following links: -- [Event Selection](/previous-versions//aa385231(v=vs.85)) -- [Event Queries and Event XML](/previous-versions/bb399427(v=vs.90)) -- [Event Query Schema](/windows/win32/wes/queryschema-schema) -- [Windows Event Collector](/windows/win32/wec/windows-event-collector) -- [4625(F): An account failed to log on](auditing/event-4625.md) +- [Event Selection](/previous-versions//aa385231(v=vs.85)) +- [Event Queries and Event XML](/previous-versions/bb399427(v=vs.90)) +- [Event Query Schema](/windows/win32/wes/queryschema-schema) +- [Windows Event Collector](/windows/win32/wec/windows-event-collector) diff --git a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/get-support-for-security-baselines.md b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/get-support-for-security-baselines.md index 1e17d437e3..7325710e0c 100644 --- a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/get-support-for-security-baselines.md +++ b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/get-support-for-security-baselines.md @@ -64,8 +64,8 @@ No. SCM supported only SCAP 1.0, which wasn't updated as SCAP evolved. The new t | Name | Details | Security Tools | |--|--|--| -| Microsoft 365 Apps for enterprise, version 2206 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-365-apps-for-enterprise-v2206/ba-p/3502714) | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | -| Microsoft Edge, version 107 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v98/ba-p/3165443) | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | +| Microsoft 365 Apps for enterprise, version 2306 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-m365-apps-for-enterprise-v2306/ba-p/3858702) | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | +| Microsoft Edge, version 117 | [SecGuide](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-117/ba-p/3930862) | [SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319) | ## Related articles diff --git a/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md b/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md index 92d8638c40..60dd8c3517 100644 --- a/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md +++ b/windows/security/operating-system-security/network-security/vpn/vpn-authentication.md @@ -74,7 +74,7 @@ For a UWP VPN plug-in, the app vendor controls the authentication method to be u See [EAP configuration](/windows/client-management/mdm/eap-configuration) for EAP XML configuration. >[!NOTE] ->To configure Windows Hello for Business authentication, follow the steps in [EAP configuration](/windows/client-management/mdm/eap-configuration) to create a smart card certificate. [Learn more about Windows Hello for Business.](../../../identity-protection/hello-for-business/hello-identity-verification.md). +>To configure Windows Hello for Business authentication, follow the steps in [EAP configuration](/windows/client-management/mdm/eap-configuration) to create a smart card certificate. [Learn more about Windows Hello for Business.](../../../identity-protection/hello-for-business/index.md). The following image shows the field for EAP XML in a Microsoft Intune VPN profile. The EAP XML field only appears when you select a built-in connection type (automatic, IKEv2, L2TP, PPTP). diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md index 0282a7bcb2..6f077f8f37 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md @@ -11,7 +11,7 @@ ms.topic: article The **Account protection** section contains information and settings for account protection and sign-in. You can get more information about these capabilities from the following list: - [Microsoft Account](https://account.microsoft.com/account/faq) -- [Windows Hello for Business](../../../identity-protection/hello-for-business/hello-identity-verification.md) +- [Windows Hello for Business](../../../identity-protection/hello-for-business/index.md) - [Lock your Windows 10 PC automatically when you step away from it](https://support.microsoft.com/help/4028111/windows-lock-your-windows-10-pc-automatically-when-you-step-away-from) You can also choose to hide the section from users of the device, if you don't want your employees to access or view user-configured options for these features. diff --git a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md index eaa7ed73d3..4c63211e0c 100644 --- a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md @@ -3,7 +3,6 @@ title: Advanced security audit policy settings description: This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. ms.assetid: 93b28b92-796f-4036-a53b-8b9e80f9f171 ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -12,7 +11,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/06/2021 -ms.technology: itpro-security --- # Advanced security audit policy settings (Windows 10) diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.yml b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.yml index 9b46b2d3a3..768de067a0 100644 --- a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.yml +++ b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.yml @@ -2,13 +2,11 @@ metadata: title: Advanced security auditing FAQ description: This article lists common questions and answers about understanding, deploying, and managing security audit policies. - ms.prod: windows-client author: vinaypamnani-msft ms.author: vinpa manager: aaroncz ms.topic: faq ms.date: 05/24/2022 - ms.technology: itpro-security title: Advanced security auditing FAQ diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing.md b/windows/security/threat-protection/auditing/advanced-security-auditing.md index 1aed416fd1..84c93ea504 100644 --- a/windows/security/threat-protection/auditing/advanced-security-auditing.md +++ b/windows/security/threat-protection/auditing/advanced-security-auditing.md @@ -4,7 +4,6 @@ description: Advanced security audit policy settings might appear to overlap wit ms.assetid: 6FE8AC10-F48E-4BBF-979B-43A5DFDC5DFC ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/6/2021 -ms.technology: itpro-security --- # Advanced security audit policies diff --git a/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md b/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md index e27eedd443..2ddc4a8249 100644 --- a/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md +++ b/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md @@ -2,7 +2,6 @@ title: Appendix A, Security monitoring recommendations for many audit events description: Learn about recommendations for the type of monitoring required for certain classes of security audit events. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/06/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md index d8dcb28e30..5e7b8bfd19 100644 --- a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md +++ b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md @@ -4,7 +4,6 @@ description: Apply audit policies to individual files and folders on your comput ms.assetid: 565E7249-5CD0-4B2E-B2C0-B3A0793A51E2 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -17,7 +16,6 @@ ms.collection: - tier3 ms.topic: reference ms.date: 09/06/2021 -ms.technology: itpro-security --- # Apply a basic audit policy on a file or folder diff --git a/windows/security/threat-protection/auditing/audit-account-lockout.md b/windows/security/threat-protection/auditing/audit-account-lockout.md index 5f21d6eab6..e4bbde6028 100644 --- a/windows/security/threat-protection/auditing/audit-account-lockout.md +++ b/windows/security/threat-protection/auditing/audit-account-lockout.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-application-generated.md b/windows/security/threat-protection/auditing/audit-application-generated.md index ad5c87de63..3c22b0237f 100644 --- a/windows/security/threat-protection/auditing/audit-application-generated.md +++ b/windows/security/threat-protection/auditing/audit-application-generated.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-application-group-management.md b/windows/security/threat-protection/auditing/audit-application-group-management.md index 9fb1c10453..fd489adaac 100644 --- a/windows/security/threat-protection/auditing/audit-application-group-management.md +++ b/windows/security/threat-protection/auditing/audit-application-group-management.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-audit-policy-change.md b/windows/security/threat-protection/auditing/audit-audit-policy-change.md index be89c50a5a..d1291e568e 100644 --- a/windows/security/threat-protection/auditing/audit-audit-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-audit-policy-change.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-authentication-policy-change.md b/windows/security/threat-protection/auditing/audit-authentication-policy-change.md index 2b14cd5e29..7ab38720e0 100644 --- a/windows/security/threat-protection/auditing/audit-authentication-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-authentication-policy-change.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-authorization-policy-change.md b/windows/security/threat-protection/auditing/audit-authorization-policy-change.md index b86b2d9b6b..5ad0e5fff3 100644 --- a/windows/security/threat-protection/auditing/audit-authorization-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-authorization-policy-change.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md b/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md index b330e72006..dbadfb80dd 100644 --- a/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md +++ b/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-certification-services.md b/windows/security/threat-protection/auditing/audit-certification-services.md index cb33e2480b..1818d6abea 100644 --- a/windows/security/threat-protection/auditing/audit-certification-services.md +++ b/windows/security/threat-protection/auditing/audit-certification-services.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-computer-account-management.md b/windows/security/threat-protection/auditing/audit-computer-account-management.md index 78bd0d1701..836f66077c 100644 --- a/windows/security/threat-protection/auditing/audit-computer-account-management.md +++ b/windows/security/threat-protection/auditing/audit-computer-account-management.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-credential-validation.md b/windows/security/threat-protection/auditing/audit-credential-validation.md index 3d6283d2ab..776717c166 100644 --- a/windows/security/threat-protection/auditing/audit-credential-validation.md +++ b/windows/security/threat-protection/auditing/audit-credential-validation.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md b/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md index d909d6ba62..7f07a68413 100644 --- a/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md +++ b/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-detailed-file-share.md b/windows/security/threat-protection/auditing/audit-detailed-file-share.md index bb87079a1b..0b41ec8acd 100644 --- a/windows/security/threat-protection/auditing/audit-detailed-file-share.md +++ b/windows/security/threat-protection/auditing/audit-detailed-file-share.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-directory-service-access.md b/windows/security/threat-protection/auditing/audit-directory-service-access.md index 0576b52401..2a83b4b3ec 100644 --- a/windows/security/threat-protection/auditing/audit-directory-service-access.md +++ b/windows/security/threat-protection/auditing/audit-directory-service-access.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-directory-service-changes.md b/windows/security/threat-protection/auditing/audit-directory-service-changes.md index d2b294d326..d746cc2a12 100644 --- a/windows/security/threat-protection/auditing/audit-directory-service-changes.md +++ b/windows/security/threat-protection/auditing/audit-directory-service-changes.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-directory-service-replication.md b/windows/security/threat-protection/auditing/audit-directory-service-replication.md index bae794b8c0..c3efe2134f 100644 --- a/windows/security/threat-protection/auditing/audit-directory-service-replication.md +++ b/windows/security/threat-protection/auditing/audit-directory-service-replication.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-distribution-group-management.md b/windows/security/threat-protection/auditing/audit-distribution-group-management.md index e254cd23b0..87cfeca376 100644 --- a/windows/security/threat-protection/auditing/audit-distribution-group-management.md +++ b/windows/security/threat-protection/auditing/audit-distribution-group-management.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-dpapi-activity.md b/windows/security/threat-protection/auditing/audit-dpapi-activity.md index edc400cd02..f7a7cf3eaa 100644 --- a/windows/security/threat-protection/auditing/audit-dpapi-activity.md +++ b/windows/security/threat-protection/auditing/audit-dpapi-activity.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-file-share.md b/windows/security/threat-protection/auditing/audit-file-share.md index 65ea03ef20..c57ba2e002 100644 --- a/windows/security/threat-protection/auditing/audit-file-share.md +++ b/windows/security/threat-protection/auditing/audit-file-share.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-file-system.md b/windows/security/threat-protection/auditing/audit-file-system.md index 18e5b32a55..689b7bd0e5 100644 --- a/windows/security/threat-protection/auditing/audit-file-system.md +++ b/windows/security/threat-protection/auditing/audit-file-system.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md b/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md index 2edf237cad..8393e5be1c 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md b/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md index a3d70e667a..9c77101ee8 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md b/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md index fe1236b0e6..9ab9af405b 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-group-membership.md b/windows/security/threat-protection/auditing/audit-group-membership.md index b5531fb996..771769f0be 100644 --- a/windows/security/threat-protection/auditing/audit-group-membership.md +++ b/windows/security/threat-protection/auditing/audit-group-membership.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-handle-manipulation.md b/windows/security/threat-protection/auditing/audit-handle-manipulation.md index 081f3a3d34..2452d552c4 100644 --- a/windows/security/threat-protection/auditing/audit-handle-manipulation.md +++ b/windows/security/threat-protection/auditing/audit-handle-manipulation.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-ipsec-driver.md b/windows/security/threat-protection/auditing/audit-ipsec-driver.md index 1719e81ee6..20882eebbc 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-driver.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-driver.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md index 0e2168d0f5..45b5d1ef63 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md index 81cfde4d9d..f1c660e1e8 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md index 0ee38a23f7..c456fc1f21 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md b/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md index bd54abd7d0..6ec1fcf9e4 100644 --- a/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md +++ b/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md b/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md index f942a116de..2d13eeaf23 100644 --- a/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md +++ b/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-kernel-object.md b/windows/security/threat-protection/auditing/audit-kernel-object.md index afb2069653..ae38545e9f 100644 --- a/windows/security/threat-protection/auditing/audit-kernel-object.md +++ b/windows/security/threat-protection/auditing/audit-kernel-object.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-logoff.md b/windows/security/threat-protection/auditing/audit-logoff.md index 8c631d2e0a..0525d84b24 100644 --- a/windows/security/threat-protection/auditing/audit-logoff.md +++ b/windows/security/threat-protection/auditing/audit-logoff.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-logon.md b/windows/security/threat-protection/auditing/audit-logon.md index fcd5e254ef..1437ead2f9 100644 --- a/windows/security/threat-protection/auditing/audit-logon.md +++ b/windows/security/threat-protection/auditing/audit-logon.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md b/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md index a6f72640dc..d00998a052 100644 --- a/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-network-policy-server.md b/windows/security/threat-protection/auditing/audit-network-policy-server.md index 8c46beb77a..9af80769b0 100644 --- a/windows/security/threat-protection/auditing/audit-network-policy-server.md +++ b/windows/security/threat-protection/auditing/audit-network-policy-server.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md b/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md index 298b8a5061..937e8bc34c 100644 --- a/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md +++ b/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-other-account-logon-events.md b/windows/security/threat-protection/auditing/audit-other-account-logon-events.md index 664c5f6b17..9b973c0b7b 100644 --- a/windows/security/threat-protection/auditing/audit-other-account-logon-events.md +++ b/windows/security/threat-protection/auditing/audit-other-account-logon-events.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-other-account-management-events.md b/windows/security/threat-protection/auditing/audit-other-account-management-events.md index 68fa5e72ef..670cf6612d 100644 --- a/windows/security/threat-protection/auditing/audit-other-account-management-events.md +++ b/windows/security/threat-protection/auditing/audit-other-account-management-events.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md b/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md index 075d245ab1..86e40c99ae 100644 --- a/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md +++ b/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-other-object-access-events.md b/windows/security/threat-protection/auditing/audit-other-object-access-events.md index fc6e2dbd2e..5807ad6849 100644 --- a/windows/security/threat-protection/auditing/audit-other-object-access-events.md +++ b/windows/security/threat-protection/auditing/audit-other-object-access-events.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-other-policy-change-events.md b/windows/security/threat-protection/auditing/audit-other-policy-change-events.md index 8f78be458c..b05830fca8 100644 --- a/windows/security/threat-protection/auditing/audit-other-policy-change-events.md +++ b/windows/security/threat-protection/auditing/audit-other-policy-change-events.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md index d7b89004e2..123145fdaf 100644 --- a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md +++ b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-other-system-events.md b/windows/security/threat-protection/auditing/audit-other-system-events.md index 9c768d486b..5472834fd9 100644 --- a/windows/security/threat-protection/auditing/audit-other-system-events.md +++ b/windows/security/threat-protection/auditing/audit-other-system-events.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-pnp-activity.md b/windows/security/threat-protection/auditing/audit-pnp-activity.md index b0f231d898..bd82df1b1e 100644 --- a/windows/security/threat-protection/auditing/audit-pnp-activity.md +++ b/windows/security/threat-protection/auditing/audit-pnp-activity.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-process-creation.md b/windows/security/threat-protection/auditing/audit-process-creation.md index 53eec87d8c..c19e613f2c 100644 --- a/windows/security/threat-protection/auditing/audit-process-creation.md +++ b/windows/security/threat-protection/auditing/audit-process-creation.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 03/16/2022 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-process-termination.md b/windows/security/threat-protection/auditing/audit-process-termination.md index 0a9089db1f..0ecd8f1351 100644 --- a/windows/security/threat-protection/auditing/audit-process-termination.md +++ b/windows/security/threat-protection/auditing/audit-process-termination.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-registry.md b/windows/security/threat-protection/auditing/audit-registry.md index 418fda413d..a4cea25938 100644 --- a/windows/security/threat-protection/auditing/audit-registry.md +++ b/windows/security/threat-protection/auditing/audit-registry.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 01/05/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-removable-storage.md b/windows/security/threat-protection/auditing/audit-removable-storage.md index faa143e4c6..5ef92d1b38 100644 --- a/windows/security/threat-protection/auditing/audit-removable-storage.md +++ b/windows/security/threat-protection/auditing/audit-removable-storage.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-rpc-events.md b/windows/security/threat-protection/auditing/audit-rpc-events.md index 1b6a9b69ca..b5dd671672 100644 --- a/windows/security/threat-protection/auditing/audit-rpc-events.md +++ b/windows/security/threat-protection/auditing/audit-rpc-events.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-sam.md b/windows/security/threat-protection/auditing/audit-sam.md index 4eb4577d13..c0253c800f 100644 --- a/windows/security/threat-protection/auditing/audit-sam.md +++ b/windows/security/threat-protection/auditing/audit-sam.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-security-group-management.md b/windows/security/threat-protection/auditing/audit-security-group-management.md index 8fd69b4b8a..ce479065a5 100644 --- a/windows/security/threat-protection/auditing/audit-security-group-management.md +++ b/windows/security/threat-protection/auditing/audit-security-group-management.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-security-state-change.md b/windows/security/threat-protection/auditing/audit-security-state-change.md index 93830b3271..c1a71e863e 100644 --- a/windows/security/threat-protection/auditing/audit-security-state-change.md +++ b/windows/security/threat-protection/auditing/audit-security-state-change.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-security-system-extension.md b/windows/security/threat-protection/auditing/audit-security-system-extension.md index ceef6d3134..a058f09795 100644 --- a/windows/security/threat-protection/auditing/audit-security-system-extension.md +++ b/windows/security/threat-protection/auditing/audit-security-system-extension.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md b/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md index becca46597..3f5fa3f97d 100644 --- a/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md +++ b/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-special-logon.md b/windows/security/threat-protection/auditing/audit-special-logon.md index 12308ff6e3..291c011a68 100644 --- a/windows/security/threat-protection/auditing/audit-special-logon.md +++ b/windows/security/threat-protection/auditing/audit-special-logon.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-system-integrity.md b/windows/security/threat-protection/auditing/audit-system-integrity.md index 8d64f386ff..85cd8f762c 100644 --- a/windows/security/threat-protection/auditing/audit-system-integrity.md +++ b/windows/security/threat-protection/auditing/audit-system-integrity.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-token-right-adjusted.md b/windows/security/threat-protection/auditing/audit-token-right-adjusted.md index 1b9208a8d5..ca2b5b0186 100644 --- a/windows/security/threat-protection/auditing/audit-token-right-adjusted.md +++ b/windows/security/threat-protection/auditing/audit-token-right-adjusted.md @@ -5,8 +5,6 @@ manager: aaroncz author: vinaypamnani-msft ms.author: vinpa ms.pagetype: security -ms.prod: windows-client -ms.technology: itpro-security ms.date: 12/31/2017 ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-user-account-management.md b/windows/security/threat-protection/auditing/audit-user-account-management.md index a504763fe3..22bd1134da 100644 --- a/windows/security/threat-protection/auditing/audit-user-account-management.md +++ b/windows/security/threat-protection/auditing/audit-user-account-management.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/audit-user-device-claims.md b/windows/security/threat-protection/auditing/audit-user-device-claims.md index 27e1a7f23d..748184d302 100644 --- a/windows/security/threat-protection/auditing/audit-user-device-claims.md +++ b/windows/security/threat-protection/auditing/audit-user-device-claims.md @@ -6,13 +6,11 @@ ms.reviewer: manager: aaroncz ms.author: vinpa ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/06/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md index 017fb5ec82..7c8b3b1d1a 100644 --- a/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md @@ -4,7 +4,6 @@ description: Determines whether to audit each instance of a user logging on to o ms.assetid: 84B44181-E325-49A1-8398-AECC3CE0A516 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/06/2021 -ms.technology: itpro-security --- # Audit account logon events diff --git a/windows/security/threat-protection/auditing/basic-audit-account-management.md b/windows/security/threat-protection/auditing/basic-audit-account-management.md index e3e8fa199c..0f902b9980 100644 --- a/windows/security/threat-protection/auditing/basic-audit-account-management.md +++ b/windows/security/threat-protection/auditing/basic-audit-account-management.md @@ -4,7 +4,6 @@ description: Determines whether to audit each event of account management on a d ms.assetid: 369197E1-7E0E-45A4-89EA-16D91EF01689 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/06/2021 -ms.technology: itpro-security --- # Audit account management diff --git a/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md b/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md index 82647ef71b..fb7213123d 100644 --- a/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md +++ b/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md @@ -4,7 +4,6 @@ description: Determines whether to audit the event of a user accessing an Active ms.assetid: 52F02EED-3CFE-4307-8D06-CF1E27693D09 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/06/2021 -ms.technology: itpro-security --- # Audit directory service access diff --git a/windows/security/threat-protection/auditing/basic-audit-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-logon-events.md index 4b5e68258f..6019102b0e 100644 --- a/windows/security/threat-protection/auditing/basic-audit-logon-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-logon-events.md @@ -4,7 +4,6 @@ description: Determines whether to audit each instance of a user logging on to o ms.assetid: 78B5AFCB-0BBD-4C38-9FE9-6B4571B94A35 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -17,7 +16,6 @@ ms.collection: - tier3 ms.topic: reference ms.date: 09/06/2021 -ms.technology: itpro-security --- # Audit logon events diff --git a/windows/security/threat-protection/auditing/basic-audit-object-access.md b/windows/security/threat-protection/auditing/basic-audit-object-access.md index 66a2833e20..a27f9b77a0 100644 --- a/windows/security/threat-protection/auditing/basic-audit-object-access.md +++ b/windows/security/threat-protection/auditing/basic-audit-object-access.md @@ -4,7 +4,6 @@ description: The policy setting, Audit object access, determines whether to audi ms.assetid: D15B6D67-7886-44C2-9972-3F192D5407EA ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/06/2021 -ms.technology: itpro-security --- # Audit object access diff --git a/windows/security/threat-protection/auditing/basic-audit-policy-change.md b/windows/security/threat-protection/auditing/basic-audit-policy-change.md index 4db162688d..c8c2ed48d0 100644 --- a/windows/security/threat-protection/auditing/basic-audit-policy-change.md +++ b/windows/security/threat-protection/auditing/basic-audit-policy-change.md @@ -4,7 +4,6 @@ description: Determines whether to audit every incident of a change to user righ ms.assetid: 1025A648-6B22-4C85-9F47-FE0897F1FA31 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/06/2021 -ms.technology: itpro-security --- # Audit policy change diff --git a/windows/security/threat-protection/auditing/basic-audit-privilege-use.md b/windows/security/threat-protection/auditing/basic-audit-privilege-use.md index 11a05ab720..1275bd3206 100644 --- a/windows/security/threat-protection/auditing/basic-audit-privilege-use.md +++ b/windows/security/threat-protection/auditing/basic-audit-privilege-use.md @@ -4,7 +4,6 @@ description: Determines whether to audit each instance of a user exercising a us ms.assetid: C5C6DAAF-8B58-4DFB-B1CE-F0675AE0E9F8 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/06/2021 -ms.technology: itpro-security --- # Audit privilege use diff --git a/windows/security/threat-protection/auditing/basic-audit-process-tracking.md b/windows/security/threat-protection/auditing/basic-audit-process-tracking.md index 796e7f323f..71a2c2735c 100644 --- a/windows/security/threat-protection/auditing/basic-audit-process-tracking.md +++ b/windows/security/threat-protection/auditing/basic-audit-process-tracking.md @@ -4,7 +4,6 @@ description: Determines whether to audit detailed tracking information for event ms.assetid: 91AC5C1E-F4DA-4B16-BEE2-C92D66E4CEEA ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/06/2021 -ms.technology: itpro-security --- # Audit process tracking diff --git a/windows/security/threat-protection/auditing/basic-audit-system-events.md b/windows/security/threat-protection/auditing/basic-audit-system-events.md index c3a231e65c..d29c89b90f 100644 --- a/windows/security/threat-protection/auditing/basic-audit-system-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-system-events.md @@ -4,7 +4,6 @@ description: Determines whether to audit when a user restarts or shuts down the ms.assetid: BF27588C-2AA7-4365-A4BF-3BB377916447 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/06/2021 -ms.technology: itpro-security --- # Audit system events diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policies.md b/windows/security/threat-protection/auditing/basic-security-audit-policies.md index 93ea3850e5..a238c70e5c 100644 --- a/windows/security/threat-protection/auditing/basic-security-audit-policies.md +++ b/windows/security/threat-protection/auditing/basic-security-audit-policies.md @@ -4,7 +4,6 @@ description: Learn about basic security audit policies that specify the categori ms.assetid: 3B678568-7AD7-4734-9BB4-53CF5E04E1D3 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/06/2021 -ms.technology: itpro-security --- # Basic security audit policies diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md index 70b4c9c798..1b496de6ee 100644 --- a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md @@ -4,7 +4,6 @@ description: Basic security audit policy settings are found under Computer Confi ms.assetid: 31C2C453-2CFC-4D9E-BC88-8CE1C1A8F900 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/06/2021 -ms.technology: itpro-security --- # Basic security audit policy settings diff --git a/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md b/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md index 90f66f7720..0dbeef18fc 100644 --- a/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md +++ b/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md @@ -4,7 +4,6 @@ description: By defining auditing settings for specific event categories, you ca ms.assetid: C9F52751-B40D-482E-BE9D-2C61098249D3 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/07/2021 -ms.technology: itpro-security --- # Create a basic audit policy for an event category diff --git a/windows/security/threat-protection/auditing/event-1100.md b/windows/security/threat-protection/auditing/event-1100.md index c243b5aac7..fd669405ba 100644 --- a/windows/security/threat-protection/auditing/event-1100.md +++ b/windows/security/threat-protection/auditing/event-1100.md @@ -2,7 +2,6 @@ title: 1100(S) The event logging service has shut down. description: Describes security event 1100(S) The event logging service has shut down. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-1102.md b/windows/security/threat-protection/auditing/event-1102.md index f576776df5..3f66f12f17 100644 --- a/windows/security/threat-protection/auditing/event-1102.md +++ b/windows/security/threat-protection/auditing/event-1102.md @@ -2,7 +2,6 @@ title: 1102(S) The audit log was cleared. description: Though you shouldn't normally see it, this event generates every time Windows Security audit log is cleared. This is for event 1102(S). ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-1104.md b/windows/security/threat-protection/auditing/event-1104.md index bb5e126fa3..60114513f7 100644 --- a/windows/security/threat-protection/auditing/event-1104.md +++ b/windows/security/threat-protection/auditing/event-1104.md @@ -2,7 +2,6 @@ title: 1104(S) The security log is now full. description: This event generates every time Windows security log becomes full and the event log retention method is set to Do not overwrite events. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-1105.md b/windows/security/threat-protection/auditing/event-1105.md index 52cf7ef880..ab01840a97 100644 --- a/windows/security/threat-protection/auditing/event-1105.md +++ b/windows/security/threat-protection/auditing/event-1105.md @@ -2,7 +2,6 @@ title: 1105(S) Event log automatic backup. description: This event generates every time Windows security log becomes full and new event log file was created. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-1108.md b/windows/security/threat-protection/auditing/event-1108.md index 82f001a25b..df61026142 100644 --- a/windows/security/threat-protection/auditing/event-1108.md +++ b/windows/security/threat-protection/auditing/event-1108.md @@ -2,7 +2,6 @@ title: The event logging service encountered an error description: Describes security event 1108(S) The event logging service encountered an error while processing an incoming event published from %1. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4608.md b/windows/security/threat-protection/auditing/event-4608.md index fe0e35c6f0..4d229afc2d 100644 --- a/windows/security/threat-protection/auditing/event-4608.md +++ b/windows/security/threat-protection/auditing/event-4608.md @@ -2,7 +2,6 @@ title: 4608(S) Windows is starting up. description: Describes security event 4608(S) Windows is starting up. This event is logged when the LSASS.EXE process starts and the auditing subsystem is initialized. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4610.md b/windows/security/threat-protection/auditing/event-4610.md index d30d8aa1fe..a277e58ec7 100644 --- a/windows/security/threat-protection/auditing/event-4610.md +++ b/windows/security/threat-protection/auditing/event-4610.md @@ -2,7 +2,6 @@ title: 4610(S) An authentication package has been loaded by the Local Security Authority. description: Describes security event 4610(S) An authentication package has been loaded by the Local Security Authority. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4611.md b/windows/security/threat-protection/auditing/event-4611.md index 2730d51adc..27574efa40 100644 --- a/windows/security/threat-protection/auditing/event-4611.md +++ b/windows/security/threat-protection/auditing/event-4611.md @@ -2,7 +2,6 @@ title: 4611(S) A trusted logon process has been registered with the Local Security Authority. description: Describes security event 4611(S) A trusted logon process has been registered with the Local Security Authority. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4612.md b/windows/security/threat-protection/auditing/event-4612.md index 5be5bf7008..fba5b23479 100644 --- a/windows/security/threat-protection/auditing/event-4612.md +++ b/windows/security/threat-protection/auditing/event-4612.md @@ -2,7 +2,6 @@ title: 4612(S) Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. description: Describes security event 4612(S) Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4614.md b/windows/security/threat-protection/auditing/event-4614.md index 03a7376a53..7742a34ee9 100644 --- a/windows/security/threat-protection/auditing/event-4614.md +++ b/windows/security/threat-protection/auditing/event-4614.md @@ -2,7 +2,6 @@ title: 4614(S) A notification package has been loaded by the Security Account Manager. description: Describes security event 4614(S) A notification package has been loaded by the Security Account Manager. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4615.md b/windows/security/threat-protection/auditing/event-4615.md index 3032b10d53..c8a16371bd 100644 --- a/windows/security/threat-protection/auditing/event-4615.md +++ b/windows/security/threat-protection/auditing/event-4615.md @@ -2,7 +2,6 @@ title: 4615(S) Invalid use of LPC port. description: Describes security event 4615(S) Invalid use of LPC port. It appears that the Invalid use of LPC port event never occurs. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4616.md b/windows/security/threat-protection/auditing/event-4616.md index 62f34dc232..91890bb297 100644 --- a/windows/security/threat-protection/auditing/event-4616.md +++ b/windows/security/threat-protection/auditing/event-4616.md @@ -2,7 +2,6 @@ title: 4616(S) The system time was changed. description: Describes security event 4616(S) The system time was changed. This event is generated every time system time is changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4618.md b/windows/security/threat-protection/auditing/event-4618.md index 0871962990..888ba46e90 100644 --- a/windows/security/threat-protection/auditing/event-4618.md +++ b/windows/security/threat-protection/auditing/event-4618.md @@ -2,7 +2,6 @@ title: 4618(S) A monitored security event pattern has occurred. description: Describes security event 4618(S) A monitored security event pattern has occurred. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4621.md b/windows/security/threat-protection/auditing/event-4621.md index 3d5e633672..23a502abad 100644 --- a/windows/security/threat-protection/auditing/event-4621.md +++ b/windows/security/threat-protection/auditing/event-4621.md @@ -2,7 +2,6 @@ title: 4621(S) Administrator recovered system from CrashOnAuditFail. description: Describes security event 4621(S) Administrator recovered system from CrashOnAuditFail. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4622.md b/windows/security/threat-protection/auditing/event-4622.md index 6fbd529f39..c55bf6a9b2 100644 --- a/windows/security/threat-protection/auditing/event-4622.md +++ b/windows/security/threat-protection/auditing/event-4622.md @@ -2,7 +2,6 @@ title: 4622(S) A security package has been loaded by the Local Security Authority. description: Describes security event 4622(S) A security package has been loaded by the Local Security Authority. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md index 244371e389..07fdf70e44 100644 --- a/windows/security/threat-protection/auditing/event-4624.md +++ b/windows/security/threat-protection/auditing/event-4624.md @@ -2,7 +2,6 @@ title: 4624(S) An account was successfully logged on. description: Describes security event 4624(S) An account was successfully logged on. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.collection: - highpri - tier3 @@ -252,6 +250,9 @@ This event generates when a logon session is created (on destination machine). I - **Source Port** [Type = UnicodeString]: source port which was used for logon attempt from remote machine. - 0 for interactive logons. + + > [!NOTE] + The fields for IP address/port and workstation name are populated depending on the authentication context and protocol used. LSASS will audit the information the authenticating service shares with LSASS. For example, network logons with Kerberos likely have no workstation information, and NTLM logons have no TCP/IP details. **Detailed Authentication Information:** diff --git a/windows/security/threat-protection/auditing/event-4625.md b/windows/security/threat-protection/auditing/event-4625.md index 702684a0a3..0cb398d228 100644 --- a/windows/security/threat-protection/auditing/event-4625.md +++ b/windows/security/threat-protection/auditing/event-4625.md @@ -2,7 +2,6 @@ title: 4625(F) An account failed to log on. description: Describes security event 4625(F) An account failed to log on. This event is generated if an account logon attempt failed for a locked out account. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 01/03/2022 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.collection: - highpri - tier3 diff --git a/windows/security/threat-protection/auditing/event-4626.md b/windows/security/threat-protection/auditing/event-4626.md index fc6a96544c..3e4a81e7d5 100644 --- a/windows/security/threat-protection/auditing/event-4626.md +++ b/windows/security/threat-protection/auditing/event-4626.md @@ -2,7 +2,6 @@ title: 4626(S) User/Device claims information. description: Describes security event 4626(S) User/Device claims information. This event is generated for new account logons. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4627.md b/windows/security/threat-protection/auditing/event-4627.md index 739f621949..bb08d6bfd0 100644 --- a/windows/security/threat-protection/auditing/event-4627.md +++ b/windows/security/threat-protection/auditing/event-4627.md @@ -2,7 +2,6 @@ title: 4627(S) Group membership information. description: Describes security event 4627(S) Group membership information. This event is generated with event 4624(S) An account was successfully logged on. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4634.md b/windows/security/threat-protection/auditing/event-4634.md index 0c24208115..6d1dd284e6 100644 --- a/windows/security/threat-protection/auditing/event-4634.md +++ b/windows/security/threat-protection/auditing/event-4634.md @@ -2,7 +2,6 @@ title: 4634(S) An account was logged off. description: Describes security event 4634(S) An account was logged off. This event is generated when a logon session is terminated and no longer exists. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4647.md b/windows/security/threat-protection/auditing/event-4647.md index 6a346735b9..d7ba93610b 100644 --- a/windows/security/threat-protection/auditing/event-4647.md +++ b/windows/security/threat-protection/auditing/event-4647.md @@ -2,7 +2,6 @@ title: 4647(S) User initiated logoff. description: Describes security event 4647(S) User initiated logoff. This event is generated when a logoff is initiated. No further user-initiated activity can occur. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4648.md b/windows/security/threat-protection/auditing/event-4648.md index 57e38cffb9..bd172bb754 100644 --- a/windows/security/threat-protection/auditing/event-4648.md +++ b/windows/security/threat-protection/auditing/event-4648.md @@ -2,7 +2,6 @@ title: 4648(S) A logon was attempted using explicit credentials. description: Describes security event 4648(S) A logon was attempted using explicit credentials. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4649.md b/windows/security/threat-protection/auditing/event-4649.md index ab9f2ef58e..81ceab6ec4 100644 --- a/windows/security/threat-protection/auditing/event-4649.md +++ b/windows/security/threat-protection/auditing/event-4649.md @@ -2,7 +2,6 @@ title: 4649(S) A replay attack was detected. description: Describes security event 4649(S) A replay attack was detected. This event is generated when a KRB_AP_ERR_REPEAT Kerberos response is sent to the client. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4656.md b/windows/security/threat-protection/auditing/event-4656.md index d019e5e260..8441566c4f 100644 --- a/windows/security/threat-protection/auditing/event-4656.md +++ b/windows/security/threat-protection/auditing/event-4656.md @@ -2,7 +2,6 @@ title: 4656(S, F) A handle to an object was requested. description: Describes security event 4656(S, F) A handle to an object was requested. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4657.md b/windows/security/threat-protection/auditing/event-4657.md index 35f1a2be85..c6279c1fa1 100644 --- a/windows/security/threat-protection/auditing/event-4657.md +++ b/windows/security/threat-protection/auditing/event-4657.md @@ -2,7 +2,6 @@ title: 4657(S) A registry value was modified. description: Describes security event 4657(S) A registry value was modified. This event is generated when a registry key value is modified. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4658.md b/windows/security/threat-protection/auditing/event-4658.md index ed093c51b6..346730e603 100644 --- a/windows/security/threat-protection/auditing/event-4658.md +++ b/windows/security/threat-protection/auditing/event-4658.md @@ -2,7 +2,6 @@ title: 4658(S) The handle to an object was closed. description: Describes security event 4658(S) The handle to an object was closed. This event is generated when the handle to an object is closed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4660.md b/windows/security/threat-protection/auditing/event-4660.md index 8613c16cee..820e2eed6f 100644 --- a/windows/security/threat-protection/auditing/event-4660.md +++ b/windows/security/threat-protection/auditing/event-4660.md @@ -2,7 +2,6 @@ title: 4660(S) An object was deleted. description: Describes security event 4660(S) An object was deleted. This event is generated when an object is deleted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4661.md b/windows/security/threat-protection/auditing/event-4661.md index ffd0495d6f..ea83c3bcec 100644 --- a/windows/security/threat-protection/auditing/event-4661.md +++ b/windows/security/threat-protection/auditing/event-4661.md @@ -2,7 +2,6 @@ title: 4661(S, F) A handle to an object was requested. description: Describes security event 4661(S, F) A handle to an object was requested. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4662.md b/windows/security/threat-protection/auditing/event-4662.md index 03c05ae001..13b91b7666 100644 --- a/windows/security/threat-protection/auditing/event-4662.md +++ b/windows/security/threat-protection/auditing/event-4662.md @@ -2,7 +2,6 @@ title: 4662(S, F) An operation was performed on an object. description: Describes security event 4662(S, F) An operation was performed on an object. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4663.md b/windows/security/threat-protection/auditing/event-4663.md index e6eb49e26e..3568c87841 100644 --- a/windows/security/threat-protection/auditing/event-4663.md +++ b/windows/security/threat-protection/auditing/event-4663.md @@ -2,7 +2,6 @@ title: 4663(S) An attempt was made to access an object. description: Describes security event 4663(S) An attempt was made to access an object. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4664.md b/windows/security/threat-protection/auditing/event-4664.md index 80106ccf42..79af8c22de 100644 --- a/windows/security/threat-protection/auditing/event-4664.md +++ b/windows/security/threat-protection/auditing/event-4664.md @@ -2,7 +2,6 @@ title: 4664(S) An attempt was made to create a hard link. description: Describes security event 4664(S) An attempt was made to create a hard link. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4670.md b/windows/security/threat-protection/auditing/event-4670.md index a2d1d9f284..45d44238be 100644 --- a/windows/security/threat-protection/auditing/event-4670.md +++ b/windows/security/threat-protection/auditing/event-4670.md @@ -2,7 +2,6 @@ title: 4670(S) Permissions on an object were changed. description: Describes security event 4670(S) Permissions on an object were changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4671.md b/windows/security/threat-protection/auditing/event-4671.md index 3c078e977d..f027eb4094 100644 --- a/windows/security/threat-protection/auditing/event-4671.md +++ b/windows/security/threat-protection/auditing/event-4671.md @@ -2,7 +2,6 @@ title: 4671(-) An application attempted to access a blocked ordinal through the TBS. description: Describes security event 4671(-) An application attempted to access a blocked ordinal through the TBS. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4672.md b/windows/security/threat-protection/auditing/event-4672.md index 32e6c9eb6a..d1ea01797e 100644 --- a/windows/security/threat-protection/auditing/event-4672.md +++ b/windows/security/threat-protection/auditing/event-4672.md @@ -2,7 +2,6 @@ title: 4672(S) Special privileges assigned to new logon. description: Describes security event 4672(S) Special privileges assigned to new logon. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4673.md b/windows/security/threat-protection/auditing/event-4673.md index 7dc7f54208..492ddbcfe0 100644 --- a/windows/security/threat-protection/auditing/event-4673.md +++ b/windows/security/threat-protection/auditing/event-4673.md @@ -2,7 +2,6 @@ title: 4673(S, F) A privileged service was called. description: Describes security event 4673(S, F) A privileged service was called. This event is generated for an attempt to perform privileged system service operations. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4674.md b/windows/security/threat-protection/auditing/event-4674.md index 80a9614ae6..6f571b60ea 100644 --- a/windows/security/threat-protection/auditing/event-4674.md +++ b/windows/security/threat-protection/auditing/event-4674.md @@ -2,7 +2,6 @@ title: 4674(S, F) An operation was attempted on a privileged object. description: Describes security event 4674(S, F) An operation was attempted on a privileged object. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4675.md b/windows/security/threat-protection/auditing/event-4675.md index cdd97e8a9e..50f41a4220 100644 --- a/windows/security/threat-protection/auditing/event-4675.md +++ b/windows/security/threat-protection/auditing/event-4675.md @@ -2,7 +2,6 @@ title: 4675(S) SIDs were filtered. description: Describes security event 4675(S) SIDs were filtered. This event is generated when SIDs were filtered for a specific Active Directory trust. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4688.md b/windows/security/threat-protection/auditing/event-4688.md index d56ba5367b..3dd248ad3c 100644 --- a/windows/security/threat-protection/auditing/event-4688.md +++ b/windows/security/threat-protection/auditing/event-4688.md @@ -2,7 +2,6 @@ title: 4688(S) A new process has been created. description: Describes security event 4688(S) A new process has been created. This event is generated when a new process starts. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 01/24/2022 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4689.md b/windows/security/threat-protection/auditing/event-4689.md index c23269a82a..fdda28bf9a 100644 --- a/windows/security/threat-protection/auditing/event-4689.md +++ b/windows/security/threat-protection/auditing/event-4689.md @@ -2,7 +2,6 @@ title: 4689(S) A process has exited. description: Describes security event 4689(S) A process has exited. This event is generates when a process exits. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4690.md b/windows/security/threat-protection/auditing/event-4690.md index b1247baf18..7bb3a0ee1c 100644 --- a/windows/security/threat-protection/auditing/event-4690.md +++ b/windows/security/threat-protection/auditing/event-4690.md @@ -2,7 +2,6 @@ title: 4690(S) An attempt was made to duplicate a handle to an object. description: Describes security event 4690(S) An attempt was made to duplicate a handle to an object. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4691.md b/windows/security/threat-protection/auditing/event-4691.md index abc7e7224a..3d757a2f5d 100644 --- a/windows/security/threat-protection/auditing/event-4691.md +++ b/windows/security/threat-protection/auditing/event-4691.md @@ -2,7 +2,6 @@ title: 4691(S) Indirect access to an object was requested. description: Describes security event 4691(S) Indirect access to an object was requested. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4692.md b/windows/security/threat-protection/auditing/event-4692.md index fd2df12df7..bd3ed5f273 100644 --- a/windows/security/threat-protection/auditing/event-4692.md +++ b/windows/security/threat-protection/auditing/event-4692.md @@ -2,7 +2,6 @@ title: 4692(S, F) Backup of data protection master key was attempted. description: Describes security event 4692(S, F) Backup of data protection master key was attempted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4693.md b/windows/security/threat-protection/auditing/event-4693.md index e8fd42218d..68957da33e 100644 --- a/windows/security/threat-protection/auditing/event-4693.md +++ b/windows/security/threat-protection/auditing/event-4693.md @@ -2,7 +2,6 @@ title: 4693(S, F) Recovery of data protection master key was attempted. description: Describes security event 4693(S, F) Recovery of data protection master key was attempted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4694.md b/windows/security/threat-protection/auditing/event-4694.md index 18eed045ab..e26a1ff60f 100644 --- a/windows/security/threat-protection/auditing/event-4694.md +++ b/windows/security/threat-protection/auditing/event-4694.md @@ -2,7 +2,6 @@ title: 4694(S, F) Protection of auditable protected data was attempted. description: Describes security event 4694(S, F) Protection of auditable protected data was attempted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4695.md b/windows/security/threat-protection/auditing/event-4695.md index 7093744387..a19d09bf9b 100644 --- a/windows/security/threat-protection/auditing/event-4695.md +++ b/windows/security/threat-protection/auditing/event-4695.md @@ -2,7 +2,6 @@ title: 4695(S, F) Unprotection of auditable protected data was attempted. description: Describes security event 4695(S, F) Unprotection of auditable protected data was attempted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4696.md b/windows/security/threat-protection/auditing/event-4696.md index 38800c2bd2..570606c8de 100644 --- a/windows/security/threat-protection/auditing/event-4696.md +++ b/windows/security/threat-protection/auditing/event-4696.md @@ -2,7 +2,6 @@ title: 4696(S) A primary token was assigned to process. description: Describes security event 4696(S) A primary token was assigned to process. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4697.md b/windows/security/threat-protection/auditing/event-4697.md index 3775a7bda7..01e5df45ef 100644 --- a/windows/security/threat-protection/auditing/event-4697.md +++ b/windows/security/threat-protection/auditing/event-4697.md @@ -2,7 +2,6 @@ title: 4697(S) A service was installed in the system. description: Describes security event 4697(S) A service was installed in the system. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4698.md b/windows/security/threat-protection/auditing/event-4698.md index 2609217fd3..e270f187af 100644 --- a/windows/security/threat-protection/auditing/event-4698.md +++ b/windows/security/threat-protection/auditing/event-4698.md @@ -2,7 +2,6 @@ title: 4698(S) A scheduled task was created. description: Describes security event 4698(S) A scheduled task was created. This event is generated when a scheduled task is created. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4699.md b/windows/security/threat-protection/auditing/event-4699.md index 87a10ab8bf..ea206aba73 100644 --- a/windows/security/threat-protection/auditing/event-4699.md +++ b/windows/security/threat-protection/auditing/event-4699.md @@ -2,7 +2,6 @@ title: 4699(S) A scheduled task was deleted. description: Describes security event 4699(S) A scheduled task was deleted. This event is generated every time a scheduled task is deleted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4700.md b/windows/security/threat-protection/auditing/event-4700.md index 0f8d3494fe..aae8e027d4 100644 --- a/windows/security/threat-protection/auditing/event-4700.md +++ b/windows/security/threat-protection/auditing/event-4700.md @@ -2,7 +2,6 @@ title: 4700(S) A scheduled task was enabled. description: Describes security event 4700(S) A scheduled task was enabled. This event is generated every time a scheduled task is enabled. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4701.md b/windows/security/threat-protection/auditing/event-4701.md index ecd015fbae..f47c7a3379 100644 --- a/windows/security/threat-protection/auditing/event-4701.md +++ b/windows/security/threat-protection/auditing/event-4701.md @@ -2,7 +2,6 @@ title: 4701(S) A scheduled task was disabled. description: Describes security event 4701(S) A scheduled task was disabled. This event is generated every time a scheduled task is disabled. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4702.md b/windows/security/threat-protection/auditing/event-4702.md index 68dfec7592..4bb86d53b2 100644 --- a/windows/security/threat-protection/auditing/event-4702.md +++ b/windows/security/threat-protection/auditing/event-4702.md @@ -2,7 +2,6 @@ title: 4702(S) A scheduled task was updated. description: Describes security event 4702(S) A scheduled task was updated. This event is generated when a scheduled task is updated/changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4703.md b/windows/security/threat-protection/auditing/event-4703.md index effc1b4ddc..0abe8a8e60 100644 --- a/windows/security/threat-protection/auditing/event-4703.md +++ b/windows/security/threat-protection/auditing/event-4703.md @@ -2,7 +2,6 @@ title: 4703(S) A user right was adjusted. description: Describes security event 4703(S) A user right was adjusted. This event is generated when token privileges are enabled or disabled for a specific account. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4704.md b/windows/security/threat-protection/auditing/event-4704.md index 94bcdf96eb..9d80b0b5ba 100644 --- a/windows/security/threat-protection/auditing/event-4704.md +++ b/windows/security/threat-protection/auditing/event-4704.md @@ -2,7 +2,6 @@ title: 4704(S) A user right was assigned. description: Describes security event 4704(S) A user right was assigned. This event is generated when a user right is assigned to an account. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4705.md b/windows/security/threat-protection/auditing/event-4705.md index 1030f0b6b6..aa5fedab07 100644 --- a/windows/security/threat-protection/auditing/event-4705.md +++ b/windows/security/threat-protection/auditing/event-4705.md @@ -2,7 +2,6 @@ title: 4705(S) A user right was removed. description: Describes security event 4705(S) A user right was removed. This event is generated when a user right is removed from an account. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4706.md b/windows/security/threat-protection/auditing/event-4706.md index 7fdea8fb2c..d379640fbc 100644 --- a/windows/security/threat-protection/auditing/event-4706.md +++ b/windows/security/threat-protection/auditing/event-4706.md @@ -2,7 +2,6 @@ title: 4706(S) A new trust was created to a domain. description: Describes security event 4706(S) A new trust was created to a domain. This event is generated when a new trust is created for a domain. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4707.md b/windows/security/threat-protection/auditing/event-4707.md index e2a779b376..a7d7e7fab3 100644 --- a/windows/security/threat-protection/auditing/event-4707.md +++ b/windows/security/threat-protection/auditing/event-4707.md @@ -2,7 +2,6 @@ title: 4707(S) A trust to a domain was removed. description: Describes security event 4707(S) A trust to a domain was removed. This event is generated when a domain trust is removed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4713.md b/windows/security/threat-protection/auditing/event-4713.md index 49ad5eeca7..f83c8df8ce 100644 --- a/windows/security/threat-protection/auditing/event-4713.md +++ b/windows/security/threat-protection/auditing/event-4713.md @@ -2,7 +2,6 @@ title: 4713(S) Kerberos policy was changed. description: Describes security event 4713(S) Kerberos policy was changed. This event is generated when Kerberos policy is changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4714.md b/windows/security/threat-protection/auditing/event-4714.md index 495cda1557..13f82a2f64 100644 --- a/windows/security/threat-protection/auditing/event-4714.md +++ b/windows/security/threat-protection/auditing/event-4714.md @@ -2,7 +2,6 @@ title: 4714(S) Encrypted data recovery policy was changed. description: Describes security event 4714(S) Encrypted data recovery policy was changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4715.md b/windows/security/threat-protection/auditing/event-4715.md index 6a09b30ae2..b92a998c6d 100644 --- a/windows/security/threat-protection/auditing/event-4715.md +++ b/windows/security/threat-protection/auditing/event-4715.md @@ -2,7 +2,6 @@ title: 4715(S) The audit policy (SACL) on an object was changed. description: Describes security event 4715(S) The audit policy (SACL) on an object was changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4716.md b/windows/security/threat-protection/auditing/event-4716.md index 12eafb94f3..42b0a6e238 100644 --- a/windows/security/threat-protection/auditing/event-4716.md +++ b/windows/security/threat-protection/auditing/event-4716.md @@ -2,7 +2,6 @@ title: 4716(S) Trusted domain information was modified. description: Describes security event 4716(S) Trusted domain information was modified. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4717.md b/windows/security/threat-protection/auditing/event-4717.md index b02eef2f90..c41a064781 100644 --- a/windows/security/threat-protection/auditing/event-4717.md +++ b/windows/security/threat-protection/auditing/event-4717.md @@ -2,7 +2,6 @@ title: 4717(S) System security access was granted to an account. description: Describes security event 4717(S) System security access was granted to an account. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4718.md b/windows/security/threat-protection/auditing/event-4718.md index 14707ab644..04e8efedd9 100644 --- a/windows/security/threat-protection/auditing/event-4718.md +++ b/windows/security/threat-protection/auditing/event-4718.md @@ -2,7 +2,6 @@ title: 4718(S) System security access was removed from an account. description: Describes security event 4718(S) System security access was removed from an account. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4719.md b/windows/security/threat-protection/auditing/event-4719.md index 4cf66c7350..6df41ebce4 100644 --- a/windows/security/threat-protection/auditing/event-4719.md +++ b/windows/security/threat-protection/auditing/event-4719.md @@ -2,7 +2,6 @@ title: 4719(S) System audit policy was changed. description: Describes security event 4719(S) System audit policy was changed. This event is generated when the computer audit policy changes. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4720.md b/windows/security/threat-protection/auditing/event-4720.md index 5ca11d5d60..6e107ff555 100644 --- a/windows/security/threat-protection/auditing/event-4720.md +++ b/windows/security/threat-protection/auditing/event-4720.md @@ -2,7 +2,6 @@ title: 4720(S) A user account was created. description: Describes security event 4720(S) A user account was created. This event is generated a user object is created. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4722.md b/windows/security/threat-protection/auditing/event-4722.md index add2d048cc..9cfac3ba8c 100644 --- a/windows/security/threat-protection/auditing/event-4722.md +++ b/windows/security/threat-protection/auditing/event-4722.md @@ -2,7 +2,6 @@ title: 4722(S) A user account was enabled. description: Describes security event 4722(S) A user account was enabled. This event is generated when a user or computer object is enabled. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4723.md b/windows/security/threat-protection/auditing/event-4723.md index 7aad069614..7793556fa9 100644 --- a/windows/security/threat-protection/auditing/event-4723.md +++ b/windows/security/threat-protection/auditing/event-4723.md @@ -2,7 +2,6 @@ title: 4723(S, F) An attempt was made to change an account's password. description: Describes security event 4723(S, F) An attempt was made to change an account's password. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4724.md b/windows/security/threat-protection/auditing/event-4724.md index 456ec46743..8ce482061b 100644 --- a/windows/security/threat-protection/auditing/event-4724.md +++ b/windows/security/threat-protection/auditing/event-4724.md @@ -2,7 +2,6 @@ title: 4724(S, F) An attempt was made to reset an account's password. description: Describes security event 4724(S, F) An attempt was made to reset an account's password. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4725.md b/windows/security/threat-protection/auditing/event-4725.md index 55cad0f2a1..5b0a882eac 100644 --- a/windows/security/threat-protection/auditing/event-4725.md +++ b/windows/security/threat-protection/auditing/event-4725.md @@ -2,7 +2,6 @@ title: 4725(S) A user account was disabled. description: Describes security event 4725(S) A user account was disabled. This event is generated when a user or computer object is disabled. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4726.md b/windows/security/threat-protection/auditing/event-4726.md index a947159c47..08c38bd0b8 100644 --- a/windows/security/threat-protection/auditing/event-4726.md +++ b/windows/security/threat-protection/auditing/event-4726.md @@ -2,7 +2,6 @@ title: 4726(S) A user account was deleted. description: Describes security event 4726(S) A user account was deleted. This event is generated when a user object is deleted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4731.md b/windows/security/threat-protection/auditing/event-4731.md index 2c65171ef1..f932a95fbb 100644 --- a/windows/security/threat-protection/auditing/event-4731.md +++ b/windows/security/threat-protection/auditing/event-4731.md @@ -2,7 +2,6 @@ title: 4731(S) A security-enabled local group was created. description: Describes security event 4731(S) A security-enabled local group was created. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4732.md b/windows/security/threat-protection/auditing/event-4732.md index 00d16da21d..2256f550a0 100644 --- a/windows/security/threat-protection/auditing/event-4732.md +++ b/windows/security/threat-protection/auditing/event-4732.md @@ -2,7 +2,6 @@ title: 4732(S) A member was added to a security-enabled local group. description: Describes security event 4732(S) A member was added to a security-enabled local group. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4733.md b/windows/security/threat-protection/auditing/event-4733.md index 926066fb81..9dadc5c6bf 100644 --- a/windows/security/threat-protection/auditing/event-4733.md +++ b/windows/security/threat-protection/auditing/event-4733.md @@ -2,7 +2,6 @@ title: 4733(S) A member was removed from a security-enabled local group. description: Describes security event 4733(S) A member was removed from a security-enabled local group. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4734.md b/windows/security/threat-protection/auditing/event-4734.md index c2af62b2bc..ec84652e18 100644 --- a/windows/security/threat-protection/auditing/event-4734.md +++ b/windows/security/threat-protection/auditing/event-4734.md @@ -2,7 +2,6 @@ title: 4734(S) A security-enabled local group was deleted. description: Describes security event 4734(S) A security-enabled local group was deleted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4735.md b/windows/security/threat-protection/auditing/event-4735.md index a08fb0391f..7aadb30077 100644 --- a/windows/security/threat-protection/auditing/event-4735.md +++ b/windows/security/threat-protection/auditing/event-4735.md @@ -2,7 +2,6 @@ title: 4735(S) A security-enabled local group was changed. description: Describes security event 4735(S) A security-enabled local group was changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4738.md b/windows/security/threat-protection/auditing/event-4738.md index be3bf1a1e5..2bf505a3b7 100644 --- a/windows/security/threat-protection/auditing/event-4738.md +++ b/windows/security/threat-protection/auditing/event-4738.md @@ -2,7 +2,6 @@ title: 4738(S) A user account was changed. description: Describes security event 4738(S) A user account was changed. This event is generated when a user object is changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4739.md b/windows/security/threat-protection/auditing/event-4739.md index 8b6090da8d..3aac4840a8 100644 --- a/windows/security/threat-protection/auditing/event-4739.md +++ b/windows/security/threat-protection/auditing/event-4739.md @@ -2,7 +2,6 @@ title: 4739(S) Domain Policy was changed. description: Describes security event 4739(S) Domain Policy was changed. This event is generated when certain changes are made to the local computer security policy. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4740.md b/windows/security/threat-protection/auditing/event-4740.md index 9fae037e5f..5447618950 100644 --- a/windows/security/threat-protection/auditing/event-4740.md +++ b/windows/security/threat-protection/auditing/event-4740.md @@ -2,7 +2,6 @@ title: 4740(S) A user account was locked out. description: Describes security event 4740(S) A user account was locked out. This event is generated every time a user account is locked out. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4741.md b/windows/security/threat-protection/auditing/event-4741.md index e26b0c96b3..37842d6609 100644 --- a/windows/security/threat-protection/auditing/event-4741.md +++ b/windows/security/threat-protection/auditing/event-4741.md @@ -2,7 +2,6 @@ title: 4741(S) A computer account was created. description: Describes security event 4741(S) A computer account was created. This event is generated every time a computer object is created. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4742.md b/windows/security/threat-protection/auditing/event-4742.md index 4a82933448..a397156de0 100644 --- a/windows/security/threat-protection/auditing/event-4742.md +++ b/windows/security/threat-protection/auditing/event-4742.md @@ -2,7 +2,6 @@ title: 4742(S) A computer account was changed. description: Describes security event 4742(S) A computer account was changed. This event is generated every time a computer object is changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4743.md b/windows/security/threat-protection/auditing/event-4743.md index 4f3da1ff73..7761fa540b 100644 --- a/windows/security/threat-protection/auditing/event-4743.md +++ b/windows/security/threat-protection/auditing/event-4743.md @@ -2,7 +2,6 @@ title: 4743(S) A computer account was deleted. description: Describes security event 4743(S) A computer account was deleted. This event is generated every time a computer object is deleted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4749.md b/windows/security/threat-protection/auditing/event-4749.md index 94f70a7eae..f0d009b637 100644 --- a/windows/security/threat-protection/auditing/event-4749.md +++ b/windows/security/threat-protection/auditing/event-4749.md @@ -2,7 +2,6 @@ title: 4749(S) A security-disabled global group was created. description: Describes security event 4749(S) A security-disabled global group was created. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4750.md b/windows/security/threat-protection/auditing/event-4750.md index 98025cf33c..3a7433f4de 100644 --- a/windows/security/threat-protection/auditing/event-4750.md +++ b/windows/security/threat-protection/auditing/event-4750.md @@ -2,7 +2,6 @@ title: 4750(S) A security-disabled global group was changed. description: Describes security event 4750(S) A security-disabled global group was changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4751.md b/windows/security/threat-protection/auditing/event-4751.md index d28e5a4ace..cf6278c300 100644 --- a/windows/security/threat-protection/auditing/event-4751.md +++ b/windows/security/threat-protection/auditing/event-4751.md @@ -2,7 +2,6 @@ title: 4751(S) A member was added to a security-disabled global group. description: Describes security event 4751(S) A member was added to a security-disabled global group. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4752.md b/windows/security/threat-protection/auditing/event-4752.md index 937c2d5d78..e81f6a3046 100644 --- a/windows/security/threat-protection/auditing/event-4752.md +++ b/windows/security/threat-protection/auditing/event-4752.md @@ -2,7 +2,6 @@ title: 4752(S) A member was removed from a security-disabled global group. description: Describes security event 4752(S) A member was removed from a security-disabled global group. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4753.md b/windows/security/threat-protection/auditing/event-4753.md index e03d2dad24..ad1a890f3c 100644 --- a/windows/security/threat-protection/auditing/event-4753.md +++ b/windows/security/threat-protection/auditing/event-4753.md @@ -2,7 +2,6 @@ title: 4753(S) A security-disabled global group was deleted. description: Describes security event 4753(S) A security-disabled global group was deleted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4764.md b/windows/security/threat-protection/auditing/event-4764.md index 28615743d5..7edbd2330a 100644 --- a/windows/security/threat-protection/auditing/event-4764.md +++ b/windows/security/threat-protection/auditing/event-4764.md @@ -2,7 +2,6 @@ title: 4764(S) A group's type was changed. description: Describes security event 4764(S) A group's type was changed. This event is generated when the type of a group is changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4765.md b/windows/security/threat-protection/auditing/event-4765.md index b7e4d12932..6f98fc7e25 100644 --- a/windows/security/threat-protection/auditing/event-4765.md +++ b/windows/security/threat-protection/auditing/event-4765.md @@ -2,7 +2,6 @@ title: 4765(S) SID History was added to an account. description: Describes security event 4765(S) SID History was added to an account. This event is generated when SID History is added to an account. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4766.md b/windows/security/threat-protection/auditing/event-4766.md index 6ec2b6bbf3..59ca2a65fa 100644 --- a/windows/security/threat-protection/auditing/event-4766.md +++ b/windows/security/threat-protection/auditing/event-4766.md @@ -2,7 +2,6 @@ title: 4766(F) An attempt to add SID History to an account failed. description: Describes security event 4766(F) An attempt to add SID History to an account failed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4767.md b/windows/security/threat-protection/auditing/event-4767.md index e18080c9e3..8ef81340aa 100644 --- a/windows/security/threat-protection/auditing/event-4767.md +++ b/windows/security/threat-protection/auditing/event-4767.md @@ -2,7 +2,6 @@ title: 4767(S) A user account was unlocked. description: Describes security event 4767(S) A user account was unlocked. This event is generated every time a user account is unlocked. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4768.md b/windows/security/threat-protection/auditing/event-4768.md index 9af99fe83b..d0f63ca03a 100644 --- a/windows/security/threat-protection/auditing/event-4768.md +++ b/windows/security/threat-protection/auditing/event-4768.md @@ -2,7 +2,6 @@ title: 4768(S, F) A Kerberos authentication ticket (TGT) was requested. description: Describes security event 4768(S, F) A Kerberos authentication ticket (TGT) was requested. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 10/20/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4769.md b/windows/security/threat-protection/auditing/event-4769.md index 2605d404c9..dde7e668e1 100644 --- a/windows/security/threat-protection/auditing/event-4769.md +++ b/windows/security/threat-protection/auditing/event-4769.md @@ -2,7 +2,6 @@ title: 4769(S, F) A Kerberos service ticket was requested. description: Describes security event 4769(S, F) A Kerberos service ticket was requested. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4770.md b/windows/security/threat-protection/auditing/event-4770.md index e0206db3db..398468db3c 100644 --- a/windows/security/threat-protection/auditing/event-4770.md +++ b/windows/security/threat-protection/auditing/event-4770.md @@ -2,7 +2,6 @@ title: 4770(S) A Kerberos service ticket was renewed. description: Describes security event 4770(S) A Kerberos service ticket was renewed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4771.md b/windows/security/threat-protection/auditing/event-4771.md index bad7f21c77..cfe1bcfb82 100644 --- a/windows/security/threat-protection/auditing/event-4771.md +++ b/windows/security/threat-protection/auditing/event-4771.md @@ -2,7 +2,6 @@ title: 4771(F) Kerberos pre-authentication failed. description: Describes security event 4771(F) Kerberos pre-authentication failed. This event is generated when the Key Distribution Center fails to issue a Kerberos TGT. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.collection: - highpri - tier3 diff --git a/windows/security/threat-protection/auditing/event-4772.md b/windows/security/threat-protection/auditing/event-4772.md index 1bb81355f0..6222ece1bb 100644 --- a/windows/security/threat-protection/auditing/event-4772.md +++ b/windows/security/threat-protection/auditing/event-4772.md @@ -2,7 +2,6 @@ title: 4772(F) A Kerberos authentication ticket request failed. description: Describes security event 4772(F) A Kerberos authentication ticket request failed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4773.md b/windows/security/threat-protection/auditing/event-4773.md index a966cf2abd..3741a22b02 100644 --- a/windows/security/threat-protection/auditing/event-4773.md +++ b/windows/security/threat-protection/auditing/event-4773.md @@ -2,7 +2,6 @@ title: 4773(F) A Kerberos service ticket request failed. description: Describes security event 4773(F) A Kerberos service ticket request failed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4774.md b/windows/security/threat-protection/auditing/event-4774.md index 5c9253d51a..25e3fe2dab 100644 --- a/windows/security/threat-protection/auditing/event-4774.md +++ b/windows/security/threat-protection/auditing/event-4774.md @@ -2,7 +2,6 @@ title: 4774(S, F) An account was mapped for logon. description: Describes security event 4774(S, F) An account was mapped for logon. This event is generated when an account is mapped for logon. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4775.md b/windows/security/threat-protection/auditing/event-4775.md index 35264e2c50..2090c1e52e 100644 --- a/windows/security/threat-protection/auditing/event-4775.md +++ b/windows/security/threat-protection/auditing/event-4775.md @@ -2,7 +2,6 @@ title: 4775(F) An account could not be mapped for logon. description: Describes security event 4775(F) An account could not be mapped for logon. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4776.md b/windows/security/threat-protection/auditing/event-4776.md index 736a967ea4..7911aa31f0 100644 --- a/windows/security/threat-protection/auditing/event-4776.md +++ b/windows/security/threat-protection/auditing/event-4776.md @@ -2,7 +2,6 @@ title: 4776(S, F) The computer attempted to validate the credentials for an account. description: Describes security event 4776(S, F) The computer attempted to validate the credentials for an account. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/13/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.collection: - highpri - tier3 diff --git a/windows/security/threat-protection/auditing/event-4777.md b/windows/security/threat-protection/auditing/event-4777.md index f14f4b4a58..a24c5864eb 100644 --- a/windows/security/threat-protection/auditing/event-4777.md +++ b/windows/security/threat-protection/auditing/event-4777.md @@ -2,7 +2,6 @@ title: 4777(F) The domain controller failed to validate the credentials for an account. description: Describes security event 4777(F) The domain controller failed to validate the credentials for an account. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4778.md b/windows/security/threat-protection/auditing/event-4778.md index d9a5bd2d94..0399f1f5c4 100644 --- a/windows/security/threat-protection/auditing/event-4778.md +++ b/windows/security/threat-protection/auditing/event-4778.md @@ -2,7 +2,6 @@ title: 4778(S) A session was reconnected to a Window Station. description: Describes security event 4778(S) A session was reconnected to a Window Station. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4779.md b/windows/security/threat-protection/auditing/event-4779.md index 3ab94db6fb..5852da5e2a 100644 --- a/windows/security/threat-protection/auditing/event-4779.md +++ b/windows/security/threat-protection/auditing/event-4779.md @@ -2,7 +2,6 @@ title: 4779(S) A session was disconnected from a Window Station. description: Describes security event 4779(S) A session was disconnected from a Window Station. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4780.md b/windows/security/threat-protection/auditing/event-4780.md index 8bc11f4997..e7c43cf82e 100644 --- a/windows/security/threat-protection/auditing/event-4780.md +++ b/windows/security/threat-protection/auditing/event-4780.md @@ -2,7 +2,6 @@ title: 4780(S) The ACL was set on accounts which are members of administrators groups. description: Describes security event 4780(S) The ACL was set on accounts which are members of administrators groups. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4781.md b/windows/security/threat-protection/auditing/event-4781.md index 3918ee0ef1..96fd56086f 100644 --- a/windows/security/threat-protection/auditing/event-4781.md +++ b/windows/security/threat-protection/auditing/event-4781.md @@ -2,7 +2,6 @@ title: 4781(S) The name of an account was changed. description: Describes security event 4781(S) The name of an account was changed. This event is generated every time a user or computer account name is changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4782.md b/windows/security/threat-protection/auditing/event-4782.md index 83020ee642..4f20ae39d6 100644 --- a/windows/security/threat-protection/auditing/event-4782.md +++ b/windows/security/threat-protection/auditing/event-4782.md @@ -2,7 +2,6 @@ title: 4782(S) The password hash of an account was accessed. description: Describes security event 4782(S) The password hash of an account was accessed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4793.md b/windows/security/threat-protection/auditing/event-4793.md index 4774459a71..713ca3f5de 100644 --- a/windows/security/threat-protection/auditing/event-4793.md +++ b/windows/security/threat-protection/auditing/event-4793.md @@ -2,7 +2,6 @@ title: 4793(S) The Password Policy Checking API was called. description: Describes security event 4793(S) The Password Policy Checking API was called. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4794.md b/windows/security/threat-protection/auditing/event-4794.md index ed8e9aebdc..29e851f761 100644 --- a/windows/security/threat-protection/auditing/event-4794.md +++ b/windows/security/threat-protection/auditing/event-4794.md @@ -2,7 +2,6 @@ title: 4794(S, F) An attempt was made to set the Directory Services Restore Mode administrator password. description: Describes security event 4794(S, F) An attempt was made to set the Directory Services Restore Mode administrator password. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4798.md b/windows/security/threat-protection/auditing/event-4798.md index 8c5e7d3c50..7a66f7461c 100644 --- a/windows/security/threat-protection/auditing/event-4798.md +++ b/windows/security/threat-protection/auditing/event-4798.md @@ -2,7 +2,6 @@ title: 4798(S) A user's local group membership was enumerated. description: Describes security event 4798(S) A user's local group membership was enumerated. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4799.md b/windows/security/threat-protection/auditing/event-4799.md index a089e448f4..7b4aead71c 100644 --- a/windows/security/threat-protection/auditing/event-4799.md +++ b/windows/security/threat-protection/auditing/event-4799.md @@ -2,7 +2,6 @@ title: 4799(S) A security-enabled local group membership was enumerated. description: Describes security event 4799(S) A security-enabled local group membership was enumerated. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4800.md b/windows/security/threat-protection/auditing/event-4800.md index fcacf65cb0..35f11545c6 100644 --- a/windows/security/threat-protection/auditing/event-4800.md +++ b/windows/security/threat-protection/auditing/event-4800.md @@ -2,7 +2,6 @@ title: 4800(S) The workstation was locked. description: Describes security event 4800(S) The workstation was locked. This event is generated when a workstation is locked. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4801.md b/windows/security/threat-protection/auditing/event-4801.md index 94d9dee683..348ba5fce6 100644 --- a/windows/security/threat-protection/auditing/event-4801.md +++ b/windows/security/threat-protection/auditing/event-4801.md @@ -2,7 +2,6 @@ title: 4801(S) The workstation was unlocked. description: Describes security event 4801(S) The workstation was unlocked. This event is generated when workstation is unlocked. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4802.md b/windows/security/threat-protection/auditing/event-4802.md index 82492616cc..9884000aae 100644 --- a/windows/security/threat-protection/auditing/event-4802.md +++ b/windows/security/threat-protection/auditing/event-4802.md @@ -2,7 +2,6 @@ title: 4802(S) The screen saver was invoked. description: Describes security event 4802(S) The screen saver was invoked. This event is generated when screen saver is invoked. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4803.md b/windows/security/threat-protection/auditing/event-4803.md index 497a3a8d07..8fae699b17 100644 --- a/windows/security/threat-protection/auditing/event-4803.md +++ b/windows/security/threat-protection/auditing/event-4803.md @@ -2,7 +2,6 @@ title: 4803(S) The screen saver was dismissed. description: Describes security event 4803(S) The screen saver was dismissed. This event is generated when screen saver is dismissed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4816.md b/windows/security/threat-protection/auditing/event-4816.md index be77d5a97c..3cfcc91bde 100644 --- a/windows/security/threat-protection/auditing/event-4816.md +++ b/windows/security/threat-protection/auditing/event-4816.md @@ -2,7 +2,6 @@ title: 4816(S) RPC detected an integrity violation while decrypting an incoming message. description: Describes security event 4816(S) RPC detected an integrity violation while decrypting an incoming message. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4817.md b/windows/security/threat-protection/auditing/event-4817.md index e166782510..685c9a0c84 100644 --- a/windows/security/threat-protection/auditing/event-4817.md +++ b/windows/security/threat-protection/auditing/event-4817.md @@ -2,7 +2,6 @@ title: 4817(S) Auditing settings on object were changed. description: Describes security event 4817(S) Auditing settings on object were changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4818.md b/windows/security/threat-protection/auditing/event-4818.md index 127a71406e..b502dcb97b 100644 --- a/windows/security/threat-protection/auditing/event-4818.md +++ b/windows/security/threat-protection/auditing/event-4818.md @@ -2,7 +2,6 @@ title: 4818(S) Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy. description: Describes security event 4818(S) Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4819.md b/windows/security/threat-protection/auditing/event-4819.md index 0e479a57b1..b1b3d80845 100644 --- a/windows/security/threat-protection/auditing/event-4819.md +++ b/windows/security/threat-protection/auditing/event-4819.md @@ -2,7 +2,6 @@ title: 4819(S) Central Access Policies on the machine have been changed. description: Describes security event 4819(S) Central Access Policies on the machine have been changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4826.md b/windows/security/threat-protection/auditing/event-4826.md index 2e79af5e64..d776cba974 100644 --- a/windows/security/threat-protection/auditing/event-4826.md +++ b/windows/security/threat-protection/auditing/event-4826.md @@ -2,7 +2,6 @@ title: 4826(S) Boot Configuration Data loaded. description: Describes security event 4826(S) Boot Configuration Data loaded. This event is generated every time system starts and loads Boot Configuration Data settings. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4864.md b/windows/security/threat-protection/auditing/event-4864.md index cbed773c60..3d52b57ab7 100644 --- a/windows/security/threat-protection/auditing/event-4864.md +++ b/windows/security/threat-protection/auditing/event-4864.md @@ -2,7 +2,6 @@ title: 4864(S) A namespace collision was detected. description: Describes security event 4864(S) A namespace collision was detected. This event is generated when a namespace collision is detected. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4865.md b/windows/security/threat-protection/auditing/event-4865.md index 8b792069f3..f98be7ebdc 100644 --- a/windows/security/threat-protection/auditing/event-4865.md +++ b/windows/security/threat-protection/auditing/event-4865.md @@ -2,7 +2,6 @@ title: 4865(S) A trusted forest information entry was added. description: Describes security event 4865(S) A trusted forest information entry was added. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4866.md b/windows/security/threat-protection/auditing/event-4866.md index 2ec48bdf4f..f138df2d0a 100644 --- a/windows/security/threat-protection/auditing/event-4866.md +++ b/windows/security/threat-protection/auditing/event-4866.md @@ -2,7 +2,6 @@ title: 4866(S) A trusted forest information entry was removed. description: Describes security event 4866(S) A trusted forest information entry was removed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4867.md b/windows/security/threat-protection/auditing/event-4867.md index b4affb0ff4..e86b7b7afe 100644 --- a/windows/security/threat-protection/auditing/event-4867.md +++ b/windows/security/threat-protection/auditing/event-4867.md @@ -2,7 +2,6 @@ title: 4867(S) A trusted forest information entry was modified. description: Describes security event 4867(S) A trusted forest information entry was modified. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4902.md b/windows/security/threat-protection/auditing/event-4902.md index a53fd03d58..0cd35ad40a 100644 --- a/windows/security/threat-protection/auditing/event-4902.md +++ b/windows/security/threat-protection/auditing/event-4902.md @@ -2,7 +2,6 @@ title: 4902(S) The Per-user audit policy table was created. description: Describes security event 4902(S) The Per-user audit policy table was created. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4904.md b/windows/security/threat-protection/auditing/event-4904.md index 1f7335e6da..0da52bcaf6 100644 --- a/windows/security/threat-protection/auditing/event-4904.md +++ b/windows/security/threat-protection/auditing/event-4904.md @@ -2,7 +2,6 @@ title: 4904(S) An attempt was made to register a security event source. description: Describes security event 4904(S) An attempt was made to register a security event source. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/07/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4905.md b/windows/security/threat-protection/auditing/event-4905.md index c710230070..bda5be072e 100644 --- a/windows/security/threat-protection/auditing/event-4905.md +++ b/windows/security/threat-protection/auditing/event-4905.md @@ -2,7 +2,6 @@ title: 4905(S) An attempt was made to unregister a security event source. description: Describes security event 4905(S) An attempt was made to unregister a security event source. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4906.md b/windows/security/threat-protection/auditing/event-4906.md index 2cdc197a9b..ba0d53e713 100644 --- a/windows/security/threat-protection/auditing/event-4906.md +++ b/windows/security/threat-protection/auditing/event-4906.md @@ -2,7 +2,6 @@ title: 4906(S) The CrashOnAuditFail value has changed. description: Describes security event 4906(S) The CrashOnAuditFail value has changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4907.md b/windows/security/threat-protection/auditing/event-4907.md index 91ed3cfa75..413c994ac3 100644 --- a/windows/security/threat-protection/auditing/event-4907.md +++ b/windows/security/threat-protection/auditing/event-4907.md @@ -2,7 +2,6 @@ title: 4907(S) Auditing settings on object were changed. description: Describes security event 4907(S) Auditing settings on object were changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4908.md b/windows/security/threat-protection/auditing/event-4908.md index 58d9d7331a..3f6c135f60 100644 --- a/windows/security/threat-protection/auditing/event-4908.md +++ b/windows/security/threat-protection/auditing/event-4908.md @@ -2,7 +2,6 @@ title: 4908(S) Special Groups Logon table modified. description: Describes security event 4908(S) Special Groups Logon table modified. This event is generated when the Special Groups Logon table is modified. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4909.md b/windows/security/threat-protection/auditing/event-4909.md index 6420bf04c1..d1a8711011 100644 --- a/windows/security/threat-protection/auditing/event-4909.md +++ b/windows/security/threat-protection/auditing/event-4909.md @@ -2,7 +2,6 @@ title: 4909(-) The local policy settings for the TBS were changed. description: Describes security event 4909(-) The local policy settings for the TBS were changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4910.md b/windows/security/threat-protection/auditing/event-4910.md index a541352ac0..37f4293a84 100644 --- a/windows/security/threat-protection/auditing/event-4910.md +++ b/windows/security/threat-protection/auditing/event-4910.md @@ -2,7 +2,6 @@ title: 4910(-) The group policy settings for the TBS were changed. description: Describes security event 4910(-) The group policy settings for the TBS were changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4911.md b/windows/security/threat-protection/auditing/event-4911.md index c31636a2f6..ea45660bc8 100644 --- a/windows/security/threat-protection/auditing/event-4911.md +++ b/windows/security/threat-protection/auditing/event-4911.md @@ -2,7 +2,6 @@ title: 4911(S) Resource attributes of the object were changed. description: Describes security event 4911(S) Resource attributes of the object were changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4912.md b/windows/security/threat-protection/auditing/event-4912.md index 152e9607f3..8670490796 100644 --- a/windows/security/threat-protection/auditing/event-4912.md +++ b/windows/security/threat-protection/auditing/event-4912.md @@ -2,7 +2,6 @@ title: 4912(S) Per User Audit Policy was changed. description: Describes security event 4912(S) Per User Audit Policy was changed. This event is generated every time Per User Audit Policy is changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4913.md b/windows/security/threat-protection/auditing/event-4913.md index 5da5f88ef9..279791472e 100644 --- a/windows/security/threat-protection/auditing/event-4913.md +++ b/windows/security/threat-protection/auditing/event-4913.md @@ -2,7 +2,6 @@ title: 4913(S) Central Access Policy on the object was changed. description: Describes security event 4913(S) Central Access Policy on the object was changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4928.md b/windows/security/threat-protection/auditing/event-4928.md index 371f4689c7..370b7401c1 100644 --- a/windows/security/threat-protection/auditing/event-4928.md +++ b/windows/security/threat-protection/auditing/event-4928.md @@ -2,7 +2,6 @@ title: 4928(S, F) An Active Directory replica source naming context was established. description: Describes security event 4928(S, F) An Active Directory replica source naming context was established. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4929.md b/windows/security/threat-protection/auditing/event-4929.md index 288d0528f8..76891ca2a8 100644 --- a/windows/security/threat-protection/auditing/event-4929.md +++ b/windows/security/threat-protection/auditing/event-4929.md @@ -2,7 +2,6 @@ title: 4929(S, F) An Active Directory replica source naming context was removed. description: Describes security event 4929(S, F) An Active Directory replica source naming context was removed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4930.md b/windows/security/threat-protection/auditing/event-4930.md index ca6a21d07a..5b50e911b7 100644 --- a/windows/security/threat-protection/auditing/event-4930.md +++ b/windows/security/threat-protection/auditing/event-4930.md @@ -2,7 +2,6 @@ title: 4930(S, F) An Active Directory replica source naming context was modified. description: Describes security event 4930(S, F) An Active Directory replica source naming context was modified. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4931.md b/windows/security/threat-protection/auditing/event-4931.md index 0f1f2d11af..253625ddd5 100644 --- a/windows/security/threat-protection/auditing/event-4931.md +++ b/windows/security/threat-protection/auditing/event-4931.md @@ -2,7 +2,6 @@ title: 4931(S, F) An Active Directory replica destination naming context was modified. description: Describes security event 4931(S, F) An Active Directory replica destination naming context was modified. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4932.md b/windows/security/threat-protection/auditing/event-4932.md index 574e020321..94321a4fc3 100644 --- a/windows/security/threat-protection/auditing/event-4932.md +++ b/windows/security/threat-protection/auditing/event-4932.md @@ -2,7 +2,6 @@ title: 4932(S) Synchronization of a replica of an Active Directory naming context has begun. description: Describes security event 4932(S) Synchronization of a replica of an Active Directory naming context has begun. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4933.md b/windows/security/threat-protection/auditing/event-4933.md index 54e6d63dd5..7747d4c6e7 100644 --- a/windows/security/threat-protection/auditing/event-4933.md +++ b/windows/security/threat-protection/auditing/event-4933.md @@ -2,7 +2,6 @@ title: 4933(S, F) Synchronization of a replica of an Active Directory naming context has ended. description: Describes security event 4933(S, F) Synchronization of a replica of an Active Directory naming context has ended. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4934.md b/windows/security/threat-protection/auditing/event-4934.md index 363e2dea0f..52cfbf71f4 100644 --- a/windows/security/threat-protection/auditing/event-4934.md +++ b/windows/security/threat-protection/auditing/event-4934.md @@ -2,7 +2,6 @@ title: 4934(S) Attributes of an Active Directory object were replicated. description: Describes security event 4934(S) Attributes of an Active Directory object were replicated. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4935.md b/windows/security/threat-protection/auditing/event-4935.md index 04b067063a..cff9eedb80 100644 --- a/windows/security/threat-protection/auditing/event-4935.md +++ b/windows/security/threat-protection/auditing/event-4935.md @@ -2,7 +2,6 @@ title: 4935(F) Replication failure begins. description: Describes security event 4935(F) Replication failure begins. This event is generated when Active Directory replication failure begins. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4936.md b/windows/security/threat-protection/auditing/event-4936.md index 04fb5a689c..fb2ebfa921 100644 --- a/windows/security/threat-protection/auditing/event-4936.md +++ b/windows/security/threat-protection/auditing/event-4936.md @@ -2,7 +2,6 @@ title: 4936(S) Replication failure ends. description: Describes security event 4936(S) Replication failure ends. This event is generated when Active Directory replication failure ends. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4937.md b/windows/security/threat-protection/auditing/event-4937.md index ad871628bd..d368e3a4b5 100644 --- a/windows/security/threat-protection/auditing/event-4937.md +++ b/windows/security/threat-protection/auditing/event-4937.md @@ -2,7 +2,6 @@ title: 4937(S) A lingering object was removed from a replica. description: Describes security event 4937(S) A lingering object was removed from a replica. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4944.md b/windows/security/threat-protection/auditing/event-4944.md index d93811a130..44a42b082b 100644 --- a/windows/security/threat-protection/auditing/event-4944.md +++ b/windows/security/threat-protection/auditing/event-4944.md @@ -2,7 +2,6 @@ title: 4944(S) The following policy was active when the Windows Firewall started. description: Describes security event 4944(S) The following policy was active when the Windows Firewall started. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4945.md b/windows/security/threat-protection/auditing/event-4945.md index 8099cfeca6..446c3da541 100644 --- a/windows/security/threat-protection/auditing/event-4945.md +++ b/windows/security/threat-protection/auditing/event-4945.md @@ -2,7 +2,6 @@ title: 4945(S) A rule was listed when the Windows Firewall started. description: Describes security event 4945(S) A rule was listed when the Windows Firewall started. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4946.md b/windows/security/threat-protection/auditing/event-4946.md index 077de83d96..a823ec76fa 100644 --- a/windows/security/threat-protection/auditing/event-4946.md +++ b/windows/security/threat-protection/auditing/event-4946.md @@ -2,7 +2,6 @@ title: 4946(S) A change has been made to Windows Firewall exception list. A rule was added. description: Describes security event 4946(S) A change has been made to Windows Firewall exception list. A rule was added. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4947.md b/windows/security/threat-protection/auditing/event-4947.md index 7647e63929..0eff4491dc 100644 --- a/windows/security/threat-protection/auditing/event-4947.md +++ b/windows/security/threat-protection/auditing/event-4947.md @@ -2,7 +2,6 @@ title: 4947(S) A change has been made to Windows Firewall exception list. A rule was modified. description: Describes security event 4947(S) A change has been made to Windows Firewall exception list. A rule was modified. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4948.md b/windows/security/threat-protection/auditing/event-4948.md index 9000f97907..66e43ae5bd 100644 --- a/windows/security/threat-protection/auditing/event-4948.md +++ b/windows/security/threat-protection/auditing/event-4948.md @@ -2,7 +2,6 @@ title: 4948(S) A change has been made to Windows Firewall exception list. A rule was deleted. description: Describes security event 4948(S) A change has been made to Windows Firewall exception list. A rule was deleted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4949.md b/windows/security/threat-protection/auditing/event-4949.md index 188a147179..c2ca64e36a 100644 --- a/windows/security/threat-protection/auditing/event-4949.md +++ b/windows/security/threat-protection/auditing/event-4949.md @@ -2,7 +2,6 @@ title: 4949(S) Windows Firewall settings were restored to the default values. description: Describes security event 4949(S) Windows Firewall settings were restored to the default values. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4950.md b/windows/security/threat-protection/auditing/event-4950.md index 4b7c3ef8da..fe1a3cacc8 100644 --- a/windows/security/threat-protection/auditing/event-4950.md +++ b/windows/security/threat-protection/auditing/event-4950.md @@ -2,7 +2,6 @@ title: 4950(S) A Windows Firewall setting has changed. description: Describes security event 4950(S) A Windows Firewall setting has changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4951.md b/windows/security/threat-protection/auditing/event-4951.md index 3922a0d9bc..e83a14e571 100644 --- a/windows/security/threat-protection/auditing/event-4951.md +++ b/windows/security/threat-protection/auditing/event-4951.md @@ -2,7 +2,6 @@ title: 4951(F) A rule has been ignored because its major version number wasn't recognized by Windows Firewall. description: Describes security event 4951(F) A rule has been ignored because its major version number wasn't recognized by Windows Firewall. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4952.md b/windows/security/threat-protection/auditing/event-4952.md index 1b2c9a1677..d727a8f210 100644 --- a/windows/security/threat-protection/auditing/event-4952.md +++ b/windows/security/threat-protection/auditing/event-4952.md @@ -2,7 +2,6 @@ title: 4952(F) Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced. description: Security event 4952(F) Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4953.md b/windows/security/threat-protection/auditing/event-4953.md index dcb48de16e..a729e5af8e 100644 --- a/windows/security/threat-protection/auditing/event-4953.md +++ b/windows/security/threat-protection/auditing/event-4953.md @@ -2,7 +2,6 @@ title: 4953(F) Windows Firewall ignored a rule because it couldn't be parsed. description: Describes security event 4953(F) Windows Firewall ignored a rule because it couldn't be parsed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4954.md b/windows/security/threat-protection/auditing/event-4954.md index 42e1732841..cdb31c5fbb 100644 --- a/windows/security/threat-protection/auditing/event-4954.md +++ b/windows/security/threat-protection/auditing/event-4954.md @@ -2,7 +2,6 @@ title: 4954(S) Windows Firewall Group Policy settings have changed. The new settings have been applied. description: Describes security event 4954(S) Windows Firewall Group Policy settings have changed. The new settings have been applied. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4956.md b/windows/security/threat-protection/auditing/event-4956.md index ab54b58db2..299e21d03c 100644 --- a/windows/security/threat-protection/auditing/event-4956.md +++ b/windows/security/threat-protection/auditing/event-4956.md @@ -2,7 +2,6 @@ title: 4956(S) Windows Firewall has changed the active profile. description: Describes security event 4956(S) Windows Firewall has changed the active profile. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4957.md b/windows/security/threat-protection/auditing/event-4957.md index 0049947eee..a2fd4fd1b8 100644 --- a/windows/security/threat-protection/auditing/event-4957.md +++ b/windows/security/threat-protection/auditing/event-4957.md @@ -2,7 +2,6 @@ title: 4957(F) Windows Firewall did not apply the following rule. description: Describes security event 4957(F) Windows Firewall didn't apply the following rule. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4958.md b/windows/security/threat-protection/auditing/event-4958.md index f1cbaa0f1d..b46bed82ca 100644 --- a/windows/security/threat-protection/auditing/event-4958.md +++ b/windows/security/threat-protection/auditing/event-4958.md @@ -2,7 +2,6 @@ title: 4958(F) Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer. description: Describes security event 4958(F) Windows Firewall didn't apply the following rule because the rule referred to items not configured on this computer. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4964.md b/windows/security/threat-protection/auditing/event-4964.md index 5567fdf5b4..12b5bf4a9b 100644 --- a/windows/security/threat-protection/auditing/event-4964.md +++ b/windows/security/threat-protection/auditing/event-4964.md @@ -2,7 +2,6 @@ title: 4964(S) Special groups have been assigned to a new logon. description: Describes security event 4964(S) Special groups have been assigned to a new logon. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-4985.md b/windows/security/threat-protection/auditing/event-4985.md index 4caca31a8e..843551f1d1 100644 --- a/windows/security/threat-protection/auditing/event-4985.md +++ b/windows/security/threat-protection/auditing/event-4985.md @@ -2,7 +2,6 @@ title: 4985(S) The state of a transaction has changed. description: Describes security event 4985(S) The state of a transaction has changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5024.md b/windows/security/threat-protection/auditing/event-5024.md index ff2c44088f..00353b46f9 100644 --- a/windows/security/threat-protection/auditing/event-5024.md +++ b/windows/security/threat-protection/auditing/event-5024.md @@ -2,7 +2,6 @@ title: 5024(S) The Windows Firewall Service has started successfully. description: Describes security event 5024(S) The Windows Firewall Service has started successfully. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5025.md b/windows/security/threat-protection/auditing/event-5025.md index 334431f02f..d13e773f3e 100644 --- a/windows/security/threat-protection/auditing/event-5025.md +++ b/windows/security/threat-protection/auditing/event-5025.md @@ -2,7 +2,6 @@ title: 5025(S) The Windows Firewall Service has been stopped. description: Describes security event 5025(S) The Windows Firewall Service has been stopped. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5027.md b/windows/security/threat-protection/auditing/event-5027.md index 1633648148..f9bd6770a1 100644 --- a/windows/security/threat-protection/auditing/event-5027.md +++ b/windows/security/threat-protection/auditing/event-5027.md @@ -2,7 +2,6 @@ title: 5027(F) The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy. description: Details on security event 5027(F) The Windows Firewall Service was unable to retrieve the security policy from the local storage. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5028.md b/windows/security/threat-protection/auditing/event-5028.md index c83b0a955a..8c49e63b2b 100644 --- a/windows/security/threat-protection/auditing/event-5028.md +++ b/windows/security/threat-protection/auditing/event-5028.md @@ -2,7 +2,6 @@ title: 5028(F) The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy. description: Describes security event 5028(F) The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5029.md b/windows/security/threat-protection/auditing/event-5029.md index 4050293075..dfa020140d 100644 --- a/windows/security/threat-protection/auditing/event-5029.md +++ b/windows/security/threat-protection/auditing/event-5029.md @@ -2,7 +2,6 @@ title: 5029(F) The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy. description: Describes security event 5029(F) The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5030.md b/windows/security/threat-protection/auditing/event-5030.md index 19faefd2f3..145336f252 100644 --- a/windows/security/threat-protection/auditing/event-5030.md +++ b/windows/security/threat-protection/auditing/event-5030.md @@ -2,7 +2,6 @@ title: 5030(F) The Windows Firewall Service failed to start. description: Describes security event 5030(F) The Windows Firewall Service failed to start. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5031.md b/windows/security/threat-protection/auditing/event-5031.md index 1187494a86..c569dbc016 100644 --- a/windows/security/threat-protection/auditing/event-5031.md +++ b/windows/security/threat-protection/auditing/event-5031.md @@ -5,13 +5,11 @@ manager: aaroncz ms.author: vinpa description: Describes security event 5031(F) The Windows Firewall Service blocked an application from accepting incoming connections on the network. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/08/2021 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5032.md b/windows/security/threat-protection/auditing/event-5032.md index 369d590db9..f982635697 100644 --- a/windows/security/threat-protection/auditing/event-5032.md +++ b/windows/security/threat-protection/auditing/event-5032.md @@ -2,7 +2,6 @@ title: 5032(F) Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network. description: Describes security event 5032(F) Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5033.md b/windows/security/threat-protection/auditing/event-5033.md index bd275a6463..65e7a2f819 100644 --- a/windows/security/threat-protection/auditing/event-5033.md +++ b/windows/security/threat-protection/auditing/event-5033.md @@ -2,7 +2,6 @@ title: 5033(S) The Windows Firewall Driver has started successfully. description: Describes security event 5033(S) The Windows Firewall Driver has started successfully. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5034.md b/windows/security/threat-protection/auditing/event-5034.md index bd017daa1f..604aaafc09 100644 --- a/windows/security/threat-protection/auditing/event-5034.md +++ b/windows/security/threat-protection/auditing/event-5034.md @@ -2,7 +2,6 @@ title: 5034(S) The Windows Firewall Driver was stopped. description: Describes security event 5034(S) The Windows Firewall Driver was stopped. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5035.md b/windows/security/threat-protection/auditing/event-5035.md index cda5f7ddc7..b0290be5fc 100644 --- a/windows/security/threat-protection/auditing/event-5035.md +++ b/windows/security/threat-protection/auditing/event-5035.md @@ -2,7 +2,6 @@ title: 5035(F) The Windows Firewall Driver failed to start. description: Describes security event 5035(F) The Windows Firewall Driver failed to start. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5037.md b/windows/security/threat-protection/auditing/event-5037.md index 6421be47c1..8f22210755 100644 --- a/windows/security/threat-protection/auditing/event-5037.md +++ b/windows/security/threat-protection/auditing/event-5037.md @@ -2,7 +2,6 @@ title: 5037(F) The Windows Firewall Driver detected critical runtime error. Terminating. description: Describes security event 5037(F) The Windows Firewall Driver detected critical runtime error. Terminating. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5038.md b/windows/security/threat-protection/auditing/event-5038.md index 865a9e7de3..84ad591d34 100644 --- a/windows/security/threat-protection/auditing/event-5038.md +++ b/windows/security/threat-protection/auditing/event-5038.md @@ -2,7 +2,6 @@ title: 5038(F) Code integrity determined that the image hash of a file is not valid. description: Describes security event 5038(F) Code integrity determined that the image hash of a file isn't valid. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5039.md b/windows/security/threat-protection/auditing/event-5039.md index 3d9ba6fd9a..a1b4dc60e2 100644 --- a/windows/security/threat-protection/auditing/event-5039.md +++ b/windows/security/threat-protection/auditing/event-5039.md @@ -2,7 +2,6 @@ title: 5039(-) A registry key was virtualized. description: Describes security event 5039(-) A registry key was virtualized. This event is generated when a registry key is virtualized using LUAFV. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5051.md b/windows/security/threat-protection/auditing/event-5051.md index 706e02d603..6ced4325e8 100644 --- a/windows/security/threat-protection/auditing/event-5051.md +++ b/windows/security/threat-protection/auditing/event-5051.md @@ -2,7 +2,6 @@ title: 5051(-) A file was virtualized. description: Describes security event 5051(-) A file was virtualized. This event is generated when a file is virtualized using LUAFV. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5056.md b/windows/security/threat-protection/auditing/event-5056.md index d67c948bf7..5130521799 100644 --- a/windows/security/threat-protection/auditing/event-5056.md +++ b/windows/security/threat-protection/auditing/event-5056.md @@ -2,7 +2,6 @@ title: 5056(S) A cryptographic self-test was performed. description: Describes security event 5056(S) A cryptographic self-test was performed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5057.md b/windows/security/threat-protection/auditing/event-5057.md index 9c4c3bbbc7..b45863a7f8 100644 --- a/windows/security/threat-protection/auditing/event-5057.md +++ b/windows/security/threat-protection/auditing/event-5057.md @@ -2,7 +2,6 @@ title: 5057(F) A cryptographic primitive operation failed. description: Describes security event 5057(F) A cryptographic primitive operation failed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5058.md b/windows/security/threat-protection/auditing/event-5058.md index b8f43fd22c..52e292db53 100644 --- a/windows/security/threat-protection/auditing/event-5058.md +++ b/windows/security/threat-protection/auditing/event-5058.md @@ -2,7 +2,6 @@ title: 5058(S, F) Key file operation. description: Describes security event 5058(S, F) Key file operation. This event is generated when an operation is performed on a file that contains a KSP key. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5059.md b/windows/security/threat-protection/auditing/event-5059.md index 80656eb84c..0631adf2e0 100644 --- a/windows/security/threat-protection/auditing/event-5059.md +++ b/windows/security/threat-protection/auditing/event-5059.md @@ -2,7 +2,6 @@ title: 5059(S, F) Key migration operation. description: Describes security event 5059(S, F) Key migration operation. This event is generated when a cryptographic key is exported/imported using a Key Storage Provider. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5060.md b/windows/security/threat-protection/auditing/event-5060.md index 95c791073a..fda2a9d82d 100644 --- a/windows/security/threat-protection/auditing/event-5060.md +++ b/windows/security/threat-protection/auditing/event-5060.md @@ -2,7 +2,6 @@ title: 5060(F) Verification operation failed. description: Describes security event 5060(F) Verification operation failed. This event is generated when the CNG verification operation fails. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5061.md b/windows/security/threat-protection/auditing/event-5061.md index 37ce0fe43d..7d05fab9d4 100644 --- a/windows/security/threat-protection/auditing/event-5061.md +++ b/windows/security/threat-protection/auditing/event-5061.md @@ -2,7 +2,6 @@ title: 5061(S, F) Cryptographic operation. description: Describes security event 5061(S, F) Cryptographic operation. This event is generated when a cryptographic operation is performed using a Key Storage Provider. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5062.md b/windows/security/threat-protection/auditing/event-5062.md index 8273fa0b06..50bb1114e2 100644 --- a/windows/security/threat-protection/auditing/event-5062.md +++ b/windows/security/threat-protection/auditing/event-5062.md @@ -2,7 +2,6 @@ title: 5062(S) A kernel-mode cryptographic self-test was performed. description: Describes security event 5062(S) A kernel-mode cryptographic self-test was performed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5063.md b/windows/security/threat-protection/auditing/event-5063.md index 111a1bebce..1d05f6f799 100644 --- a/windows/security/threat-protection/auditing/event-5063.md +++ b/windows/security/threat-protection/auditing/event-5063.md @@ -2,7 +2,6 @@ title: 5063(S, F) A cryptographic provider operation was attempted. description: Describes security event 5063(S, F) A cryptographic provider operation was attempted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5064.md b/windows/security/threat-protection/auditing/event-5064.md index 3414385e9f..f727a5f6af 100644 --- a/windows/security/threat-protection/auditing/event-5064.md +++ b/windows/security/threat-protection/auditing/event-5064.md @@ -2,7 +2,6 @@ title: 5064(S, F) A cryptographic context operation was attempted. description: Describes security event 5064(S, F) A cryptographic context operation was attempted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5065.md b/windows/security/threat-protection/auditing/event-5065.md index 2543372fd8..e94042c052 100644 --- a/windows/security/threat-protection/auditing/event-5065.md +++ b/windows/security/threat-protection/auditing/event-5065.md @@ -2,7 +2,6 @@ title: 5065(S, F) A cryptographic context modification was attempted. description: Describes security event 5065(S, F) A cryptographic context modification was attempted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5066.md b/windows/security/threat-protection/auditing/event-5066.md index 6385f0488a..4aabb3e542 100644 --- a/windows/security/threat-protection/auditing/event-5066.md +++ b/windows/security/threat-protection/auditing/event-5066.md @@ -2,7 +2,6 @@ title: 5066(S, F) A cryptographic function operation was attempted. description: Describes security event 5066(S, F) A cryptographic function operation was attempted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5067.md b/windows/security/threat-protection/auditing/event-5067.md index 16a2775d06..d7a4d6a6b2 100644 --- a/windows/security/threat-protection/auditing/event-5067.md +++ b/windows/security/threat-protection/auditing/event-5067.md @@ -2,7 +2,6 @@ title: 5067(S, F) A cryptographic function modification was attempted. description: Describes security event 5067(S, F) A cryptographic function modification was attempted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5068.md b/windows/security/threat-protection/auditing/event-5068.md index 49659e38f5..a86f4345b5 100644 --- a/windows/security/threat-protection/auditing/event-5068.md +++ b/windows/security/threat-protection/auditing/event-5068.md @@ -2,7 +2,6 @@ title: 5068(S, F) A cryptographic function provider operation was attempted. description: Describes security event 5068(S, F) A cryptographic function provider operation was attempted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5069.md b/windows/security/threat-protection/auditing/event-5069.md index ffcfb92ca9..15b6f1bbe3 100644 --- a/windows/security/threat-protection/auditing/event-5069.md +++ b/windows/security/threat-protection/auditing/event-5069.md @@ -2,7 +2,6 @@ title: 5069(S, F) A cryptographic function property operation was attempted. description: Describes security event 5069(S, F) A cryptographic function property operation was attempted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5070.md b/windows/security/threat-protection/auditing/event-5070.md index 079cb18504..afdb292917 100644 --- a/windows/security/threat-protection/auditing/event-5070.md +++ b/windows/security/threat-protection/auditing/event-5070.md @@ -2,7 +2,6 @@ title: 5070(S, F) A cryptographic function property modification was attempted. description: Describes security event 5070(S, F) A cryptographic function property modification was attempted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5136.md b/windows/security/threat-protection/auditing/event-5136.md index e71aa708cc..c4d5e84029 100644 --- a/windows/security/threat-protection/auditing/event-5136.md +++ b/windows/security/threat-protection/auditing/event-5136.md @@ -2,7 +2,6 @@ title: 5136(S) A directory service object was modified. description: Describes security event 5136(S) A directory service object was modified. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5137.md b/windows/security/threat-protection/auditing/event-5137.md index e7d10b0197..49ade1e081 100644 --- a/windows/security/threat-protection/auditing/event-5137.md +++ b/windows/security/threat-protection/auditing/event-5137.md @@ -2,7 +2,6 @@ title: 5137(S) A directory service object was created. description: Describes security event 5137(S) A directory service object was created. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5138.md b/windows/security/threat-protection/auditing/event-5138.md index 1120df1fc3..7dac9ef63f 100644 --- a/windows/security/threat-protection/auditing/event-5138.md +++ b/windows/security/threat-protection/auditing/event-5138.md @@ -2,7 +2,6 @@ title: 5138(S) A directory service object was undeleted. description: Describes security event 5138(S) A directory service object was undeleted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5139.md b/windows/security/threat-protection/auditing/event-5139.md index 09ca54dca4..2b06e5309c 100644 --- a/windows/security/threat-protection/auditing/event-5139.md +++ b/windows/security/threat-protection/auditing/event-5139.md @@ -2,7 +2,6 @@ title: 5139(S) A directory service object was moved. description: Describes security event 5139(S) A directory service object was moved. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5140.md b/windows/security/threat-protection/auditing/event-5140.md index d79d99892e..e0afa21cd5 100644 --- a/windows/security/threat-protection/auditing/event-5140.md +++ b/windows/security/threat-protection/auditing/event-5140.md @@ -2,7 +2,6 @@ title: 5140(S, F) A network share object was accessed. description: Describes security event 5140(S, F) A network share object was accessed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5141.md b/windows/security/threat-protection/auditing/event-5141.md index e70a399593..dfdea7ca5f 100644 --- a/windows/security/threat-protection/auditing/event-5141.md +++ b/windows/security/threat-protection/auditing/event-5141.md @@ -2,7 +2,6 @@ title: 5141(S) A directory service object was deleted. description: Describes security event 5141(S) A directory service object was deleted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5142.md b/windows/security/threat-protection/auditing/event-5142.md index 790b6ea8f0..4620f55d07 100644 --- a/windows/security/threat-protection/auditing/event-5142.md +++ b/windows/security/threat-protection/auditing/event-5142.md @@ -2,7 +2,6 @@ title: 5142(S) A network share object was added. description: Describes security event 5142(S) A network share object was added. This event is generated when a network share object is added. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5143.md b/windows/security/threat-protection/auditing/event-5143.md index e26f69e294..f7f04d6cf0 100644 --- a/windows/security/threat-protection/auditing/event-5143.md +++ b/windows/security/threat-protection/auditing/event-5143.md @@ -2,7 +2,6 @@ title: 5143(S) A network share object was modified. description: Describes security event 5143(S) A network share object was modified. This event is generated when a network share object is modified. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5144.md b/windows/security/threat-protection/auditing/event-5144.md index 6d6a16e1af..df41963e27 100644 --- a/windows/security/threat-protection/auditing/event-5144.md +++ b/windows/security/threat-protection/auditing/event-5144.md @@ -2,7 +2,6 @@ title: 5144(S) A network share object was deleted. description: Describes security event 5144(S) A network share object was deleted. This event is generated when a network share object is deleted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5145.md b/windows/security/threat-protection/auditing/event-5145.md index 32fef4024d..783c17d59f 100644 --- a/windows/security/threat-protection/auditing/event-5145.md +++ b/windows/security/threat-protection/auditing/event-5145.md @@ -2,7 +2,6 @@ title: 5145(S, F) A network share object was checked to see whether client can be granted desired access. description: Describes security event 5145(S, F) A network share object was checked to see whether client can be granted desired access. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5148.md b/windows/security/threat-protection/auditing/event-5148.md index 291a541e11..9eb90940af 100644 --- a/windows/security/threat-protection/auditing/event-5148.md +++ b/windows/security/threat-protection/auditing/event-5148.md @@ -2,7 +2,6 @@ title: 5148(F) The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded. description: Details on Security event 5148(F), The Windows Filtering Platform has detected a DoS attack and entered a defensive mode. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5149.md b/windows/security/threat-protection/auditing/event-5149.md index 0f37543acf..f1c753d3a9 100644 --- a/windows/security/threat-protection/auditing/event-5149.md +++ b/windows/security/threat-protection/auditing/event-5149.md @@ -2,7 +2,6 @@ title: 5149(F) The DoS attack has subsided and normal processing is being resumed. description: Describes security event 5149(F) The DoS attack has subsided and normal processing is being resumed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5150.md b/windows/security/threat-protection/auditing/event-5150.md index aa56f896dc..a5f3e3b184 100644 --- a/windows/security/threat-protection/auditing/event-5150.md +++ b/windows/security/threat-protection/auditing/event-5150.md @@ -2,7 +2,6 @@ title: 5150(-) The Windows Filtering Platform blocked a packet. description: Describes security event 5150(-) The Windows Filtering Platform blocked a packet. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5151.md b/windows/security/threat-protection/auditing/event-5151.md index 22dcd9a63e..92c88cdf47 100644 --- a/windows/security/threat-protection/auditing/event-5151.md +++ b/windows/security/threat-protection/auditing/event-5151.md @@ -2,7 +2,6 @@ title: 5151(-) A more restrictive Windows Filtering Platform filter has blocked a packet. description: Describes security event 5151(-) A more restrictive Windows Filtering Platform filter has blocked a packet. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5152.md b/windows/security/threat-protection/auditing/event-5152.md index 363a095741..0c38edef1f 100644 --- a/windows/security/threat-protection/auditing/event-5152.md +++ b/windows/security/threat-protection/auditing/event-5152.md @@ -2,7 +2,6 @@ title: 5152(F) The Windows Filtering Platform blocked a packet. description: Describes security event 5152(F) The Windows Filtering Platform blocked a packet. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5153.md b/windows/security/threat-protection/auditing/event-5153.md index a46227f056..0fe85f8e85 100644 --- a/windows/security/threat-protection/auditing/event-5153.md +++ b/windows/security/threat-protection/auditing/event-5153.md @@ -2,7 +2,6 @@ title: 5153(S) A more restrictive Windows Filtering Platform filter has blocked a packet. description: Describes security event 5153(S) A more restrictive Windows Filtering Platform filter has blocked a packet. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5154.md b/windows/security/threat-protection/auditing/event-5154.md index 76424d3ca5..d99a804e12 100644 --- a/windows/security/threat-protection/auditing/event-5154.md +++ b/windows/security/threat-protection/auditing/event-5154.md @@ -2,7 +2,6 @@ title: 5154(S) The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. description: Describes security event 5154(S) The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5155.md b/windows/security/threat-protection/auditing/event-5155.md index 89e206fdbb..883e22bd27 100644 --- a/windows/security/threat-protection/auditing/event-5155.md +++ b/windows/security/threat-protection/auditing/event-5155.md @@ -2,7 +2,6 @@ title: 5155(F) The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections. description: Describes security event 5155(F) The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5156.md b/windows/security/threat-protection/auditing/event-5156.md index 95b20ccfcf..5c4dd19d0c 100644 --- a/windows/security/threat-protection/auditing/event-5156.md +++ b/windows/security/threat-protection/auditing/event-5156.md @@ -2,7 +2,6 @@ title: 5156(S) The Windows Filtering Platform has permitted a connection. description: Describes security event 5156(S) The Windows Filtering Platform has permitted a connection. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5157.md b/windows/security/threat-protection/auditing/event-5157.md index cce391d0d8..2042aa3cb3 100644 --- a/windows/security/threat-protection/auditing/event-5157.md +++ b/windows/security/threat-protection/auditing/event-5157.md @@ -2,7 +2,6 @@ title: 5157(F) The Windows Filtering Platform has blocked a connection. description: Describes security event 5157(F) The Windows Filtering Platform has blocked a connection. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5158.md b/windows/security/threat-protection/auditing/event-5158.md index 7152b22478..42d2e97dd8 100644 --- a/windows/security/threat-protection/auditing/event-5158.md +++ b/windows/security/threat-protection/auditing/event-5158.md @@ -2,7 +2,6 @@ title: 5158(S) The Windows Filtering Platform has permitted a bind to a local port. description: Describes security event 5158(S) The Windows Filtering Platform has permitted a bind to a local port. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5159.md b/windows/security/threat-protection/auditing/event-5159.md index 1c163b30dc..e73c67f9da 100644 --- a/windows/security/threat-protection/auditing/event-5159.md +++ b/windows/security/threat-protection/auditing/event-5159.md @@ -2,7 +2,6 @@ title: 5159(F) The Windows Filtering Platform has blocked a bind to a local port. description: Describes security event 5159(F) The Windows Filtering Platform has blocked a bind to a local port. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5168.md b/windows/security/threat-protection/auditing/event-5168.md index f961f15bab..f29c101e31 100644 --- a/windows/security/threat-protection/auditing/event-5168.md +++ b/windows/security/threat-protection/auditing/event-5168.md @@ -2,7 +2,6 @@ title: 5168(F) SPN check for SMB/SMB2 failed. description: Describes security event 5168(F) SPN check for SMB/SMB2 failed. This event is generated when an SMB SPN check fails. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5376.md b/windows/security/threat-protection/auditing/event-5376.md index 0f2be5a04a..ea9979f965 100644 --- a/windows/security/threat-protection/auditing/event-5376.md +++ b/windows/security/threat-protection/auditing/event-5376.md @@ -2,7 +2,6 @@ title: 5376(S) Credential Manager credentials were backed up. description: Describes security event 5376(S) Credential Manager credentials were backed up. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5377.md b/windows/security/threat-protection/auditing/event-5377.md index d5a1660220..e5a9be7063 100644 --- a/windows/security/threat-protection/auditing/event-5377.md +++ b/windows/security/threat-protection/auditing/event-5377.md @@ -2,7 +2,6 @@ title: 5377(S) Credential Manager credentials were restored from a backup. description: Describes security event 5377(S) Credential Manager credentials were restored from a backup. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5378.md b/windows/security/threat-protection/auditing/event-5378.md index 25c68deee6..6d1ac9a70f 100644 --- a/windows/security/threat-protection/auditing/event-5378.md +++ b/windows/security/threat-protection/auditing/event-5378.md @@ -2,7 +2,6 @@ title: 5378(F) The requested credentials delegation was disallowed by policy. description: Describes security event 5378(F) The requested credentials delegation was disallowed by policy. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5447.md b/windows/security/threat-protection/auditing/event-5447.md index d1ffd6b03d..a3065a4f0a 100644 --- a/windows/security/threat-protection/auditing/event-5447.md +++ b/windows/security/threat-protection/auditing/event-5447.md @@ -2,7 +2,6 @@ title: 5447(S) A Windows Filtering Platform filter has been changed. description: Describes security event 5447(S) A Windows Filtering Platform filter has been changed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5632.md b/windows/security/threat-protection/auditing/event-5632.md index 0815f5d12f..8b751f272e 100644 --- a/windows/security/threat-protection/auditing/event-5632.md +++ b/windows/security/threat-protection/auditing/event-5632.md @@ -2,7 +2,6 @@ title: 5632(S, F) A request was made to authenticate to a wireless network. description: Describes security event 5632(S, F) A request was made to authenticate to a wireless network. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5633.md b/windows/security/threat-protection/auditing/event-5633.md index bf786c1d2d..5c2c68695a 100644 --- a/windows/security/threat-protection/auditing/event-5633.md +++ b/windows/security/threat-protection/auditing/event-5633.md @@ -2,7 +2,6 @@ title: 5633(S, F) A request was made to authenticate to a wired network. description: Describes security event 5633(S, F) A request was made to authenticate to a wired network. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5712.md b/windows/security/threat-protection/auditing/event-5712.md index a7ec0a5e10..8fe2ad8714 100644 --- a/windows/security/threat-protection/auditing/event-5712.md +++ b/windows/security/threat-protection/auditing/event-5712.md @@ -2,7 +2,6 @@ title: 5712(S) A Remote Procedure Call (RPC) was attempted. description: Describes security event 5712(S) A Remote Procedure Call (RPC) was attempted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5888.md b/windows/security/threat-protection/auditing/event-5888.md index 47bfb7e52c..7f06d1e907 100644 --- a/windows/security/threat-protection/auditing/event-5888.md +++ b/windows/security/threat-protection/auditing/event-5888.md @@ -2,7 +2,6 @@ title: 5888(S) An object in the COM+ Catalog was modified. description: Describes security event 5888(S) An object in the COM+ Catalog was modified. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5889.md b/windows/security/threat-protection/auditing/event-5889.md index 21bced3526..32bd5bffd8 100644 --- a/windows/security/threat-protection/auditing/event-5889.md +++ b/windows/security/threat-protection/auditing/event-5889.md @@ -2,7 +2,6 @@ title: 5889(S) An object was deleted from the COM+ Catalog. description: Describes security event 5889(S) An object was deleted from the COM+ Catalog. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-5890.md b/windows/security/threat-protection/auditing/event-5890.md index 652453190a..959e6fd3e4 100644 --- a/windows/security/threat-protection/auditing/event-5890.md +++ b/windows/security/threat-protection/auditing/event-5890.md @@ -2,7 +2,6 @@ title: 5890(S) An object was added to the COM+ Catalog. description: Describes security event 5890(S) An object was added to the COM+ Catalog. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6144.md b/windows/security/threat-protection/auditing/event-6144.md index b58495dff5..826d274d51 100644 --- a/windows/security/threat-protection/auditing/event-6144.md +++ b/windows/security/threat-protection/auditing/event-6144.md @@ -2,7 +2,6 @@ title: 6144(S) Security policy in the group policy objects has been applied successfully. description: Describes security event 6144(S) Security policy in the group policy objects has been applied successfully. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6145.md b/windows/security/threat-protection/auditing/event-6145.md index 690cca9856..a5e630ff72 100644 --- a/windows/security/threat-protection/auditing/event-6145.md +++ b/windows/security/threat-protection/auditing/event-6145.md @@ -2,7 +2,6 @@ title: 6145(F) One or more errors occurred while processing security policy in the group policy objects. description: Describes security event 6145(F) One or more errors occurred while processing security policy in the group policy objects. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/08/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6281.md b/windows/security/threat-protection/auditing/event-6281.md index b740282ddf..307122724f 100644 --- a/windows/security/threat-protection/auditing/event-6281.md +++ b/windows/security/threat-protection/auditing/event-6281.md @@ -2,7 +2,6 @@ title: 6281(F) Code Integrity determined that the page hashes of an image file aren't valid. description: Describes security event 6281(F) Code Integrity determined that the page hashes of an image file aren't valid. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6400.md b/windows/security/threat-protection/auditing/event-6400.md index 8ea567df22..0f1bdbe078 100644 --- a/windows/security/threat-protection/auditing/event-6400.md +++ b/windows/security/threat-protection/auditing/event-6400.md @@ -2,7 +2,6 @@ title: 6400(-) BranchCache Received an incorrectly formatted response while discovering availability of content. description: Describes security event 6400(-) BranchCache Received an incorrectly formatted response while discovering availability of content. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6401.md b/windows/security/threat-protection/auditing/event-6401.md index 6216a8ab19..56a4cdce4c 100644 --- a/windows/security/threat-protection/auditing/event-6401.md +++ b/windows/security/threat-protection/auditing/event-6401.md @@ -2,7 +2,6 @@ title: 6401(-) BranchCache Received invalid data from a peer. Data discarded. description: Describes security event 6401(-) BranchCache Received invalid data from a peer. Data discarded. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6402.md b/windows/security/threat-protection/auditing/event-6402.md index 6e00df66af..5e47ee6c4d 100644 --- a/windows/security/threat-protection/auditing/event-6402.md +++ b/windows/security/threat-protection/auditing/event-6402.md @@ -2,7 +2,6 @@ title: 6402(-) BranchCache The message to the hosted cache offering it data is incorrectly formatted. description: Describes security event 6402(-) BranchCache The message to the hosted cache offering it data is incorrectly formatted. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6403.md b/windows/security/threat-protection/auditing/event-6403.md index 92b228cf4a..f442562eb5 100644 --- a/windows/security/threat-protection/auditing/event-6403.md +++ b/windows/security/threat-protection/auditing/event-6403.md @@ -2,7 +2,6 @@ title: 6403(-) BranchCache The hosted cache sent an incorrectly formatted response to the client. description: Describes security event 6403(-) BranchCache The hosted cache sent an incorrectly formatted response to the client. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6404.md b/windows/security/threat-protection/auditing/event-6404.md index ef4073df30..387de30aa7 100644 --- a/windows/security/threat-protection/auditing/event-6404.md +++ b/windows/security/threat-protection/auditing/event-6404.md @@ -2,7 +2,6 @@ title: 6404(-) BranchCache Hosted cache could not be authenticated using the provisioned SSL certificate. description: Describes security event 6404(-) BranchCache Hosted cache could not be authenticated using the provisioned SSL certificate. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6405.md b/windows/security/threat-protection/auditing/event-6405.md index 63fc073a30..50bb5a679b 100644 --- a/windows/security/threat-protection/auditing/event-6405.md +++ b/windows/security/threat-protection/auditing/event-6405.md @@ -2,7 +2,6 @@ title: 6405(-) BranchCache %2 instance(s) of event id %1 occurred. description: Describes security event 6405(-) BranchCache %2 instance(s) of event id %1 occurred. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6406.md b/windows/security/threat-protection/auditing/event-6406.md index 057f4579b7..758b702bb1 100644 --- a/windows/security/threat-protection/auditing/event-6406.md +++ b/windows/security/threat-protection/auditing/event-6406.md @@ -2,7 +2,6 @@ title: 6406(-) %1 registered to Windows Firewall to control filtering for the following %2. description: Describes security event 6406(-) %1 registered to Windows Firewall to control filtering for the following %2. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6407.md b/windows/security/threat-protection/auditing/event-6407.md index 40c5e05deb..7c1f4a4e30 100644 --- a/windows/security/threat-protection/auditing/event-6407.md +++ b/windows/security/threat-protection/auditing/event-6407.md @@ -2,7 +2,6 @@ title: 6407(-) 1%. description: Describes security event 6407(-) 1%. This event is a BranchCache event, which is outside the scope of this document. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6408.md b/windows/security/threat-protection/auditing/event-6408.md index 6c5f475831..ccdc08387f 100644 --- a/windows/security/threat-protection/auditing/event-6408.md +++ b/windows/security/threat-protection/auditing/event-6408.md @@ -2,7 +2,6 @@ title: 6408(-) Registered product %1 failed and Windows Firewall is now controlling the filtering for %2. description: Describes security event 6408(-) Registered product %1 failed and Windows Firewall is now controlling the filtering for %2. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6409.md b/windows/security/threat-protection/auditing/event-6409.md index c1fbba806a..8ad3091f3a 100644 --- a/windows/security/threat-protection/auditing/event-6409.md +++ b/windows/security/threat-protection/auditing/event-6409.md @@ -2,7 +2,6 @@ title: 6409(-) BranchCache A service connection point object could not be parsed. description: Describes security event 6409(-) BranchCache A service connection point object could not be parsed. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6410.md b/windows/security/threat-protection/auditing/event-6410.md index a2b8474480..c9dc6f669c 100644 --- a/windows/security/threat-protection/auditing/event-6410.md +++ b/windows/security/threat-protection/auditing/event-6410.md @@ -2,7 +2,6 @@ title: 6410(F) Code integrity determined that a file doesn't meet the security requirements to load into a process. description: Describes security event 6410(F) Code integrity determined that a file doesn't meet the security requirements to load into a process. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6416.md b/windows/security/threat-protection/auditing/event-6416.md index 352f1eabbb..8629acdd90 100644 --- a/windows/security/threat-protection/auditing/event-6416.md +++ b/windows/security/threat-protection/auditing/event-6416.md @@ -2,7 +2,6 @@ title: 6416(S) A new external device was recognized by the System. description: Describes security event 6416(S) A new external device was recognized by the System. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6419.md b/windows/security/threat-protection/auditing/event-6419.md index e44f35c6ff..e5dfac4ae6 100644 --- a/windows/security/threat-protection/auditing/event-6419.md +++ b/windows/security/threat-protection/auditing/event-6419.md @@ -2,7 +2,6 @@ title: 6419(S) A request was made to disable a device. description: Describes security event 6419(S) A request was made to disable a device. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6420.md b/windows/security/threat-protection/auditing/event-6420.md index 951cd5e25d..068cc2db0e 100644 --- a/windows/security/threat-protection/auditing/event-6420.md +++ b/windows/security/threat-protection/auditing/event-6420.md @@ -2,7 +2,6 @@ title: 6420(S) A device was disabled. description: Describes security event 6420(S) A device was disabled. This event is generated when a specific device is disabled. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6421.md b/windows/security/threat-protection/auditing/event-6421.md index 866bdda53e..778380652b 100644 --- a/windows/security/threat-protection/auditing/event-6421.md +++ b/windows/security/threat-protection/auditing/event-6421.md @@ -2,7 +2,6 @@ title: 6421(S) A request was made to enable a device. description: Describes security event 6421(S) A request was made to enable a device. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6422.md b/windows/security/threat-protection/auditing/event-6422.md index 7411ffa42b..5ff3f69b78 100644 --- a/windows/security/threat-protection/auditing/event-6422.md +++ b/windows/security/threat-protection/auditing/event-6422.md @@ -2,7 +2,6 @@ title: 6422(S) A device was enabled. description: Describes security event 6422(S) A device was enabled. This event is generated when a specific device is enabled. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6423.md b/windows/security/threat-protection/auditing/event-6423.md index ebf46bad15..3aeaebb602 100644 --- a/windows/security/threat-protection/auditing/event-6423.md +++ b/windows/security/threat-protection/auditing/event-6423.md @@ -2,7 +2,6 @@ title: 6423(S) The installation of this device is forbidden by system policy. description: Describes security event 6423(S) The installation of this device is forbidden by system policy. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/event-6424.md b/windows/security/threat-protection/auditing/event-6424.md index ef8f789bd2..5d206fb5f9 100644 --- a/windows/security/threat-protection/auditing/event-6424.md +++ b/windows/security/threat-protection/auditing/event-6424.md @@ -2,7 +2,6 @@ title: 6424(S) The installation of this device was allowed, after having previously been forbidden by policy. description: Describes security event 6424(S) The installation of this device was allowed, after having previously been forbidden by policy. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: low @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md b/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md index 9e83c5b9cc..ccbd578203 100644 --- a/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md +++ b/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md @@ -4,7 +4,6 @@ description: The policy setting, File System (Global Object Access Auditing), en ms.assetid: 4f215d61-0e23-46e4-9e58-08511105d25b ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/09/2021 -ms.technology: itpro-security --- # File System (Global Object Access Auditing) diff --git a/windows/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata.md b/windows/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata.md index ba9bfd059d..0c2a17c7e0 100644 --- a/windows/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata.md +++ b/windows/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata.md @@ -1,7 +1,6 @@ --- title: How to get a list of XML data name elements in description: This reference article for the IT professional explains how to use PowerShell to get a list of XML data name elements that can appear in . -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md b/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md index 2f42573827..2db4bc7e3a 100644 --- a/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md +++ b/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md @@ -4,7 +4,6 @@ description: Learn how to use advanced security auditing options to monitor chan ms.assetid: 553f98a6-7606-4518-a3c5-347a33105130 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/09/2021 -ms.technology: itpro-security --- # Monitor central access policy and rule definitions diff --git a/windows/security/threat-protection/auditing/monitor-claim-types.md b/windows/security/threat-protection/auditing/monitor-claim-types.md index 60d4da3a45..13bd276728 100644 --- a/windows/security/threat-protection/auditing/monitor-claim-types.md +++ b/windows/security/threat-protection/auditing/monitor-claim-types.md @@ -4,7 +4,6 @@ description: Learn how to monitor changes to claim types that are associated wit ms.assetid: 426084da-4eef-44af-aeec-e7ab4d4e2439 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/09/2021 -ms.technology: itpro-security --- # Monitor claim types diff --git a/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md b/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md index 69a7d74967..0554f4f44d 100644 --- a/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md +++ b/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md @@ -4,7 +4,6 @@ description: Learn how to monitor changes to resource attribute definitions when ms.assetid: aace34b0-123a-4b83-9e09-f269220e79de ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/09/2021 -ms.technology: itpro-security --- # Monitor resource attribute definitions diff --git a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md index 19e11f0da4..0086d38798 100644 --- a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md +++ b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md @@ -4,7 +4,6 @@ description: Monitor changes to central access policies associated with files an ms.assetid: 2ea8fc23-b3ac-432f-87b0-6a16506e8eed ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/09/2021 -ms.technology: itpro-security --- # Monitor the central access policies associated with files and folders diff --git a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md index 84de3a7b3a..01731d7b6e 100644 --- a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md +++ b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md @@ -4,7 +4,6 @@ description: Learn how to monitor changes to the central access policies that ap ms.assetid: 126b051e-c20d-41f1-b42f-6cff24dcf20c ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/09/2021 -ms.technology: itpro-security --- # Monitor the central access policies that apply on a file server diff --git a/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md b/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md index 21f8121312..37a5df774a 100644 --- a/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md +++ b/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md @@ -4,7 +4,6 @@ description: Learn how to use advanced security auditing options to monitor atte ms.assetid: 4944097b-320f-44c7-88ed-bf55946a358b ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/09/2021 -ms.technology: itpro-security --- # Monitor the resource attributes on files and folders diff --git a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md index 26a826e404..4e187a67d2 100644 --- a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md +++ b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md @@ -4,7 +4,6 @@ description: Learn how advanced security auditing options can be used to monitor ms.assetid: b0a9e4a5-b7ff-41c6-96ff-0228d4ba5da8 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/09/2021 -ms.technology: itpro-security --- # Monitor the use of removable storage devices diff --git a/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md b/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md index 7fc2ba75cf..e4792764cf 100644 --- a/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md +++ b/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md @@ -4,7 +4,6 @@ description: Learn how to monitor user and device claims that are associated wit ms.assetid: 71796ea9-5fe4-4183-8475-805c3c1f319f ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/09/2021 -ms.technology: itpro-security --- # Monitor user and device claims during sign-in diff --git a/windows/security/threat-protection/auditing/other-events.md b/windows/security/threat-protection/auditing/other-events.md index 86ef4c8957..c4bdc43d1f 100644 --- a/windows/security/threat-protection/auditing/other-events.md +++ b/windows/security/threat-protection/auditing/other-events.md @@ -2,7 +2,6 @@ title: Other Events description: Describes the Other Events auditing subcategory, which includes events that are generated automatically and enabled by default. ms.pagetype: security -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: medium @@ -11,7 +10,6 @@ ms.date: 09/09/2021 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md b/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md index 35b3eb2d9c..3d589a1ec4 100644 --- a/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md +++ b/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md @@ -4,7 +4,6 @@ description: Learn to deploy an effective security audit policy in a network tha ms.assetid: 7428e1db-aba8-407b-a39e-509671e5a442 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/09/2021 -ms.technology: itpro-security --- # Plan and deploy advanced security audit policies diff --git a/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md b/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md index b82b7aa8de..e411afa653 100644 --- a/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md +++ b/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md @@ -4,7 +4,6 @@ description: The Advanced Security Audit policy setting, Registry (Global Object ms.assetid: 953bb1c1-3f76-43be-ba17-4aed2304f578 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/09/2021 -ms.technology: itpro-security --- # Registry (Global Object Access Auditing) diff --git a/windows/security/threat-protection/auditing/security-auditing-overview.md b/windows/security/threat-protection/auditing/security-auditing-overview.md index a4e0800569..250f523977 100644 --- a/windows/security/threat-protection/auditing/security-auditing-overview.md +++ b/windows/security/threat-protection/auditing/security-auditing-overview.md @@ -4,7 +4,6 @@ description: Learn about security auditing features in Windows, and how your org ms.assetid: 2d9b8142-49bd-4a33-b246-3f0c2a5f32d4 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/09/2021 -ms.technology: itpro-security --- # Security auditing diff --git a/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md b/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md index 076763b3d8..bc12d22422 100644 --- a/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md +++ b/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md @@ -4,7 +4,6 @@ description: Domain admins can set up advanced security audit options in Windows ms.assetid: 0d2c28ea-bdaf-47fd-bca2-a07dce5fed37 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/09/2021 -ms.technology: itpro-security --- # Using advanced security auditing options to monitor dynamic access control objects diff --git a/windows/security/threat-protection/auditing/view-the-security-event-log.md b/windows/security/threat-protection/auditing/view-the-security-event-log.md index 88b1438852..49c2f8a769 100644 --- a/windows/security/threat-protection/auditing/view-the-security-event-log.md +++ b/windows/security/threat-protection/auditing/view-the-security-event-log.md @@ -4,7 +4,6 @@ description: The security log records each event as defined by the audit policie ms.assetid: 20DD2ACD-241A-45C5-A92F-4BE0D9F198B9 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -17,7 +16,6 @@ ms.collection: - tier3 ms.topic: reference ms.date: 09/09/2021 -ms.technology: itpro-security --- # View the security event log diff --git a/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md b/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md index 2ede0f5748..543c3f0dbc 100644 --- a/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md +++ b/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md @@ -4,7 +4,6 @@ description: This reference topic for the IT professional describes which versio ms.assetid: 87c71cc5-522d-4771-ac78-34a2a0825f31 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/09/2021 -ms.technology: itpro-security --- # Which editions of Windows support advanced audit policy configuration diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index aafae23e17..5dd0c7c3f0 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -1,12 +1,10 @@ --- title: Windows threat protection description: Describes the security capabilities in Windows client focused on threat protection -ms.prod: windows-client author: aczechowski ms.author: aaroncz manager: aaroncz ms.topic: conceptual -ms.technology: itpro-security ms.date: 12/31/2017 --- diff --git a/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md b/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md deleted file mode 100644 index 682b246cfa..0000000000 --- a/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Override Process Mitigation Options -description: How to use Group Policy to override individual Process Mitigation Options settings and to help enforce specific app-related security policies. -ms.prod: windows-client -author: aczechowski -ms.author: aaroncz -manager: aaroncz -ms.localizationpriority: medium -ms.technology: itpro-security -ms.date: 12/31/2017 -ms.topic: article ---- - - -# Override Process Mitigation Options to help enforce app-related security policies - -**Applies to:** - -- Windows 10, version 1607 -- Windows Server 2016 - -Windows 10 includes Group Policy-configurable "Process Mitigation Options" that add advanced protections against memory-based attacks, that is, attacks where malware manipulates memory to gain control of a system. For example, malware might attempt to use buffer overruns to inject malicious executable code into memory, but Process Mitigation Options can prevent the running of the malicious code. - -> [!IMPORTANT] -> We recommend trying these mitigations in a test lab before deploying to your organization, to determine if they interfere with your organization's required apps. - -The Group Policy settings in this topic are related to three types of process mitigations. In Windows 10, all three types are on by default for 64-bit applications, but by using the Group Policy settings described in this topic, you can configure more protections. The types of process mitigations are: - -- **Data Execution Prevention (DEP)** is a system-level memory protection feature that enables the operating system to mark one or more pages of memory as non-executable, preventing code from being run from that region of memory, to help prevent exploitation of buffer overruns. DEP helps prevent code from being run from data pages such as the default heap, stacks, and memory pools. For more information, see [Data Execution Prevention](overview-of-threat-mitigations-in-windows-10.md#data-execution-prevention). - -- **Structured Exception Handling Overwrite Protection (SEHOP)** is designed to block exploits that use the Structured Exception Handler (SEH) overwrite technique. Because this protection mechanism is provided at run-time, it helps to protect apps regardless of whether they've been compiled with the latest improvements. For more information, see [Structured Exception Handling Overwrite Protection](overview-of-threat-mitigations-in-windows-10.md#structured-exception-handling-overwrite-protection). - -- **Address Space Layout Randomization (ASLR)** loads DLLs into random memory addresses at boot time to mitigate against malware that's designed to attack specific memory locations, where specific DLLs are expected to be loaded. For more information, see [Address Space Layout Randomization](overview-of-threat-mitigations-in-windows-10.md#address-space-layout-randomization). - To find more ASLR protections in the table below, look for `IMAGES` or `ASLR`. - -The following procedure describes how to use Group Policy to override individual **Process Mitigation Options** settings. - -**To modify Process Mitigation Options** - -1. Open your Group Policy editor and go to the **Administrative Templates\System\Mitigation Options\Process Mitigation Options** setting. - - ![Group Policy editor: Process Mitigation Options with setting enabled and Show button active.](images/gp-process-mitigation-options.png) - -2. Click **Enabled**, and then in the **Options** area, click **Show** to open the **Show Contents** box, where you'll be able to add your apps and the appropriate bit flag values, as shown in the [Setting the bit field](#setting-the-bit-field) and [Example](#example) sections of this topic. - - **Important**
            For each app you want to include, you must include: - - - **Value name.** The app file name, including the extension. For example, iexplore.exe. - - **Value.** A bit field with a series of bit flags in particular positions. Bits can be set to 0 (where the setting is forced off), 1 (where the setting is forced on), or ? (where the setting retains the previous, existing value). - - **Note**
            Setting bit flags in positions not specified here to anything other than ? might cause undefined behavior. - - ![Group Policy editor: Process Mitigation Options with Show Contents box and example text.](images/gp-process-mitigation-options-show.png) - -## Setting the bit field -Here's a visual representation of the bit flag locations for the various Process Mitigation Options settings: - -![Visual representation of the bit flag locations for the Process Mitigation Options settings.](images/gp-process-mitigation-options-bit-flag-image.png) - -Where the bit flags are read from right to left and are defined as: - -|Flag |Bit location |Setting |Details | -|-----|--------------|--------|--------| -|A |0 |`PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE (0x00000001)` |Turns on Data Execution Prevention (DEP) for child processes. | -|B |1 |`PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE (0x00000002)` |Turns on DEP-ATL thunk emulation for child processes. DEP-ATL thunk emulation lets the system intercept non-executable (NX) faults that originate from the Active Template Library (ATL) thunk layer, and then emulate and handle the instructions so the process can continue to run. | -|C |2 |`PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE (0x00000004)` |Turns on Structured Exception Handler Overwrite Protection (SEHOP) for child processes. SEHOP helps to block exploits that use the Structured Exception Handler (SEH) overwrite technique. | -|D |8 |`PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON (0x00000100)` |Uses the force Address Space Layout Randomization (ASLR) setting to act as though an image base collision happened at load time, forcibly rebasing images that aren't dynamic base compatible. Images without the base relocation section won't be loaded if relocations are required. | -|E |15 |`PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON (0x00010000)` |Turns on the bottom-up randomization policy, which includes stack randomization options and causes a random location to be used as the lowest user address. | -|F |16 |`PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF (0x00020000)` |Turns off the bottom-up randomization policy, which includes stack randomization options and causes a random location to be used as the lowest user address. | - -## Example -If you want to turn on the **PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE** and **PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON** settings, turn off the **PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF** setting, and leave everything else as the default values, you'd want to type a value of `???????????????0???????1???????1`. - - diff --git a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md index 365c09f330..61a3073fa1 100644 --- a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md +++ b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md @@ -1,12 +1,10 @@ --- title: Mitigate threats by using Windows 10 security features description: An overview of software and firmware threats faced in the current security landscape, and the mitigations that Windows 10 offers in response to these threats. -ms.prod: windows-client ms.localizationpriority: medium author: aczechowski ms.author: aaroncz manager: aaroncz -ms.technology: itpro-security ms.date: 12/31/2017 ms.topic: article --- diff --git a/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller.md b/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller.md index 81f50b4fda..61b895b145 100644 --- a/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller.md +++ b/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller.md @@ -4,7 +4,6 @@ description: Describes best practices, security considerations, and more for the ms.assetid: a51820d2-ca5b-47dd-8e9b-d7008603db88 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Access Credential Manager as a trusted caller diff --git a/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md b/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md index f8a0e483fd..58ab435398 100644 --- a/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md +++ b/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: f6767bc2-83d1-45f1-847c-54f5362db022 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 06/11/2021 -ms.technology: itpro-security --- # Access this computer from the network - security policy setting diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md b/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md index ab6ba1901c..23acbe9b1c 100644 --- a/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md +++ b/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: a4167bf4-27c3-4a9b-8ef0-04e3c6ec3aa4 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -17,7 +16,6 @@ ms.collection: - tier3 ms.topic: reference ms.date: 08/16/2021 -ms.technology: itpro-security --- # Account lockout duration diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md b/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md index 1872b25b41..25df645272 100644 --- a/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md +++ b/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md @@ -4,7 +4,6 @@ description: Describes the Account Lockout Policy settings and links to informat ms.assetid: eb968c28-17c5-405f-b413-50728cb7b724 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 10/11/2018 -ms.technology: itpro-security --- # Account Lockout Policy diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md b/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md index 2bae54f4e2..7902e5d1c9 100644 --- a/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md +++ b/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: 4904bb40-a2bd-4fef-a102-260ba8d74e30 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -17,7 +16,6 @@ ms.collection: - tier3 ms.topic: reference ms.date: 11/02/2018 -ms.technology: itpro-security --- # Account lockout threshold diff --git a/windows/security/threat-protection/security-policy-settings/account-policies.md b/windows/security/threat-protection/security-policy-settings/account-policies.md index 4504d333df..979811c1da 100644 --- a/windows/security/threat-protection/security-policy-settings/account-policies.md +++ b/windows/security/threat-protection/security-policy-settings/account-policies.md @@ -4,7 +4,6 @@ description: An overview of account policies in Windows and provides links to po ms.assetid: 711b3797-b87a-4cd9-a2e3-1f8ef18688fb ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Account Policies diff --git a/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status.md b/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status.md index 179f5ba556..2525359221 100644 --- a/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status.md +++ b/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: 71a3bd48-1014-49e0-a936-bfe9433af23e ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 08/01/2017 -ms.technology: itpro-security --- # Accounts: Administrator account status diff --git a/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts.md b/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts.md index 1ac6245b9b..63a3b327b9 100644 --- a/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts.md +++ b/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, management, and sec ms.assetid: 94c76f45-057c-4d80-8d01-033cf28ef2f7 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 08/10/2017 -ms.technology: itpro-security --- # Accounts: Block Microsoft accounts diff --git a/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status.md b/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status.md index 6c768ad6d6..a61f1e0d49 100644 --- a/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status.md +++ b/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: 07e53fc5-b495-4d02-ab42-5b245d10d0ce ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Accounts: Guest account status - security policy setting diff --git a/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md b/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md index 947a4c0f6f..a04536f260 100644 --- a/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md +++ b/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md @@ -4,7 +4,6 @@ description: Learn best practices, security considerations, and more for the pol ms.assetid: a1bfb58b-1ae8-4de9-832b-aa889a6e64bd ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Accounts: Limit local account use of blank passwords to console logon only diff --git a/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account.md b/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account.md index 44905ab096..3740084b0b 100644 --- a/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account.md +++ b/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account.md @@ -4,7 +4,6 @@ description: This security policy reference topic for the IT professional descri ms.assetid: d21308eb-7c60-4e48-8747-62b8109844f9 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Accounts: Rename administrator account diff --git a/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account.md b/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account.md index d034cdf835..1f3dd3b5f6 100644 --- a/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account.md +++ b/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: 9b8052b4-bbb9-4cc1-bfee-ce25390db707 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Accounts: Rename guest account - security policy setting diff --git a/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system.md b/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system.md index 1bdbf787f1..cf116b92be 100644 --- a/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system.md +++ b/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: c1b7e084-a9f7-4377-b678-07cc913c8b0c ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Act as part of the operating system diff --git a/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain.md b/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain.md index fb594e8748..f73cdd251d 100644 --- a/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain.md +++ b/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain.md @@ -3,13 +3,11 @@ title: Add workstations to domain description: Describes the best practices, location, values, policy management and security considerations for the Add workstations to domain security policy setting. ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Add workstations to domain diff --git a/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process.md b/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process.md index 5c9b499b8b..6a963f20cf 100644 --- a/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process.md +++ b/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 6754a2c8-6d07-4567-9af3-335fd8dd7626 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Adjust memory quotas for a process diff --git a/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md b/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md index 3a11417c5b..be7eb4d379 100644 --- a/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md +++ b/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md @@ -4,7 +4,6 @@ description: This article discusses different methods to administer security pol ms.assetid: 7617d885-9d28-437a-9371-171197407599 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Administer security policy settings diff --git a/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md b/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md index ec8dd1980d..0bb7fa0b5a 100644 --- a/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md +++ b/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: d9e5e1f3-3bff-4da7-a9a2-4bb3e0c79055 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Allow log on locally - security policy setting diff --git a/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md b/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md index b76363e1b5..1d44efc4b3 100644 --- a/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md +++ b/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md @@ -4,7 +4,6 @@ description: Best practices, location, values, policy management, and security c ms.assetid: 6267c376-8199-4f2b-ae56-9c5424e76798 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Allow log on through Remote Desktop Services diff --git a/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md b/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md index 25ef7bc3d6..179941bc1c 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md +++ b/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: 20d40a79-ce89-45e6-9bb4-148f83958460 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Audit: Audit the access of global system objects diff --git a/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md b/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md index 011e035679..05c570e013 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md +++ b/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md @@ -4,7 +4,6 @@ description: "Describes the best practices, location, values, and security consi ms.assetid: f656a2bb-e8d6-447b-8902-53df3a7756c5 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/01/2019 -ms.technology: itpro-security --- # Audit: Audit the use of Backup and Restore privilege diff --git a/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md b/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md index 663cfb1d30..1d81955c37 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md +++ b/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md @@ -4,7 +4,6 @@ description: Learn more about the security policy setting, Audit Force audit pol ms.assetid: 8ddc06bc-b6d6-4bac-9051-e0d77035bd4e ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings diff --git a/windows/security/threat-protection/security-policy-settings/audit-policy.md b/windows/security/threat-protection/security-policy-settings/audit-policy.md index bf27ff18aa..72c1169cf3 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-policy.md +++ b/windows/security/threat-protection/security-policy-settings/audit-policy.md @@ -4,7 +4,6 @@ description: Provides information about basic audit policies that are available ms.assetid: 2e8ea400-e555-43e5-89d6-0898cb89da90 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Audit Policy diff --git a/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md b/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md index da06353caf..4d0ab7c979 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md +++ b/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the security ms.assetid: 2cd23cd9-0e44-4d0b-a1f1-39fc29303826 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Audit: Shut down system immediately if unable to log security audits diff --git a/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories.md b/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories.md index 3bd99b5590..1ba7777a2b 100644 --- a/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories.md +++ b/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories.md @@ -4,7 +4,6 @@ description: Describes the recommended practices, location, values, policy manag ms.assetid: 1cd6bdd5-1501-41f4-98b9-acf29ac173ae ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Back up files and directories - security policy setting diff --git a/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md b/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md index f4a8745518..153da82af0 100644 --- a/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md +++ b/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 1c828655-68d3-4140-aa0f-caa903a7087e ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Bypass traverse checking diff --git a/windows/security/threat-protection/security-policy-settings/change-the-system-time.md b/windows/security/threat-protection/security-policy-settings/change-the-system-time.md index d985a6eaf9..7c3ac55c23 100644 --- a/windows/security/threat-protection/security-policy-settings/change-the-system-time.md +++ b/windows/security/threat-protection/security-policy-settings/change-the-system-time.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: f2f6637d-acbc-4352-8ca3-ec563f918e65 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Change the system time - security policy setting diff --git a/windows/security/threat-protection/security-policy-settings/change-the-time-zone.md b/windows/security/threat-protection/security-policy-settings/change-the-time-zone.md index 3ac7b50a9c..0c3b2e17fd 100644 --- a/windows/security/threat-protection/security-policy-settings/change-the-time-zone.md +++ b/windows/security/threat-protection/security-policy-settings/change-the-time-zone.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 3b1afae4-68bb-472f-a43e-49e300d73e50 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Change the time zone - security policy setting diff --git a/windows/security/threat-protection/security-policy-settings/create-a-pagefile.md b/windows/security/threat-protection/security-policy-settings/create-a-pagefile.md index a28a19a33f..4b5f9a7ed6 100644 --- a/windows/security/threat-protection/security-policy-settings/create-a-pagefile.md +++ b/windows/security/threat-protection/security-policy-settings/create-a-pagefile.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: dc087897-459d-414b-abe0-cd86c8dccdea ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Create a pagefile - security policy setting diff --git a/windows/security/threat-protection/security-policy-settings/create-a-token-object.md b/windows/security/threat-protection/security-policy-settings/create-a-token-object.md index 6c50cc0ce0..e45a81f726 100644 --- a/windows/security/threat-protection/security-policy-settings/create-a-token-object.md +++ b/windows/security/threat-protection/security-policy-settings/create-a-token-object.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: bfbf52fc-6ba4-442a-9df7-bd277e55729c ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Create a token object diff --git a/windows/security/threat-protection/security-policy-settings/create-global-objects.md b/windows/security/threat-protection/security-policy-settings/create-global-objects.md index 18fb5d25ad..9c2e0740b7 100644 --- a/windows/security/threat-protection/security-policy-settings/create-global-objects.md +++ b/windows/security/threat-protection/security-policy-settings/create-global-objects.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 9cb6247b-44fc-4815-86f2-cb59b6f0221e ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Create global objects diff --git a/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects.md b/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects.md index e5d58fc80d..8e28020f73 100644 --- a/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects.md +++ b/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 6a58438d-65ca-4c4a-a584-450eed976649 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Create permanent shared objects diff --git a/windows/security/threat-protection/security-policy-settings/create-symbolic-links.md b/windows/security/threat-protection/security-policy-settings/create-symbolic-links.md index 970e2ddfd7..d0a05e5cde 100644 --- a/windows/security/threat-protection/security-policy-settings/create-symbolic-links.md +++ b/windows/security/threat-protection/security-policy-settings/create-symbolic-links.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 882922b9-0ff8-4ee9-8afc-4475515ee3fd ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Create symbolic links diff --git a/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index 6426a749bf..784e63d190 100644 --- a/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -4,7 +4,6 @@ description: Learn about best practices and more for the syntax policy setting, ms.assetid: 0fe3521a-5252-44df-8a47-8d92cf936e7c ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax diff --git a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index 5accd3bbbc..6f20c35a59 100644 --- a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -4,7 +4,6 @@ description: Best practices and more for the security policy setting, DCOM Machi ms.assetid: 4b95d45f-dd62-4c34-ba32-43954528dabe ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax diff --git a/windows/security/threat-protection/security-policy-settings/debug-programs.md b/windows/security/threat-protection/security-policy-settings/debug-programs.md index c65db98a6f..f0d787d7a9 100644 --- a/windows/security/threat-protection/security-policy-settings/debug-programs.md +++ b/windows/security/threat-protection/security-policy-settings/debug-programs.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 594d9f2c-8ffc-444b-9522-75615ec87786 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Debug programs diff --git a/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network.md b/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network.md index 09c0633dea..446fad10ca 100644 --- a/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network.md +++ b/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network.md @@ -4,7 +4,6 @@ description: Best practices, location, values, policy management, and security c ms.assetid: 935e9f89-951b-4163-b186-fc325682bb0b ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 05/19/2021 -ms.technology: itpro-security --- # Deny access to this computer from the network diff --git a/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job.md b/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job.md index c4bc52c008..49ad4d216d 100644 --- a/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job.md +++ b/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 0ac36ebd-5e28-4b6a-9b4e-8924c6ecf44b ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Deny log on as a batch job diff --git a/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service.md b/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service.md index 7bdd2075ca..d2a042c022 100644 --- a/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service.md +++ b/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: f1114964-df86-4278-9b11-e35c66949794 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Deny log on as a service diff --git a/windows/security/threat-protection/security-policy-settings/deny-log-on-locally.md b/windows/security/threat-protection/security-policy-settings/deny-log-on-locally.md index 263496c85d..709c72bee4 100644 --- a/windows/security/threat-protection/security-policy-settings/deny-log-on-locally.md +++ b/windows/security/threat-protection/security-policy-settings/deny-log-on-locally.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 00150e88-ec9c-43e1-a70d-33bfe10434db ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Deny log on locally diff --git a/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services.md b/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services.md index 24e896eb79..c6dfb97ab1 100644 --- a/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services.md +++ b/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services.md @@ -4,7 +4,6 @@ description: Best practices, location, values, policy management, and security c ms.assetid: 84bbb807-287c-4acc-a094-cf0ffdcbca67 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Deny log on through Remote Desktop Services diff --git a/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on.md b/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on.md index abbf2b5679..a2514e41a3 100644 --- a/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on.md +++ b/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: 1d403f5d-ad41-4bb4-9f4a-0779c1c14b8c ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Devices: Allow undock without having to log on diff --git a/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md b/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md index c2b35adf67..515856c7f7 100644 --- a/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md +++ b/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: d1b42425-7244-4ab1-9d46-d68de823459c ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Devices: Allowed to format and eject removable media diff --git a/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md b/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md index 9a909d447c..9590fbf54b 100644 --- a/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md +++ b/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: ab70a122-f7f9-47e0-ad8c-541f30a27ec3 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 01/05/2022 -ms.technology: itpro-security --- # Devices: Prevent users from installing printer drivers diff --git a/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md b/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md index 30a9097f46..5ccf446d9e 100644 --- a/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md +++ b/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: 8b8f44bb-84ce-4f18-af30-ab89910e234d ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Devices: Restrict CD-ROM access to locally logged-on user only diff --git a/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md b/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md index 0a4d6c2250..b4a13d2337 100644 --- a/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md +++ b/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: 92997910-da95-4c03-ae6f-832915423898 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Devices: Restrict floppy access to locally logged-on user only diff --git a/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md b/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md index 8d5b95d46a..2757a09e31 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md +++ b/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md @@ -3,13 +3,11 @@ title: Domain controller Allow server operators to schedule tasks description: Describes the best practices, location, values, and security considerations for the Domain controller Allow server operators to schedule tasks security policy setting. ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Domain controller: Allow server operators to schedule tasks diff --git a/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements.md b/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements.md index af6812e273..ecf16ca65c 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements.md +++ b/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements.md @@ -3,13 +3,11 @@ title: Domain controller LDAP server channel binding token requirements description: Describes the best practices, location, values, and security considerations for the Domain controller LDAP server channel binding token requirements security policy setting. ms.reviewer: waynmc ms.author: waynmc -ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz ms.topic: reference ms.date: 04/26/2023 -ms.technology: itpro-security --- # Domain controller: LDAP server channel binding token requirements diff --git a/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements.md b/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements.md index 0745e54ec3..b46d83e1d6 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements.md +++ b/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements.md @@ -3,13 +3,11 @@ title: Domain controller LDAP server signing requirements description: Describes the best practices, location, values, and security considerations for the Domain controller LDAP server signing requirements security policy setting. ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Domain controller: LDAP server signing requirements diff --git a/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md b/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md index dcc3e3be66..453dae2c04 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md +++ b/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md @@ -3,12 +3,10 @@ title: Refuse machine account password changes policy description: Describes the best practices, location, values, and security considerations for the Domain controller Refuse machine account password changes security policy setting. ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz ms.topic: reference -ms.technology: itpro-security ms.date: 12/31/2017 --- diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md index 820c7facca..00874bb080 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md @@ -4,7 +4,6 @@ description: Best practices, location, values, and security considerations for t ms.assetid: 4480c7cb-adca-4f29-b4b8-06eb68d272bf ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Domain member: Digitally encrypt or sign secure channel data (always) diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md index 0086d01e2c..d66e753fe4 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the security ms.assetid: 73e6023e-0af3-4531-8238-82f0f0e4965b ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Domain member: Digitally encrypt secure channel data (when possible) diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md index cadfa2282e..07861eeed3 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md @@ -4,7 +4,6 @@ description: Best practices, location, values, and security considerations for t ms.assetid: a643e491-4f45-40ea-b12c-4dbe47e54f34 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Domain member: Digitally sign secure channel data (when possible) diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes.md b/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes.md index 324f36b008..83bc426b58 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: 1f660300-a07a-4243-a09f-140aa1ab8867 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 06/27/2019 -ms.technology: itpro-security --- # Domain member: Disable machine account password changes diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md b/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md index 278f2854fa..b5f6a01f3e 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: 0ec6f7c1-4d82-4339-94c0-debb2d1ac109 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 05/29/2020 -ms.technology: itpro-security --- # Domain member: Maximum machine account password age diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md b/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md index 5f03addc62..e0b22d6cf2 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md @@ -4,7 +4,6 @@ description: Best practices, location, values, and security considerations for t ms.assetid: 5ab8993c-5086-4f09-bc88-1b27454526bd ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Domain member: Require strong (Windows 2000 or later) session key diff --git a/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md b/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md index 2580f51ed8..ca2112846d 100644 --- a/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md +++ b/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md @@ -4,7 +4,6 @@ description: Learn about best practices, security considerations and more for th ms.assetid: 524062d4-1595-41f3-8ce1-9c85fd21497b ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Enable computer and user accounts to be trusted for delegation diff --git a/windows/security/threat-protection/security-policy-settings/enforce-password-history.md b/windows/security/threat-protection/security-policy-settings/enforce-password-history.md index b2b87b7314..ed174c38a8 100644 --- a/windows/security/threat-protection/security-policy-settings/enforce-password-history.md +++ b/windows/security/threat-protection/security-policy-settings/enforce-password-history.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 8b2ab871-3e52-4dd1-9776-68bb1e935442 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Enforce password history diff --git a/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions.md b/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions.md index faf39c7570..5879883e45 100644 --- a/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions.md +++ b/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 5891cb73-f1ec-48b9-b703-39249e48a29f ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Enforce user logon restrictions diff --git a/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system.md b/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system.md index fbf329985c..e2e2fbba6b 100644 --- a/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system.md +++ b/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 63129243-31ea-42a4-a598-c7064f48a3df ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Force shutdown from a remote system diff --git a/windows/security/threat-protection/security-policy-settings/generate-security-audits.md b/windows/security/threat-protection/security-policy-settings/generate-security-audits.md index 9b9ab36731..a9c54c538d 100644 --- a/windows/security/threat-protection/security-policy-settings/generate-security-audits.md +++ b/windows/security/threat-protection/security-policy-settings/generate-security-audits.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: c0e1cd80-840e-4c74-917c-5c2349de885f ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Generate security audits diff --git a/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication.md b/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication.md index 918c634443..59a5523281 100644 --- a/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication.md +++ b/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 4cd241e2-c680-4b43-8ed0-3b391925cec5 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Impersonate a client after authentication diff --git a/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set.md b/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set.md index b383d4e733..f65a5700dd 100644 --- a/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set.md +++ b/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: b742ad96-37f3-4686-b8f7-f2b48367105b ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Increase a process working set diff --git a/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority.md b/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority.md index e0afba5ecc..156b06d265 100644 --- a/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority.md +++ b/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: fbec5973-d35e-4797-9626-d0d56061527f ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 2/6/2020 -ms.technology: itpro-security --- # Increase scheduling priority diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md index 6b6a223a3c..2f420b21cf 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the security ms.assetid: 9146aa3d-9b2f-47ba-ac03-ff43efb10530 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Interactive logon: Display user information when the session is locked diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md index 6d7880e8fe..66d276bacf 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md @@ -1,7 +1,6 @@ --- title: Interactive logon Don't display last signed-in description: Describes the best practices, location, values, and security considerations for the Interactive logon Don't display last user name security policy setting. -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,7 +12,6 @@ ms.topic: reference ms.date: 04/19/2017 ms.reviewer: ms.author: vinpa -ms.technology: itpro-security --- # Interactive logon: Don't display last signed-in diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md index a13d25cd15..ab27093a1c 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: 04e2c000-2eb2-4d4b-8179-1e2cb4793e18 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Interactive logon: Do not require CTRL+ALT+DEL diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md index 85cca7c7f1..05151970da 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: 98b24b03-95fe-4edc-8e97-cbdaa8e314fd ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Interactive logon: Don't display username at sign-in diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md index a9c3a468db..fba7a86ac4 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md @@ -4,7 +4,6 @@ description: Best practices, location, values, management, and security consider ms.assetid: ebbd8e22-2611-4ebe-9db9-d49344e631e4 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Interactive logon: Machine account lockout threshold diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md index 499c8ea921..93e24a9961 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, management, and sec ms.assetid: 7065b4a9-0d52-41d5-afc4-5aedfc4162b5 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -17,7 +16,6 @@ ms.collection: - tier3 ms.topic: reference ms.date: 09/18/2018 -ms.technology: itpro-security --- # Interactive logon: Machine inactivity limit diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md index 9ea2643a8c..cc406c3e45 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md @@ -4,7 +4,6 @@ description: Learn about best practices, security considerations and more for th ms.assetid: fcfe8a6d-ca65-4403-b9e6-2fa017a31c2e ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Interactive logon: Message text for users attempting to log on diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md index f97c4515e8..20776c7140 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the security ms.assetid: f2596470-4cc0-4ef1-849c-bef9dc3533c6 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Interactive logon: Message title for users attempting to log on diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md index 60159d1dd5..3817c2a334 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md @@ -4,7 +4,6 @@ description: Best practices and more for the security policy setting, Interactiv ms.assetid: 660e925e-cc3e-4098-a41e-eb8db8062d8d ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 08/27/2018 -ms.technology: itpro-security --- # Interactive logon: Number of previous logons to cache (in case domain controller is not available) diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md index 1c2bd90367..14eb3e7e3a 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md @@ -4,7 +4,6 @@ description: Best practices and security considerations for an interactive log-o ms.assetid: 8fe94781-40f7-4fbe-8cfd-5e116e6833e9 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Interactive log on: Prompt the user to change passwords before expiration diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md index 12c079fced..2249b7889f 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md @@ -4,7 +4,6 @@ description: Best practices security considerations, and more for the policy set ms.assetid: 97618ed3-e946-47db-a212-b5e7a4fc6ffc ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Interactive logon: Require Domain Controller authentication to unlock workstation diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md index 7175af2912..fab0a761f3 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md @@ -5,8 +5,6 @@ author: vinaypamnani-msft ms.author: vinpa manager: aaroncz ms.reviewer: -ms.prod: windows-client -ms.technology: itpro-security ms.localizationpriority: medium ms.topic: reference ms.date: 01/13/2023 diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md index 4ae503eb5d..3101ddf604 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md @@ -4,7 +4,6 @@ description: Best practices, location, values, policy management, and security c ms.assetid: 61487820-9d49-4979-b15d-c7e735999460 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Interactive logon: Smart card removal behavior diff --git a/windows/security/threat-protection/security-policy-settings/kerberos-policy.md b/windows/security/threat-protection/security-policy-settings/kerberos-policy.md index c8b07ad5e2..b2d778abd6 100644 --- a/windows/security/threat-protection/security-policy-settings/kerberos-policy.md +++ b/windows/security/threat-protection/security-policy-settings/kerberos-policy.md @@ -4,7 +4,6 @@ description: Describes the Kerberos Policy settings and provides links to policy ms.assetid: 94017dd9-b1a3-4624-af9f-b29161b4bf38 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Kerberos Policy diff --git a/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers.md b/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers.md index 7a97507fb3..f51292c134 100644 --- a/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers.md +++ b/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 66262532-c610-470c-9792-35ff4389430f ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Load and unload device drivers diff --git a/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory.md b/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory.md index 6be9e7a10f..8efc6d6d5e 100644 --- a/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory.md +++ b/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: cc724979-aec0-496d-be4e-7009aef660a3 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Lock pages in memory diff --git a/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job.md b/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job.md index cd62546d27..9be27bb7d6 100644 --- a/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job.md +++ b/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 4eaddb51-0a18-470e-9d3d-5e7cd7970b41 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -17,7 +16,6 @@ ms.collection: - tier3 ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Log on as a batch job diff --git a/windows/security/threat-protection/security-policy-settings/log-on-as-a-service.md b/windows/security/threat-protection/security-policy-settings/log-on-as-a-service.md index f96d6aad98..b9d7dcc0af 100644 --- a/windows/security/threat-protection/security-policy-settings/log-on-as-a-service.md +++ b/windows/security/threat-protection/security-policy-settings/log-on-as-a-service.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: acc9a9e0-fd88-4cda-ab54-503120ba1f42 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Log on as a service diff --git a/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log.md b/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log.md index 180e73d52d..eae4a7c4b6 100644 --- a/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log.md +++ b/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 4b946c0d-f904-43db-b2d5-7f0917575347 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Manage auditing and security log diff --git a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket.md b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket.md index a750dcb65c..e7ac39b82a 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 484bf05a-3858-47fc-bc02-6599ca860247 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Maximum lifetime for service ticket diff --git a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md index 6dc4d1607b..6d0137547d 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: f88cd819-3dd1-4e38-b560-13fe6881b609 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Maximum lifetime for user ticket renewal diff --git a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket.md b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket.md index 238e860228..3cc212c913 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: bcb4ff59-334d-4c2f-99af-eca2b64011dc ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Maximum lifetime for user ticket diff --git a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md index a416e4543c..2bd4c4aa31 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 2d6e70e7-c8b0-44fb-8113-870c6120871d ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Maximum password age diff --git a/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md b/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md index fd26c1fd58..164df232e6 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md @@ -4,7 +4,6 @@ description: Best practices, location, values, policy management, and security c ms.assetid: ba2cf59e-d69d-469e-95e3-8e6a0ba643af ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Maximum tolerance for computer clock synchronization diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md index 687a39281d..658dc72de2 100644 --- a/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md +++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md @@ -4,11 +4,9 @@ description: Best practices and security considerations for the Microsoft netwo ms.reviewer: manager: aaroncz ms.author: vinpa -ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft ms.date: 01/13/2023 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md index a3d215db1a..de1a65cacc 100644 --- a/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md +++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md @@ -4,7 +4,6 @@ description: Learn about best practices and more for the security policy setting ms.assetid: 97a76b93-afa7-4dd9-bb52-7c9e289b6017 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md index e79a912300..7add3c22bb 100644 --- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md +++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the policy se ms.assetid: 8227842a-569d-480f-b43c-43450bbaa722 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Microsoft network server: Amount of idle time required before suspending session diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md index 8fcc7102c7..e9667f8aeb 100644 --- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md +++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md @@ -4,7 +4,6 @@ description: Learn about the security policy setting, Microsoft network server A ms.assetid: e4508387-35ed-4a3f-a47c-27f8396adbba ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Microsoft network server: Attempt S4U2Self to obtain claim information diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md index 030123cf61..afe2dc3cac 100644 --- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md +++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md @@ -5,8 +5,6 @@ author: vinaypamnani-msft ms.author: vinpa ms.reviewer: manager: aaroncz -ms.prod: windows-client -ms.technology: itpro-security ms.localizationpriority: medium ms.topic: reference ms.date: 01/13/2023 diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md index b7f738611b..f502ed6336 100644 --- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md +++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md @@ -4,7 +4,6 @@ description: Best practices, location, values, and security considerations for t ms.assetid: 48b5c424-9ba8-416d-be7d-ccaabb3f49af ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Microsoft network server: Disconnect clients when sign-in hours expire diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md index c10cf64969..2d618461c5 100644 --- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md +++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the security ms.assetid: 18337f78-eb45-42fd-bdbd-f8cd02c3e154 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Microsoft network server: Server SPN target name validation level diff --git a/windows/security/threat-protection/security-policy-settings/minimum-password-age.md b/windows/security/threat-protection/security-policy-settings/minimum-password-age.md index 67cf3aac2e..4922c645e8 100644 --- a/windows/security/threat-protection/security-policy-settings/minimum-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/minimum-password-age.md @@ -5,14 +5,12 @@ ms.assetid: 91915cb2-1b3f-4fb7-afa0-d03df95e8161 ms.reviewer: manager: aaroncz ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft ms.date: 11/13/2018 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/security-policy-settings/minimum-password-length.md b/windows/security/threat-protection/security-policy-settings/minimum-password-length.md index d264ff4033..f6edea308a 100644 --- a/windows/security/threat-protection/security-policy-settings/minimum-password-length.md +++ b/windows/security/threat-protection/security-policy-settings/minimum-password-length.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 3d22eb9a-859a-4b6f-82f5-c270c427e17e ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -17,7 +16,6 @@ ms.collection: - tier3 ms.topic: reference ms.date: 03/30/2022 -ms.technology: itpro-security --- # Minimum password length diff --git a/windows/security/threat-protection/security-policy-settings/modify-an-object-label.md b/windows/security/threat-protection/security-policy-settings/modify-an-object-label.md index e3f1d6decd..dbd4f943f7 100644 --- a/windows/security/threat-protection/security-policy-settings/modify-an-object-label.md +++ b/windows/security/threat-protection/security-policy-settings/modify-an-object-label.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 3e5a97dd-d363-43a8-ae80-452e866ebfd5 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Modify an object label diff --git a/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values.md b/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values.md index 5a2d90eb2c..58d6be0e68 100644 --- a/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values.md +++ b/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 80bad5c4-d9eb-4e3a-a5dc-dcb742b83fca ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Modify firmware environment values diff --git a/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md b/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md index 16e357e6c1..e0d4fc62d5 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md @@ -4,7 +4,6 @@ description: Best practices, location, values, policy management and security co ms.assetid: 0144477f-22a6-4d06-b70a-9c9c2196e99e ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network access: Allow anonymous SID/Name translation diff --git a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md index 9f3219cb41..50e1eddf2c 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md @@ -4,7 +4,6 @@ description: Learn about best practices and more for the security policy setting ms.assetid: 3686788d-4cc7-4222-9163-cbc7c3362d73 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network access: Do not allow anonymous enumeration of SAM accounts and shares diff --git a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md index e737e440d1..4eb9c91bd1 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: 6ee25b33-ad43-4097-b031-7be680f64c7c ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network access: Do not allow anonymous enumeration of SAM accounts diff --git a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md index 07e8b5d1cb..2787a6af79 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md @@ -4,7 +4,6 @@ description: Learn about best practices and more for the security policy setting ms.assetid: b9b64360-36ea-40fa-b795-2d6558c46563 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 07/01/2021 -ms.technology: itpro-security --- # Network access: Do not allow storage of passwords and credentials for network authentication diff --git a/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md b/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md index 65f3d3d7c6..eba40fa8db 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md @@ -4,7 +4,6 @@ description: Learn about best practices, security considerations and more for th ms.assetid: cdbc5159-9173-497e-b46b-7325f4256353 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network access: Let Everyone permissions apply to anonymous users diff --git a/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md b/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md index 311f70c3ef..c43a8bc781 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md @@ -4,7 +4,6 @@ description: Describes best practices, security considerations and more for the ms.assetid: 8897d2a4-813e-4d2b-8518-fcee71e1cf2c ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network access: Named Pipes that can be accessed anonymously diff --git a/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md b/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md index 12988a2e90..ca04da80eb 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md @@ -4,7 +4,6 @@ description: Describes best practices, location, values, and security considerat ms.assetid: 3fcbbf70-a002-4f85-8e86-8dabad21928e ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network access: Remotely accessible registry paths and subpaths diff --git a/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md b/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md index 3a1924da9a..b7cd9c9122 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md @@ -4,7 +4,6 @@ description: Best practices, location, values, policy management and security co ms.assetid: 977f86ea-864f-4f1b-9756-22220efce0bd ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network access: Remotely accessible registry paths diff --git a/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md b/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md index e45ad66787..048ad3f0b8 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the security ms.assetid: e66cd708-7322-4d49-9b57-1bf8ec7a4c10 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network access: Restrict anonymous access to Named Pipes and Shares diff --git a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md index 587ae7e3a5..cf13b74c2e 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md @@ -1,8 +1,6 @@ --- title: Network access - Restrict clients allowed to make remote calls to SAM description: Security policy setting that controls which users can enumerate users and groups in the local Security Accounts Manager (SAM) database. -ms.prod: windows-client -ms.technology: itpro-security ms.localizationpriority: medium ms.date: 09/17/2018 author: vinaypamnani-msft diff --git a/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md b/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md index 57882060a6..d4d2161114 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md @@ -4,7 +4,6 @@ description: Learn about best practices, security considerations, and more for t ms.assetid: f3e4b919-8279-4972-b415-5f815e2f0a1a ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network access: Shares that can be accessed anonymously diff --git a/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md b/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md index 9665aaaaf7..3e5ed1f57e 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the security ms.assetid: 0b3d703c-ea27-488f-8f59-b345af75b994 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network access: Sharing and security model for local accounts diff --git a/windows/security/threat-protection/security-policy-settings/network-list-manager-policies.md b/windows/security/threat-protection/security-policy-settings/network-list-manager-policies.md index 04167671df..36e4ff299e 100644 --- a/windows/security/threat-protection/security-policy-settings/network-list-manager-policies.md +++ b/windows/security/threat-protection/security-policy-settings/network-list-manager-policies.md @@ -4,7 +4,6 @@ description: Network List Manager policies are security settings that configure ms.assetid: bd8109d4-b07c-4beb-a9a6-affae2ba2fda ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network List Manager policies diff --git a/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md b/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md index 509602f606..9d920c4925 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md @@ -4,7 +4,6 @@ description: Location, values, policy management, and security considerations fo ms.assetid: c46a658d-b7a4-4139-b7ea-b9268c240053 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 10/04/2021 -ms.technology: itpro-security --- # Network security: Allow Local System to use computer identity for NTLM diff --git a/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md b/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md index 02d157f8db..db63f8cfbc 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: 5b72edaa-bec7-4572-b6f0-648fc38f5395 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network security: Allow LocalSystem NULL session fallback diff --git a/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md b/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md index 202d37d4e5..9ebd32dab8 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md @@ -4,7 +4,6 @@ description: Best practices for the Network Security Allow PKU2U authentication ms.assetid: e04a854e-d94d-4306-9fb3-56e9bd7bb926 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 01/03/2022 -ms.technology: itpro-security --- # Network security: Allow PKU2U authentication requests to this computer to use online identities diff --git a/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md b/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md index 5e1c37d2b4..dddf04ec16 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md @@ -3,7 +3,6 @@ title: Network security Configure encryption types allowed for Kerberos description: Best practices, location, values and security considerations for the policy setting, Network security Configure encryption types allowed for Kerberos Win7 only. ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz @@ -12,7 +11,6 @@ ms.collection: - tier3 ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network security: Configure encryption types allowed for Kerberos diff --git a/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md b/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md index c708a656d1..a421232bf4 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the security ms.assetid: 6452b268-e5ba-4889-9d38-db28f919af51 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network security: Do not store LAN Manager hash value on next password change diff --git a/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md b/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md index 665eee915f..7af8f09acd 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md @@ -4,7 +4,6 @@ description: Best practices, location, values, policy management, and security c ms.assetid: 64d5dde4-58e4-4217-b2c4-73bd554ec926 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network security: Force logoff when logon hours expire diff --git a/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level.md b/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level.md index 57246a6f27..806700542f 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level.md @@ -4,7 +4,6 @@ description: Best practices, location, values, policy management and security co ms.assetid: bbe1a98c-420a-41e7-9d3c-3a2fe0f1843e ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -17,7 +16,6 @@ ms.collection: - tier3 ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network security: LAN Manager authentication level diff --git a/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements.md b/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements.md index 2199e96b47..1c8757c3f8 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements.md @@ -4,7 +4,6 @@ description: Best practices, location, values, policy management and security co ms.assetid: 38b35489-eb5b-4035-bc87-df63de50509c ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network security: LDAP client signing requirements diff --git a/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md b/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md index 5bda79521f..5c12f9b876 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md @@ -4,7 +4,6 @@ description: Best practices and more for the security policy setting, Network se ms.assetid: 89903de8-23d0-4e0f-9bef-c00cb7aebf00 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 07/27/2017 -ms.technology: itpro-security --- # Network security: Minimum session security for NTLM SSP based (including secure RPC) clients diff --git a/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md b/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md index ebae59999d..952c7a8873 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md @@ -4,7 +4,6 @@ description: Best practices and security considerations for the policy setting, ms.assetid: c6a60c1b-bc8d-4d02-9481-f847a411b4fc ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network security: Minimum session security for NTLM SSP based (including secure RPC) servers diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md index b0e28dc0b1..bc6bb0004a 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the policy se ms.assetid: 9b017399-0a54-4580-bfae-614c2beda3a1 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md index b6aa571487..fe6fa9e00a 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the security ms.assetid: 2f981b68-6aa7-4dd9-b53d-d88551277cc0 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network security: Restrict NTLM: Add server exceptions in this domain diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md index c81152a791..23ba1014a2 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md @@ -4,7 +4,6 @@ description: Best practices, security considerations and more for the security p ms.assetid: 37e380c2-22e1-44cd-9993-e12815b845cf ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network security: Restrict NTLM: Audit incoming NTLM traffic diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md index f79dd47f62..533e169c84 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md @@ -3,13 +3,11 @@ title: Network security Restrict NTLM Audit NTLM authentication in this domain description: Best practices, security considerations, and more for the security policy setting, Network Security Restrict NTLM Audit NTLM authentication in this domain. ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network security: Restrict NTLM: Audit NTLM authentication in this domain diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md index 5f964c33cc..9432404d9c 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the security ms.assetid: c0eff7d3-ed59-4004-908a-2205295fefb8 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Network security: Restrict NTLM: Incoming NTLM traffic diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md index 8b9e4f8973..039bfedb88 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md @@ -3,12 +3,10 @@ title: Network security Restrict NTLM in this domain description: Learn about best practices, security considerations and more for the security policy setting, Network Security Restrict NTLM NTLM authentication in this domain. ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz ms.topic: reference -ms.technology: itpro-security ms.date: 12/31/2017 --- diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md index 4869db61ec..fe152c8d75 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md @@ -4,7 +4,6 @@ description: Learn about best practices, security considerations and more for th ms.assetid: 63437a90-764b-4f06-aed8-a4a26cf81bd1 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 06/15/2022 -ms.technology: itpro-security --- # Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers diff --git a/windows/security/threat-protection/security-policy-settings/password-policy.md b/windows/security/threat-protection/security-policy-settings/password-policy.md index 1d6e578b5c..c9050c5e21 100644 --- a/windows/security/threat-protection/security-policy-settings/password-policy.md +++ b/windows/security/threat-protection/security-policy-settings/password-policy.md @@ -4,7 +4,6 @@ description: An overview of password policies for Windows and links to informati ms.assetid: aec1220d-a875-4575-9050-f02f9c54a3b6 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -17,7 +16,6 @@ ms.collection: - tier3 ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Password Policy diff --git a/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks.md b/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks.md index 15ffdec99c..5f1bb7b6cd 100644 --- a/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks.md +++ b/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: b6990813-3898-43e2-8221-c9c06d893244 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Perform volume maintenance tasks diff --git a/windows/security/threat-protection/security-policy-settings/profile-single-process.md b/windows/security/threat-protection/security-policy-settings/profile-single-process.md index 2bdc87455f..565b612a6f 100644 --- a/windows/security/threat-protection/security-policy-settings/profile-single-process.md +++ b/windows/security/threat-protection/security-policy-settings/profile-single-process.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: c0963de4-4f5e-430e-bfcd-dfd68e66a075 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Profile single process diff --git a/windows/security/threat-protection/security-policy-settings/profile-system-performance.md b/windows/security/threat-protection/security-policy-settings/profile-system-performance.md index 6be8f9269b..f0af56ab38 100644 --- a/windows/security/threat-protection/security-policy-settings/profile-system-performance.md +++ b/windows/security/threat-protection/security-policy-settings/profile-system-performance.md @@ -4,7 +4,6 @@ description: Best practices, location, values, policy management, and security c ms.assetid: ffabc3c5-9206-4105-94ea-84f597a54b2e ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Profile system performance diff --git a/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md b/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md index 590b49f09b..55d2e7660d 100644 --- a/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md +++ b/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md @@ -4,7 +4,6 @@ description: Best practices, location, values, policy management, and security c ms.assetid: be2498fc-48f4-43f3-ad09-74664e45e596 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Recovery console: Allow automatic administrative logon diff --git a/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md b/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md index 08ca6beb3f..10304c2de7 100644 --- a/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md +++ b/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the policy se ms.assetid: a5b4ac0c-f33d-42b5-a866-72afa7cbd0bd ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Recovery console: Allow floppy copy and access to all drives and folders diff --git a/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station.md b/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station.md index 253213f2c1..d7f19e7b40 100644 --- a/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station.md +++ b/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 229a385a-a862-4973-899a-413b1b5b6c30 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Remove computer from docking station - security policy setting diff --git a/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token.md b/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token.md index d180d2acea..139239d715 100644 --- a/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token.md +++ b/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 5add02db-6339-489e-ba21-ccc3ccbe8745 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Replace a process level token diff --git a/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md b/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md index 44c6716d50..83a1004c87 100644 --- a/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md +++ b/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: d5ccf6dd-5ba7-44a9-8e0b-c478d8b1442c ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 11/02/2018 -ms.technology: itpro-security --- # Reset account lockout counter after diff --git a/windows/security/threat-protection/security-policy-settings/restore-files-and-directories.md b/windows/security/threat-protection/security-policy-settings/restore-files-and-directories.md index f970ac8154..85b208bd22 100644 --- a/windows/security/threat-protection/security-policy-settings/restore-files-and-directories.md +++ b/windows/security/threat-protection/security-policy-settings/restore-files-and-directories.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: c673c0fa-6f49-4edd-8c1f-c5e8513f701d ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Restore files and directories - security policy setting diff --git a/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md b/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md index 78ea3fcb09..ebfd260fab 100644 --- a/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md +++ b/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md @@ -4,7 +4,6 @@ description: Provides information about the advanced security audit policy setti ms.assetid: 6BF9A642-DBC3-4101-94A3-B2316C553CE3 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Advanced security audit policy settings for Windows 10 diff --git a/windows/security/threat-protection/security-policy-settings/security-options.md b/windows/security/threat-protection/security-policy-settings/security-options.md index de522cb6d3..2872bdad4b 100644 --- a/windows/security/threat-protection/security-policy-settings/security-options.md +++ b/windows/security/threat-protection/security-policy-settings/security-options.md @@ -4,11 +4,9 @@ description: Introduction to the Security Options settings of the local security ms.reviewer: manager: aaroncz ms.author: vinpa -ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft ms.date: 01/13/2023 -ms.technology: itpro-security ms.topic: reference --- diff --git a/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference.md b/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference.md index 9db7d59a20..a6167efac3 100644 --- a/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference.md +++ b/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference.md @@ -4,7 +4,6 @@ description: This reference of security settings provides information about how ms.assetid: ef5a4579-15a8-4507-9a43-b7ccddcb0ed1 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Security policy settings reference diff --git a/windows/security/threat-protection/security-policy-settings/security-policy-settings.md b/windows/security/threat-protection/security-policy-settings/security-policy-settings.md index 062aa06d3d..7c394d7e01 100644 --- a/windows/security/threat-protection/security-policy-settings/security-policy-settings.md +++ b/windows/security/threat-protection/security-policy-settings/security-policy-settings.md @@ -4,7 +4,6 @@ description: This reference topic describes the common scenarios, architecture, ms.assetid: e7ac5204-7f6c-4708-a9f6-6af712ca43b9 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -17,7 +16,6 @@ ms.collection: - tier3 ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Security policy settings diff --git a/windows/security/threat-protection/security-policy-settings/shut-down-the-system.md b/windows/security/threat-protection/security-policy-settings/shut-down-the-system.md index def26ab7ef..24628a2de8 100644 --- a/windows/security/threat-protection/security-policy-settings/shut-down-the-system.md +++ b/windows/security/threat-protection/security-policy-settings/shut-down-the-system.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: c8e8f890-153a-401e-a957-ba6a130304bf ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Shut down the system - security policy setting diff --git a/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md b/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md index 672e91297b..86b9b4dfd8 100644 --- a/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md +++ b/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the security ms.assetid: f3964767-5377-4416-8eb3-e14d553a7315 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Shutdown: Allow system to be shut down without having to log on diff --git a/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md b/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md index b40140dc0f..da640b385d 100644 --- a/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md +++ b/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management a ms.assetid: 31400078-6c56-4891-a6df-6dfb403c4bc9 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 08/01/2017 -ms.technology: itpro-security --- # Shutdown: Clear virtual memory pagefile diff --git a/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md b/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md index 6b4584688f..30ba31a152 100644 --- a/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md +++ b/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, and security consid ms.assetid: 57f958c2-f1e9-48bf-871b-0a9b3299e238 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Store passwords using reversible encryption diff --git a/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data.md b/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data.md index 6744567fe3..b5cbe5f54e 100644 --- a/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data.md +++ b/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 97b0aaa4-674f-40f4-8974-b4bfb12c232c ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Synchronize directory service data diff --git a/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md b/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md index 597b9027a0..b72384f5df 100644 --- a/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md +++ b/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the policy se ms.assetid: 8cbff267-881e-4bf6-920d-b583a5ff7de0 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # System cryptography: Force strong key protection for user keys stored on the computer diff --git a/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md b/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md index d660ac1952..2c4c5679ce 100644 --- a/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md +++ b/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the policy se ms.assetid: 83988865-dc0f-45eb-90d1-ee33495eb045 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 11/16/2018 -ms.technology: itpro-security --- # System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing diff --git a/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md b/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md index 3694fe2434..1f8e7eadab 100644 --- a/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md +++ b/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md @@ -4,7 +4,6 @@ description: Best practices, security considerations and more for the security p ms.assetid: 340d6769-8f33-4067-8470-1458978d1522 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # System objects: Require case insensitivity for non-Windows subsystems diff --git a/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md b/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md index 8358279b2d..2045194c25 100644 --- a/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md +++ b/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md @@ -4,7 +4,6 @@ description: Best practices and more for the security policy setting, System obj ms.assetid: 3a592097-9cf5-4fd0-a504-7cbfab050bb6 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # System objects: Strengthen default permissions of internal system objects (for example, Symbolic Links) diff --git a/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems.md b/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems.md index ef7ca4315a..b33abc4d19 100644 --- a/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems.md +++ b/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: 5cb6519a-4f84-4b45-8072-e2aa8a72fb78 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # System settings: Optional subsystems diff --git a/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md b/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md index fee999b57a..61df619542 100644 --- a/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md +++ b/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md @@ -4,7 +4,6 @@ description: Best practices and more for the security policy setting, System set ms.assetid: 2380d93b-b553-4e56-a0c0-d1ef740d089c ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # System settings: Use certificate rules on Windows executables for Software Restriction Policies diff --git a/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects.md b/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects.md index 39152767a9..1563e3d995 100644 --- a/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects.md +++ b/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects.md @@ -4,7 +4,6 @@ description: Describes the best practices, location, values, policy management, ms.assetid: cb8595d1-74cc-4176-bb15-d97663eebb2d ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # Take ownership of files or other objects diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md b/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md index 58989112e3..1dbf68c41d 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the policy se ms.assetid: d465fc27-1cd2-498b-9cf6-7ad2276e5998 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/08/2017 -ms.technology: itpro-security --- # User Account Control: Admin Approval Mode for the Built-in Administrator account diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md b/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md index eb9a42ffeb..4452ee2e72 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md @@ -4,7 +4,6 @@ description: Best practices and more for the policy setting, User Account Contro ms.assetid: fce20472-3c93-449d-b520-13c4c74a9892 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md index 8acd28314d..ba2ac6f92a 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md @@ -4,7 +4,6 @@ description: Best practices and more for the security policy setting, User Accou ms.assetid: 46a3c3a2-1d2e-4a6f-b5e6-29f9592f535d ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 09/08/2017 -ms.technology: itpro-security --- # User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md index 6a471c51bb..f4ef816fc7 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md @@ -2,12 +2,10 @@ title: Behavior of the elevation prompt for standard users description: Learn about best practices, security considerations, and more for the policy setting, User Account Control Behavior of the elevation prompt for standard users. ms.author: vinpa -ms.prod: windows-client author: vinaypamnani-msft manager: aaroncz ms.topic: reference ms.date: 01/18/2023 -ms.technology: itpro-security --- # User Account Control: Behavior of the elevation prompt for standard users diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md b/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md index ea22f7f177..4456c3de17 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md @@ -4,7 +4,6 @@ description: Learn about best practices and more for the security policy setting ms.assetid: 3f8cb170-ba77-4c9f-abb3-c3ed1ef264fc ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # User Account Control: Detect application installations and prompt for elevation diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md b/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md index 92d124a4f7..ace44a281a 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the security ms.assetid: 64950a95-6985-4db6-9905-1db18557352d ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # User Account Control: Only elevate executables that are signed and validated diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md b/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md index 4aad366985..68167d5fe5 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md @@ -4,7 +4,6 @@ description: Learn about best practices and more for the policy setting, User Ac ms.assetid: 4333409e-a5be-4f2f-8808-618f53abd22c ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # User Account Control: Only elevate UIAccess applications that are installed in secure locations diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md b/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md index 97d8752204..f8aa1b8eec 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md @@ -4,7 +4,6 @@ description: Learn about best practices, security considerations and more for th ms.assetid: b838c561-7bfc-41ef-a7a5-55857259c7bf ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # User Account Control: Run all administrators in Admin Approval Mode diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md b/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md index 9059607fe2..97f904064a 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md @@ -4,7 +4,6 @@ description: Best practices, security considerations, and more for the policy se ms.assetid: 77a067db-c70d-4b02-9861-027503311b8b ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # User Account Control: Switch to the secure desktop when prompting for elevation diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md b/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md index adb9f83c7e..eb289356c6 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md @@ -4,7 +4,6 @@ description: Best practices, security considerations and more for the policy set ms.assetid: a7b47420-cc41-4b1c-b03e-f67a05221261 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +13,6 @@ manager: aaroncz audience: ITPro ms.topic: reference ms.date: 04/19/2017 -ms.technology: itpro-security --- # User Account Control: Virtualize file and registry write failures to per-user locations diff --git a/windows/security/threat-protection/security-policy-settings/user-rights-assignment.md b/windows/security/threat-protection/security-policy-settings/user-rights-assignment.md index 3ca31c4fe8..0ce9074142 100644 --- a/windows/security/threat-protection/security-policy-settings/user-rights-assignment.md +++ b/windows/security/threat-protection/security-policy-settings/user-rights-assignment.md @@ -4,7 +4,6 @@ description: Provides an overview and links to information about the User Rights ms.assetid: 99340252-60be-4c79-b0a5-56fbe1a9b0c5 ms.reviewer: ms.author: vinpa -ms.prod: windows-client ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -17,7 +16,6 @@ ms.collection: - tier3 ms.topic: reference ms.date: 12/16/2021 -ms.technology: itpro-security --- # User Rights Assignment diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index f24e8b23a2..c04bfd3133 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -1,7 +1,7 @@ --- title: Deprecated features in the Windows client description: Review the list of features that Microsoft is no longer actively developing in Windows 10 and Windows 11. -ms.date: 12/07/2023 +ms.date: 01/05/2024 ms.prod: windows-client ms.technology: itpro-fundamentals ms.localizationpriority: medium @@ -19,7 +19,7 @@ appliesto: # Deprecated features for Windows client -Each version of Windows client adds new features and functionality. Occasionally, new versions also remove features and functionality, often because they've added a newer option. This article provides details about the features and functionalities that are no longer being developed in Windows client. For more information about features that have been removed, see [Windows features removed](removed-features.md). +Each version of Windows client adds new features and functionality. Occasionally, new versions also remove features and functionality, often because they've added a newer option. This article provides details about the features and functionalities that are no longer being developed in Windows client. For more information about features that have been removed, see [Windows features removed](removed-features.md). For more information about features in Windows 11, see [Feature deprecations and removals](https://www.microsoft.com/windows/windows-11-specifications#table3). @@ -27,6 +27,17 @@ To understand the distinction between *deprecation* and *removal*, see [Windows The features in this article are no longer being actively developed, and might be removed in a future update. Some features have been replaced with other features or functionality and some are now available from other sources. +> [!TIP] +> You can use RSS to be notified when this page is updated. For example, the following RSS link includes this article: +> +> ``` url +> https://learn.microsoft.com/api/search/rss?search=%22details+about+the+features+and+functionalities+that+are+no+longer+being+developed+in+Windows%22&locale=en-us&%24filter=%28category+eq+%27Documentation%27%29 +> ``` +> +> This example includes the `&locale=en-us` variable. The `locale` variable is required, but you can change it to another supported locale. For example, `&locale=ja-jp`. +> +> For more information on using RSS for notifications, see [How to use the docs](/mem/use-docs#notifications) in the Intune documentation. + ## Deprecated features **The following list is subject to change and might not include every affected feature or functionality.** @@ -34,21 +45,24 @@ The features in this article are no longer being actively developed, and might b > [!NOTE] > If you have feedback about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/windows/send-feedback-to-microsoft-with-the-feedback-hub-app-f59187f8-8739-22d6-ba93-f66612949332). -|Feature | Details and mitigation | Deprecation announced | +| Feature | Details and mitigation | Deprecation announced | |---|---|---| -| Windows speech recognition | [Windows speech recognition](https://support.microsoft.com/windows/83ff75bd-63eb-0b6c-18d4-6fae94050571) is being deprecated and will no longer being developed. This feature is being replaced with [voice access](https://support.microsoft.com/en-us/topic/4dcd23ee-f1b9-4fd1-bacc-862ab611f55d). Voice access is available for Windows 11, version 22H2, or later devices. Currently, voice access supports five English locales: English - US, English - UK, English - India, English - New Zealand, English - Canada, and English - Australia. For more information, see [Setup voice access](https://support.microsoft.com/en-us/topic/set-up-voice-access-9fc44e29-12bf-4d86-bc4e-e9bb69df9a0e). | December 2023 | -| Microsoft Defender Application Guard for Office | [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/app-guard-for-office-install) is being deprecated and is no longer being updated. This deprecation also includes the [Windows.Security.Isolation APIs](/uwp/api/windows.security.isolation) that are used for Microsoft Defender Application Guard for Office. We recommend transitioning to Microsoft Defender for Endpoint [attack surface reduction rules](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction) along with [Protected View](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365#global-settings-for-safe-attachments) and [Windows Defender Application Control](/windows/security/application-security/application-control/windows-defender-application-control/wdac). | November 2023 | +| Windows Mixed Reality | [Windows Mixed Reality](/windows/mixed-reality/enthusiast-guide/before-you-start) is deprecated and will be removed in a future release of Windows. This deprecation includes the [Mixed Reality Portal](/windows/mixed-reality/enthusiast-guide/install-windows-mixed-reality) app, and [Windows Mixed Reality for SteamVR](/windows/mixed-reality/enthusiast-guide/using-steamvr-with-windows-mixed-reality) and Steam VR Beta.

            As of November 1, 2026, for consumer editions of Windows and November 1, 2027 for commercial editions of Windows, Windows Mixed Reality will no longer be available for download via the Mixed Reality Portal app, Windows Mixed Reality for SteamVR, and Steam VR beta, and we'll discontinue support. At that time, Windows Mixed Reality will no longer receive security updates, nonsecurity updates, bug fixes, technical support, or online technical content updates. Existing Windows Mixed Reality devices will continue to work with Steam until users upgrade to a version of Windows that doesn't include Windows Mixed Reality.

            This deprecation doesn't impact HoloLens. We remain committed to HoloLens and our enterprise customers. | December 2023 | +| Microsoft Defender Application Guard for Edge | [Microsoft Defender Application Guard](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is being deprecated for Microsoft Edge for Business and [will no longer be updated](feature-lifecycle.md). Please download the [Microsoft Edge For Business Security Whitepaper](https://edgestatic.azureedge.net/shared/cms/pdfs/Microsoft_Edge_Security_Whitepaper_v2.pdf) to learn more about Edge for Business security capabilities. | December 2023 | +| Legacy console mode | The [legacy console mode](/windows/console/legacymode) is deprecated and no longer being updated. In future Windows releases, it will be available as an optional [Feature on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). This feature won't be installed by default. | December 2023 | +| Windows speech recognition | [Windows speech recognition](https://support.microsoft.com/windows/83ff75bd-63eb-0b6c-18d4-6fae94050571) is deprecated and is no longer being developed. This feature is being replaced with [voice access](https://support.microsoft.com/topic/4dcd23ee-f1b9-4fd1-bacc-862ab611f55d). Voice access is available for Windows 11, version 22H2, or later devices. Currently, voice access supports five English locales: English - US, English - UK, English - India, English - New Zealand, English - Canada, and English - Australia. For more information, see [Setup voice access](https://support.microsoft.com/topic/set-up-voice-access-9fc44e29-12bf-4d86-bc4e-e9bb69df9a0e). | December 2023 | +| Microsoft Defender Application Guard for Office | [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/app-guard-for-office-install), including the [Windows Isolated App Launcher APIs](/windows/win32/api/isolatedapplauncher/), is being deprecated and will no longer be updated. We recommend transitioning to Microsoft Defender for Endpoint [attack surface reduction rules](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction) along with [Protected View](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365#global-settings-for-safe-attachments) and [Windows Defender Application Control](/windows/security/application-security/application-control/windows-defender-application-control/wdac). | November 2023 | | Steps Recorder (psr.exe) | Steps Recorder is no longer being updated and will be removed in a future release of Windows. For screen recording, we recommend the Snipping Tool, Xbox Game Bar, or Microsoft Clipchamp. | November 2023 | | Tips | The Tips app is deprecated and will be removed in a future release of Windows. Content in the app will continue to be updated with information about new Windows features until the app is removed. | November 2023 | -| Computer Browser | The Computer Browser driver and service are deprecated. The browser (browser protocol and service) is a dated and insecure device location protocol. This protocol, service, and driver were first disabled by default in Windows 10 with the removal of the SMB1 service. For more information on Computer Browser, see [MS-BRWS Common Internet File System](/openspecs/windows_protocols/ms-brws/3cfbad92-09b3-4abc-808f-c6f6347d5677). | November 2023 | +| Computer Browser | The Computer Browser driver and service are deprecated. The browser (browser protocol and service) is a dated and insecure device location protocol. This protocol, service, and driver were first disabled by default in Windows 10 with the removal of the SMB1 service. For more information on Computer Browser, see [MS-BRWS Common Internet File System](/openspecs/windows_protocols/ms-brws/3cfbad92-09b3-4abc-808f-c6f6347d5677). | November 2023 | | Webclient (WebDAV) Service | The Webclient (WebDAV) service is deprecated. The Webclient service isn't started by default in Windows. For more information on WebDAV, see [WebDAV - Win32 apps](/windows/win32/webdav/webdav-portal). | November 2023 | -| Remote Mailslots | Remote Mailslots are deprecated. The Remote Mailslot protocol is a dated, simple, unreliable, insecure IPC method first introduced in MS DOS. This protocol was first disabled by default in [Windows 11 Insider Preview Build ](https://blogs.windows.com/windows-insider/2023/03/08/announcing-windows-11-insider-preview-build-25314/). For more information on Remote Mailslots, see [About Mailslots](/windows/win32/ipc/about-mailslots) and [[MS-MAIL]: Remote Mailslot Protocol](/openspecs/windows_protocols/ms-mail/8ea19aa4-6e5a-4aed-b628-0b5cd75a1ab9).| November 2023 | +| Remote Mailslots | Remote Mailslots are deprecated. The Remote Mailslot protocol is a dated, simple, unreliable, insecure IPC method first introduced in MS DOS. This protocol was first disabled by default in [Windows 11 Insider Preview Build ](https://blogs.windows.com/windows-insider/2023/03/08/announcing-windows-11-insider-preview-build-25314/). For more information on Remote Mailslots, see [About Mailslots](/windows/win32/ipc/about-mailslots) and [[MS-MAIL]: Remote Mailslot Protocol](/openspecs/windows_protocols/ms-mail/8ea19aa4-6e5a-4aed-b628-0b5cd75a1ab9).| November 2023 | | Timeline for Microsoft Entra accounts | Cross-device syncing of Microsoft Entra user activity history will stop starting in January 2024. Microsoft will stop storing this data in the cloud, aligning with [the previous change for Microsoft accounts (MSA)](https://blogs.windows.com/windows-insider/2021/04/14/announcing-windows-10-insider-preview-build-21359) in 2021. The timeline user experience was retired in Windows 11, although it remains in Windows 10. The timeline user experience and all your local activity history still remains on Windows 10 devices. Users can access web history using their browser and access recent files through OneDrive and Office. | October 2023 | | VBScript | VBScript is deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript). | October 2023 | | WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt. | September 1, 2023 | | AllJoyn | Microsoft's implementation of AllJoyn, which included the [Windows.Devices.AllJoyn API namespace](/uwp/api/windows.devices.alljoyn), a [Win32 API](/windows/win32/api/_alljoyn/), a [management configuration service provider (CSP)](/windows/client-management/mdm/alljoynmanagement-csp), and an [Alljoyn Router Service](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#alljoyn-router-service) has been deprecated. [AllJoyn](https://openconnectivity.org/technology/reference-implementation/alljoyn/), sponsored by AllSeen Alliance, was an open source discovery and communication protocol for Internet of Things scenarios such as turning on/off lights or reading temperatures.AllSeen Alliance promoted the AllJoyn project from 2013 until 2016 when it merged with the Open Connectivity Foundation (OCF), the sponsors of [Iotivity.org](https://iotivity.org/), another protocol for Internet of Things scenarios. Customers should refer to the [Iotivity.org](https://iotivity.org/) website for alternatives such as [Iotivity Lite](https://github.com/iotivity/iotivity-lite) or [Iotivity](https://github.com/iotivity/iotivity). | August 17, 2023 | -| TLS 1.0 and 1.1 | Over the past several years, internet standards and regulatory bodies have [deprecated or disallowed](https://www.ietf.org/rfc/rfc8996.html) TLS versions 1.0 and 1.1 due to various security issues. Starting in Windows 11 Insider Preview builds for September 2023 and continuing in future Windows OS releases, TLS 1.0 and 1.1 will be disabled by default. This change increases the security posture of Windows customers and encourages modern protocol adoption. For organizations that need to use these versions, there's an option to re-enable TLS 1.0 or TLS 1.1. For more information, see [Resources for deprecated features](deprecated-features-resources.md). | August 1, 2023| -| Cortana in Windows | Cortana in Windows as a standalone app is deprecated. This change only impacts Cortana in Windows, and your productivity assistant, Cortana, will continue to be available in Outlook mobile, Teams mobile, Microsoft Teams display, and Microsoft Teams rooms. | June 2023 | +| TLS 1.0 and 1.1 | Over the past several years, internet standards and regulatory bodies have [deprecated or disallowed](https://www.ietf.org/rfc/rfc8996.html) TLS versions 1.0 and 1.1 due to various security issues. Starting in Windows 11 Insider Preview builds for September 2023 and continuing in future Windows OS releases, TLS 1.0 and 1.1 will be disabled by default. This change increases the security posture of Windows customers and encourages modern protocol adoption. For organizations that need to use these versions, there's an option to re-enable TLS 1.0 or TLS 1.1. For more information, see [Resources for deprecated features](deprecated-features-resources.md). | August 1, 2023| +| Cortana in Windows | Cortana in Windows as a standalone app is deprecated. This change only impacts Cortana in Windows, and your productivity assistant, Cortana, will continue to be available in Outlook mobile, Teams mobile, Microsoft Teams display, and Microsoft Teams rooms. | June 2023 | | Microsoft Support Diagnostic Tool (MSDT) | [MSDT](/windows-server/administration/windows-commands/msdt) is deprecated and will be removed in a future release of Windows. MSDT is used to gather diagnostic data for analysis by support professionals. For more information, see [Resources for deprecated features](deprecated-features-resources.md) | January 2023 | | Universal Windows Platform (UWP) Applications for 32-bit Arm | This change is applicable only to devices with an Arm processor, for example Snapdragon processors from Qualcomm. If you have a PC built with a processor from Intel or AMD, this content isn't applicable. If you aren't sure which type of processor you have, check **Settings** > **System** > **About**.

            Support for 32-bit Arm versions of applications will be removed in a future release of Windows 11. After this change, for the small number of applications affected, app features might be different and you might notice a difference in performance. For more technical details about this change, see [Update app architecture from Arm32 to Arm64](/windows/arm/arm32-to-arm64). | January 2023 | | Update Compliance | [Update Compliance](/windows/deployment/update/update-compliance-monitor), a cloud-based service for the Windows client, is no longer being developed. This service has been replaced with [Windows Update for Business reports](/windows/deployment/update/wufb-reports-overview), which provides reporting on client compliance with Microsoft updates from the Azure portal. | November 2022| diff --git a/windows/whats-new/feature-lifecycle.md b/windows/whats-new/feature-lifecycle.md index dd03e924a0..0c963dd3b4 100644 --- a/windows/whats-new/feature-lifecycle.md +++ b/windows/whats-new/feature-lifecycle.md @@ -8,7 +8,7 @@ manager: aaroncz ms.author: mstewart ms.topic: conceptual ms.technology: itpro-fundamentals -ms.date: 12/05/2023 +ms.date: 12/15/2023 ms.collection: - highpri - tier2 @@ -38,12 +38,12 @@ The following article has details about features that have been removed from Win ## Terminology -The following terms can be used to describe the status that might be assigned to a feature during its lifecycle: +The following terms can be used to describe the status that might be assigned to a feature during its lifecycle: - **Deprecation**: The stage of the product lifecycle when a feature or functionality is no longer in active development and may be removed in future releases of a product or online service. - **End of support**: The stage of the product lifecycle when support and servicing are no longer available for a product. - **Retirement**: The stage of the product lifecycle when a service is shut down so that it's no longer available for use. -- **Remove or retire a feature**: The stage of the product lifecycle when a feature or functionality is removed from a service after it has been deprecated. +- **Remove or retire a feature**: The stage of the product lifecycle when a feature or functionality is taken out of a service after it has been marked as deprecated. The feature is removed from newer versions of Windows, but still exists in older versions and is supported until those versions reach **end of support** stage. - **Replace a feature**: The stage of the product lifecycle when a feature or functionality in a service is replaced with a different feature or functionality. ## Also see diff --git a/windows/whats-new/ltsc/index.yml b/windows/whats-new/ltsc/index.yml index 4744f04260..aecd90e01a 100644 --- a/windows/whats-new/ltsc/index.yml +++ b/windows/whats-new/ltsc/index.yml @@ -15,7 +15,7 @@ metadata: author: mestew ms.author: mstewart manager: aaroncz - ms.date: 05/22/2023 + ms.date: 12/18/2023 localization_priority: medium landingContent: diff --git a/windows/whats-new/ltsc/overview.md b/windows/whats-new/ltsc/overview.md index 2faae9d8de..77fdc1e229 100644 --- a/windows/whats-new/ltsc/overview.md +++ b/windows/whats-new/ltsc/overview.md @@ -1,6 +1,6 @@ --- title: Windows 10 Enterprise LTSC overview -description: New and updated IT Pro content about new features in Windows 10, LTSC (also known as Windows 10 LTSB). +description: An overview of the Windows 10 long-term servicing channel (LTSC). ms.prod: windows-client author: mestew ms.author: mstewart @@ -8,42 +8,43 @@ manager: aaroncz ms.localizationpriority: low ms.topic: overview ms.technology: itpro-fundamentals -ms.date: 12/31/2017 +ms.date: 12/18/2023 appliesto: - ✅ Windows 10 Enterprise LTSC --- # Windows 10 Enterprise LTSC -This article provides links to information about what's new in each release of Windows 10 Enterprise LTSC, and includes a short description of this servicing channel. +This article provides general information about the Windows 10 Enterprise long-term servicing channel (LTSC). For more information about the features in each available version of the Windows 10 LTSC, see the following articles: -[What's New in Windows 10 Enterprise LTSC 2021](whats-new-windows-10-2021.md)
            -[What's New in Windows 10 Enterprise LTSC 2019](whats-new-windows-10-2019.md)
            -[What's New in Windows 10 Enterprise LTSC 2016](whats-new-windows-10-2016.md)
            -[What's New in Windows 10 Enterprise LTSC 2015](whats-new-windows-10-2015.md) +- [What's New in Windows 10 Enterprise LTSC 2021](whats-new-windows-10-2021.md) +- [What's New in Windows 10 Enterprise LTSC 2019](whats-new-windows-10-2019.md) +- [What's New in Windows 10 Enterprise LTSC 2016](whats-new-windows-10-2016.md) +- [What's New in Windows 10 Enterprise LTSC 2015](whats-new-windows-10-2015.md) -## The Long-Term Servicing Channel (LTSC) +## The long-term servicing channel (LTSC) -The following table summarizes equivalent feature update versions of Windows 10 LTSC and General Availability Channel (GA Channel) releases. +The following table summarizes equivalent feature update versions of Windows 10 LTSC and general availability channel (GA channel) releases: -| LTSC release | Equivalent GA Channel release | Availability date | +| LTSC release | Equivalent GA channel release | Availability date | | --- | --- | --- | -| Windows 10 Enterprise LTSC 2015 | Windows 10, Version 1507 | 7/29/2015 | -| Windows 10 Enterprise LTSC 2016 | Windows 10, Version 1607 | 8/2/2016 | -| Windows 10 Enterprise LTSC 2019 | Windows 10, Version 1809 | 11/13/2018 | | Windows 10 Enterprise LTSC 2021 | Windows 10, Version 21H2 | 11/16/2021 | +| Windows 10 Enterprise LTSC 2019 | Windows 10, Version 1809 | 11/13/2018 | +| Windows 10 Enterprise LTSC 2016 | Windows 10, Version 1607 | 8/2/2016 | +| Windows 10 Enterprise LTSC 2015 | Windows 10, Version 1507 | 7/29/2015 | > [!NOTE] -> The Long-Term Servicing Channel was previously called the Long-Term Servicing Branch (LTSB). All references to LTSB are changed in this article to LTSC for consistency, even though the name of previous versions might still be displayed as LTSB. +> The long-term servicing channel was previously called the long-term servicing branch (LTSB). All references to LTSB are changed in this article to LTSC for consistency, even though the name of previous versions might still be displayed as LTSB. -With the LTSC servicing model, customers can delay receiving feature updates and instead only receive monthly quality updates on devices. Features from Windows 10 that could be updated with new functionality, including Cortana, Edge, and all in-box Universal Windows apps, are also not included. Feature updates are offered in new LTSC releases every 2–3 years instead of every 6 months, and organizations can choose to install them as in-place upgrades, or even skip releases. Microsoft is committed to providing bug fixes and security patches for each LTSC release during the extended LTSC servicing lifecycle. Always check your individual LTSC release to verify its servicing lifecycle. For more information, see [release information](/windows/release-health/release-information), or perform a search on the [product lifecycle information](/lifecycle/products/) page. +With the LTSC servicing model, you can delay receiving *feature* updates and instead only receive monthly *quality* updates on devices. Features from Windows 10 that could be updated with new functionality, including Microsoft Edge and in-box Windows apps, are also not included. Feature updates are offered in new LTSC releases every several years instead of every few months. You can choose to install them as in-place upgrades, or even skip releases, what's best for your business requirements. Microsoft is committed to providing bug fixes and security patches for each LTSC release during the extended LTSC servicing lifecycle. Always check your individual LTSC release to verify its servicing lifecycle. For more information, see [release information](/windows/release-health/release-information), or search the [product lifecycle information](/lifecycle/products/) page. > [!IMPORTANT] -> The Long-Term Servicing Channel is not intended for deployment on most or all the PCs in an organization. The LTSC edition of Windows 10 provides customers with access to a deployment option for their special-purpose devices and environments. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. These devices are also typically not heavily dependent on support from external apps and tools. Since the feature set for LTSC does not change for the lifetime of the release, over time there might be some external tools that do not continue to provide legacy support. See [LTSC: What is it, and when it should be used](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181). - -For detailed information about Windows 10 servicing, see [Overview of Windows as a service](/windows/deployment/update/waas-overview). +> The long-term servicing channel isn't intended for deployment on most or all the PCs in an organization. The LTSC edition of Windows 10 provides a deployment option for special-purpose devices and environments. These devices typically do a single important task and don't need feature updates as frequently as other devices in the organization. These devices are also typically not heavily dependent on support from external apps and tools. Since the feature set for LTSC doesn't change for the lifetime of the release, over time there might be some external tools that don't continue to provide legacy support. For more information, see [LTSC: What is it, and when it should be used](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181). -## See Also +For more information about Windows 10 servicing, see [Overview of Windows as a service](/windows/deployment/update/waas-overview). -[What's New in Windows 10](../index.yml): See what’s new in other versions of Windows 10.
            -[Windows 10 - Release information](/windows/release-health/release-information): Windows 10 current versions by servicing option. +## See also + +- [What's new in Windows](../index.yml): See what's new in other versions of Windows. + +- [Windows 10 release information](/windows/release-health/release-information): Windows 10 current versions by servicing option. diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2015.md b/windows/whats-new/ltsc/whats-new-windows-10-2015.md index da9e6df080..66b1088247 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2015.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2015.md @@ -2,20 +2,23 @@ title: What's new in Windows 10 Enterprise LTSC 2015 manager: aaroncz ms.author: mstewart -description: New and updated IT Pro content about new features in Windows 10 Enterprise LTSC 2015 (also known as Windows 10 Enterprise 2015 LTSB). +description: New and updated IT pro content about new features in Windows 10 Enterprise LTSC 2015 (also known as Windows 10 Enterprise 2015 LTSB). ms.prod: windows-client author: mestew ms.localizationpriority: low -ms.topic: article +ms.topic: conceptual ms.technology: itpro-fundamentals -ms.date: 02/26/2023 +ms.date: 12/18/2023 appliesto: - ✅ Windows 10 Enterprise LTSC 2015 --- # What's new in Windows 10 Enterprise LTSC 2015 -This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](overview.md). +This article lists new and updated features and content that are of interest to IT pros for Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](overview.md). + +> [!NOTE] +> Windows 10 Enterprise LTSC 2015 was first available on July 29, 2015. Features in Windows 10 Enterprise LTSC 2015 are equivalent to Windows 10, version 1507. ## Deployment @@ -29,24 +32,24 @@ With Windows 10, you can create provisioning packages that let you quickly and e ### AppLocker -AppLocker was available for Windows 8.1, and is improved with Windows 10. See [Requirements to use AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker) for a list of operating system requirements. +AppLocker was available for Windows 8.1, and is improved with Windows 10. See [Requirements to use AppLocker](/windows/security/application-security/application-control/windows-defender-application-control/applocker/requirements-to-use-applocker) for a list of operating system requirements. Enhancements to AppLocker in Windows 10 include: - A new parameter was added to the [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy) Windows PowerShell cmdlet that lets you choose whether executable and DLL rule collections apply to non-interactive processes. To enable this parameter, set the **ServiceEnforcement** to **Enabled**. - A new [AppLocker](/windows/client-management/mdm/applocker-csp) configuration service provider was added to allow you to enable AppLocker rules by using an MDM server. -[Learn how to manage AppLocker within your organization](/windows/device-security/applocker/applocker-overview). +[Learn how to manage AppLocker within your organization](/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview). ### BitLocker Enhancements to AppLocker in Windows 10 include: -- **Encrypt and recover your device with Azure Active Directory**. In addition to using a Microsoft Account, automatic [Device Encryption](/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10#device-encryption) can now encrypt your devices that are joined to an Azure Active Directory domain. When the device is encrypted, the BitLocker recovery key is automatically escrowed to Azure Active Directory. This escrow will make it easier to recover your BitLocker key online. -- **DMA port protection**. You can use the [DataProtection/AllowDirectMemoryAccess](/windows/client-management/mdm/policy-configuration-service-provider#dataprotection-allowdirectmemoryaccess) MDM policy to block DMA ports when the device is starting up. Also, when a device is locked, all unused DMA ports are turned off, but any devices that are already plugged into a DMA port will continue to work. When the device is unlocked, all DMA ports are turned back on. -- **New Group Policy for configuring pre-boot recovery**. You can now configure the pre-boot recovery message and recover URL that is shown on the pre-boot recovery screen. For more info, see the [Configure pre-boot recovery message and URL](/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#bkmk-configurepreboot) section in "BitLocker Group Policy settings." +- **Encrypt and recover your device with Microsoft Entra**. In addition to using a Microsoft Account, automatic device encryption can now encrypt your devices that are joined to a Microsoft Entra domain. When the device is encrypted, the BitLocker recovery key is automatically escrowed to Microsoft Entra. This escrow will make it easier to recover your BitLocker key online. +- **DMA port protection**. You can use the [DataProtection/AllowDirectMemoryAccess](/windows/client-management/mdm/policy-csp-dataprotection#allowdirectmemoryaccess) MDM policy to block DMA ports when the device is starting up. Also, when a device is locked, all unused DMA ports are turned off, but any devices that are already plugged into a DMA port will continue to work. When the device is unlocked, all DMA ports are turned back on. +- **New Group Policy for configuring pre-boot recovery**. You can now configure the pre-boot recovery message and recover URL that is shown on the pre-boot recovery screen. For more information, see [BitLocker preboot recovery screen](/windows/security/operating-system-security/data-protection/bitlocker/preboot-recovery-screen). -[Learn how to deploy and manage BitLocker within your organization](/windows/device-security/bitlocker/bitlocker-overview). +[Learn how to deploy and manage BitLocker within your organization](/windows/security/operating-system-security/data-protection/bitlocker/). ### Certificate management @@ -54,20 +57,22 @@ For Windows 10-based devices, you can use your MDM server to directly deploy cli ### Microsoft Passport -In Windows 10, [Microsoft Passport](/windows/access-protection/hello-for-business/hello-identity-verification) replaces passwords with strong two-factor authentication that consists of an enrolled device and a Windows Hello (biometric) or PIN. +In Windows 10, [Microsoft Passport](/windows/security/identity-protection/hello-for-business/deploy/requirements) replaces passwords with strong two-factor authentication that consists of an enrolled device and a Windows Hello (biometric) or PIN. -Microsoft Passport lets users authenticate to a Microsoft account, an Active Directory account, a Microsoft Azure Active Directory (AD) account, or non-Microsoft service that supports Fast ID Online (FIDO) authentication. After an initial two-step verification during Microsoft Passport enrollment, a Microsoft Passport is set up on the user's device and the user sets a gesture, which can be Windows Hello or a PIN. The user provides the gesture to verify identity; Windows then uses Microsoft Passport to authenticate users and help them to access protected resources and services. +Microsoft Passport lets users authenticate to a Microsoft account, an Active Directory account, a Microsoft Entra ID account, or non-Microsoft service that supports Fast ID Online (FIDO) authentication. After an initial two-step verification during Microsoft Passport enrollment, a Microsoft Passport is set up on the user's device and the user sets a gesture, which can be Windows Hello or a PIN. The user provides the gesture to verify identity; Windows then uses Microsoft Passport to authenticate users and help them to access protected resources and services. ### Security auditing In Windows 10, security auditing has added some improvements: + - [New audit subcategories](#bkmk-auditsubcat) - [More info added to existing audit events](#bkmk-moreinfo) #### New audit subcategories In Windows 10, two new audit subcategories were added to the Advanced Audit Policy Configuration to provide greater granularity in audit events: -- [Audit Group Membership](/windows/device-security/auditing/audit-group-membership) Found in the Logon/Logoff audit category, the Audit Group Membership subcategory allows you to audit the group membership information in a user's logon token. Events in this subcategory are generated when group memberships are enumerated or queried on the PC where the sign-in session was created. For an interactive logon, the security audit event is generated on the PC that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the PC hosting the resource. + +- [Audit Group Membership](/windows/security/threat-protection/auditing/audit-handle-manipulation) Found in the Logon/Logoff audit category, the Audit Group Membership subcategory allows you to audit the group membership information in a user's logon token. Events in this subcategory are generated when group memberships are enumerated or queried on the PC where the sign-in session was created. For an interactive logon, the security audit event is generated on the PC that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the PC hosting the resource. When this setting is configured, one or more security audit events are generated for each successful sign-in. You must also enable the **Audit Logon** setting under **Advanced Audit Policy Configuration\\System Audit Policies\\Logon/Logoff**. Multiple events are generated if the group membership information can't fit in a single security audit event. - [Audit PNP Activity](/windows/security/threat-protection/auditing/audit-pnp-activity) Found in the Detailed Tracking category, the Audit PNP Activity subcategory allows you to audit when plug and play detects an external device. Only Success audits are recorded for this category. If you don't configure this policy setting, no audit event is generated when an external device is detected by plug and play. @@ -76,6 +81,7 @@ In Windows 10, two new audit subcategories were added to the Advanced Audit Poli #### More info added to existing audit events With Windows 10, version 1507, we've added more info to existing audit events to make it easier for you to put together a full audit trail and come away with the information you need to protect your enterprise. Improvements were made to the following audit events: + - [Changed the kernel default audit policy](#bkmk-kdal) - [Added a default process SACL to LSASS.exe](#bkmk-lsass) - [Added new fields in the logon event](#bkmk-logon) @@ -96,6 +102,7 @@ This process-when enabled-can help identify attacks that steal credentials from #### New fields in the sign-in event The sign-in event ID 4624 has been updated to include more verbose information to make them easier to analyze. The following fields have been added to event 4624: + 1. **MachineLogon** String: yes or no If the account that signed in to the PC is a computer account, this field will be yes. Otherwise, the field is no. 2. **ElevatedToken** String: yes or no @@ -109,7 +116,6 @@ The sign-in event ID 4624 has been updated to include more verbose information t A list of all of the groups in the user's token. 6. **RestrictedAdminMode** String: yes or no If the user logs into the PC in restricted admin mode with Remote Desktop, this field will be yes. - For more info on restricted admin mode, see [Restricted Admin mode for RDP](/archive/blogs/kfalde/restricted-admin-mode-for-rdp-in-windows-8-1-2012-r2). #### New fields in the process creation event @@ -156,24 +162,25 @@ Event ID 4826 has been added to track the following changes to the Boot Configur #### New PNP events -Event ID 6416 has been added to track when an external device is detected through Plug and Play. One important scenario is if an external device that contains malware is inserted into a high-value machine that doesn’t expect this type of action, such as a domain controller. - -[Learn how to manage your security audit policies within your organization](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn319078(v=ws.11)) +Event ID 6416 has been added to track when an external device is detected through Plug and Play. One important scenario is if an external device that contains malware is inserted into a high-value machine that doesn't expect this type of action, such as a domain controller. ### Trusted Platform Module #### New TPM features in Windows 10 The following sections describe the new and changed functionality in the TPM for Windows 10: + - [Device health attestation](#bkmk-dha) -- [Microsoft Passport](/windows/access-protection/hello-for-business/hello-identity-verification) support -- [Device Guard](/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies) support -- [Credential Guard](/windows/access-protection/credential-guard/credential-guard) support +- [Microsoft Passport](/windows/security/identity-protection/hello-for-business/deploy/requirements) support +- [Device Guard](/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control) support +- [Credential Guard](/windows/security/identity-protection/credential-guard/) support ### Device health attestation Device health attestation enables enterprises to establish trust based on hardware and software components of a managed device. With device health attestation, you can configure an MDM server to query a health attestation service that will allow or deny a managed device access to a secure resource. + Some things that you can check on the device are: + - Is Data Execution Prevention supported and enabled? - Is BitLocker Drive Encryption supported and enabled? - Is SecureBoot supported and enabled? @@ -181,7 +188,7 @@ Some things that you can check on the device are: > [!NOTE] > The device must be running Windows 10 and it must support at least TPM 2.0. -[Learn how to deploy and manage TPM within your organization](/windows/device-security/tpm//trusted-platform-module-overview). +[Learn how to deploy and manage TPM within your organization](/windows/security/hardware-security/tpm/trusted-platform-module-overview). ### User Account Control @@ -189,13 +196,13 @@ User Account Control (UAC) helps prevent malware from damaging a computer and he You shouldn't turn off UAC because such a setting isn't supportive of devices running Windows 10. If you do turn off UAC, all Universal Windows Platform apps stop working. You must always set the **HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA** registry value to 1. If you need to provide auto elevation for programmatic access or installation, you could set the **HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin** registry value to 0, which is the same as setting the UAC slider Never Notify. This setting isn't recommended for devices running Windows 10. -For more info about how to manage UAC, see [UAC Group Policy Settings and Registry Key Settings](/windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings). +For more info about how to manage UAC, see [UAC group policy settings and registry key settings](/windows/security/application-security/application-control/user-account-control/settings-and-configuration). In Windows 10, User Account Control has added some improvements: - **Integration with the Antimalware Scan Interface (AMSI)**. The [AMSI](/windows/win32/amsi/antimalware-scan-interface-portal) scans all UAC elevation requests for malware. If malware is detected, the admin privilege is blocked. -[Learn how to manage User Account Control within your organization](/windows/access-protection/user-account-control/user-account-control-overview). +[Learn how to manage User Account Control within your organization](/windows/security/application-security/application-control/user-account-control/). ### VPN profile options @@ -207,7 +214,7 @@ Windows 10 provides a set of VPN features that both increase enterprise security - Lock down VPN - Integration with Microsoft Passport for Work -[Learn more about the VPN options in Windows 10.](/windows/access-protection/vpn/vpn-profile-options) +[Learn more about the VPN options in Windows 10.](/windows/security/operating-system-security/network-security/vpn/vpn-profile-options) ## Management @@ -216,11 +223,11 @@ Windows 10 provides mobile device management (MDM) capabilities for PCs, laptops ### MDM support -MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Microsoft Store, VPN configuration, and more. +MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Entra ID accounts, full control over the Microsoft Store, VPN configuration, and more. -MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](https://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification. +MDM support in Windows 10 is based on Open Mobile Alliance (OMA) Device Management (DM) protocol 1.2.1 specification. -Corporate-owned devices can be enrolled automatically for enterprises using Azure AD. [Reference for Mobile device management for Windows 10](/windows/client-management/mdm/) +Corporate-owned devices can be enrolled automatically for enterprises using Azure AD. [Reference for mobile device management for Windows 10](/windows/client-management/mdm/) ### Unenrollment @@ -265,17 +272,17 @@ Administrators can also use mobile device management (MDM) or Group Policy to di ## Updates -Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft’s Windows Update service. +Windows Update for Business enables information technology administrators to keep the Windows 10-based devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Microsoft's Windows Update service. -By using [Group Policy Objects](/previous-versions/cc498727(v=msdn.10)), Windows Update for Business is an easily established and implemented system that enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: +By using group policy objects, Windows Update for Business is an easily established and implemented system that enables organizations and administrators to exercise control on how their Windows 10-based devices are updated, by allowing: - **Deployment and validation groups**; where administrators can specify which devices go first in an update wave, and which devices will come later (to ensure any quality bars are met). - **Peer-to-peer delivery**, which administrators can enable to make delivery of updates to branch offices and remote sites with limited bandwidth efficient. -- **Use with existing tools** such as Microsoft Intune and the [Enterprise Mobility Suite](/enterprise-mobility-security). +- **Use with existing tools** such as Microsoft Intune and Configuration Manager. -Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, and provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as [Windows Server Update Services (WSUS)](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh852345(v=ws.11)) and [Microsoft Configuration Manager](/configmgr). +Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, and provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as Windows Server Update Services (WSUS) and [Microsoft Configuration Manager](/configmgr). Learn more about [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb). diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2016.md b/windows/whats-new/ltsc/whats-new-windows-10-2016.md index ba451305fd..9a932a1ef1 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2016.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2016.md @@ -2,29 +2,29 @@ title: What's new in Windows 10 Enterprise LTSC 2016 manager: aaroncz ms.author: mstewart -description: New and updated IT Pro content about new features in Windows 10 Enterprise LTSC 2016 (also known as Windows 10 Enterprise 2016 LTSB). +description: New and updated IT pro content about new features in Windows 10 Enterprise LTSC 2016 (also known as Windows 10 Enterprise 2016 LTSB). ms.prod: windows-client author: mestew ms.localizationpriority: low -ms.topic: article +ms.topic: conceptual ms.technology: itpro-fundamentals -ms.date: 12/31/2017 +ms.date: 12/18/2023 appliesto: - ✅ Windows 10 Enterprise LTSC 2016 --- # What's new in Windows 10 Enterprise LTSC 2016 -This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2016 (LTSB), compared to Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](overview.md). +This article lists new and updated features and content that are of interest to IT pros for Windows 10 Enterprise LTSC 2016 (LTSB), compared to Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](overview.md). ->[!NOTE] ->Features in Windows 10 Enterprise LTSC 2016 are equivalent to Windows 10, version 1607. +> [!NOTE] +> Windows 10 Enterprise LTSC 2016 was first available on August 2, 2016. Features in Windows 10 Enterprise LTSC 2016 are equivalent to Windows 10, version 1607. ## Deployment ### Windows Imaging and Configuration Designer (ICD) -In previous versions of the Windows 10 Assessment and Deployment Kit (ADK), you had to install more features for Windows ICD to run. Starting in this version of Windows 10, you can install just the configuration designer component independent of the rest of the imaging components. [Install the ADK.](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) +In previous versions of the Windows 10 Assessment and Deployment Kit (ADK), you had to install more features for Windows ICD to run. Starting in this version of Windows 10, you can install just the configuration designer component independent of the rest of the imaging components. [Install the ADK](/windows-hardware/get-started/adk-install). Windows ICD now includes simplified workflows for creating provisioning packages: @@ -39,7 +39,7 @@ Windows ICD now includes simplified workflows for creating provisioning packages >[!IMPORTANT] >Upgrade Readiness will not allow you to assess an upgrade to an LTSC release (LTSC builds are not available as target versions). However, you can enroll devices running LTSC to plan for an upgrade to a General Availability Channel release. -Microsoft developed Upgrade Readiness in response to demand from enterprise customers looking for more direction and details about upgrading to Windows 10. Upgrade Readiness was built taking into account multiple channels of customer feedback, testing, and Microsoft’s experience upgrading millions of devices to Windows 10. +Microsoft developed Upgrade Readiness in response to demand from enterprise customers looking for more direction and details about upgrading to Windows 10. Upgrade Readiness was built taking into account multiple channels of customer feedback, testing, and Microsoft's experience upgrading millions of devices to Windows 10. With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they're known to Microsoft. @@ -69,11 +69,11 @@ When Windows 10 was first shipped, it included Microsoft Passport and Windows He Other changes for Windows Hello in Windows 10 Enterprise LTSC 2016: -- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. +- Personal (Microsoft account) and corporate (Active Directory or Entra ID) accounts use a single container for keys. - Group Policy settings for managing Windows Hello for Business are now available for both **User Configuration** and **Computer Configuration**. - Beginning in this version of Windows 10, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN, enable the Group Policy setting **Turn on convenience PIN sign-in**. -[Learn more about Windows Hello for Business.](/windows/access-protection/hello-for-business/hello-identity-verification) +[Learn more about Windows Hello for Business.](/windows/security/identity-protection/hello-for-business/deploy/requirements) ### BitLocker @@ -101,7 +101,7 @@ Other changes for Windows Hello in Windows 10 Enterprise LTSC 2016: ### Windows Information Protection (WIP), formerly known as enterprise data protection (EDP) -With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. +With the increase of employee-owned devices in the enterprise, there's also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise's control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. Windows Information Protection (WIP) helps to protect against this potential data leakage without otherwise interfering with the employee experience. WIP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps. @@ -125,20 +125,20 @@ Several new features and management options have been added to Windows Defender With the growing threat from more sophisticated targeted attacks, a new security solution is imperative in securing an increasingly complex network ecosystem. Microsoft Defender for Endpoint is a security service, built into Windows 10 that enables enterprise customers detect, investigate, and respond to advanced threats on their networks. -[Learn more about Microsoft Defender for Endpoint](/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection). +[Learn more about Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/). ### VPN security -- The VPN client can integrate with the Conditional Access Framework, a cloud-based policy engine built into Azure Active Directory, to provide a device compliance option for remote clients. +- The VPN client can integrate with the Conditional Access Framework, a cloud-based policy engine built into Microsoft Entra ID, to provide a device compliance option for remote clients. - The VPN client can integrate with Windows Information Protection (WIP) policy to provide extra security. [Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip), previously known as Enterprise Data Protection. -- New VPNv2 configuration service provider (CSP) adds configuration settings. For details, see [What's new in MDM enrollment and management](/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew_1607) +- New VPNv2 configuration service provider (CSP) adds configuration settings. For details, see [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) - Microsoft Intune: *VPN* profile template includes support for native VPN plug-ins. For more information, see [Create VPN profiles to connect to VPN servers in Intune](/mem/intune/configuration/vpn-settings-configure). ## Management -### Use Remote Desktop Connection for PCs joined to Azure Active Directory +### Use Remote Desktop Connection for PCs joined to Microsoft Entra ID -From its release, Windows 10 has supported remote connections to PCs that are joined to Active Directory. Starting in this version of Windows 10, you can also connect to a remote PC that is joined to Azure Active Directory (Azure AD). [Learn about the requirements and supported configurations.](/windows/client-management/connect-to-remote-aadj-pc) +From its release, Windows 10 has supported remote connections to PCs that are joined to Active Directory. Starting in this version of Windows 10, you can also connect to a remote PC that is joined to Microsoft Entra ID. [Learn about the requirements and supported configurations.](/windows/client-management/connect-to-remote-aadj-pc) ### Taskbar configuration @@ -146,7 +146,7 @@ Enterprise administrators can add and remove pinned apps from the taskbar. Users ### Mobile device management and configuration service providers (CSPs) -Numerous settings have been added to the Windows 10 CSPs to expand MDM capabilities for managing devices. To learn more about the specific changes in MDM policies for this version of Windows 10, see [What's new in MDM enrollment and management](/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew_1607). +Numerous settings have been added to the Windows 10 CSPs to expand MDM capabilities for managing devices. To learn more about the specific changes in MDM policies for this version of Windows 10, see [What's new in MDM enrollment and management](/windows/client-management/mdm/new-in-windows-mdm-enrollment-management). ### Shared PC mode @@ -154,9 +154,9 @@ This version of Windows 10, introduces shared PC mode, which optimizes Windows 1 ### Application Virtualization (App-V) for Windows 10 -Application Virtualization (App-V) enables organizations to deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points, including the Microsoft Store, and interact with them as if they were installed locally. +Application Virtualization (App-V) enables organizations to deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service - in real time and on as as-needed basis. Users launch virtual applications from familiar access points, including the Microsoft Store, and interact with them as if they were installed locally. -With the release of this version of Windows 10, App-V is included with the Windows 10 for Enterprise edition. If you're new to Windows 10 and App-V or if you're upgrading from a previous version of App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. +With the release of this version of Windows 10, App-V is included with the Windows 10 for Enterprise edition. If you're new to Windows 10 and App-V or if you're upgrading from a previous version of App-V, you'll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. [Learn how to deliver virtual applications with App-V.](/windows/application-management/app-v/appv-getting-started) @@ -166,13 +166,13 @@ Many users customize their settings for Windows and for specific applications. C With User Experience Virtualization (UE-V), you can capture user-customized Windows and application settings and store them on a centrally managed network file share. When users sign in, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they sign in to. -With the release of this version of Windows 10, UE-V is included with the Windows 10 for Enterprise edition. If you're new to Windows 10 and UE-V or upgrading from a previous version of UE-V, you’ll need to download, activate, and install server- and client-side components to start synchronizing user-customized settings across devices. +With the release of this version of Windows 10, UE-V is included with the Windows 10 for Enterprise edition. If you're new to Windows 10 and UE-V or upgrading from a previous version of UE-V, you'll need to download, activate, and install server- and client-side components to start synchronizing user-customized settings across devices. [Learn how to synchronize user-customized settings with UE-V.](/windows/configuration/ue-v/uev-for-windows) ## Microsoft Edge -The new chromium-based Microsoft Edge isn't included in the LTSC release of Windows 10. However, you can download and install it separately [here](https://www.microsoft.com/edge/business/download). +The new chromium-based Microsoft Edge isn't included in the LTSC release of Windows 10. However, you can download and install it separately. For more information, see [Download and configure Microsoft Edge for Business](https://www.microsoft.com/edge/business/download). ## See Also diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index 99cf0f87aa..2221b4ab44 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -8,7 +8,7 @@ author: mestew ms.localizationpriority: medium ms.topic: conceptual ms.technology: itpro-fundamentals -ms.date: 04/05/2023 +ms.date: 12/18/2023 appliesto: - ✅ Windows 10 Enterprise LTSC 2019 --- @@ -17,8 +17,8 @@ appliesto: This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2019, compared to Windows 10 Enterprise LTSC 2016 (LTSB). For a brief description of the LTSC servicing channel and associated support, see [Windows 10 Enterprise LTSC](overview.md). ->[!NOTE] ->Features in Windows 10 Enterprise LTSC 2019 are equivalent to Windows 10, version 1809. +> [!NOTE] +> Windows 10 Enterprise LTSC 2019 was first available on November 13, 2018. Features in Windows 10 Enterprise LTSC 2019 are equivalent to Windows 10, version 1809. Windows 10 Enterprise LTSC 2019 builds on Windows 10 Pro, version 1809 adding premium features designed to address the needs of large and mid-size organizations (including large academic institutions), such as: @@ -30,11 +30,12 @@ Windows 10 Enterprise LTSC 2019 builds on Windows 10 Pro, version 1809 adding pr The Windows 10 Enterprise LTSC 2019 release is an important release for LTSC users because it includes the cumulative enhancements provided in Windows 10 versions 1703, 1709, 1803, and 1809. Details about these enhancements are provided below. >[!IMPORTANT] ->The LTSC release is [intended for special use devices](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181). Support for LTSC by apps and tools that are designed for the General Availability Channel release of Windows 10 might be limited. +>The LTSC release is [intended for special use devices](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181). Support for LTSC by apps and tools that are designed for the general availability channel release of Windows 10 might be limited. ## Microsoft Intune Microsoft Intune supports Windows 10 Enterprise LTSC 2019 with the following exception: + - [Update rings](/mem/intune/protect/windows-10-update-rings) can't be used for feature updates since Windows 10 LTSC versions don't receive feature updates. Update rings can be used for quality updates for Windows 10 Enterprise LTSC 2019 clients. ## Security @@ -49,7 +50,7 @@ The [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/ ##### Attack surface reduction -Attack surface reduction includes host-based intrusion prevention systems such as [controlled folder access]/microsoft-365/security/defender-endpoint/enable-controlled-folders). +Attack surface reduction includes host-based intrusion prevention systems such as [controlled folder access](/microsoft-365/security/defender-endpoint/enable-controlled-folders). - This feature can help prevent ransomware and other destructive malware from changing your personal files. In some cases, apps that you normally use might be blocked from making changes to common folders like **Documents** and **Pictures**. We've made it easier for you to add apps that were recently blocked so you can keep using your device without turning off the feature altogether. @@ -74,7 +75,7 @@ But these protections can also be configured separately. And, unlike HVCI, code Endpoint detection and response are improved. Enterprise customers can now take advantage of the entire Windows security stack with Microsoft Defender Antivirus **detections** and Device Guard **blocks** being surfaced in the Microsoft Defender for Endpoint portal. -Windows Defender is now called Microsoft Defender Antivirus and now shares detection status between Microsoft 365 services and interoperates with Microsoft Defender for Endpoint. Other policies have also been implemented to enhance cloud based protection, and new channels are available for emergency protection. For more information, see [Virus and threat protection](/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection) and [Use next-gen technologies in Microsoft Defender Antivirus through cloud-delivered protection](/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus). +Windows Defender is now called Microsoft Defender Antivirus and now shares detection status between Microsoft 365 services and interoperates with Microsoft Defender for Endpoint. Other policies have also been implemented to enhance cloud based protection, and new channels are available for emergency protection. For more information, see [Virus and threat protection](/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection) and [Use next-gen technologies in Microsoft Defender Antivirus through cloud-delivered protection](/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus). We've also [increased the breadth of the documentation library for enterprise security admins](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows). The new library includes information on: @@ -143,12 +144,7 @@ We've also added a new assessment for the Windows time service to the **Device p We're continuing to work on how other security apps you've installed show up in the **Windows Security** app. There's a new page called **Security providers** that you can find in the **Settings** section of the app. Select **Manage providers** to see a list of all the other security providers (including antivirus, firewall, and web protection) that are running on your device. Here you can easily open the providers' apps or get more information on how to resolve issues reported to you through **Windows Security**. -This improvement also means you'll see more links to other security apps within **Windows Security**. For example, if you open the **Firewall & network protection** section, you'll see the firewall apps that are running on your device under each firewall type, which includes domain, private, and public networks). - -You can read more about ransomware mitigations and detection capability at: - -- [Averting ransomware epidemics in corporate networks with Microsoft Defender for Endpoint](https://www.microsoft.com/security/blog/2017/01/30/averting-ransomware-epidemics-in-corporate-networks-with-windows-defender-atp/) -- [Microsoft Malware Protection Center blog](https://www.microsoft.com/security/blog/category/research/ransomware/) +This improvement also means you'll see more links to other security apps within **Windows Security**. For example, if you open the **Firewall & network protection** section, you'll see the firewall apps that are running on your device under each firewall type, which includes domain, private, and public networks. Also see [New capabilities of Microsoft Defender for Endpoint further maximizing the effectiveness and robustness of endpoint security](https://blogs.windows.com/business/2018/04/17/new-capabilities-of-windows-defender-atp-further-maximizing-the-effectiveness-and-robustness-of-endpoint-security/#62FUJ3LuMXLQidVE.97) @@ -170,11 +166,11 @@ This release enables support for WIP with Files on Demand, allows file encryptio ### BitLocker -The minimum PIN length is being changed from 6 to 4, with a default of 6. For more information, see [BitLocker Group Policy settings](/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#configure-minimum-pin-length-for-startup). +The minimum PIN length is being changed from 6 to 4, with a default of 6. For more information, see [BitLocker Group Policy settings](/windows/security/operating-system-security/data-protection/bitlocker/configure#bitlocker-policy-settings). #### Silent enforcement on fixed drives -Through a Modern Device Management (MDM) policy, BitLocker can be enabled silently for standard Azure Active Directory (Azure AD) joined users. In Windows 10, version 1803 automatic BitLocker encryption was enabled for standard Azure AD users, but this still required modern hardware that passed the Hardware Security Test Interface (HSTI). This new functionality enables BitLocker via policy even on devices that don't pass the HSTI. +Through a modern device management (MDM) policy, BitLocker can be enabled silently for standard Microsoft Entra ID joined users. In Windows 10, version 1803 automatic BitLocker encryption was enabled for standard Entra ID users, but this still required modern hardware that passed the Hardware Security Test Interface (HSTI). This new functionality enables BitLocker via policy even on devices that don't pass the HSTI. This change is an update to the [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp) and used by Intune and others. @@ -192,7 +188,7 @@ New features in [Windows Hello for Business](/windows/security/identity-protecti - For Windows desktops, users are able to reset a forgotten PIN through **Settings > Accounts > Sign-in options**. For more information, see [What if I forget my PIN?](/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset). -Windows Hello for Business now supports FIDO 2.0 authentication for Azure AD Joined Windows 10 devices and has enhanced support for shared devices, as described in [Kiosk configuration](#kiosk-configuration). +Windows Hello for Business now supports FIDO 2.0 authentication for Entra ID-joined Windows 10 devices and has enhanced support for shared devices, as described in [Kiosk configuration](#kiosk-configuration). - Windows Hello is now password-less on S-mode. @@ -212,18 +208,18 @@ For more information, see: [Windows Hello and FIDO2 Security Keys enable secure Credential Guard is a security service in Windows 10 built to protect Active Directory (AD) domain credentials so that they can't be stolen or misused by malware on a user's machine. It's designed to protect against well-known threats such as Pass-the-Hash and credential harvesting. -Credential Guard has always been an optional feature, but Windows 10 in S mode turns on this functionality by default when the machine has been Azure Active Directory-joined. This feature provides an added level of security when connecting to domain resources not normally present on devices running Windows 10 in S mode. +Credential Guard has always been an optional feature, but Windows 10 in S mode turns on this functionality by default when the machine has been Entra ID-joined. This feature provides an added level of security when connecting to domain resources not normally present on devices running Windows 10 in S mode. > [!NOTE] > Credential Guard is available only to S mode devices or Enterprise and Education Editions. -For more information, see [Credential Guard Security Considerations](/windows/security/identity-protection/credential-guard/credential-guard-requirements#security-considerations). +For more information, see [Credential Guard overview](/windows/security/identity-protection/credential-guard/credential-guard-requirements). ### Other security improvements #### Windows security baselines -Microsoft has released new [Windows security baselines](/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines) for Windows Server and Windows 10. A security baseline is a group of Microsoft-recommended configuration settings with an explanation of their security effect. For more information, and to download the Policy Analyzer tool, see [Microsoft Security Compliance Toolkit 1.0](/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10). +Microsoft has released new [Windows security baselines](/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines) for Windows Server and Windows 10. A security baseline is a group of Microsoft-recommended configuration settings with an explanation of their security effect. For more information, and to download the Policy Analyzer tool, see [Microsoft Security Compliance Toolkit 1.0](/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10). #### SMBLoris vulnerability @@ -250,9 +246,9 @@ A new security policy setting #### Windows 10 in S mode -We've continued to work on the **Current threats** area in [Virus & threat protection](/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection), which now displays all threats that need action. You can quickly take action on threats from this screen: +We've continued to work on the **Current threats** area in [Virus & threat protection](/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection), which now displays all threats that need action. You can quickly take action on threats from this screen: -:::image type="content" source="../images/virus-and-threat-protection.png" alt-text="Screenshot of the Virus & threat protection settings in Windows."::: +:::image type="content" source="../images/virus-and-threat-protection.png" alt-text="Screenshot of the Virus & threat protection settings in Windows 10 Enterprise LTSC 2019."::: ## Deployment @@ -295,7 +291,7 @@ It's also now possible to run a script if the user rolls back their version of W `/PostRollback [\setuprollback.cmd] [/postrollback {system / admin}]` -For more information, see [Windows Setup Command-Line Options](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#postrollback). +For more information, see [Windows Setup command-line options](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#postrollback). New command-line switches are also available to control BitLocker: @@ -309,7 +305,7 @@ For more information, see [Windows Setup Command-Line Options](/windows-hardware ### Feature update improvements -Portions of the work done during the offline phases of a Windows update have been moved to the online phase. This change results in a significant reduction of offline time when installing updates. For more information, see [We're listening to you](https://insider.windows.com/articles/were-listening-to-you/). +Portions of the work done during the offline phases of a Windows update have been moved to the online phase. This change results in a significant reduction of offline time when installing updates. ### SetupDiag @@ -331,7 +327,7 @@ If you have shared devices deployed in your work place, **Fast sign-in** enables 3. Sign-in to a shared PC with your account. - :::image type="content" source="../images/fastsignin.png" alt-text="An animated image that demonstrates the fast sign-in feature."::: + :::image type="content" source="../images/fastsignin.png" alt-text="An animated image that demonstrates the fast sign-in feature in Windows 10 Enterprise LTSC 2019."::: ### Web sign-in to Windows 10 @@ -339,7 +335,7 @@ Until now, Windows sign-in only supported the use of identities federated to ADF #### Try out web sign-in -1. Azure AD Join your Windows 10 PC. (Web sign-in is only supported on Azure AD Joined PCs). +1. Entra ID join your Windows 10 PC. (Web sign-in is only supported on Entra ID-joined PCs). 2. Set the Policy CSP, and the Authentication and EnableWebSignIn policies to enable web sign-in. @@ -347,7 +343,7 @@ Until now, Windows sign-in only supported the use of identities federated to ADF 4. Select "Sign in" to continue. - :::image type="content" source="../images/websignin.png" alt-text="A screenshot of the Windows sign-in screen that highlights the web sign-in feature."::: + :::image type="content" source="../images/websignin.png" alt-text="A screenshot of the Windows 10 sign-in screen that highlights the web sign-in feature."::: ## Update Compliance @@ -357,8 +353,6 @@ Update Compliance is a solution built using OMS Log Analytics that provides info New capabilities in Update Compliance let you monitor Windows Defender protection status, compare compliance with industry peers, and optimize bandwidth for deploying updates. -For more information about Update Compliance, see [Monitor Windows Updates with Update Compliance](/windows/deployment/update/update-compliance-monitor). - ## Accessibility and privacy ### Accessibility @@ -377,11 +371,11 @@ The new chromium-based Microsoft Edge has many improvements targeted to kiosks. Internet Explorer is included in Windows 10 LTSC releases as its feature set isn't changing, and it will continue to get security fixes for the life of a Windows 10 LTSC release. -If you wish to take advantage of [Kiosk capabilities in Microsoft Edge](/previous-versions/windows/edge-legacy/microsoft-edge-kiosk-mode-deploy), consider [Kiosk mode](/windows/configuration/kiosk-methods) with a semi-annual release channel. +If you wish to take advantage of kiosk capabilities in Microsoft Edge, consider [Kiosk mode](/windows/configuration/kiosk-methods) with a semi-annual release channel. ### Co-management -Intune and Microsoft Configuration Manager policies have been added to enable hybrid Azure AD-joined authentication. Mobile Device Management (MDM) has added over 150 new policies and settings in this release, including the [MDMWinsOverGP](/windows/client-management/mdm/policy-csp-controlpolicyconflict) policy, to enable easier transition to cloud-based management. +Intune and Microsoft Configuration Manager policies have been added to enable hybrid Entra ID-joined authentication. Mobile Device Management (MDM) has added over 150 new policies and settings in this release, including the [MDMWinsOverGP](/windows/client-management/mdm/policy-csp-controlpolicyconflict) policy, to enable easier transition to cloud-based management. For more information, see [What's New in MDM enrollment and management](/windows/client-management/mdm/new-in-windows-mdm-enrollment-management). @@ -389,9 +383,9 @@ For more information, see [What's New in MDM enrollment and management](/windows The OS uninstall period is a length of time that users are given when they can optionally roll back a Windows 10 update. With this release, administrators can use Intune or [DISM](#dism) to customize the length of the OS uninstall period. -### Azure Active Directory join in bulk +### Microsoft Entra ID join in bulk -Using the new wizards in Windows Configuration Designer, you can [create provisioning packages to enroll devices in Azure Active Directory](/windows/configuration/provisioning-packages/provisioning-packages#configuration-designer-wizards). Azure AD join in bulk is available in the desktop, mobile, kiosk, and Surface Hub wizards. +Using the new wizards in Windows Configuration Designer, you can [create provisioning packages to enroll devices in Entra ID](/windows/configuration/provisioning-packages/provisioning-packages#configuration-designer-wizards). Entra ID join in bulk is available in the desktop, mobile, kiosk, and Surface Hub wizards. ### Windows Spotlight @@ -419,9 +413,9 @@ Previously, the customized taskbar could only be deployed using Group Policy or ### Windows Insider for Business -We recently added the option to download Windows 10 Insider Preview builds using your corporate credentials in Azure Active Directory (Azure AD). By enrolling devices in Azure AD, you increase the visibility of feedback submitted by users in your organization - especially on features that support your specific business needs. For details, see [Windows Insider Program for Business](https://insider.windows.com/for-business). +We recently added the option to download Windows 10 Insider Preview builds using your corporate credentials in Microsoft Entra ID. By enrolling devices in Entra ID, you increase the visibility of feedback submitted by users in your organization - especially on features that support your specific business needs. For details, see [Windows Insider Program for Business](https://www.microsoft.com/windowsinsider/for-business). -You can now register your Azure AD domains to the Windows Insider Program. For more information, see [Windows Insider Program for Business](https://insider.windows.com/for-business). +You can now register your Entra ID domains to the Windows Insider Program. For more information, see [Windows Insider Program for Business](https://www.microsoft.com/windowsinsider/for-business). ### Optimize update delivery @@ -470,7 +464,7 @@ Some of the other new CSPs are: For more information, see [What's new in mobile device enrollment and management](/windows/client-management/mdm/new-in-windows-mdm-enrollment-management). -MDM has been expanded to include domain joined devices with Azure Active Directory registration. Group policy can be used with Active Directory-joined devices to trigger auto-enrollment to MDM. For more information, see [Enroll a Windows 10 device automatically using Group Policy](/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy). +MDM has been expanded to include domain joined devices with Microsoft Entra ID registration. Group policy can be used with Active Directory-joined devices to trigger auto-enrollment to MDM. For more information, see [Enroll a Windows 10 device automatically using Group Policy](/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy). Multiple new configuration items are also added. For more information, see [What's new in MDM enrollment and management](/windows/client-management/mdm/new-in-windows-mdm-enrollment-management). @@ -556,11 +550,11 @@ If you have a device that has been updated to Windows 10 Enterprise LTSC 2019, t We added a dropdown that displays while you type to help complete the next part of the path. You can also press **Ctrl + Backspace** to delete the last word, and **Ctrl + Delete** to delete the next word. -:::image type="content" source="../images/regeditor.png" alt-text="Screenshot of Registry Editor showing list of path completion."::: +:::image type="content" source="../images/regeditor.png" alt-text="Screenshot of Registry Editor in Windows 10 showing list of path completion."::: ## Remote Desktop with Biometrics -Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. +Microsoft Entra ID and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. To get started, sign into your device using Windows Hello for Business. Bring up **Remote Desktop Connection** (mstsc.exe), type the name of the computer you want to connect to, and select **Connect**. diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2021.md b/windows/whats-new/ltsc/whats-new-windows-10-2021.md index c07ad692ea..ab677b2b33 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2021.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2021.md @@ -8,7 +8,7 @@ author: mestew ms.localizationpriority: high ms.topic: conceptual ms.technology: itpro-fundamentals -ms.date: 04/05/2023 +ms.date: 12/18/2023 appliesto: - ✅ Windows 10 Enterprise LTSC 2021 --- @@ -18,8 +18,9 @@ appliesto: This article lists new and updated features and content that is of interest to IT Pros for Windows 10 Enterprise LTSC 2021, compared to Windows 10 Enterprise LTSC 2019 (LTSB). For a brief description of the LTSC servicing channel and associated support, see [Windows 10 Enterprise LTSC](overview.md). > [!NOTE] -> Features in Windows 10 Enterprise LTSC 2021 are equivalent to Windows 10, version 21H2.
            -> The LTSC release is [intended for special use devices](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181). Support for LTSC by apps and tools that are designed for the General Availability Channel release of Windows 10 might be limited. +> Windows 10 Enterprise LTSC 2021 was first available on November 16, 2021. Features in Windows 10 Enterprise LTSC 2021 are equivalent to Windows 10, version 21H2. +> +> The LTSC release is [intended for special use devices](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181). Support for LTSC by apps and tools that are designed for the general availability channel release of Windows 10 might be limited. Windows 10 Enterprise LTSC 2021 builds on Windows 10 Enterprise LTSC 2019, adding premium features such as advanced protection against modern security threats and comprehensive device management, app management, and control capabilities. @@ -28,9 +29,9 @@ The Windows 10 Enterprise LTSC 2021 release includes the cumulative enhancements ## Lifecycle > [!IMPORTANT] -> Windows 10 Enterprise LTSC 2021 has a 5 year lifecycle ([IoT Enterprise LTSC](/windows/iot/iot-enterprise/whats-new/windows-iot-enterprise-ltsc) continues to have a [10 year lifecycle](/lifecycle/products/windows-10-iot-enterprise-ltsc-2021)). Thus, the LTSC 2021 release is not a direct replacement for LTSC 2019, which has a 10 year lifecycle. +> Windows 10 Enterprise LTSC 2021 has a 5 year lifecycle. ([IoT Enterprise LTSC](/windows/iot/iot-enterprise/whats-new/windows-iot-enterprise-ltsc) continues to have a [10 year lifecycle](/lifecycle/products/windows-10-iot-enterprise-ltsc-2021)). Thus, the LTSC 2021 release is not a direct replacement for LTSC 2019, which has a 10 year lifecycle. -For more information about the lifecycle for this release, see [The next Windows 10 Long Term Servicing Channel (LTSC) release](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-next-windows-10-long-term-servicing-channel-ltsc-release/ba-p/2147232). +For more information about the lifecycle for this release, see [The next Windows 10 long-term servicing channel (LTSC) release](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-next-windows-10-long-term-servicing-channel-ltsc-release/ba-p/2147232). ## Hardware security @@ -52,7 +53,7 @@ There are already devices in the market today that offer SMM Firmware Protection ### Encryption and data protection -BitLocker and Mobile Device Management (MDM) with Azure Active Directory work together to protect your devices from accidental password disclosure. Now, a new key-rolling feature securely rotates recovery passwords on MDM-managed devices. The feature is activated whenever Microsoft Intune/MDM tools or a recovery password is used to unlock a BitLocker protected drive. As a result, the recovery password will be better protected when users manually unlock a BitLocker drive. +BitLocker and Mobile Device Management (MDM) with Microsoft Entra ID work together to protect your devices from accidental password disclosure. Now, a new key-rolling feature securely rotates recovery passwords on MDM-managed devices. The feature is activated whenever Microsoft Intune/MDM tools or a recovery password is used to unlock a BitLocker protected drive. As a result, the recovery password will be better protected when users manually unlock a BitLocker drive. ### Network security @@ -97,11 +98,12 @@ Windows Defender Firewall also now supports [Windows Subsystem for Linux (WSL)]( ### App isolation -[Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849): Isolated desktop environment where you can run untrusted software without the fear of lasting impact to your device. +[Windows Sandbox](/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview): Isolated desktop environment where you can run untrusted software without the fear of lasting impact to your device. #### Microsoft Defender Application Guard -[Microsoft Defender Application Guard](/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) enhancements include: +[Microsoft Defender Application Guard](/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) enhancements include: + - Standalone users can install and configure their Windows Defender Application Guard settings without needing to change registry key settings. Enterprise users can check their settings to see what their administrators have configured for their machines to better understand the behavior. - Application Guard is now an extension in Google Chrome and Mozilla Firefox. Many users are in a hybrid browser environment, and would like to extend Application Guard's browser isolation technology beyond Microsoft Edge. In the latest release, users can install the Application Guard extension in their Chrome or Firefox browsers. This extension will redirect untrusted navigation to the Application Guard Edge browser. There's also a companion app to enable this feature in the Microsoft Store. Users can quickly launch Application Guard from their desktop using this app. This feature is also available in Windows 10, version 1803 or later with the latest updates. @@ -119,10 +121,6 @@ Application Guard performance is improved with optimized document opening times: - A memory issue is fixed that could cause an Application Guard container to use almost 1 GB of working set memory when the container is idle. - The performance of Robocopy is improved when copying files over 400 MB in size. -[Edge support for Microsoft Defender Application Guard](/deployedge/microsoft-edge-security-windows-defender-application-guard) has been available for Chromium-based Edge since early 2020. - -**Application Guard now supports Office**: With [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/install-app-guard), you can launch untrusted Office documents (from outside the Enterprise) in an isolated container to prevent potentially malicious content from compromising your device. - ### Application Control [Application Control for Windows](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control): In Windows 10, version 1903, Windows Defender Application Control (WDAC) added many new features that light up key scenarios and provide feature parity with AppLocker. @@ -140,12 +138,12 @@ Windows Hello enhancements include: - Windows Hello is now supported as Fast Identity Online 2 (FIDO2) authenticator across all major browsers including Chrome and Firefox. - You can now enable passwordless sign-in for Microsoft accounts on your Windows 10 device by going to **Settings > Accounts > Sign-in options**, and selecting **On** under **Make your device passwordless**. Enabling passwordless sign-in will switch all Microsoft accounts on your Windows 10 device to modern authentication with Windows Hello Face, Fingerprint, or PIN. - Windows Hello PIN sign-in support is [added to Safe mode](/windows-insider/archive/new-in-20H1#windows-hello-pin-in-safe-mode-build-18995). -- Windows Hello for Business now has Hybrid Azure Active Directory support and phone number sign-in (Microsoft account). FIDO2 security key support is expanded to Azure Active Directory hybrid environments, enabling enterprises with hybrid environments to take advantage of [passwordless authentication](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). For more information, see [Expanding Azure Active Directory support for FIDO2 preview to hybrid environments](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/expanding-azure-active-directory-support-for-fido2-preview-to/ba-p/981894). +- Windows Hello for Business now has Microsoft Entra hybrid support and phone number sign-in (Microsoft account). FIDO2 security key support is expanded to Microsoft Entra hybrid environments, enabling enterprises with hybrid environments to take advantage of [passwordless authentication](/entra/identity/authentication/howto-authentication-passwordless-security-key-on-premises). For more information, see [Expanding Azure Active Directory support for FIDO2 preview to hybrid environments](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/expanding-azure-active-directory-support-for-fido2-preview-to/ba-p/981894). - With specialized hardware and software components available on devices shipping with Windows 10, version 20H2 configured out of factory, Windows Hello now offers added support for virtualization-based security with supporting fingerprint and face sensors. This feature isolates and secures a user's biometric authentication data. - Windows Hello multi-camera support is added, allowing users to choose an external camera priority when both external and internal Windows Hello-capable cameras are present. -- [Windows Hello FIDO2 certification](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/): Windows Hello is now a FIDO2 Certified authenticator and enables password-less sign-in for websites supporting FIDO2 authentication, such as Microsoft account and Azure AD. +- [Windows Hello FIDO2 certification](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/): Windows Hello is now a FIDO2 Certified authenticator and enables password-less sign-in for websites supporting FIDO2 authentication, such as Microsoft account and Entra ID. - [Streamlined Windows Hello PIN reset experience](/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience): Microsoft account users have a revamped Windows Hello PIN reset experience with the same look and feel as signing in on the web. -- [Remote Desktop with Biometrics](/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop#remote-desktop-with-biometrics): Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. +- [Remote Desktop with Biometrics](/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop#remote-desktop-with-biometrics): Microsoft Entra ID and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. ### Credential protection @@ -155,26 +153,19 @@ Windows Hello enhancements include: ### Privacy controls -[Microphone privacy settings](https://support.microsoft.com/en-us/help/4468232/windows-10-camera-microphone-and-privacy-microsoft-privacy): A microphone icon appears in the notification area letting you see which apps are using your microphone. +[Microphone privacy settings](https://support.microsoft.com/windows/windows-camera-microphone-and-privacy-a83257bc-e990-d54a-d212-b5e41beba857): A microphone icon appears in the notification area letting you see which apps are using your microphone. ## Cloud Services -### Microsoft Intune family of products - -Configuration Manager, Intune, Desktop Analytics, Co-Management, and the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) are now part of the [Microsoft endpoint management services](/mem/endpoint-manager-overview). See the Nov. 4 2019 [announcement](https://www.microsoft.com/microsoft-365/blog/2019/11/04/use-the-power-of-cloud-intelligence-to-simplify-and-accelerate-it-and-the-move-to-a-modern-workplace/). - -### Configuration Manager - -An in-place upgrade wizard is available in Configuration Manager. For more information, see [Simplifying Windows 10 deployment with Configuration Manager](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-windows-10-deployment-with-configuration-manager/ba-p/1214364). - -#### Microsoft Intune +### Microsoft Intune Microsoft Intune supports Windows 10 Enterprise LTSC 2021 with the following exception: + - [Update rings](/mem/intune/protect/windows-10-update-rings) can't be used for feature updates since Windows 10 LTSC versions don't receive feature updates. Update rings can be used for quality updates for Windows 10 Enterprise LTSC 2021 clients. -A new Intune remote action: **Collect diagnostics**, lets you collect the logs from corporate devices without interrupting or waiting for the end user. For more information, see [Collect diagnostics remote action](/mem/intune/fundamentals/whats-new#collect-diagnostics-remote-action). +A new Intune remote action: **Collect diagnostics**, lets you collect the logs from corporate devices without interrupting or waiting for the end user. For more information, see [Collect diagnostics remote action](/mem/intune/remote-actions/collect-diagnostics). -Intune has also added capabilities to [Role-based access control](/mem/intune/fundamentals/whats-new#role-based-access-control) (RBAC) that can be used to further define profile settings for the Enrollment Status Page (ESP). For more information, see [Create Enrollment Status Page profile and assign to a group](/mem/intune/enrollment/windows-enrollment-status#create-enrollment-status-page-profile-and-assign-to-a-group). +Intune has also added capabilities to [Role-based access control](/mem/intune/fundamentals/role-based-access-control) (RBAC) that can be used to further define profile settings for the Enrollment Status Page (ESP). For more information, see [Create Enrollment Status Page profile and assign to a group](/mem/intune/enrollment/windows-enrollment-status). For a full list of what's new in Microsoft Intune, see [What's new in Microsoft Intune](/mem/intune/fundamentals/whats-new). @@ -189,7 +180,8 @@ Windows Management Instrumentation (WMI) Group Policy Service (GPSVC) has a perf #### Key-rolling and Key-rotation -This release also includes two new features called Key-rolling and Key-rotation enables secure rolling of Recovery passwords on MDM-managed Azure Active Directory devices on demand from Microsoft Intune/MDM tools or when a recovery password is used to unlock the BitLocker protected drive. This feature will help prevent accidental recovery password disclosure as part of manual BitLocker drive unlock by users. +This release also includes two new features called key-rolling and key-rotation enables secure rolling of recovery passwords on MDM-managed Microsoft Entra ID devices on demand from Microsoft Intune/MDM tools or when a recovery password is used to unlock the BitLocker protected drive. This feature will help prevent accidental recovery password disclosure as part of manual BitLocker drive unlock by users. + ## Deployment ### SetupDiag diff --git a/windows/whats-new/windows-licensing.md b/windows/whats-new/windows-licensing.md index d6f384c4f5..d4ac767421 100644 --- a/windows/whats-new/windows-licensing.md +++ b/windows/whats-new/windows-licensing.md @@ -1,7 +1,7 @@ --- title: Windows commercial licensing overview description: Learn about products and use rights available through Windows commercial licensing. -ms.prod: windows-client +ms.subservice: itpro-security author: paolomatarazzo ms.author: paoloma manager: aaroncz @@ -11,7 +11,7 @@ ms.topic: overview ms.date: 05/04/2023 appliesto: - ✅ Windows 11 -ms.technology: itpro-security +ms.service: windows-client --- # Windows Commercial Licensing overview