Merged PR 5915: Merge master to rs4

devices/surface-hub/change-history-surface-hub.md

@@ -8,7 +8,7 @@ ms.sitesec: library
 ms.pagetype: surfacehub
 author: jdeckerms
 ms.author: jdecker
-ms.date: 01/17/2018
+ms.date: 02/16/2018
 ms.localizationpriority: medium
 ---
 
@@ -16,6 +16,12 @@ ms.localizationpriority: medium
 
 This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md).
 
+## February 2018
+
+New or changed topic | Description
+--- | ---
+[Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Updated instructions for custom settings using Microsoft Intune.
+
 ## January 2018
 
 New or changed topic | Description

devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md

@@ -9,7 +9,7 @@ ms.sitesec: library
 ms.pagetype: surfacehub, mobility
 author: jdeckerms
 ms.author: jdecker
-ms.date: 01/17/2018
+ms.date: 02/16/2018
 ms.localizationpriority: medium
 ---
 
@@ -212,38 +212,9 @@ The data type is also stated in the CSP documentation. The most common data type
 <span id="example-intune">
 ## Example: Manage Surface Hub settings with Microsoft Intune
 
-You can use Microsoft Intune to manage Surface Hub settings. 
+You can use Microsoft Intune to manage Surface Hub settings. For custom settings, follow the instructions in [How to configure custom device settings in Microsoft Intune](https://docs.microsoft.com/intune/custom-settings-configure). For **Platform**, select **Windows 10 and later**, and in **Profile type**, select **Device restrictions (Windows 10 Team)**.
 
-**To create a configuration policy from a template**
 
-You'll use the **Windows 10 Team general configuration policy** as the template.
-
-1. On the [Intune management portal](https://manage.microsoft.com), sign in with your Intune administrator account.
-2. On the left-hand navigation menu, click **Policy**.
-3. In the Overview page, click **Add Policy**.
-4. On **Select a template for the new policy**, expand **Windows**, select **General Configuration (Windows 10 Team and later)**, and then click **Create Policy**.
-
-    ![template for Windows 10 Team](images/intune-template.png)
-5. Configure your policy, then click **Save Policy**
-   
-    ![save policy](images/intune-save-policy.png)
-6. When prompted, click **Yes** to deploy your new policy to a user or device group. For more information, see [Use groups to manage users and devices in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/use-groups-to-manage-users-and-devices-with-microsoft-intune).
-
-**To create a custom configuration policy**
-
-You’ll need to create a custom policy using the **Custom Configuration (Windows 10 Desktop and Mobile and later)** template to manage settings that are not available in the **Windows 10 Team general configuration policy** template. 
-
-1. On the [Intune management portal](https://manage.microsoft.com), sign in with your Intune administrator account.
-2. On the left-hand navigation menu, click **Policy**.
-3. On the Overview page, click **Add Policy**.
-4. On **Select a template for the new policy**, expand **Windows**, select **Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**.
-5. Type a name and optional description for the policy.
-6. Under OMA-URI Settings, click **Add**.
-7. Complete the form to create a new setting, and then click **OK**.
-
-    ![example of OMA URI form](images/oma-uri.png)
-8. Repeat Steps 6 and 7 for each setting you want to configure with this policy.
-9. After you're done, click **Save Policy** and deploy it to a user or device group. 
 
 <span id="example-sccm">
 ## Example: Manage Surface Hub settings with System Center Configuration Manager

mdop/mbam-v25/TOC.md

@@ -55,6 +55,7 @@
 #### [How to Enable BitLocker by Using MBAM as Part of a Windows Deployment](how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md)
 #### [How to Deploy the MBAM Client by Using a Command Line](how-to-deploy-the-mbam-client-by-using-a-command-line.md)
 ### [MBAM 2.5 Deployment Checklist](mbam-25-deployment-checklist.md)
+### [Upgrading to MBAM 2.5 SP1 from MBAM 2.5](upgrading-to-mbam-25-sp1-from-mbam-25.md)
 ### [Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions](upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md)
 ### [Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md)
 ## [Operations for MBAM 2.5](operations-for-mbam-25.md)

mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md

@@ -0,0 +1,44 @@
+---
+title: Upgrading to MBAM 2.5 SP1 from MBAM 2.5
+description: Upgrading to MBAM 2.5 SP1 from MBAM 2.5
+author: kaushika
+ms.assetid: 
+ms.pagetype: mdop, security
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.prod: w10
+ms.date: 2/16/2018
+---
+
+# Upgrading to MBAM 2.5 SP1 from MBAM 2.5
+This topic describes the process for upgrading the Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 and the MBAM Client from 2.5 to MBAM 2.5 SP1.
+
+### Before you begin, download the September 2017 servicing release
+[Desktop Optimization Pack](https://www.microsoft.com/en-us/download/details.aspx?id=56126)
+
+#### Steps to upgrade the MBAM Database (SQL Server)
+1. Using the MBAM Configurator; remove the Reports roll from the SQL server, or wherever the SSRS database is housed (Could be on the same server or  different one, depending on your environment)
+Note: You will not see an option to remove the Databases; this is expected.  
+2. Install 2.5 SP1 (Located with MDOP - Microsoft Desktop Optimization Pack 2015 from the Volume Licensing Service Center site:  <https://www.microsoft.com/Licensing/servicecenter/default.aspx>
+3. Do not configure it at this time 
+4. Install the September Rollup: https://www.microsoft.com/en-us/download/details.aspx?id=56126
+5. Using the MBAM Configurator; re-add the Reports rollup
+6. This will configure the SSRS connection using the latest MBAM code from the rollup 
+7. Using the MBAM Configurator; re-add the SQL Database roll on the SQL Server.
+- At the end, you will be warned that the DBs already exist and  weren’t created, but this is  expected.
+- This process updates the existing databases to the current version  being installed                  
+
+#### Steps to upgrade the MBAM Server (Running MBAM and IIS)
+1. Using the MBAM Configurator; remove the Admin and Self Service Portals from  the IIS server
+2. Install MBAM 2.5 SP1
+3. Do not configure it at this time  
+4. Install the September 2017 Rollup on the IIS server(https://www.microsoft.com/en-us/download/details.aspx?id=56126)
+5. Using the MBAM Configurator; re-add the Admin and Self Service Portals to the IIS server 
+6. This will configure the sites using the latest MBAM code from the June  Rollup
+7. - Open an elevated command prompt, Type: **IISRESET** and Hit Enter.
+ 
+#### Steps to upgrade the MBAM Clients/Endpoints
+1. Uninstall the 2.5 Agent from client endpoints
+2. Install the 2.5 SP1 Agent on the client endpoints
+3. Push out the September Rollup Client update to clients running the 2.5 SP1 Agent 
+4. There is no need to uninstall existing client prior to installing the September Rollup.  

windows/security/threat-protection/TOC.md

@@ -187,9 +187,6 @@
 #### [Review events and errors on endpoints with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md)
 ### [Windows Defender Antivirus compatibility with Windows Defender ATP](windows-defender-atp\defender-compatibility-windows-defender-advanced-threat-protection.md)
 
-
-##	[Windows Defender Antivirus in Windows 10](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md)
-### [Windows Defender AV in the Windows Defender Security Center app](windows-defender-antivirus\windows-defender-security-center-antivirus.md)
 ##	[Windows Defender Antivirus in Windows 10](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md)
 ### [Windows Defender AV in the Windows Defender Security Center app](windows-defender-antivirus\windows-defender-security-center-antivirus.md)
 

windows/security/threat-protection/change-history-for-threat-protection.md

@@ -12,6 +12,12 @@ ms.date: 10/31/2017
 # Change history for threat protection
 This topic lists new and updated topics in the [Threat protection](index.md) documentation.
 
+## February 2018
+
+New or changed topic | Description
+---------------------|------------
+[Security Compliance Toolkit](security-compliance-toolkit-10.md) | Added Office 2016 Security Baseline.
+
 ## January 2018
 |New or changed topic |Description |
 |---------------------|------------|

windows/security/threat-protection/security-compliance-toolkit-10.md

@@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
 ms.localizationpriority: high
 ms.author: sagaudre
 author: brianlic-msft
-ms.date: 10/16/2017
+ms.date: 02/16/2018
 ---
 
 # Microsoft Security Compliance Toolkit 1.0
@@ -32,6 +32,9 @@ The Security Compliance Toolkit consists of:
     -   Windows Server 2016
     -   Windows Server 2012 R2
 
+-   Microsoft Office Security Baselines
+    -   Office 2016 
+
 -   Tools
     -   Policy Analyzer tool
     -   Local Group Policy Object (LGPO) tool

windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md

@@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: security
 author: tedhardyMSFT
-ms.date: 10/27/2017
+ms.date: 02/16/2018
 ---
 
 # Use Windows Event Forwarding to help with intrusion detection
@@ -636,9 +636,9 @@ Here are the minimum steps for WEF to operate:
     <!-- Detect User-Mode drivers loaded - for potential BadUSB detection. -->
     <Select Path="Microsoft-Windows-DriverFrameworks-UserMode/Operational">*[System[(EventID=2004)]]</Select>
   </Query>
-<Query Id="14" Path=" Windows PowerShell">
+<Query Id="14" Path="Windows PowerShell">
     <!-- Legacy PowerShell pipeline execution details (800) -->
-    <Select Path=" Windows PowerShell">*[System[(EventID=800)]]</Select>
+    <Select Path="Windows PowerShell">*[System[(EventID=800)]]</Select>
   </Query>
 </QueryList> 
 ```