Merge remote-tracking branch 'refs/remotes/origin/master' into dh-expressupdate-10896053

1.ps1

@@ -0,0 +1,3 @@
+git add .
+git commit -m "changes"
+git push -u origin vso-10788146

windows/deploy/change-history-for-deploy-windows-10.md

@@ -11,9 +11,10 @@ author: greg-lindsay
 # Change history for Deploy Windows 10
 This topic lists new and updated topics in the [Deploy Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md).
 
-## January 2017
+## February 2017
 | New or changed topic | Description |
 |----------------------|-------------|
+| [USMT Requirements](usmt-requirements.md) | Updated: Vista support removed and other minor changes | 
 | [Get started with Upgrade Analytics](upgrade-analytics-get-started.md) | Updated structure and content | 
 | [Upgrade Analytics deployment script](upgrade-analytics-deployment-script.md) | Added as a separate page from get started | 
 | [Use Upgrade Analytics to manage Windows upgrades](use-upgrade-analytics-to-manage-windows-upgrades.md) | Updated with links to new content and information about the target OS setting |
@@ -22,6 +23,10 @@ This topic lists new and updated topics in the [Deploy Windows 10](index.md) doc
 | [Upgrade Analytics - Step 2: Resolve app and driver issues](upgrade-analytics-resolve-issues.md) | New | 
 | [Upgrade Analytics - Step 3: Deploy Windows](upgrade-analytics-deploy-windows.md) | New | 
 | [Upgrade Analytics - Additional insights](upgrade-analytics-additional-insights.md) | New | 
+
+## January 2017
+| New or changed topic | Description |
+|----------------------|-------------|
 | [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) | New | 
 | [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) | New | 
 | [Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md) | New | 

windows/deploy/provisioning-packages.md

@@ -25,13 +25,13 @@ Provisioning packages are simple enough that with a short set of written instruc
 
 The [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) includes the Imaging and Configuration Designer (ICD), a tool for configuring provisioning packages. 
 
-## New in Windows 10, Version 1607
+## New in Windows 10, version 1607
 
-Windows ICD for Windows 10, Version 1607, simplifies common provisioning scenarios. 
+Windows ICD for Windows 10, version 1607, simplifies common provisioning scenarios. 
 
 ![Configuration Designer options](images/icd.png)
 
-Windows ICD in Windows 10, Version 1607, supports the following scenarios for IT administrators:
+Windows ICD in Windows 10, version 1607, supports the following scenarios for IT administrators:
 
 * **Simple provisioning** – Enables IT administrators to define a desired configuration in Windows ICD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner. 
 
@@ -49,7 +49,7 @@ Windows ICD in Windows 10, Version 1607, supports the following scenarios for IT
     * Other MDMs (cert-based enrollment) 
 
 > [!NOTE]
-> Windows ICD in Windows 10, Version 1607, also provides a wizard to create provisioning packages for school PCs. To learn more, see [Set up students' PCs to join domain](https://technet.microsoft.com/edu/windows/index).
+> Windows ICD in Windows 10, version 1607, also provides a wizard to create provisioning packages for school PCs. To learn more, see [Set up students' PCs to join domain](https://technet.microsoft.com/edu/windows/index).
 
 ## Benefits of provisioning packages
 

windows/deploy/update-windows-10-images-with-provisioning-packages.md

@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: mobile
 author: jdeckerMS
+redirect_url: https://technet.microsoft.com/itpro/windows/deploy/provisioning-packages
 ---
 
 # Update Windows 10 images with provisioning packages

windows/deploy/upgrade-analytics-upgrade-overview.md

@@ -19,6 +19,10 @@ The upgrade overivew blade displays data refresh status, including the date and
 - Pending user changes = User changes count displays "Data refresh pending" in amber.
 - No pending user changes = User changes count displays "Up to date" in green.
 
+In the following example, less than 4% of (3k\355k) computers have incomplete data, and there are no pending user changes:
+
+![Upgrade overview](images/ua-cg-17.png)
+
 <!-- PRESERVING ORIGINAL IMAGE CODING JUST IN CASE
 <img src="media/image3.png" width="214" height="345" />
 -->

windows/deploy/usmt-requirements.md

@@ -15,11 +15,11 @@ author: greg-lindsay
 
 
 -   [Supported Operating Systems](#bkmk-1)
-
+-   [Windows PE](#windows-pe)
--   [Software Requirements](#bkmk-2)
+-   [Credentials](#credentials)
-
+-   [Config.xml](#config-xml)
+-   [LoadState](#loadstate)
 -   [Hard Disk Requirements](#bkmk-3)
-
 -   [User Prerequisites](#bkmk-userprereqs)
 
 ## <a href="" id="bkmk-1"></a>Supported Operating Systems
@@ -44,16 +44,6 @@ The following table lists the operating systems supported in USMT.
 </thead>
 <tbody>
 <tr class="odd">
-<td align="left"><p>32-bit versions of Windows Vista</p></td>
-<td align="left"><p>X</p></td>
-<td align="left"><p></p></td>
-</tr>
-<tr class="even">
-<td align="left"><p>64-bit versions of Windows Vista</p></td>
-<td align="left"><p>X</p></td>
-<td align="left"><p></p></td>
-</tr>
-<tr class="odd">
 <td align="left"><p>32-bit versions of Windows 7</p></td>
 <td align="left"><p>X</p></td>
 <td align="left"><p>X</p></td>
@@ -95,45 +85,42 @@ USMT does not support any of the Windows Server® operating systems, Windows 20
 
  
 
-## <a href="" id="bkmk-2"></a>Software Requirements
+## Windows PE
-
 
 -   **Must use latest version of Window PE.** For example, to migrate to Windows 10, you'll need Windows PE 5.1. For more info, see [What's New in Windows PE](http://msdn.microsoft.com/library/windows/hardware/dn938350.aspx).
 
--   **Must run in Administrator Mode** When manually running the **ScanState** and **LoadState** tools on Windows 7, Windows 8 or Windows 10 you must run them in Administrator mode from an account with administrative credentials to ensure that all specified users are migrated. This is because User Access Control (UAC) is enabled by default. If you do not run USMT in Administrator mode, only the user profile that is logged on will be included in the migration.
+## Credentials
 
-    To run in Administrator mode:
+-  **Run as administrator** 
+    When manually running the **ScanState** and **LoadState** tools on Windows 7, Windows 8 or Windows 10 you must run them from an elevated command prompt to ensure that all specified users are migrated. If you do not run USMT from an elevated prompt, only the user profile that is logged on will be included in the migration.
+
+To open an elevated command prompt:
 
 1. Click **Start**.
+2. Enter **cmd** in the search function.
+3. Depending on the OS you are using, **cmd** or **Command Prompt** is displayed.
+3. Right-click **cmd** or **Command Prompt**, and then click **Run as administrator**.
+4. If the current user is not already an administrator, you will be prompted to enter administrator credentials.
 
-    2.  Click **All Programs**.
+**Important**<BR>
-
+You must run USMT using an account with full administrative permissions, including the following privileges:
-    3.  Click **Accessories**.
-
-    4.  Right-click **Command Prompt**.
-
-    5.  Click **Run as administrator**.
-
-    6.  At the command prompt, type the `ScanState` or `LoadState` command.
-
-    **Important**  
-    You must run USMT in Administrator mode from an account with full administrative permissions, including the following privileges:
 
 - SeBackupPrivilege (Back up files and directories)
-
 - SeDebugPrivilege (Debug programs)
-
 - SeRestorePrivilege (Restore files and directories)
-
 - SeSecurityPrivilege (Manage auditing and security log)
-
 - SeTakeOwnership Privilege (Take ownership of files or other objects)
 
-     
 
--   **Specify the /c option and &lt;ErrorControl&gt; settings in the Config.xml file.** USMT will fail if it cannot migrate a file or setting, unless you specify the **/c** option. When you specify the **/c** option, USMT logs an error each time it encounters a file that is in use that did not migrate, but the migration will not be interrupted. In USMT, you can specify in the Config.xml file which types of errors should allow the migration to continue, and which should cause the migration to fail. For more information about error reporting, and the **&lt;ErrorControl&gt;** element, see [Config.xml File](usmt-configxml-file.md), [Log Files](usmt-log-files.md), and [XML Elements Library](usmt-xml-elements-library.md).
+## Config.xml
 
--   **Install applications before running the LoadState command.** Install all applications on the destination computer before restoring the user state. This ensures that migrated settings are preserved.
+-  **Specify the /c option and &lt;ErrorControl&gt; settings in the Config.xml file.**<BR>
+    USMT will fail if it cannot migrate a file or setting, unless you specify the **/c** option. When you specify the **/c** option, USMT logs an error each time it encounters a file that is in use that did not migrate, but the migration will not be interrupted. In USMT, you can specify in the Config.xml file which types of errors should allow the migration to continue, and which should cause the migration to fail. For more information about error reporting, and the **&lt;ErrorControl&gt;** element, see [Config.xml File](usmt-configxml-file.md), [Log Files](usmt-log-files.md), and [XML Elements Library](usmt-xml-elements-library.md).
+
+## LoadState
+
+-  **Install applications before running the LoadState command.**<BR>
+    Install all applications on the destination computer before restoring the user state. This ensures that migrated settings are preserved.
 
 ## <a href="" id="bkmk-3"></a>Hard-Disk Requirements
 
@@ -146,21 +133,16 @@ Ensure that there is enough available space in the migration-store location and
 This documentation assumes that IT professionals using USMT understand command-line tools. The documentation also assumes that IT professionals using USMT to author MigXML rules understand the following:
 
 -   The navigation and hierarchy of the Windows registry.
-
 -   The files and file types that applications use.
-
 -   The methods to extract application and setting information manually from applications created by internal software-development groups and non-Microsoft software vendors.
-
 -   XML-authoring basics.
 
 ## Related topics
 
 
-[Plan Your Migration](usmt-plan-your-migration.md)
+[Plan Your Migration](usmt-plan-your-migration.md)<BR>
-
+[Estimate Migration Store Size](usmt-estimate-migration-store-size.md)<BR>
-[Estimate Migration Store Size](usmt-estimate-migration-store-size.md)
+[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)<BR>
-
-[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)
 
  
 

windows/manage/TOC.md

@@ -20,6 +20,9 @@
 ### [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
 ### [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
 ### [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
+### [Monitor Windows Updates with Update Compliance](update-compliance-monitor.md)
+#### [Get started with Update Compliance](update-compliance-get-started.md)
+#### [Use Update Compliance](update-compliance-using.md)
 ### [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
 #### [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md)
 #### [Configure BranchCache for Windows 10 updates](waas-branchcache.md)

windows/manage/change-history-for-manage-and-update-windows-10.md

@@ -18,6 +18,9 @@ This topic lists new and updated topics in the [Manage and update Windows 10](in
 
 | New or changed topic | Description |
 | --- | --- |
+| [Monitor Windows Updates with Update Compliance](update-compliance-monitor.md) | New |
+| [Get started with Update Compliance](update-compliance-get-started.md) | New |
+| [Use Update Compliance to monitor Windows Updates](update-compliance-using.md) | New |
 | [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) | Added Group Policy setting that blocks user access to Windows Update. |
 | [Distribute offline apps](distribute-offline-apps.md) | General updates to topic. Added links to supporting content for System Center Configuration Manager and Microsoft Intune.  |
 

windows/manage/index.md

@@ -35,7 +35,7 @@ Learn about managing and updating Windows 10.
 <tr class="odd">
 <td align="left"><p>[Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md)</p></td>
 <td align="left"><p>The world’s first personal digital assistant helps users get things done, even at work. Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments.</p></td></tr>
-<tr><td>[Update Windows 10 in the enterprise](waas-update-windows-10.md) </td><td>Learn how to manage updates to Windows 10 in your organization, including Windows Update for Business. </td></tr>
+<tr><td>[Update Windows 10 in the enterprise](waas-update-windows-10.md) </td><td>Learn how to manage updates to Windows 10 in your organization, including Update Compliance, and Windows Update for Business. </td></tr>
 <tr><td align="left"><p>[Manage corporate devices](manage-corporate-devices.md)</p></td>
 <td align="left"><p>You can use the same management tools to manage all device types running Windows 10: desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, Orchestrator runbooks, System Center tools, and so on, will continue to work for Windows 10 on desktop editions.</p></td>
 </tr>

windows/manage/update-compliance-get-started.md

@@ -0,0 +1,117 @@
+---
+title: Get started with Update Compliance (Windows 10)
+description: Explains how to configure Update Compliance.
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: deploy
+author: greg-lindsay
+---
+
+# Get started with Update Compliance
+
+This topic explains the steps necessary to configure your environment for Windows Analytics: Update Compliance. 
+
+Steps are provided in sections that follow the recommended setup process:
+1.	Ensure that [prerequisites](#update-compliance-prerequisites) are met.
+2.	[Add Update Compliance](#add-update-compliance-to-microsoft-operatiions-management-suite) to Microsoft Operations Management Suite
+3.	[Deploy your Commercial ID](#deploy-your-commercial-id-to-your-windows-10-devices) to your organization’s devices
+
+## Update Compliance Prerequisites
+
+Update Compliance has the following requirements: 
+1. Update Compliance is currently only compatible with Windows 10 devices. The solution is intended to be used with desktop devices (Windows 10 workstations and laptops). 
+2. The solution requires that Windows 10 telemetry is enabled on all devices that are intended to be displayed in the solution. These devices must have at least the [basic level of telemetry](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization#basic-level) enabled. To learn more about Windows telemetry, see [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md). 
+3. The telemetry of your organization’s Windows devices must be successfully transmitted to Microsoft. Microsoft has specified [endpoints for different aspects of telemetry](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization#endpoints), which must be whitelisted by your organization so the data can be transmitted. The following table is taken from the article on telemetry endpoints and summarizes the use of each endpoint:
+
+    <TABLE BORDER=1>
+    <TR><TD BGCOLOR="#cceeff">Service<TD BGCOLOR="#cceeff">Endpoint
+    <TR><TD>Connected User Experience and Telemetry component<TD>v10.vortex-win.data.microsoft.com
+    <BR>settings-win.data.microsoft.com
+    <TR><TD>Windows Error Reporting	<TD>watson.telemetry.microsoft.com
+    <TR><TD>Online Crash Analysis	<TD>oca.telemetry.microsoft.com
+    </TABLE>
+
+## Add Update Compliance to Microsoft Operations Management Suite
+
+Update Compliance is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud-based servicing for monitoring and automating your on-premises and cloud environments. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/). 
+
+If you are already using OMS, you’ll find Update Compliance in the Solutions Gallery. Select the **Update Compliance** tile in the gallery and then click **Add** on the solution's details page. Update Compliance is now visible in your workspace.
+
+If you are not yet using OMS, use the following steps to subscribe to OMS Update Compliance:
+
+1.	Go to [Operations Management Suite’s page](https://www.microsoft.com/en-us/cloud-platform/operations-management-suite) on Microsoft.com and click **Sign in**.
+
+    <P><TABLE BORDER=1><TR><TD>
+    <A HREF="images/uc-02.png"><img src="images/uc-02a.png"></A>
+    <TABLE>
+
+2.	Sign in to Operations Management Suite (OMS). You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory (Azure AD), use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS.
+
+    <P><TABLE BORDER=1><TR><TD>
+    <A HREF="images/uc-03.png"><img src="images/uc-03a.png"></A>
+    <TABLE>
+
+3.	Create a new OMS workspace. 
+
+    <P><TABLE BORDER=1><TR><TD>
+    <A HREF="images/uc-04.png"><img src="images/uc-04a.png"></A>
+    <TABLE>
+
+4.	Enter a name for the workspace, select the workspace region, and provide the email address that you want associated with this workspace. Click **Create**.
+
+    <P><TABLE BORDER=1><TR><TD>
+    <A HREF="images/uc-05.png"><img src="images/uc-05a.png"></A>
+    <TABLE>
+
+5.	If your organization already has an Azure subscription, you can link it to your workspace. Note that you may need to request access from your organization’s Azure administrator. If your organization does not have an Azure subscription, create a new one or select the default OMS Azure subscription from the list. If you do not yet have an Azure subscription, follow [this guide](https://blogs.technet.microsoft.com/upgradeanalytics/2016/11/08/linking-operations-management-suite-workspaces-to-microsoft-azure/) to create and link an Azure subscription to an OMS workspace.
+
+    <P><TABLE BORDER=1><TR><TD>
+    <A HREF="images/uc-06.png"><img src="images/uc-06a.png"></A>
+    <TABLE>
+
+6.	To add the Update Compliance solution to your workspace, go to the Solutions Gallery.
+
+    <P><TABLE BORDER=1><TR><TD>
+    <A HREF="images/uc-07.png"><img src="images/uc-07a.png"></A>
+    <TABLE>
+
+7.	Select the **Update Compliance** tile in the gallery and then select **Add** on the solution’s details page. You might need to scroll to find **Update Compliance**. The solution is now visible on your workspace. 
+
+    <P><TABLE BORDER=1><TR><TD>
+    <A HREF="images/uc-08.png"><img src="images/uc-08a.png"></A>
+    <TABLE>
+
+8.	Click the **Update Compliance** tile to configure the solution. The **Settings Dashboard** opens.
+
+    <P><TABLE BORDER=1><TR><TD>
+    <A HREF="images/uc-09.png"><img src="images/uc-09a.png"></A>
+    <TABLE>
+
+9.	Click **Subscribe** to subscribe to OMS Update Compliance. You will then need to distribute your Commercial ID across all your organization’s devices. More information on the Commercial ID is provided below.
+
+    <P><TABLE BORDER=1><TR><TD>
+    <A HREF="images/uc-10.png"><img src="images/uc-10a.png"></A>
+    <TABLE>
+
+After you are subscribed to OMS Update Compliance and your devices have a Commercial ID, you will begin receiving data. It will typically take 24 hours for the first data to begin appearing. The following section explains how to deploy your Commercial ID to your Windows 10 devices.
+
+>You can unsubscribe from the Update Compliance solution if you no longer want to monitor your organization’s devices. User device data will continue to be shared with Microsoft while the opt-in keys are set on user devices and the proxy allows traffic.
+
+## Deploy your Commercial ID to your Windows 10 devices
+
+In order for your devices to show up in Windows Analytics: Update Compliance, they must be configured with your organization’s Commercial ID. This is so that Microsoft knows that a given device is a member of your organization and to feed that device’s data back to you. There are two primary methods for widespread deployment of your Commercial ID: Group Policy and Mobile Device Management (MDM). 
+
+- Using Group Policy<BR><BR>
+    Deploying your Commercial ID using Group Policy can be accomplished by configuring domain Group Policy Objects with the Group Policy Management Editor, or by configuring local Group Policy using the Local Group Policy Editor.
+    1. In the console tree, navigate to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**
+    2. Double-click **Configure the Commercial ID**
+    3. In the **Options** box, under **Commercial Id**, type the Commercial ID GUID, and then click **OK**.<P>
+
+- Using Microsoft Mobile Device Management (MDM)<BR><BR>
+    Microsoft’s Mobile Device Management can be used to deploy your Commercial ID to your organization’s devices. The Commercial ID is listed under **Provider/ProviderID/CommercialID**. More information on deployment using MDM can be found [here](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/dmclient-csp).  
+
+
+## Related topics
+
+[Use Update Compliance to monitor Windows Updates](update-compliance-using.md)

windows/manage/update-compliance-monitor.md

@@ -0,0 +1,59 @@
+---
+title: Monitor Windows Updates with Update Compliance (Windows 10)
+description: Introduction to Update Compliance.
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: deploy
+author: greg-lindsay
+---
+
+# Monitor Windows Updates with Update Compliance
+
+## Introduction
+
+With Windows 10, organizations need to change the way they approach monitoring and deploying updates. Update Compliance is a powerful set of tools that enable organizations to monitor and track all important aspects of Microsoft’s new servicing strategy: [Windows as a Service](waas-overview.md).
+
+Update Compliance is a solution built within Operations Management Suite (OMS), a cloud-based monitoring and automation service which has a flexible servicing subscription based off data usage/retention. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/).
+
+Update Compliance uses the Windows telemetry that is part of all Windows 10 devices. It collects system data including update installation progress, Windows Update for Business (WUfB) configuration data, and other update-specific information, and then sends this data privately to a secure cloud to be stored for analysis and usage within the solution. 
+
+Update Compliance provides the following:
+
+- An overview of your organization’s devices that just works.
+- Dedicated drill-downs for devices that might need attention.
+- An inventory of devices, including the version of Windows they are running and their update status.
+- An overview of WUfB deferral configurations (Windows 10 Anniversary Update [1607] and later).
+- Powerful built-in [log analytics](https://www.microsoft.com/en-us/cloud-platform/insight-and-analytics?WT.srch=1&WT.mc_id=AID529558_SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=log%20analytics&utm_campaign=Hybrid_Cloud_Management) to create useful custom queries.
+- Cloud-connected access utilizing Windows 10 telemetry means no need for new complex, customized infrastructure.
+
+See the following topics in this guide for detailed information about configuring and use the Update Compliance solution:
+
+- [Get started with Update Compliance](update-compliance-get-started.md): How to add Update Compliance to your environment.
+- [Using Update Compliance](update-compliance-using.md): How to begin using Update Compliance.
+
+An overview of the processes used by the Update Compliance solution is provided below.
+
+## Update Compliance architecture
+ 
+The Update Compliance architecture and data flow is summarized by the following five step process:
+
+**(1)** User computers send telemetry data to a secure Microsoft data center using the Microsoft Data Management Service.<BR>
+**(2)** Telemetry data is analyzed by the Update Compliance Data Service.<BR>
+**(3)** Telemetry data is pushed from the Update Compliance Data Service to your OMS workspace.<BR>
+**(4)** Telemetry data is available in the Update Compliance solution.<BR>
+**(5)** You are able to monitor and troubleshoot Windows updates on your network.<BR>
+
+These steps are illustrated in following diagram:
+
+![Update Compliance architecture](images/uc-01.png)
+
+>This process assumes that Windows telemetry is enabled and devices are assigned your Commercial ID.
+
+
+
+ 
+## Related topics
+
+[Get started with Update Compliance](update-compliance-get-started.md)<BR>
+[Use Update Compliance to monitor Windows Updates](update-compliance-using.md)

windows/manage/update-compliance-using.md

@@ -0,0 +1,354 @@
+---
+title: Using Update Compliance (Windows 10)
+description: Explains how to begin usihg Update Compliance.
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: deploy
+author: greg-lindsay
+---
+
+# Use Update Compliance to monitor Windows Updates
+
+This section describes how to use Update Compliance to monitor Windows Updates and troubleshoot update failures on your network.
+
+
+Update Compliance: 
+- Uses telemetry gathered from user devices to form an all-up view of Windows 10 devices in your organization. 
+- Enables you to maintain a high-level perspective on the progress and status of updates across all devices.
+- Provides a workflow that can be used to quickly identify which devices require attention. 
+- Enables you to track deployment compliance targets for updates.
+
+>Information is refreshed daily so that update progress can be monitored. Changes will be displayed about 24 hours after their occurrence, so you always have a recent snapshot of your devices.
+
+In OMS, the aspects of a solution's dashboard are usually divided into <I>blades</I>. Blades are a slice of information, typically with a summarization tile and an enumeration of the items that makes up that data. All data is presented through <I>queries</I>. <I>Perspectives</I> are also possible, wherein a given query has a unique view designed to display custom data. The terminology of blades, tiles, and perspectives will be used in the sections that follow. 
+
+Update Compliance has the following primary blades: 
+
+
+1. [OS Update Overview](#os-update-overview)
+2. [Overall Quality Update Status](#overall-quality-update-status)
+3. [Latest and Previous Security Update Status](#latest-and-previous-security-update-status)
+4. [Overall Feature Update Status](#overall-feature-update-status)
+5. [CB, CBB, LTSB Deployment Status](#cb-cbb-ltsb-deployment-status)
+6. [List of Queries](#list-of-queries)
+
+
+## OS Update Overview
+
+The first blade of OMS Update Compliance is the General **OS Update Overview** blade: 
+
+![OS Update Overview](images/uc-11.png)
+
+
+This blade is divided into three sections: 
+- Device Summary: 
+- Needs Attention Summary
+- Update Status Summary
+
+The **Device Summary** displays the total number of devices in your organization. These devices have the commercial ID configured, telemetry enabled, and have sent telemetry to Microsoft within the last 28 days. The tile also shows the devices that Need Attention. 
+
+
+The **Needs Attention Summary** summarizes devices that require action on your part. There are multiple reasons why a device might need attention, and these reasons are categorized and summarized in the tile. You can view details about devices that are categorized as Needs Attention using a table view. The following **Needs Attention** states are defined:
+
+
+<TABLE>
+<TR><TD BGCOLOR="#cceeff">Needs Attention<TD BGCOLOR="#cceeff" ALIGN=left>Definition
+<TR><TD>Out of Support<TD>Total number of devices that are no longer receiving servicing updates
+<TR><TD>Update failed<TD>When a device has reported a failure at some stage in its update deployment process, it will report that the Update Failed. You can click on this to see the full set of devices with more details about the stage at which a failure was reported, when the device reported a failure, and other data.
+<TR><TD>Missing 2+ Security Updates<TD>Total number of devices that are missing two or more security updates
+<TR><TD>Update Progress Stalled<TD>Total number of devices where an update installation has been “in progress” for more than 7 days
+</TABLE>
+
+
+The **Update Status Summary** summarizes your organization's devices per the Windows 10 "Windows as a Service" (WaaS) model. For more information about WaaS, see [Overview of Windows as a service](waas-overview.md). Devices are categorized as: **Current**, **Up-to-date**, and **Not up-to-date**. See the following graphical representation of this model:<BR>
+
+
+![Device states](images/uc-12.png)
+
+
+Update Status Summary definitions:
+
+
+<TABLE>
+<TR><TD BGCOLOR="#cceeff">Update Status<TD BGCOLOR="#cceeff" ALIGN=left>Definition
+<TR><TD>Current and Up-to-date<TD>A device that is current is on the latest and greatest Microsoft offers. It is on the very newest feature update (ex. The Windows Anniversary Update, RS1), on the very latest quality update for its servicing branch.
+<TR><TD>Up-to-date<TD>A device that is up-to-date is on the latest quality update for its servicing option (CB, CBB, LTSB), and the device is running an OS that is supported by Microsoft.
+<TR><TD>Not up-to-date<TD>A device does not have the latest quality update for its servicing option.  
+</TABLE>
+
+
+## Overall Quality Update Status
+
+**Overall Quality Update Status** is the second blade in Update Compliance. It has a donut data tile and lists the breakdown of the Up-to-date status of devices pivoted on OS version. See the following example: 
+
+
+![OS Quality Update Status](images/uc-13.png)
+
+
+The donut tile offers a summary of all devices in your organization, divided into **Up-to-date** and **Not up-to-date**. Recall that devices that are current are also up-to-date.
+
+
+The list view contains the breakdown of Up-to-date, Not up-to-date, and Update failed, all pivoted on OS version (e.g., 1507, 1511, 1607). Clicking on any of the rows of this list view will display the **OS Quality Update Summary Perspective** for that OS version. 
+ 
+ 
+## Latest and Previous Security Update Status
+
+Security updates are extremely important to your organization, so in addition to an overall view of Quality Updates, the deployment status for the latest two security updates are displayed for each supported OS build offered by Microsoft. 
+
+
+![Latest security update status](images/uc-14.png)
+
+
+For the latest security update, a doughnut chart is displayed across all OS builds with a count of installed, in progress/deferred, update failed, and unknown status relative to that update. Two table views are provided below the doughnut displaying the same breakdown for each OS build supported by Microsoft. 
+
+See the following definitions:
+
+
+<TABLE>
+<TR><TD BGCOLOR="#cceeff">Term<TD BGCOLOR="#cceeff" ALIGN=left>Definition
+<TR><TD>OS Build<TD>The OS build + Revision for the OS Version. The build + revision is a one-to-one mapping of the given security update in this context.
+<TR><TD>Version<TD>The OS Version corresponding to the OS build.
+<TR><TD>Installed<TD>The count of devices that have the given security update installed. In the case that the latest security update is not latest quality update (that is, an update has since been released but it did not contain any security fixes), then devices that are on a newer update will also be counted.
+<BR><BR>For the previous security update, a device will display as **Installed** until it has at least installed the latest security update.
+<TR><TD>In Progress or Deferred<TD>The count of devices that are either currently in the process of installing the given security update, or are deferring the install as per their WUFB policy.
+<BR><BR> All devices in this category for Previous Security Update Status are missing 2 or more security updates, and therefore qualify as needing attention.
+<TR><TD>Update Failed<TD>The count of devices that were **In Progress** for the given security update, but failed at some point in the process. They will no longer be shown as **In Progress or deferred** in this case, and only be counted as **Update failed**.
+<TR><TD>Status Unknown<TD>If a device should be, in some way, progressing toward this security update, but it’s status cannot be inferred, it will count as **Status Unknown**. Devices that are not using Windows Update are the most likely devices to fall into this category.
+</TABLE>
+
+
+## Overall Feature Update Status
+
+Windows 10 has two main update types: Quality and Feature updates. The third blade in Update Compliance provides the most essential data about your organization’s devices for feature updates. 
+
+Microsoft has developed terms to help specify the state of a given device for how it fits into the Windows as a Service (WaaS) model. There are three update states for a device: 
+- Current 
+- Up-to-date
+- Not up-to-date
+
+
+See the **Update Status Summary** description under [OS Update Overview](#os-update-overview) in this guide for definitions of these terms. 
+
+
+The Overall Feature Update Status blade focuses around whether or not your devices are considered Current. See the following example:
+
+
+![Overall feature update status](images/uc-15.png)
+
+
+Devices are evaluated by OS Version (e.g., 1607) and the count of how many are Current, Not Current, and have Update Failures is displayed. Clicking on any of these counts will allow you to view all those devices, as well as select the **Update Deployment Status** perspective, described below. 
+
+
+## CB, CBB, LTSB Deployment Status
+
+Following the overview with respect to how current your organization’s devices are, there are three tables that show feature update deployment for all devices. The devices are split up by which branch they are on, as this directly impacts whether they are supported (for example, 1607 may be supported under CBB, but not under CB). This allows you a quick glance at how deployment is progressing across your organization with respect to feature updates. 
+
+See the following example:
+
+
+![CB deployment status](images/uc-16.png)
+
+
+The three tables break down devices by feature update. For each OS version, the following columns provide counts of the possible device states:
+
+
+<TABLE>
+<TR><TD BGCOLOR="#cceeff">Deployment Status<TD BGCOLOR="#cceeff" ALIGN=left>Description
+<TR><TD>Feature Update<TD>A concatenation of servicing branch (CB, CBB, LTSB) and OS Version (e.g., 1607)
+<TR><TD>Installed<TD>The number of devices that have reported to be on the given servicing train and feature update.
+<TR><TD>In progress<TD>The number of devices that have reported to be at some stage in the installation process for the given feature update.
+<BR><BR>Example: Device X running CB 1507 could be installing CB 1607. In this example, X would count as both **Installed** for **CB 1507** and **In Progress** for **CB 1607**. 
+<TR><TD>Scheduled next 7 days<TD>The total number of devices that are set to have a deferral period expire within 7 days, and after that deferral period expires are targeted to install the given update.
+<BR><BR>Example: Device Y running CB 1507 could be scheduled to install CB 1607 in 5 days. In this example, X would count as both **Installed** for **CB 1507** and **Scheduled next 7 days** for **CB 1607**
+<TR><TD>Update Failed<TD>The total number of devices that were **In progress** with the installation for the given feature update, but encountered a failure.
+<BR><BR>Example: Device X running CB 1507 could be installing CB 1607. X then encounters an error during installation. In this example, X would count as both **Installed** for **CB 1507** and **Update failed** for **CB 1607**, but not as **In progress** for **CB 1607**.
+<TR><TD>Status Unknown<TD>For devices not using Windows Update to get updates, some information on deployment progress cannot be known. It is possible to know the current installed Feature Update for a device, but not which devices are **In Progress**, **Scheduled next 7 days**, or devices with **Update Failed**.
+<BR><BR>Devices that Update Compliance knows belongs to your organization, but it does not know update failures or installation progress, will be counted here. 
+</TABLE>
+
+
+## Quality Update Perspective
+
+The Quality Update Deployment Status perspective is a breakdown of the most essential data the user should know about the status of their devices with respect to being Up-to-date. The perspective shows a summary of the organization’s devices for one specific OS version, or build. 
+ 
+### Quality Update Build Summary
+
+The build summary blade attempts to summarize the most important data points to the user for the given build. It is divided into two sections. The first section is a summary of devices for that build – the total number of devices, and the amount that need attention. Each row within the table below is a breakdown of why each device requires attention. The rows can be interacted with to be taken to a larger table view that shows detailed information about all the devices that meet the given criteria. See the following example:
+
+
+![Quality update build summary](images/uc-17.png)
+
+ 
+### Quality Update Deferral Configurations
+
+The next blade is the Deferral configuration blade, which shows the WUFB Deferral configurations for all devices that are using WUFB and are reporting to Update Compliance. If no information can be gathered from a device or it is not configured to use WUFB, it will show up as **Not configured (-1)**. See the following example:
+
+
+![Quality Update Deferral Configurations](images/uc-18.png)
+
+ 
+### Quality Update Deployment Status
+
+Under the three top-level blades is the deployment status for the newest quality update for the given build. It provides information on the revision number as well as how many days it has been since that revision has been released. See the following example:
+
+
+![Quality Update Deployment Status](images/uc-19.png)
+
+
+See the following table for a description of last reported states for devices deploying that quality update. 
+
+
+<TABLE>
+<TR><TD BGCOLOR="#cceeff">Deployment State<TD BGCOLOR="#cceeff" ALIGN=left>Description
+<TR><TD>Update Completed<TD>When a device has finished the update process and is on the given update, it will display here as **Update completed**.
+<TR><TD>In Progress<TD>Devices that are “in progress” installing an update will fall within this category. This category is detailed in the following blade: **Detailed Deployment Status**.
+<TR><TD>Deferred<TD>If a device’s WUfB deferral policy dictates that it is not set to receive this update, the device will show as Update deferred.
+<TR><TD>Cancelled<TD>A device will report that the update has been cancelled if the user, at some point, cancelled the update on the device.
+<TR><TD>Blocked<TD>Devices that are blocked are prevented from proceeding further with the given update. This could be because another update is paused, or some other task on the device must be performed before the update process can proceed.
+</TABLE>
+
+<P>
+
+
+### Quality Update Detailed Deployment Status
+
+This blade provides more detail on the deployment process for the update in the Deployment Status blade. This blade is more of a deployment funnel for devices, enabling you to see at a more granular level how devices are progressing along in their deployment. See the following example:
+
+
+![Quality Update Detailed Deployment Status](images/uc-20.png)
+
+
+>Devices that are not managed using Windows Update (Windows Update for Business or otherwise) will not have detailed deployment information. 
+
+
+The following table provides a list of the detailed deployment states a device can report:
+
+
+<TABLE>
+<TR><TD BGCOLOR="#cceeff">Detailed Deployment State<TD BGCOLOR="#cceeff" ALIGN=left>Description
+<TR><TD>Update deferred<TD>The WUfB policy of the device dictates the update is deferred. 
+<TR><TD>Pre-Download Tasks Passed<TD>The device has finished all tasks necessary prior to downloading the update. 
+<TR><TD>Download Started<TD>The update has begun downloading on the device. 
+<TR><TD>Download Succeeded<TD>The device has successfully downloaded the update. 
+<TR><TD>Pre-Install Tasks Passed<TD>The device has downloaded the update successfully, and successfully passed all checks prior to beginning installation of the update. 
+<TR><TD>Install Started<TD>The device has begun installing the update. 
+<TR><TD>Reboot Required<TD>The device has finished installing the update, and a reboot is required before the update can be completed. 
+<TR><TD>Reboot Pending<TD>The device is pending a scheduled reboot before the update can be completed. 
+<TR><TD>Reboot Initiated<TD>The device has reported to have initiated the reboot process for completing the update. 
+<TR><TD>Update completed<TD>The device has completed installing, rebooting, and applying the update. 
+</TABLE>
+
+
+## Feature Update Perspective
+
+
+Like Quality Updates, the Feature Update Deployment Status perspective is a breakdown of information most essential to an administrator. This information is viewed by clicking on a given build on the Feature Update Status blade and then navigating to the **Update Deployment Status** pane as displayed previously. In Update Compliance, a perspective is assigned to a query; the query used to generate the perspective can be altered to show other information, if desired.
+
+Every piece of data shown in this view can be clicked; when clicked, it will alter the query to focus only on the data you need. If the perspective is not meaningful after the query is altered, you can use the other data views like the List and Table.
+
+>After clicking on an OS version from the Feature Update Status blade, the query must fully load the results before you can select the Update Deployment Status perspective.
+
+### Feature Update Build Summary
+
+
+The Build Summary blade provides a summary for all devices on the given build. It gives a count of all devices, as well as a count of all devices that need attention. Below the counts, you can see why the devices need attention, with a count of devices that fall into each category. See the following example:
+
+![Feature Update Build Summary](images/uc-21.png)
+
+### Feature Update Deferral Configuration
+
+
+This blade shows all deferral configurations for the devices on the given build. See the following example:
+
+
+![Feature Update Deferral Configuration](images/uc-22.png)
+
+
+Deferral configurations are WUfB-specific, and are shown as days. Some useful information regarding how deferral configurations are shown:
+- The devices are grouped based off what their deferral policy is set at. For feature updates, this can be up to 120 days. 
+- A deferral of zero days means the device has WUfB configured, but is set to not defer the update. These devices will be under “0” for the Update Deferred field.
+- Devices that are not configured to use WUfB deferral policies have a “-1” for their deferral days. In this table, the devices will show up as “Not Configured (-1)”.  
+
+### Feature Update Deployment Status
+
+As stated earlier in this section, the Feature Updates blade focuses on how Current your devices are. A device is only Current when it is on the latest feature update and quality update Microsoft offers. Thus, the Deployment Status blade displays the deployment status for devices regarding their deployment to the latest feature update. See the following example:
+
+
+![Feature Update Deployment Status](images/uc-23.png)
+
+
+This blade breaks down the main states a device can be in through the deployment of a feature update. The possible states are as follows:
+
+
+<TABLE>
+<TR><TD BGCOLOR="#cceeff">Deployment State<TD BGCOLOR="#cceeff" ALIGN=left>Description
+<TR><TD>Update completed<TD>When a device has completely finished the update process and is on the given update, it will show up here as **Update completed**. 
+<TR><TD>Inprogress<TD>Devices “in progress” of installing the given update will fall within this category. This category is iterated on with further granularity in the proceeding blade, “Detailed Deployment Status”. 
+<TR><TD>Update deferred<TD>If a device’s WUfB deferral policy dictates that it is not set to receive this update yet, the device will show as Update deferred.
+<TR><TD>Cancelled<TD>A device will report that the update has been cancelled if the user, at some point, cancelled the update on the device. 
+<TR><TD>Blocked<TD>Devices that are blocked are prevented from proceeding further with the given update. This could be because another update is paused, or some other task on the device must be performed before the update process can proceed. 
+</TABLE>
+
+<P>
+
+
+
+
+
+
+### Feature Update Detailed Deployment Status
+
+This blade provides more detail on the deployment process for the update in the Deployment Status blade. This blade is more of a deployment funnel for devices, enabling you to see at a more granular level how devices are progressing along in their deployment. See the following example:
+
+
+![Feature Update Detailed Deployment Status](images/uc-24.png)
+
+
+The following table displays all states a device can report:
+
+
+<TABLE>
+<TR><TD BGCOLOR="#cceeff">Detailed Deployment State<TD BGCOLOR="#cceeff" ALIGN=left>Description
+<TR><TD>Update deferred<TD>The WUfB policy of the device dictates the update is deferred.
+<TR><TD>Pre-Download Tasks Passed<TD>The device has finished all tasks necessary prior to downloading the update.
+<TR><TD>Download Started<TD>The update has begun downloading on the device.
+<TR><TD>Download Succeeded<TD>The device has successfully downloaded the update.
+<TR><TD>Pre-Install Tasks Passed<TD>The device has downloaded the update successfully, and successfully passed all checks prior to beginning installation of the update.
+<TR><TD>Install Started<TD>The device has begun installing the update.
+<TR><TD>Reboot Required<TD>The device has finished installing the update, and a reboot is required before the update can be completed.
+<TR><TD>Reboot Pending<TD>The device is pending a scheduled reboot before the update can be completed.
+<TR><TD>Reboot Initiated<TD>The device has reported to have initiated the reboot process for completing the update.
+<TR><TD>Update completed<TD>The device has completed installing, rebooting, and applying the update.
+</TABLE>
+
+
+
+## List of Queries
+
+Operations Management Suite leverages its powerful Log Analytics querying to perform all data calculations. For this blade, we provide examples of queries that show useful data to the user about their organization’s devices. See the following example:
+
+
+![List of Queries](images/uc-25.png)
+
+
+The following **Common queries** are available:
+
+
+<TABLE>
+<TR><TD BGCOLOR="#cceeff">Query Title<TD BGCOLOR="#cceeff" ALIGN=left>Description
+<TR><TD>OS Security Update Status<TD>This query provides an all-up view with respect to how many devices are on the latest security update for their OS version. The table will detail an aggregated count of the number of devices, out of the total (so count, or percent) are on the latest security update for their OS build. 
+<TR><TD>Update Deployment Failures<TD>This query provides a chart view, displaying an aggregation of all devices that have reported a deployment failure for either feature or quality updates. The aggregation of the data is on the given update for which a given device has reported a deployment failure. 
+<TR><TD>Devices pending reboot to complete update<TD>This query will provide a table showing all devices that are at the stage of "Reboot Pending" In the update deployment process.<BR><BR>This query will show devices which are in this state for both feature and quality updates; the data will be organized on precisely which update the given device(s) are pending a reboot to install.
+<TR><TD>Servicing Option Distribution for the devices<TD>This query provides a chart view that aggregates all devices seen by the solution on for each servicing option available for Windows 10 devices (CB, CBB, LTSB)
+OS Distribution for the devices	This query provides a chart view displaying the distribution of the different editions of Windows 10 that devices seen by the solution are running (e.g., Enterprise, Professional, Education, etc.) 
+<TR><TD>Deferral configurations for Feature Update<TD>This query provides a chart view which displays a breakdown of the different Feature Update deferral configurations through WUfB that the devices seen by the solution are using.<BR><BR>The configuration is in days. 0 days means the device has WUfB deferrals configured, but is not set to defer feature updates. -1 means the device has no feature update deferral policies configured. 
+<TR><TD>Pause configurations for Feature Update<TD>The WUfB policy 
+<TR><TD>Update deferred<TD>This query provides a chart view displaying the breakdown of devices that are either paused, or not paused for feature updates.<BR><BR>“Not configured” means the device is not paused. “Paused” means it is currently paused.
+<TR><TD>Deferral configurations for Quality Update<TD>This query provides a chart view which displays a breakdown of the different Quality Update deferral configurations through WUfB that the devices seen by the solution are using.<BR><BR>The configuration is in days. 0 days means the device has WUfB deferrals configured, but is not set to defer quality updates. -1 means the device has no quality update deferral policies configured.
+<TR><TD>Pause configurations for Quality Update<TD>This query provides to a chart view displaying the breakdown of devices that are either paused, or not paused for quality updates.<BR><BR>**Not configured** means the device is not paused. **Paused** means it is currently paused. 
+</TABLE>
+
+## Related topics
+
+[Get started with Update Compliance](update-compliance-get-started.md)

windows/manage/waas-update-windows-10.md

@@ -34,6 +34,7 @@ Windows as a service provides a new way to think about building, deploying, and
 | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | Explains the decisions you need to make in your servicing strategy.  |
 | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | Explains how to make use of servicing branches and update deferrals to manage Windows 10 updates.  |
 | [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) | Explains how to assign devices to Current Branch (CB) or Current Branch for Business (CBB) for feature and quality updates, and how to enroll devices in Windows Insider. |
+| [Monitor Windows Updates with Update Compliance](update-compliance-monitor.md) | Explains how to use Windows Analytics: Update Compliance to monitor and manage Windows Updates on devices in your organization.  |
 | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | Explains the benefits of using Delivery Optimization or BranchCache for update distribution.  |
 | [Manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) | Explains updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile. |
 | [Manage updates using Windows Update for Business](waas-manage-updates-wufb.md) | Explains how to use Windows Update for Business to manage when devices receive updates directly from Windows Update. Includes walkthroughs for configuring Windows Update for Business using Group Policy and Microsoft Intune.  |