From e46140191e58103fc3d197be58c487d26d15ed87 Mon Sep 17 00:00:00 2001 From: isaiahng Date: Wed, 12 Oct 2016 15:40:43 -0700 Subject: [PATCH 01/57] Added headers --- devices/surface-hub/device-reset-surface-hub.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/devices/surface-hub/device-reset-surface-hub.md b/devices/surface-hub/device-reset-surface-hub.md index 3f02701b0e..c3b6cb8508 100644 --- a/devices/surface-hub/device-reset-surface-hub.md +++ b/devices/surface-hub/device-reset-surface-hub.md @@ -30,7 +30,7 @@ Initiating a reset will return the device to the last cumulative Windows update, - Local admins on the device - Configurations from MDM or the Settings app -**To reset a Surface Hub** +## Reset a Surface Hub 1. On your Surface Hub, open **Settings**. ![Image showing Settings app for Surface Hub.](images/sh-settings.png) @@ -43,7 +43,12 @@ Initiating a reset will return the device to the last cumulative Windows update, ![Image showing Reset device option in Settings app for Surface Hub.](images/sh-settings-reset-device.png) -**To reset a Surface Hub from Windows Recovery Environment** +> [!IMPORTANT] +> Performing a device reset may take up to 2 hours. Do not interrupt the reset process. Interrupting the process will render the device inoperable, requiring warranty service to return to normal functionality. + +After the reset, Surface Hub restarts the [first run program](first-run-program-surface-hub.md) again. + +## Reset a Surface Hub from Windows Recovery Environment On rare occasions, a Surface Hub may encounter an error while cleaning up user and app data at the end of a session. When this happens, the device will automatically reboot and try again. But if this operation fails repeatedly, the device will be automatically locked to protect user data. To unlock it, you must reset the device from [Windows Recovery Environment](https://technet.microsoft.com/library/cc765966.aspx) (Windows RE). @@ -52,11 +57,6 @@ On rare occasions, a Surface Hub may encounter an error while cleaning up user a 3. Select **Reset**. 4. If prompted, enter your device's BitLocker key. -> [!IMPORTANT] -> Performing a device reset may take up to 2 hours. Do not interrupt the reset process. Interrupting the process will render the device inoperable, requiring warranty service to return to normal functionality. - -After the reset, Surface Hub restarts the [first run program](first-run-program-surface-hub.md) again. - ## Related topics [Manage Microsoft Surface Hub](manage-surface-hub.md) From c3af333c5ffa6f9c5f44b904543a714e74339054 Mon Sep 17 00:00:00 2001 From: isaiahng Date: Tue, 18 Oct 2016 16:11:23 -0700 Subject: [PATCH 02/57] Update device reset article from Microsoft/master --- .../surface-hub/device-reset-surface-hub.md | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/devices/surface-hub/device-reset-surface-hub.md b/devices/surface-hub/device-reset-surface-hub.md index c3b6cb8508..dc24991701 100644 --- a/devices/surface-hub/device-reset-surface-hub.md +++ b/devices/surface-hub/device-reset-surface-hub.md @@ -30,7 +30,15 @@ Initiating a reset will return the device to the last cumulative Windows update, - Local admins on the device - Configurations from MDM or the Settings app -## Reset a Surface Hub +> [!IMPORTANT] +> Performing a device reset may take up to 2 hours. Do not interrupt the reset process. Interrupting the process will render the device inoperable, requiring warranty service to return to normal functionality. + +After the reset, Surface Hub restarts the [first run program](first-run-program-surface-hub.md) again. + + +## Reset a Surface Hub from Settings + +**To reset a Surface Hub** 1. On your Surface Hub, open **Settings**. ![Image showing Settings app for Surface Hub.](images/sh-settings.png) @@ -43,20 +51,18 @@ Initiating a reset will return the device to the last cumulative Windows update, ![Image showing Reset device option in Settings app for Surface Hub.](images/sh-settings-reset-device.png) -> [!IMPORTANT] -> Performing a device reset may take up to 2 hours. Do not interrupt the reset process. Interrupting the process will render the device inoperable, requiring warranty service to return to normal functionality. - -After the reset, Surface Hub restarts the [first run program](first-run-program-surface-hub.md) again. - ## Reset a Surface Hub from Windows Recovery Environment On rare occasions, a Surface Hub may encounter an error while cleaning up user and app data at the end of a session. When this happens, the device will automatically reboot and try again. But if this operation fails repeatedly, the device will be automatically locked to protect user data. To unlock it, you must reset the device from [Windows Recovery Environment](https://technet.microsoft.com/library/cc765966.aspx) (Windows RE). +**To reset a Surface Hub from Windows Recovery Environment** + 1. From the welcome screen, toggle the Surface Hub's power switch 3 times. Wait a few seconds between each toggle. See the [Surface Hub Site Readiness Guide](https://www.microsoft.com/surface/support/surface-hub/surface-hub-site-readiness-guide) for help with locating the power switch. 2. The device should automatically boot into Windows RE. Select **Advanced Repair**. 3. Select **Reset**. 4. If prompted, enter your device's BitLocker key. + ## Related topics [Manage Microsoft Surface Hub](manage-surface-hub.md) From e9e375b068491cf3339d6b5464cec32fc6d00292 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 19 Oct 2016 10:36:20 -0700 Subject: [PATCH 03/57] adding Windows 10, version 1607 and Windows Server 2016 baselines --- .../keep-secure/change-history-for-keep-windows-10-secure.md | 1 + windows/keep-secure/windows-security-baselines.md | 3 +++ 2 files changed, 4 insertions(+) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index dada97fc72..93cfe58314 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -20,6 +20,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |Added content about using ActiveX controls.| |[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |New | |[VPN technical guide](vpn-guide.md) | Multiple new topics, replacing previous **VPN profile options** topic | +| [Windows security baselines](windows-security-baselines.md) | Added Windows 10, version 1607 and Windows Server 2016 baseline | ## September 2016 diff --git a/windows/keep-secure/windows-security-baselines.md b/windows/keep-secure/windows-security-baselines.md index 872f3dd541..f62ee298ba 100644 --- a/windows/keep-secure/windows-security-baselines.md +++ b/windows/keep-secure/windows-security-baselines.md @@ -14,6 +14,7 @@ author: brianlic-msft **Applies to** - Windows 10 +- Windows Server 2016 - Windows Server 2012 R2 Microsoft is dedicated to provide our customers with a secure operating system, such as Windows 10 and Windows Server, as well as secure apps, such as Microsoft Edge. In addition to the security assurance of its products, Microsoft also enables you to have fine control of your environments by providing various configuration capabilities. Even though Windows and Windows Server are designed to be secure out-of-the-box, a large number of organizations still want more granular control of their security configurations. To navigate these large number of controls, organizations need guidance for configuring various security features. Microsoft provides this guidance in the form of security baselines. @@ -56,11 +57,13 @@ To help faster deployments and increase the ease of managing Windows, Microsoft ### Windows 10 security baselines + - [Windows 10, version 1607 and Windows Server 2016 security baseline](https://go.microsoft.com/fwlink/?linkid=831663) - [Windows 10, Version 1511 security baseline](https://go.microsoft.com/fwlink/p/?LinkID=799381) - [Windows 10, Version 1507 security baseline](https://go.microsoft.com/fwlink/p/?LinkID=799380) ### Windows Server security baselines + - [Windows 10, version 1607 and Windows Server 2016 security baseline](https://go.microsoft.com/fwlink/?linkid=831663) - [Windows Server 2012 R2 security baseline](https://go.microsoft.com/fwlink/p/?LinkID=799382) ## How can I monitor security baseline deployments? From d9415b3da3dc3a487e9c923b681f461bb10303a2 Mon Sep 17 00:00:00 2001 From: Tommy N Date: Wed, 19 Oct 2016 13:19:14 -0700 Subject: [PATCH 04/57] Update uev-whats-new-in-uev-for-windows.md --- windows/manage/uev-whats-new-in-uev-for-windows.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/manage/uev-whats-new-in-uev-for-windows.md b/windows/manage/uev-whats-new-in-uev-for-windows.md index a7759f623e..a360c496d8 100644 --- a/windows/manage/uev-whats-new-in-uev-for-windows.md +++ b/windows/manage/uev-whats-new-in-uev-for-windows.md @@ -78,6 +78,8 @@ While earlier versions of UE-V roamed taskbar settings between Windows 10 device In addition, UE-for Windows does not synchronize settings between the Microsoft Calculator in Windows 10 and the Microsoft Calculator in previous versions of Windows. +The Windows modern apps settings (DontSyncWindows8AppSettings) group policy is enabled by default and therefore, modern apps will not roam unless this policy is changed to disabled. + ## Support Added for Roaming Network Printers Users can now print to their saved network printers from any network device, including their default network printer. From d0bcff4bfb031844995f805a81d84728ab700c6b Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Wed, 19 Oct 2016 16:36:39 -0700 Subject: [PATCH 05/57] Added warning about testing config before productn deploymt --- ...oy-device-guard-enable-virtualization-based-security.md | 7 ++++++- ...tting-started-on-the-device-guard-deployment-process.md | 6 +++++- ...-and-deployment-planning-guidelines-for-device-guard.md | 3 +++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md index bf63f5df7f..f9a6a62792 100644 --- a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -104,7 +104,12 @@ Unfortunately, it would be time consuming to perform these steps manually on eve > **Important**  These settings include **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.
In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can have code integrity policies enabled.
For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). -6. For **Virtualization Based Protection of Code Integrity**, select the appropriate option: +6. For **Virtualization Based Protection of Code Integrity**, select the appropriate option. + + > [!WARNING] + > Virtualization-based protection of code integrity may be incompatible with some devices and applications. We strongly recommend testing this configuration in your lab before enabling virtualization-based protection of code integrity on production systems. Failure to do so may result in unexpected failures up to and including data loss or a blue screen error (also called a stop error). + + Select an option as follows: - With Windows 10, version 1607 or Windows Server 2016, choose an appropriate option:
For an initial deployment or test deployment, we recommend **Enabled without lock**.
When your deployment is stable in your environment, we recommend changing to **Enabled with lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person. diff --git a/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md b/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md index 0790236e3f..2846134874 100644 --- a/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md +++ b/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md @@ -53,5 +53,9 @@ This topic provides a roadmap for planning and getting started on the Device Gua - [Enforce code integrity policies](deploy-code-integrity-policies-steps.md#enforce-code-integrity-policies) - [Deploy and manage code integrity policies with Group Policy](deploy-code-integrity-policies-steps.md#deploy-and-manage-code-integrity-policies-with-group-policy)
-8. **Enable desired hardware (VBS) security features**. Hardware-based security features—also called virtualization-based security (VBS) features—strengthen the protections offered by code integrity policies, as described in [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). For information about enabling VBS features, see [Deploy Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md). +8. **Enable desired hardware (VBS) security features**. Hardware-based security features—also called virtualization-based security (VBS) features—strengthen the protections offered by code integrity policies, as described in [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). + > [!WARNING] + > Virtualization-based protection of code integrity may be incompatible with some devices and applications. We strongly recommend testing this configuration in your lab before enabling virtualization-based protection of code integrity on production systems. Failure to do so may result in unexpected failures up to and including data loss or a blue screen error (also called a stop error). + + For information about enabling VBS features, see [Deploy Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md). diff --git a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md index 13b3f05f42..705d3e8b90 100644 --- a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md +++ b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md @@ -35,6 +35,9 @@ For example, hardware that includes CPU virtualization extensions and SLAT will You can deploy Device Guard in phases, and plan these phases in relation to the computer purchases you plan for your next hardware refresh. +> [!WARNING] +> Virtualization-based protection of code integrity may be incompatible with some devices and applications. We strongly recommend testing this configuration in your lab before enabling virtualization-based protection of code integrity on production systems. Failure to do so may result in unexpected failures up to and including data loss or a blue screen error (also called a stop error). + The following tables provide more information about the hardware, firmware, and software required for deployment of various Device Guard features. The tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, available in 2016, and announced as options for 2017. > **Notes** From dcb37ad3ef088b947c880f02d520a90a77b5f1ae Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Thu, 20 Oct 2016 11:48:44 -0700 Subject: [PATCH 06/57] Fixed bkmk links, updated refs to WIP, tweaked linebrks --- windows/whats-new/security.md | 62 +++++++++++++++++++---------------- 1 file changed, 33 insertions(+), 29 deletions(-) diff --git a/windows/whats-new/security.md b/windows/whats-new/security.md index f2d45edd95..4cf480e9d7 100644 --- a/windows/whats-new/security.md +++ b/windows/whats-new/security.md @@ -10,8 +10,8 @@ ms.pagetype: security author: TrudyHa --- - # What's new in Windows 10 security + There are several key client security improvements Microsoft has made in Windows 10. These improvements focus on three key areas — threat resistance, information protection, and identity protection and access control. In addition to an overview of the features themselves, this article discusses the hardware requirements for each new feature and offers configuration recommendations and links to more detailed resources. Microsoft designed the Windows 10 operating system to be the most secure version of the Windows operating system to date. To achieve this goal, Windows 10 employs advanced and now widely available hardware features to help protect users and devices against modern cyber threats. With thousands of new malware variants discovered daily and malicious hacking techniques evolving rapidly, never before has Windows client security been more important. In Windows 10, organizations can deploy new threat-resistant security features that harden the operating system in ways that can benefit Bring Your Own Device (BYOD) and corporate-owned device scenarios, as well as devices for special use cases, such as kiosks, ATMs, and point-of-sale (PoS) systems. These new threat-resistant features are modular—that is, they’re designed to be deployed together, although you can also implement them individually. With all these new features enabled together, organizations can protect themselves immediately against a majority of today’s most sophisticated threats and malware. @@ -26,26 +26,27 @@ Today’s security threat landscape is one of aggressive and tenacious threats. Windows 10 introduces several new security features that help mitigate modern threats and protect organizations against cyber attackers, regardless of their motive. Microsoft has made significant investments in Windows 10 to make it the most malware-resistant Windows operating system to date. Rather than simply adding defenses to the operating system, as was the case in previous Windows releases, Microsoft introduces architectural changes in Windows 10 that address entire classes of threats. By fundamentally changing the way the operating system works, Microsoft seeks to make Windows 10 much more difficult for modern attackers to exploit. New features in Windows 10 include Device Guard, configurable code integrity, virtualization-based security (VBS), and improvements to Windows Defender, to name just a few. By enabling all these new features together, organizations can immediately protect themselves against the types of malware responsible for approximately 95 percent of modern attacks. -### Virtualization-based security +### Virtualization-based security In the server world, virtualization technologies like Microsoft Hyper-V have proven extremely effective in isolating and protecting virtual machines (VMs) in the data center. Now, with those virtualization capabilities becoming more pervasive in modern client devices, there is an incredible opportunity for new Windows client security scenarios. Windows 10 can use virtualization technology to isolate core operating system services in a segregated, virtualized environment, similar to a VM. This additional level of protection, called virtualization-based security, ensures that no one can manipulate those services, even if the kernel mode of the host operating system is compromised. Just like with client Hyper-V, Windows itself can now take advantage of processors equipped with second-level address translation (SLAT) technology and virtualization extensions, such as Intel Virtualization Technology (VT) x and AMD V, to create a secure execution environment for sensitive Windows functions and data. This VBS environment protects the following services: -- **Hypervisor Code Integrity (HVCI).** The HVCI service in Windows 10 determines whether code executing in kernel mode is securely designed and trustworthy. It offers Zero Day and vulnerability exploit protection capabilities by ensuring that all software running in kernel mode, including drivers, securely allocate memory and operate as they are intended. In Windows 10, kernel mode code integrity is configurable, which allows organizations to scope preboot code execution to their desired configuration. For more information about configurable code integrity in Windows 10, see the [Configurable code integrity](#config-code) section. -- **Local Security Authority (LSA).** The LSA service in Windows manages authentication operations, including NT LAN Manager (NTLM) and Kerberos mechanisms. In Windows 10, the Credential Guard feature isolates a portion of this service and helps mitigate the pass-the-hash and pass-the-ticket techniques by protecting domain credentials. In addition to logon credentials, this protection is extended to credentials stored within Credential Manager. For more information about Credential Guard, see the [Credential Guard](#credential-guard) section. -**Note**   +- **Hypervisor Code Integrity (HVCI).** The HVCI service in Windows 10 determines whether code executing in kernel mode is securely designed and trustworthy. It offers Zero Day and vulnerability exploit protection capabilities by ensuring that all software running in kernel mode, including drivers, securely allocate memory and operate as they are intended. In Windows 10, kernel mode code integrity is configurable, which allows organizations to scope preboot code execution to their desired configuration. For more information about configurable code integrity in Windows 10, see the [Configurable code integrity](#configurable-code-integrity) section. +- **Local Security Authority (LSA).** The LSA service in Windows manages authentication operations, including NT LAN Manager (NTLM) and Kerberos mechanisms. In Windows 10, the Credential Guard feature isolates a portion of this service and helps mitigate the pass-the-hash and pass-the-ticket techniques by protecting domain credentials. In addition to logon credentials, this protection is extended to credentials stored within Credential Manager. For more information about Credential Guard, see the [Credential Guard](#credential-guard) section. + +**Note**
To determine whether virtualization is supported for a client machine model, simply run **systeminfo** from a command prompt window.   VBS provides the core framework for some of the most impactful mitigations Windows 10 offers. Having client machines within your organization that can employ this functionality is crucial to modern threat resistance. For more information about the specific hardware features that each Windows 10 feature requires, including VBS, see the [Windows 10 hardware considerations](#hardware) section. ### Device Guard -Microsoft Device Guard is a feature set that combines system integrity–hardening features that revolutionize Windows security by taking advantage of new VBS options to protect the system core and a trust-nothing model often seen in mobile operating systems. This feature set takes advantage of the best preexisting Windows hardening features (for example, Unified Extensible Firmware Interface \[UEFI\] Secure Boot, Windows Trusted Boot), and then combines them with powerful new app control features like the VBS-powered HVCI service and configurable code integrity, which together help prevent vulnerability exploits and unauthorized apps from running on the device in both user and kernel modes. For more information about VBS in Windows 10 and the additional features that use it, see the [Virtualization-based security](#virtualization-security) section. For more information about configurable code integrity, see the [Configurable code integrity](#config-code) section. +Microsoft Device Guard is a feature set that combines system integrity–hardening features that revolutionize Windows security by taking advantage of new VBS options to protect the system core and a trust-nothing model often seen in mobile operating systems. This feature set takes advantage of the best preexisting Windows hardening features (for example, Unified Extensible Firmware Interface \[UEFI\] Secure Boot, Windows Trusted Boot), and then combines them with powerful new app control features like the VBS-powered HVCI service and configurable code integrity, which together help prevent vulnerability exploits and unauthorized apps from running on the device in both user and kernel modes. For more information about VBS in Windows 10 and the additional features that use it, see the [Virtualization-based security](#virtualization-based-security) section. For more information about configurable code integrity, see the [Configurable code integrity](#configurable-code-integrity) section. Although Microsoft intends the Device Guard feature set to run alongside new Windows security features such as Credential Guard, it can run independently. Depending on your organization’s client resources, you can selectively choose which features make sense for your environment and device compatibility. For information about the hardware requirements for Device Guard and other Windows 10 security features, see the [Windows 10 hardware considerations](#hardware) section. For more information about Credential Guard, see the [Credential Guard](#credential-guard) section. -For most organizations, implementing specific Device Guard functionality will depend on the role of the device and its primary user, employing more features on single-workload devices, such as kiosks, and fewer features on administrative machines over which users are allowed full control. By using this model, IT organizations can categorize users into groups that align with Device Guard security policies relating to device security and code integrity restrictions. For more information about configurable code integrity, see the [Configurable code integrity](#config-code) section. +For most organizations, implementing specific Device Guard functionality will depend on the role of the device and its primary user, employing more features on single-workload devices, such as kiosks, and fewer features on administrative machines over which users are allowed full control. By using this model, IT organizations can categorize users into groups that align with Device Guard security policies relating to device security and code integrity restrictions. For more information about configurable code integrity, see the [Configurable code integrity](#configurable-code-integrity) section. New desktops and laptops will be available to expedite your Device Guard implementation efforts. Device Guard-ready devices will require the least amount of physical interaction with the actual device before it’s ready for use. @@ -56,19 +57,19 @@ Going forward, all devices will fall into one of the following three categories: For more information about how to prepare for, manage, and deploy Device Guard, see the [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md). -### Configurable code integrity +### Configurable code integrity *Code integrity* is the Windows component that verifies that the code Windows is running is trusted and safe. Like the operating modes found in Windows itself, Windows code integrity contains two primary components: kernel mode code integrity (KMCI) and user mode code integrity (UMCI). Microsoft has used KMCI in recent versions of Windows to prevent the Windows kernel from executing unsigned drivers. Although this approach is effective, drivers aren’t the only route malware can take to penetrate the operating system’s kernel mode space. So, for Windows 10, Microsoft has raised the standard for kernel mode code out of the box by requiring the use of security best practices regarding memory management and has provided enterprises with a way to set their own UMCI and KMCI standards. Historically, UMCI has been available only for Windows RT and Windows Phone devices, which made it difficult for attackers to infect such devices with viruses and malware. This reduced infection rate results from the way the operating system determines which code to execute. Natively, binaries follow a process to prove to the operating system that they are trustworthy before the operating system allows them to execute. This process is intended to restrict the execution of arbitrary code and thereby decrease the risk of malware infection. This successful trust-nothing operating system model is now available in Windows 10 through a feature called *configurable code integrity*. Configurable code integrity allows IT organizations to create and deploy code integrity policies that stipulate exactly which binaries can run in their environment. Administrators can manage this trust at a certification authority or publisher level down to the individual hash values for each executed binary. This level of customization allows organizations to create policies that are as restrictive as they desire. In addition, organizations can choose to provide different levels of restriction for certain types of machines. For example, fixed-workload devices such as kiosks and PoS systems would likely receive a strict policy, because their purpose is to provide the same service day after day. Administrators can manage devices that have more variable workloads, such as users’ PCs, at a higher level, providing certain software publishers’ applications for installation or aligning those devices with the organization’s software catalog. -**Note**   +**Note**
Configurable code integrity is not intended to replace technologies that allow or block programs such as AppLocker or an organization’s antivirus software. Rather, it complements such technologies by establishing a baseline of security, and then using those additional technologies to fine-tune client security.   Configurable code integrity is not limited to Windows Store applications. In fact, it is not even limited to existing signed applications. Windows 10 gives you a way to sign line-of-business or third-party applications without having to repackage them: you can monitor the application’s installation and initial execution to create a list of binaries called a catalog file. When created, you sign these catalog files and add the signing certificate to the code integrity policy so that those binaries contained within the catalog files are allowed to execute. Then, you can use Group Policy, Configuration Manager, or any other familiar management tool to distribute these catalog files to your client machines. Historically, most malware has been unsigned; simply by deploying code integrity policies, your organization can immediately protect itself against unsigned malware, which is responsible for most modern attacks. -**Note**   +**Note**
For detailed deployment and planning information about configurable code integrity, see the [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md).   The process to create, test, and deploy a code integrity policy is as follows: @@ -78,7 +79,7 @@ The process to create, test, and deploy a code integrity policy is as follows: 4. **Enforce and sign the policy.** After you create, audit, and merge the resulting code integrity policies, it’s time to enforce your policy. To do so, run the **Set-RuleOption** cmdlet to remove the **Unsigned Policy** rule. When enforced, no binaries that are exceptions to the policy will be allowed to run. In addition to enforcing a policy, signed policies offer an additional level of protection. Signed code integrity policies inherently protect themselves against manipulation and deletion, even by administrators. 5. **Deploy the code integrity policy.** When you have enforced and optionally signed your code integrity policy, it’s ready for deployment. To deploy your code integrity policies, you can use Microsoft client management technologies, mobile device management solutions, or Group Policy, or you can simply copy the file to the correct location on your client computers. For Group Policy deployment, a new administrative template is available in Windows 10 and the Windows Server 2016 operating system to simplify the deployment process. -**Note**   +**Note**
Configurable code integrity is available in Windows 10 Enterprise and Windows 10 Education.   You can enable configurable code integrity as part of a Device Guard deployment or as a stand-alone component. In addition, you can run configurable code integrity on hardware that is compatible with the Windows 7 operating system, even if such hardware is not Device Guard ready. Code integrity policies can align with an existing application catalog, existing corporate imaging strategy, or with any other method that provides the organization’s desired levels of restriction. For more information about configurable code integrity with Device Guard, see the [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md). @@ -96,6 +97,7 @@ Measured Boot by itself does not prevent malware from loading during the startup For Windows 10, Microsoft has revamped Windows Defender and combined it with Microsoft System Center Endpoint Protection. Unlike with Microsoft System Center 2012 R2, there will be no System Center Endpoint Protection client to deploy to Windows 10 machines because Windows Defender is built into the operating system and enabled by default. In addition to simplified deployment, Windows Defender contains several improvements. The most important improvements to Windows Defender are: + - **Early Launch Antimalware (ELAM) compatible.** After Secure Boot has verified that the loading operating system is trusted, ELAM can start a registered and signed antimalware application before any other operating system components. Windows Defender is compatible with ELAM. - **Local context for detections and centralized sensory data.** Unlike most antimalware software and previous versions of Windows Defender, Windows Defender in Windows 10 reports additional information about the context of discovered threats. This information includes the source of the content that contains the threat as well as the historical movement of the malware throughout the system. When collection is complete, Windows Defender reports this information (when users elect to enable cloud-based protection) and uses it to mitigate threats more quickly. - **User Account Control (UAC) integration.** Windows Defender is now closely integrated with the UAC mechanism in Windows 10. Whenever a UAC request is made, Windows Defender automatically scans the threat before prompting the user, which helps prevent users from providing elevated privileges to malware. @@ -103,19 +105,19 @@ In addition to simplified deployment, Windows Defender contains several improvem ## Information protection -Protecting the integrity of company data as well as preventing the inappropriate disclosure and sharing of that data are a top priority for IT organizations. Trends like BYOD and mobility make the task of information protection more challenging than ever before. Windows 10 includes several improvements to built-in information protection, including a new Enterprise Data Protection (EDP) feature that offers DLP capability. This feature allows an organizations’ users to classify data themselves and gives you the ability to automatically classify data as it ingresses from business resources. It can also help prevent users from copying business content to unauthorized locations such as personal documents or websites. +Protecting the integrity of company data as well as preventing the inappropriate disclosure and sharing of that data are a top priority for IT organizations. Trends like BYOD and mobility make the task of information protection more challenging than ever before. Windows 10 includes several improvements to built-in information protection, including a new Windows Information Protection (WIP) feature that offers DLP capability. This feature allows an organizations’ users to classify data themselves and gives you the ability to automatically classify data as it ingresses from business resources. It can also help prevent users from copying business content to unauthorized locations such as personal documents or websites. -Unlike some current DLP solutions, EDP does not require users to switch modes or apps or work within containers to protect data, and the protection happens behind the scenes without altering the user experience that your users have grown accustomed to in Windows. For more information about EDP in Windows 10, see the [Enterprise Data Protection](#enterprise) section. +Unlike some current DLP solutions, WIP does not require users to switch modes or apps or work within containers to protect data, and the protection happens behind the scenes without altering the user experience that your users have grown accustomed to in Windows. For more information about WIP in Windows 10, see the [Windows Information Protection](#windows-information-protection) section. -In addition to EDP, Microsoft has made substantial improvements to BitLocker, including simplified manageability through Microsoft BitLocker Administration and Monitoring (MBAM), used-space-only encryption, and single sign-on (SSO) capability. For more information about BitLocker improvements in Windows 10, see the [Improvements to BitLocker](#bitlocker) section. +In addition to WIP, Microsoft has made substantial improvements to BitLocker, including simplified manageability through Microsoft BitLocker Administration and Monitoring (MBAM), used-space-only encryption, and single sign-on (SSO) capability. For more information about BitLocker improvements in Windows 10, see the [Improvements in BitLocker](#bitlocker) section. -### Enterprise Data Protection +### Windows Information Protection -DLP systems are intended to protect sensitive corporate data through encryption and managed use while the data is in use, in motion, or at rest. Traditional DLP software is typically invasive and frustrating for users and can be complicated for administrators to configure and deploy. Windows 10 now includes an EDP feature that offers DLP capabilities and is built in and simple to use. This solution gives you the flexibility to define policies that will help determine what kind of data to protect as business data and what should be considered personal. Based on these policies, you can also choose what to do, either automatically or manually, whenever you suspect that data is about to be or has been compromised. For example, if an employee has a personal but managed device that contains business data, an IT organization could block that user from copying and pasting business data to nonbusiness documents and locations or could even selectively wipe the business data from the device at any time without affecting the personal data on the device. +DLP systems are intended to protect sensitive corporate data through encryption and managed use while the data is in use, in motion, or at rest. Traditional DLP software is typically invasive and frustrating for users and can be complicated for administrators to configure and deploy. Windows 10 now includes a Windows Information Protection (WIP) feature that offers DLP capabilities and is built in and simple to use. This solution gives you the flexibility to define policies that will help determine what kind of data to protect as business data and what should be considered personal. Based on these policies, you can also choose what to do, either automatically or manually, whenever you suspect that data is about to be or has been compromised. For example, if an employee has a personal but managed device that contains business data, an IT organization could block that user from copying and pasting business data to nonbusiness documents and locations or could even selectively wipe the business data from the device at any time without affecting the personal data on the device. -You can configure EDP policies to encrypt and protect files automatically based on the network source from which the content was acquired, such as an email server, file share, or a Microsoft SharePoint site. The policies can work with on-premises resources as well as those that originate from the Internet. When specified, any data retrieved from internal network resources will always be protected as business data; even if that data is copied to portable storage, such as a flash drive or CD, the protection remains. In an effort to allow easy corrections of misclassified data, users who feel that EDP has incorrectly protected their personal data can modify the data’s classification. When such a modification occurs, you have access to audit data on the client machine. You can also use a policy to prevent users from reclassifying data. The EDP feature in Windows 10 also includes policy controls that allow you to define which apps have access to business data and even which have access to the corporate virtual private network (VPN). +You can configure WIP policies to encrypt and protect files automatically based on the network source from which the content was acquired, such as an email server, file share, or a Microsoft SharePoint site. The policies can work with on-premises resources as well as those that originate from the Internet. When specified, any data retrieved from internal network resources will always be protected as business data; even if that data is copied to portable storage, such as a flash drive or CD, the protection remains. In an effort to allow easy corrections of misclassified data, users who feel that WIP has incorrectly protected their personal data can modify the data’s classification. When such a modification occurs, you have access to audit data on the client machine. You can also use a policy to prevent users from reclassifying data. The WIP feature in Windows 10 also includes policy controls that allow you to define which apps have access to business data and even which have access to the corporate virtual private network (VPN). -To manage EDP, you use the same system management tools you probably already use to manage your Windows client computers, such as Configuration Manager and Intune. For more information about EDP, see [Enterprise data protection (EDP) overview](edp-whats-new-overview.md). +To manage WIP, you use the same system management tools you probably already use to manage your Windows client computers, such as Configuration Manager and Intune. For more information about WIP, see [Protect your enterprise data using Windows Information Protection](https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip). ### Improvements in BitLocker @@ -162,8 +164,9 @@ Pass the hash is the most commonly used derived credential attack today. This at Credential Guard is another new feature in Windows 10 Enterprise that employs VBS to protect domain credentials against theft, even when the host operating system is compromised. To achieve such protection, Credential Guard isolates a portion of the LSA service, which is responsible for managing authentication, inside a virtualized container. This container is similar to a VM running on a hypervisor but is extremely lightweight and contains only those files and components required to operate the LSA and other isolated services. By isolating a portion of the LSA service within this virtualized environment, credentials are protected even if the system kernel is compromised, removing the attack vector for pass the hash. -For more information about the hardware requirements for Credential Guard, see the [Windows 10 hardware considerations](#hardware) section. For more information about VBS in Windows 10, see the [Virtualization-based security](#virtualization-security) section. -**Note**   +For more information about the hardware requirements for Credential Guard, see the [Windows 10 hardware considerations](#hardware) section. For more information about VBS in Windows 10, see the [Virtualization-based security](#virtualization-based-security) section. + +**Note**
Because it requires isolated user mode and a Hyper-V hypervisor, you cannot configure Credential Guard on a VM, only on a physical computer.   The Credential Guard feature is targeted at resisting the use of pass-the-hash and pass-the-ticket techniques. By employing a MFA option such as Microsoft Passport with Credential Guard, you can gain additional protection against such threats. For more in-depth information about how Credential Guard works and the specific mitigations it provides, see [Protect derived domain credentials with Credential Guard](../keep-secure/credential-guard.md). @@ -171,6 +174,7 @@ The Credential Guard feature is targeted at resisting the use of pass-the-hash a ## Windows 10 hardware considerations Most of the features this article describes rely on specific hardware to maximize their capabilities. By purchasing hardware that includes these features during your next purchase cycle, you will be able to take advantage of the most comprehensive client security package Windows 10 has to offer. Careful consideration about which hardware vendor and specific models to purchase is vital to the success of your organization’s client security portfolio. Table 1 contains a list of each new Windows 10 security feature and its hardware requirements. + Table 1. Windows 10 hardware requirements | Windows 10 feature | TPM | Input/output memory management unit | Virtualization extensions | SLAT | UEFI 2.3.1 | x64 architecture only | @@ -186,15 +190,15 @@ Table 1. Windows 10 hardware requirements | Device health attestation through Measured Boot | Y\* | N | N | N | Y | Y |   \* Requires use of TPM 2.0. -**Note**   + +**Note**
In this table, **R** stands for *recommended*, **Y** means that the hardware component is *required* for that Windows 10 feature, and **N** means that the hardware component is *not used* with that Windows 10 feature.   ## Related topics -[Windows 10 Specifications](https://go.microsoft.com/fwlink/p/?LinkId=717550) -[Making Windows 10 More Personal and More Secure with Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=717551) -[Protect BitLocker from pre-boot attacks](../keep-secure/protect-bitlocker-from-pre-boot-attacks.md) -[BitLocker Countermeasures](../keep-secure/bitlocker-countermeasures.md) -[Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md) -[Protect derived domain credentials with Credential Guard](../keep-secure/credential-guard.md) -  -  + +- [Windows 10 Specifications](https://go.microsoft.com/fwlink/p/?LinkId=717550) +- [Making Windows 10 More Personal and More Secure with Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=717551) +- [Protect BitLocker from pre-boot attacks](../keep-secure/protect-bitlocker-from-pre-boot-attacks.md) +- [BitLocker Countermeasures](../keep-secure/bitlocker-countermeasures.md) +- [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md) +- [Protect derived domain credentials with Credential Guard](../keep-secure/credential-guard.md) From f946cc4524e93f8e2299b8b4d19dcdbf905a818e Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Thu, 20 Oct 2016 14:18:08 -0700 Subject: [PATCH 07/57] Fixed the indent of a couple of bullets --- ...nage-windows-10-in-your-organization-modern-management.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/manage/manage-windows-10-in-your-organization-modern-management.md b/windows/manage/manage-windows-10-in-your-organization-modern-management.md index 7c049e6a98..64e9301aee 100644 --- a/windows/manage/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/manage/manage-windows-10-in-your-organization-modern-management.md @@ -58,10 +58,9 @@ You can envision user and device management as falling into these two categories - **Corporate (CYOD) or personal (BYOD) devices used by mobile users for SaaS apps such as Office 365.** With Windows 10, your employees can self-provision their devices: -- For corporate devices, they can set up corporate access with Azure AD Join. When you offer them Azure AD Join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://blogs.technet.microsoft.com/ad/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/), all from the cloud. - Azure AD Join is also a great solution for temporary staff, partners, or other part-time employees. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources. + - For corporate devices, they can set up corporate access with Azure AD Join. When you offer them Azure AD Join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://blogs.technet.microsoft.com/ad/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/), all from the cloud.
Azure AD Join is also a great solution for temporary staff, partners, or other part-time employees. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources. -- Likewise, for personal devices, employees can use a new, simplified BYOD experience to add their work account to Windows, then access work resources on the device. + - Likewise, for personal devices, employees can use a new, simplified BYOD experience to add their work account to Windows, then access work resources on the device. - **Domain joined PCs and tablets used for traditional applications and access to important resources.** These may be traditional applications and resources that require authentication or accessing highly sensitive or classified resources on-premises. With Windows 10, if you have an on-premises Active Directory domain that’s integrated with Azure AD, when employee devices are joined, they automatically register with Azure AD. This provides: From 8e55bafb9ff59570959140eb1285c8ee693d9562 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Thu, 20 Oct 2016 14:22:24 -0700 Subject: [PATCH 08/57] Removd tbl row re UEFI NX, per Suhas Manangi --- windows/keep-secure/credential-guard.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 2ed94b71f9..d31167eaf6 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -94,9 +94,8 @@ The following tables describes additional hardware and firmware requirements, an ### 2017 Additional Qualification Requirements for Credential Guard (announced as options for future Windows operating systems for 2017) -| Protections for Improved Security - requirement | Description | +| Protection for Improved Security - requirement | Description | |---------------------------------------------|----------------------------------------------------| -| Firmware: **UEFI NX Protections** | **Requirements**:
- All UEFI memory that is marked executable must be read only. Memory marked writable must not be executable.

UEFI Runtime Services:
- Must implement the UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. The entire UEFI runtime must be described by this table.
- All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both.
- No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory MUST be either readable and executable OR writeable and non-executable.

**Security benefits**:
- Protects against potential vulnerabilities in UEFI runtime in functions such as Update Capsule, Set Variables, and so on, so they can't compromise VBS.
- Reduces attack surface to VBS from system firmware. | | Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.

**Security benefits**:
- Protects against potential vulnerabilities in UEFI runtime in functions such as Update Capsule, Set Variables, and so on, so they can't compromise VBS.
- Reduces attack surface to VBS from system firmware.
- Blocks additional security attacks against SMM. | ## Manage Credential Guard From ca7404dc790d9975b87b27bce53abe01ff8a1289 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Thu, 20 Oct 2016 16:40:53 -0700 Subject: [PATCH 09/57] added exit code table and minor tweaks --- .../deploy/upgrade-analytics-get-started.md | 50 +++++++++++++++---- 1 file changed, 41 insertions(+), 9 deletions(-) diff --git a/windows/deploy/upgrade-analytics-get-started.md b/windows/deploy/upgrade-analytics-get-started.md index 070a9e137c..5dcb740498 100644 --- a/windows/deploy/upgrade-analytics-get-started.md +++ b/windows/deploy/upgrade-analytics-get-started.md @@ -2,28 +2,28 @@ title: Get started with Upgrade Analytics (Windows 10) description: Explains how to get started with Upgrade Analytics. ms.prod: w10 -author: MaggiePucciEvans +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +author: greg-lindsay --- # Get started with Upgrade Analytics -Use Upgrade Analytics to plan and manage your upgrade project end to end. After you’ve established communications between user computers and Microsoft, Upgrade Analytics collects computer, application, and driver data for analysis. We use this data to identify compatibility issues that can block your upgrade and suggest fixes that are known to Microsoft. +you can use Upgrade Analytics to plan and manage your upgrade project end to end. After you’ve established communications between user computers and Microsoft, Upgrade Analytics collects computer, application, and driver data for analysis. This data is used to identify compatibility issues that can block your upgrade and to suggest fixes that are known to Microsoft. -For system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what telemetry data Microsoft collects and how that data is used and protected by Microsoft, see: +To enable system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what telemetry data Microsoft collects and how that data is used and protected by Microsoft, see the following topics: - [Configure Windows telemetry in your organization](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization) - - [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services) - - [Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields](https://go.microsoft.com/fwlink/?LinkID=822965) -This topic explains how to obtain and set up Upgrade Analytics components. If you haven’t done so already, see [Upgrade Analytics requirements](https://technet.microsoft.com/itpro/windows/deploy/upgrade-analytics-requirements) for information about requirements for using Upgrade Analytics. +This topic explains how to obtain and set up Upgrade Analytics components. If you haven’t done so already, see [Upgrade Analytics requirements](https://technet.microsoft.com/itpro/windows/deploy/upgrade-analytics-requirements) for information about requirements for using Upgrade Analytics. Also, check out the [Upgrade Analytics blog](https://blogs.technet.microsoft.com/UpgradeAnalytics) for new announcements and helpful tips for using Upgrade Analytics. To configure Upgrade Analytics, you’ll need to: - Add the Upgrade Analytics solution to a workspace in the Operations Management Suite portal - - Establish communications and enable data sharing between your organization and Microsoft Each task is explained in detail in the following sections. @@ -109,9 +109,7 @@ IMPORTANT: Restart user computers after you install the compatibility update KBs To ensure that user computers are receiving the most up to date data from Microsoft, we recommend that you establish the following data sharing and analysis processes. - Enable automatic updates for the compatibility update and related KBs. These KBs are updated frequently to include the latest application and driver issue information as we discover it during testing. - - Schedule the Upgrade Analytics deployment script to automatically run so that you don’t have to manually initiate an inventory scan each time the compatibility update KBs are updated. Computers are re-scanned only when the compatibility KBs are updated, so if your inventory changes significantly between KB releases you won’t see the changes in Upgrade Analytics until you run the script again. - - Schedule monthly user computer scans to view monthly active computer and usage information. ## Run the Upgrade Analytics deployment script @@ -170,6 +168,40 @@ To run the Upgrade Analytics deployment script: 6. After you finish editing the parameters in RunConfig.bat, run the script as an administrator. +The deployment script displays the following exit codes to let you know if it was successful, or if an error was encountered. + +
+ + +
Exit codeMeaning +
0Success +
1Unexpected error occurred while executing the script +
2Error when logging to console. $logMode = 0. +
3Error when logging to console and file. $logMode = 1. +
4Error when logging to file. $logMode = 2. +
5Error when logging to console and file. $logMode = unknown. +
6The commercialID parameter is set to unknown. Modify the script. +
7Function -CheckCommercialId: Unexpected failure. +
8Failure to create registry key path: HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection. +
9Error when writing CommercialId to registry. +
10Error when writing CommercialDataOptIn to registry. +
11Function -SetupCommercialId: Unexpected failure. +
12Can’t connect to Microsoft – Vortex. Check your network/proxy settings. +
13Can’t connect to Microsoft – setting. Check your network/proxy settings. +
14Can’t connect to Microsoft – compatexchange. Check your network/proxy settings. +
15Error connecting to Microsoft. Check your network/proxy settings. +
16Machine requires reboot. +
17Function -CheckRebootRequired: Unexpected failure. +
18Outdated compatibility update KB package. Update via Windows Update/WSUS. +
19This machine doesn’t have the proper KBs installed. Make sure you have recent compatibility update KB downloaded. +
20Error writing RequestAllAppraiserVersions registry key. +
21Function – SetRequestAllAppraiserVersions: Unexpected failure. +
22Error when running inventory scan. +
23Error finding system variable %WINDIR%. +
+ +
+ ## Seeing data from computers in Upgrade Analytics After data is sent from computers to Microsoft, it generally takes 48 hours for the data to populate in Upgrade Analytics. The compatibility update KB takes several minutes to run. If the KB does not get a chance to finish running or if the computers are inaccessible (turned off or sleeping for example), data will take longer to populate in Upgrade Analytics. For this reason, you can expect most your computers to be populated in OMS in about 1-2 weeks after deploying the KB and configuration to user computers. From 35e6c28569713439fa24df0b087573933fb67dd1 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Thu, 20 Oct 2016 17:02:54 -0700 Subject: [PATCH 10/57] a --- windows/deploy/upgrade-analytics-get-started.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/windows/deploy/upgrade-analytics-get-started.md b/windows/deploy/upgrade-analytics-get-started.md index 5dcb740498..0969339d05 100644 --- a/windows/deploy/upgrade-analytics-get-started.md +++ b/windows/deploy/upgrade-analytics-get-started.md @@ -10,7 +10,9 @@ author: greg-lindsay # Get started with Upgrade Analytics -you can use Upgrade Analytics to plan and manage your upgrade project end to end. After you’ve established communications between user computers and Microsoft, Upgrade Analytics collects computer, application, and driver data for analysis. This data is used to identify compatibility issues that can block your upgrade and to suggest fixes that are known to Microsoft. +This topic explains how to obtain and set up Upgrade Analytics components. If you haven’t done so already, see [Upgrade Analytics requirements](https://technet.microsoft.com/itpro/windows/deploy/upgrade-analytics-requirements) for information about requirements for using Upgrade Analytics. Also, check out the [Upgrade Analytics blog](https://blogs.technet.microsoft.com/UpgradeAnalytics) for new announcements and helpful tips for using Upgrade Analytics. + +You can use Upgrade Analytics to plan and manage your upgrade project end to end. After you’ve established communications between user computers and Microsoft, Upgrade Analytics collects computer, application, and driver data for analysis. This data is used to identify compatibility issues that can block your upgrade and to suggest fixes that are known to Microsoft. To enable system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what telemetry data Microsoft collects and how that data is used and protected by Microsoft, see the following topics: @@ -18,9 +20,6 @@ To enable system, application, and driver data to be shared with Microsoft, you - [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services) - [Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields](https://go.microsoft.com/fwlink/?LinkID=822965) - -This topic explains how to obtain and set up Upgrade Analytics components. If you haven’t done so already, see [Upgrade Analytics requirements](https://technet.microsoft.com/itpro/windows/deploy/upgrade-analytics-requirements) for information about requirements for using Upgrade Analytics. Also, check out the [Upgrade Analytics blog](https://blogs.technet.microsoft.com/UpgradeAnalytics) for new announcements and helpful tips for using Upgrade Analytics. - To configure Upgrade Analytics, you’ll need to: - Add the Upgrade Analytics solution to a workspace in the Operations Management Suite portal @@ -28,7 +27,6 @@ To configure Upgrade Analytics, you’ll need to: Each task is explained in detail in the following sections. - ## Add Upgrade Analytics to Operations Management Suite Upgrade Analytics is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud based services for managing your on-premises and cloud environments. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/documentation/articles/operations-management-suite-overview/). From ef59a6f79072151b54917a0be4b055d7a7154a24 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Thu, 20 Oct 2016 17:47:40 -0700 Subject: [PATCH 11/57] Added links to feature overviews etc. --- ...-in-your-organization-modern-management.md | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/windows/manage/manage-windows-10-in-your-organization-modern-management.md b/windows/manage/manage-windows-10-in-your-organization-modern-management.md index 64e9301aee..97f4cc4e6f 100644 --- a/windows/manage/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/manage/manage-windows-10-in-your-organization-modern-management.md @@ -44,38 +44,38 @@ With Windows 10, you can continue to use traditional OS deployment, but you can - Avoid reimaging by using dynamic provisioning, enabled by a cloud-based device management services like Microsoft Intune. -- Create self-contained provisioning packages built with the Windows Imaging and Configuration Designer (ICD). +- Create self-contained provisioning packages built with the [Windows Imaging and Configuration Designer (ICD)](https://msdn.microsoft.com/library/windows/hardware/dn916113(v=vs.85).aspx). -- Use traditional imaging techniques such as deploying custom images using System Center Configuration Manager. +- Use traditional imaging techniques such as deploying custom images using [System Center Configuration Manager](https://docs.microsoft.com/sccm/core/understand/introduction). -You have multiple options for upgrading to Windows 10. For existing devices running Windows 7 or Windows 8.1, you can use the robust in-place upgrade process for a fast, reliable move to Windows 10 while automatically preserving all the existing apps, data, and settings. This can mean significantly lower deployment costs, as well as improved productivity as end users can be immediately productive – everything is right where they left it. Of course, you can also use a traditional wipe-and-load approach if you prefer, using the same tools that you use today with Windows 7. +You have multiple options for [upgrading to Windows 10](https://technet.microsoft.com/itpro/windows/deploy/windows-10-deployment-scenarios). For existing devices running Windows 7 or Windows 8.1, you can use the robust in-place upgrade process for a fast, reliable move to Windows 10 while automatically preserving all the existing apps, data, and settings. This can mean significantly lower deployment costs, as well as improved productivity as end users can be immediately productive – everything is right where they left it. Of course, you can also use a traditional wipe-and-load approach if you prefer, using the same tools that you use today with Windows 7. ## Identity and Authentication -You can use Windows 10 and services like Azure Active Directory in new ways for cloud-based identity, authentication, and management. You can offer your users the ability to **“bring your own device” (BYOD)** or to **“choose your own device” (CYOD)** from a selection you make available. At the same time, you might be managing PCs and tablets that must be domain-joined because of specific applications or resources that are used on them. +You can use Windows 10 and services like [Azure Active Directory](https://azure.microsoft.com/documentation/articles/active-directory-whatis/) in new ways for cloud-based identity, authentication, and management. You can offer your users the ability to **“bring your own device” (BYOD)** or to **“choose your own device” (CYOD)** from a selection you make available. At the same time, you might be managing PCs and tablets that must be domain-joined because of specific applications or resources that are used on them. You can envision user and device management as falling into these two categories: - **Corporate (CYOD) or personal (BYOD) devices used by mobile users for SaaS apps such as Office 365.** With Windows 10, your employees can self-provision their devices: - - For corporate devices, they can set up corporate access with Azure AD Join. When you offer them Azure AD Join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://blogs.technet.microsoft.com/ad/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/), all from the cloud.
Azure AD Join is also a great solution for temporary staff, partners, or other part-time employees. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources. + - For corporate devices, they can set up corporate access with [Azure AD Join](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-overview/). When you offer them Azure AD Join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://blogs.technet.microsoft.com/ad/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/), all from the cloud.
Azure AD Join is also a great solution for temporary staff, partners, or other part-time employees. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources. - - Likewise, for personal devices, employees can use a new, simplified BYOD experience to add their work account to Windows, then access work resources on the device. + - Likewise, for personal devices, employees can use a new, simplified [BYOD experience](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-windows10-devices/) to add their work account to Windows, then access work resources on the device. - **Domain joined PCs and tablets used for traditional applications and access to important resources.** These may be traditional applications and resources that require authentication or accessing highly sensitive or classified resources on-premises. - With Windows 10, if you have an on-premises Active Directory domain that’s integrated with Azure AD, when employee devices are joined, they automatically register with Azure AD. This provides: + With Windows 10, if you have an on-premises [Active Directory](https://technet.microsoft.com/windows-server-docs/identity/whats-new-active-directory-domain-services) domain that’s [integrated with Azure AD](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-devices-group-policy/), when employee devices are joined, they automatically register with Azure AD. This provides: - Single sign-on to cloud and on-premises resources from everywhere - - Enterprise roaming of settings + - [Enterprise roaming of settings](https://azure.microsoft.com/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) - - Conditional access to corporate resources based on the health or configuration of the device + - [Conditional access](https://azure.microsoft.com/documentation/articles/active-directory-conditional-access/) to corporate resources based on the health or configuration of the device - - Windows Hello for Business + - [Windows Hello for Business](https://technet.microsoft.com/itpro/windows/keep-secure/manage-identity-verification-using-microsoft-passport) - Windows Hello - Domain joined PCs and tablets can continue to be managed with the System Center Configuration Manager client or Group Policy. + Domain joined PCs and tablets can continue to be managed with the [System Center Configuration Manager](https://docs.microsoft.com/sccm/core/understand/introduction) client or Group Policy. For more information about how Windows 10 and Azure AD optimize access to work resources across a mix of devices and scenarios, see [Using Windows 10 devices in your workplace](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-windows10-devices/). @@ -87,7 +87,7 @@ As you review the roles in your organization, you can use the following generali Your configuration requirements are defined by multiple factors, including the level of management needed, the devices and data managed, and your industry requirements. Meanwhile, employees are frequently concerned about IT applying strict policies to their personal devices, but they still want access to corporate email and documents. With Windows 10, you can create a consistent set of configurations across PCs, tablets, and phones through the common MDM layer.  -**MDM**: MDM gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, Group Policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. This makes MDM the best choice for devices that are constantly on the go. +**MDM**: [MDM](https://www.microsoft.com/en-us/cloud-platform/mobile-device-management) gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, Group Policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. This makes MDM the best choice for devices that are constantly on the go. **Group Policy** and **System Center Configuration Manager**: Your organization might still need to manage domain joined computers at a granular level such as Internet Explorer’s 1,500 configurable Group Policy settings, or very specific Windows Firewall rules. If so, Group Policy and System Center Configuration Manager continue to be excellent management choices: @@ -101,7 +101,7 @@ You can use the following generalized decision tree to review the management cho ## Updating and Servicing -With Windows as a Service, your IT department no longer needs to perform complex imaging (wipe-and-load) processes with each new Windows release. Whether on current branch (CB) or current branch for business (CBB), devices receive the latest feature and quality updates through simple – often automatic – patching processes. +With Windows as a Service, your IT department no longer needs to perform complex imaging (wipe-and-load) processes with each new Windows release. Whether on current branch (CB) or current branch for business (CBB), devices receive the latest feature and quality updates through simple – often automatic – patching processes. For more information, see [Windows 10 deployment scenarios](https://technet.microsoft.com/itpro/windows/deploy/windows-10-deployment-scenarios). MDM with Intune provide tools for applying Windows updates to client computers in your organization. Configuration Manager allows rich management and tracking capabilities of these updates, including maintenance windows and automatic deployment rules. From ad3156ea5773166af016aafc48b7640c579de971 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 21 Oct 2016 07:37:08 -0700 Subject: [PATCH 12/57] Squashed commit of the following: commit 3239ec9cfd2799bc557da4a5fbcf836b422338ac Author: jdeckerMS Date: Fri Oct 21 07:01:00 2016 -0700 LTSB commit 12d2e63b50aa32f23c5bbd331311630fd4d303c3 Merge: 8ca56df bbea844 Author: jdeckerMS Date: Fri Oct 21 06:59:08 2016 -0700 Merge remote-tracking branch 'refs/remotes/origin/master' into jdltsb commit 8ca56df779611a9f0362b9cd59fb53a65db9fa2a Author: jdeckerMS Date: Thu Oct 20 12:52:30 2016 -0700 change note format commit 2acbacbeaf0361ed32107a71087bf00a99f1ea80 Merge: 79fc385 2c7daec Author: jdeckerMS Date: Thu Oct 20 10:56:25 2016 -0700 Merge remote-tracking branch 'refs/remotes/origin/master' into jdltsb commit 79fc385e7e0d2bec1c41479a5473f81e28f16b6a Author: jdeckerMS Date: Thu Oct 20 09:52:36 2016 -0700 Adrienne feedback commit d4d628c509c2594d3e6359324d5d164fa3c49f8b Merge: 337815c d726120 Author: jdeckerMS Date: Thu Oct 20 09:51:48 2016 -0700 Merge remote-tracking branch 'refs/remotes/origin/master' into jdltsb commit 337815c59081c9fca9a8a674bb3af363cd5bd6a3 Merge: 615d187 e7f5095 Author: jdeckerMS Date: Wed Oct 19 09:22:25 2016 -0700 Merge remote-tracking branch 'refs/remotes/origin/master' into jdltsb commit 615d18796d855992db06b340e433a5c3ef3ea0bb Author: jdeckerMS Date: Wed Oct 19 08:47:20 2016 -0700 tweak commit c0880b278097a04e5a8ac7f516d329f6f6928b82 Author: jdeckerMS Date: Wed Oct 19 08:35:05 2016 -0700 remove edit commit a199d2c58a18c7037ef65f5c0d408d6ea2d3ba5c Merge: 35ef393 464227c Author: jdeckerMS Date: Wed Oct 19 08:29:59 2016 -0700 Merge remote-tracking branch 'refs/remotes/origin/master' into jdltsb commit 35ef393d724a9ada6f21024c7addfc2ebaff2d55 Merge: 535eac9 bd40ef2 Author: jdeckerMS Date: Mon Oct 17 13:36:27 2016 -0700 Merge remote-tracking branch 'refs/remotes/origin/master' into jdltsb commit 535eac959f575813729f33659af25bf6aa2c627d Author: jdeckerMS Date: Mon Oct 17 10:36:31 2016 -0700 add change history to index commit 7bf8ed5ec05537b09a153cab897a982ec7b48275 Author: jdeckerMS Date: Mon Oct 17 10:35:15 2016 -0700 fix change history commit 5e71fc2cb3a36d2813144c2f5d76711e4be8a75f Author: jdeckerMS Date: Mon Oct 17 10:20:19 2016 -0700 add change hsitory commit c07f9ac004d876a02417c4d418ac949f7b4a1c9d Author: jdeckerMS Date: Mon Oct 17 09:25:51 2016 -0700 add new topic --- devices/surface/TOC.md | 2 + ...efi-security-features-for-surface-pro-3.md | 3 +- devices/surface/change-history-for-surface.md | 23 ++++++++++ devices/surface/deploy.md | 1 + devices/surface/index.md | 1 + devices/surface/ltsb-for-surface.md | 44 +++++++++++++++++++ 6 files changed, 73 insertions(+), 1 deletion(-) create mode 100644 devices/surface/change-history-for-surface.md create mode 100644 devices/surface/ltsb-for-surface.md diff --git a/devices/surface/TOC.md b/devices/surface/TOC.md index eff3b9bb69..aa9fee3d31 100644 --- a/devices/surface/TOC.md +++ b/devices/surface/TOC.md @@ -1,5 +1,6 @@ # [Surface](index.md) ## [Deploy Surface devices](deploy.md) +### [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md) ### [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) ### [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md) ### [Customize the OOBE for Surface deployments](customize-the-oobe-for-surface-deployments.md) @@ -21,5 +22,6 @@ ### [Unenroll Surface devices from SEMM](unenroll-surface-devices-from-semm.md) ## [Surface Diagnostic Toolkit](surface-diagnostic-toolkit.md) ## [Surface Data Eraser](microsoft-surface-data-eraser.md) +## [Change history for Surface documentation](change-history-for-surface.md) diff --git a/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md b/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md index 7b231f3562..6caa1ce23a 100644 --- a/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md +++ b/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md @@ -28,7 +28,8 @@ To update the UEFI on Surface Pro 3, you can download and install the Surface UE ## Manually configure additional security settings ->**Note:**  To enter firmware setup on a Surface device, begin with the device powered off, press and hold the **Volume Up** button, then press and release the **Power** button, then release the **Volume Up** button after the device has begun to boot. +>[!NOTE] +>To enter firmware setup on a Surface device, begin with the device powered off, press and hold the **Volume Up** button, then press and release the **Power** button, then release the **Volume Up** button after the device has begun to boot. After the v3.11.760.0 UEFI update is installed on a Surface device, an additional UEFI menu named **Advanced Device Security** becomes available. If you click this menu, the following options are displayed: diff --git a/devices/surface/change-history-for-surface.md b/devices/surface/change-history-for-surface.md new file mode 100644 index 0000000000..6128cfbbfa --- /dev/null +++ b/devices/surface/change-history-for-surface.md @@ -0,0 +1,23 @@ +--- +title: Change history for Surface documentation (Windows 10) +description: This topic lists new and updated topics in the Surface documentation library. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +--- + +# Change history for Surface documentation + +This topic lists new and updated topics in the Surface documentation library. + +## October 2016 + +| New or changed topic | Description | +| --- | --- | +| [Long-term servicing branch for Surface devices](ltsb-for-surface.md) | New | + + + + +  \ No newline at end of file diff --git a/devices/surface/deploy.md b/devices/surface/deploy.md index 517aca2f0b..03cdc49f49 100644 --- a/devices/surface/deploy.md +++ b/devices/surface/deploy.md @@ -16,6 +16,7 @@ Get deployment guidance for your Surface devices including information about MDT | Topic | Description | | --- | --- | +| [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md) | Explains that LTSB is not supported for general-purpose Surface devices and should be used for specialized devices only. | | [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) | Walk through the recommended process of how to deploy Windows 10 to your Surface devices with the Microsoft Deployment Toolkit.| | [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md)| Find out how to perform a Windows 10 upgrade deployment to your Surface devices. | | [Customize the OOBE for Surface deployments](customize-the-oobe-for-surface-deployments.md)| Walk through the process of customizing the Surface out-of-box experience for end users in your organization.| diff --git a/devices/surface/index.md b/devices/surface/index.md index 1b70df3e57..4843bb6970 100644 --- a/devices/surface/index.md +++ b/devices/surface/index.md @@ -29,6 +29,7 @@ For more information on planning for, deploying, and managing Surface devices in | [Surface Enterprise Management Mode](surface-enterprise-management-mode.md) | See how this feature of Surface devices with Surface UEFI allows you to secure and manage firmware settings within your organization. | | [Surface Diagnostic Toolkit](surface-diagnostic-toolkit.md) | Find out how you can use the Microsoft Surface Diagnostic Toolkit to test the hardware of your Surface device. | | [Surface Data Eraser](microsoft-surface-data-eraser.md) | Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices. | +| [Change history for Surface documentation](change-history-for-surface.md) | This topic lists new and updated topics in the Surface documentation library. | diff --git a/devices/surface/ltsb-for-surface.md b/devices/surface/ltsb-for-surface.md new file mode 100644 index 0000000000..e4f9a7c769 --- /dev/null +++ b/devices/surface/ltsb-for-surface.md @@ -0,0 +1,44 @@ +--- +title: Long-Term Servicing Branch for Surface devices (Surface) +description: LTSB is not supported for general-purpose Surface devices and should be used for specialized devices only. +ms.prod: w10 +ms.mktglfcycl: manage +ms.pagetype: surface, devices +ms.sitesec: library +author: jdeckerMS +--- + +# Long-Term Servicing Branch (LTSB) for Surface devices + + +General-purpose Surface devices running Long-Term Servicing Branch (LTSB) are not supported. As a general guideline, if a Surface device runs productivity software, such as Microsoft Office, it is a general-purpose device that does not qualify for LTSB and should instead run Current Branch (CB) or Current Branch for Business (CBB). + +>[!NOTE] +>For more information about the servicing branches, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview). + +LTSB prevents Surface devices from receiving critical Windows 10 feature updates and certain non-security servicing updates. Customers with poor experiences using Surface devices in the LTSB configuration will be instructed to upgrade to CB or CBB. Furthermore, the Windows 10 Enterprise LTSB edition removes core features of Surface devices, including seamless inking and touch-friendly applications. It does not contain key in-box applications including Microsoft Edge, OneNote, Calendar or Camera. Therefore, productivity is impacted and functionality is limited. LTSB is not supported as a suitable servicing solution for general-purpose Surface devices. + +General-purpose Surface devices are intended to run CB or CBB to receive full servicing and firmware updates and forward compatibility with the introduction of new Surface features. With CB, feature updates are available as soon as Microsoft releases them. Customers in the CBB servicing model receive the same build of Windows 10 as those in CB, at a later date. + +Surface devices in specialized scenarios – such as PCs that control medical equipment, point-of-sale systems, and ATMs – may consider the use of LTSB. These special-purpose systems typically perform a single task and do not require feature updates as frequently as other devices in the organization. + + + + + +## Related topics + +- [Surface TechCenter](https://technet.microsoft.com/windows/surface) + +- [Surface for IT pros blog](http://blogs.technet.com/b/surface/) + + + +  + +  + + + + + From 8103e45e9c8879f057b2553f331f475a6e2d5177 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 21 Oct 2016 08:36:58 -0700 Subject: [PATCH 13/57] sync --- devices/surface/ltsb-for-surface.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/ltsb-for-surface.md b/devices/surface/ltsb-for-surface.md index e4f9a7c769..91ae3a566b 100644 --- a/devices/surface/ltsb-for-surface.md +++ b/devices/surface/ltsb-for-surface.md @@ -20,7 +20,7 @@ LTSB prevents Surface devices from receiving critical Windows 10 feature updates General-purpose Surface devices are intended to run CB or CBB to receive full servicing and firmware updates and forward compatibility with the introduction of new Surface features. With CB, feature updates are available as soon as Microsoft releases them. Customers in the CBB servicing model receive the same build of Windows 10 as those in CB, at a later date. -Surface devices in specialized scenarios – such as PCs that control medical equipment, point-of-sale systems, and ATMs – may consider the use of LTSB. These special-purpose systems typically perform a single task and do not require feature updates as frequently as other devices in the organization. +Surface devices in specialized scenarios–such as PCs that control medical equipment, point-of-sale systems, and ATMs–may consider the use of LTSB. These special-purpose systems typically perform a single task and do not require feature updates as frequently as other devices in the organization. From 7183a8b0ed2e61b493965951301261af317bf293 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 21 Oct 2016 09:31:42 -0700 Subject: [PATCH 14/57] changing best practice to align with security baseline --- .../interactive-logon-do-not-require-ctrl-alt-del.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md b/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md index f2741165ce..d1d0b00b2e 100644 --- a/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md +++ b/windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md @@ -35,7 +35,7 @@ A malicious user might install malware that looks like the standard logon dialog ### Best practices -- It is advisable to set **Disable CTRL+ALT+DEL requirement for logon** to **Disabled**. Unless they are using a smart card to log on, users will have to simultaneously press three keys before the logon dialog box appears. +- It is advisable to set **Disable CTRL+ALT+DEL requirement for logon** to **Not configured**. ### Location From bff3d3478dd41a707711b5f718af6575708c9b3c Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Fri, 21 Oct 2016 10:05:34 -0700 Subject: [PATCH 15/57] Reorgd the registry sectn per Suhas M --- ...rd-enable-virtualization-based-security.md | 149 ++++++++++++++---- 1 file changed, 116 insertions(+), 33 deletions(-) diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md index f9a6a62792..edb6d77be3 100644 --- a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -22,21 +22,21 @@ Hardware-based security features, also called virtualization-based security or V 3. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see the following section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security). -4. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see [Enable virtualization-based security (VBS)](#enable-virtualization-based-security-vbs), later in this topic. +4. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see [Enable virtualization-based security (VBS)](#enable-virtualization-based-security-vbs-and-device-guard), later in this topic. For information about enabling Credential Guard, see [Protect derived domain credentials with Credential Guard](credential-guard.md). -## Windows feature requirements for virtualization-based security +## Windows feature requirements for virtualization-based security and Device Guard -In addition to the hardware requirements found in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard), you must enable certain operating system features before you can enable VBS: +In addition to the hardware requirements found in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard), you must confirm that certain operating system features are enabled before you can enable VBS: - With Windows 10, version 1607 or Windows Server 2016:
-Hyper-V Hypervisor (shown in Figure 1). +Hyper-V Hypervisor, which is enabled automatically (shown in Figure 1). - With an earlier version of Windows 10, or Windows Server 2016 Technical Preview 5 or earlier:
Hyper-V Hypervisor and Isolated User Mode (not shown). -> **Note**  You can configure these features manually by using Windows PowerShell or Deployment Image Servicing and Management. For specific information about these methods, see [Protect derived domain credentials with Credential Guard](credential-guard.md). +> **Note**  You can configure these features by using Group Policy or Deployment Image Servicing and Management, or manually by using Windows PowerShell or the Windows Features dialog box.   ![Turn Windows features on or off](images/dg-fig1-enableos.png) @@ -44,41 +44,19 @@ Figure 1. Enable operating system feature for VBS After you enable the feature or features, you can enable VBS for Device Guard, as described in the following sections. -## Enable Virtualization Based Security (VBS) +## Enable Virtualization Based Security (VBS) and Device Guard Before you begin this process, verify that the target device meets the hardware and firmware requirements for the features that you want, as described in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). Also, confirm that you have enabled the Windows features discussed in the previous section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security). -There are multiple ways to configure VBS features for Device Guard. You can use the [readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) rather than the procedures in this topic, or you can use the following procedures, either to configure the appropriate registry keys manually or to use Group Policy. +There are multiple ways to configure VBS features for Device Guard: -> **Important**   -> - The settings in the following procedure include **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you simply choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.
In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can still have code integrity policies enabled.
For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats).
-> - All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable these features on a group of test computers before you enable them on users' computers. - -**To configure VBS manually** - -1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. - -2. Set the **EnableVirtualizationBasedSecurity DWORD** value to **1**. - -3. Set the **RequirePlatformSecurityFeatures DWORD** value as appropriate: - - | **With Windows 10, version 1607,
or Windows Server 2016** | **With an earlier version of Windows 10,
or Windows Server 2016 Technical Preview 5 or earlier** | - | ---------------- | ---------------- | - | **1** enables the **Secure Boot** option
**3** enables the **Secure Boot and DMA protection** option | **1** enables the **Secure Boot** option
**2** enables the **Secure Boot and DMA protection** option | - -4. With a supported operating system earlier than Windows 10, version 1607, or Windows Server 2016, skip this step, and remain in the same registry subkey. - - With Windows 10, version 1607, or Windows Server 2016, navigate to **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios**. - -5. Set the **HypervisorEnforcedCodeIntegrity DWORD** value to **1**. - -6. Restart the client computer. - -Unfortunately, it would be time consuming to perform these steps manually on every protected computer in your enterprise. Group Policy offers a much simpler way to deploy these features to your organization. This example creates a test organizational unit (OU) called *DG Enabled PCs*. If you want, you can instead link the policy to an existing OU, and then scope the GPO by using appropriately named computer security groups. +- You can use the [readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) rather than the procedures in this topic. +- You can use Group Policy, as described in the procedure that follows. +- You can configure VBS manually, as described in [Use registry keys to enable VBS and Device Guard](#use-registry-keys-to-enable-vbs-and-device-guard), later in this topic. > **Note**  We recommend that you test-enable these features on a group of test computers before you enable them on users' computers. If untested, there is a possibility that this feature can cause system instability and ultimately cause the client operating system to fail. -### Use Group Policy to enable VBS +### Use Group Policy to enable VBS and Device Guard 1. To create a new GPO, right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. @@ -125,6 +103,111 @@ Unfortunately, it would be time consuming to perform these steps manually on eve Processed Device Guard policies are logged in event viewer at **Applications and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational**. When the **Turn On Virtualization Based Security** policy is successfully processed, event ID 7000 is logged, which contains the selected settings within the policy. +>**Note**  Events will be logged in this event channel only when Group Policy is used to enable Device Guard features, not through other methods. If other methods such as registry keys are used, Device Guard features will be enabled but the events won’t be logged in this event channel. + +### Use registry keys to enable VBS and Device Guard + +Set the following registry keys to enable VBS and Device Guard. This provides exactly same set of configuration options provided by Group Policy. + +> **Important**   +> - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you simply choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.
In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can still have code integrity policies enabled.
For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats).
+> - All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable these features on a group of test computers before you enable them on users' computers. + +#### For Windows 1607 and above + +Recommended settings (to enable virtualization-based protection of Code Integrity policies, without UEFI Lock): + +``` commands +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f + +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f + +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f + +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f + +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f +``` + +If you want to customize the preceding recommended settings, use the following settings. + +**To enable VBS** + +``` command +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f +``` + +**To enable VBS and require Secure boot only (value 1)** + +``` command +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f +``` + +> To enable **VBS with Secure Boot and DMA (value 2)**, in the preceding command, change **/d 1** to **/d 2**. + +**To enable VBS without UEFI lock (value 0)** + +``` command +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f +``` + +> To enable **VBS with UEFI lock (value 1)**, in the preceding command, change **/d 0** to **/d 1**. + +**To enable virtualization-based protection of Code Integrity policies** + +``` command +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f +``` + +**To enable virtualization-based protection of Code Integrity policies without UEFI lock (value 0)** + +``` command +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f +``` + +> To enable **virtualization-based protection of Code Integrity policies with UEFI lock (value 1)**, in the preceding command, change **/d 0** to **/d 1**. + +#### For Windows 1511 and below + +Recommended settings (to enable virtualization-based protection of Code Integrity policies, without UEFI Lock): + +``` command +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f + +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f + +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f + +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v " Unlocked" /t REG_DWORD /d 1 /f +``` + +If you want to customize the preceding recommended settings, use the following settings. + +**To enable VBS (it is always locked to UEFI)** + +``` command +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f +``` + +**To enable VBS and require Secure boot only (value 1)** + +``` command +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f +``` + +> To enable **VBS with Secure Boot and DMA (value 2)**, in the preceding command, change **/d 1** to **/d 2**. + +**To enable virtualization-based protection of Code Integrity policies (with the default, UEFI lock)** + +``` command +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f +``` + +**To enable virtualization-based protection of Code Integrity policies without UEFI lock** + +``` command +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v " Unlocked" /t REG_DWORD /d 1 /f +``` ### Validate enabled Device Guard hardware-based security features From 908afbff38e084fb87fb7ff927f83cd205af1c35 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 21 Oct 2016 13:43:52 -0700 Subject: [PATCH 16/57] Removed text --- .../keep-secure/change-history-for-keep-windows-10-secure.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index dada97fc72..bba6f8cedc 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -16,7 +16,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md | New or changed topic | Description | | --- | --- | -|[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) and [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Updated the text about the icon overlay option. This icon now only appears on corporate files in the Save As and File Explore views. | +|[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) and [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Updated the text about the icon overlay option. This icon now only appears on corporate files in the Save As and File Explore views | |[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |Added content about using ActiveX controls.| |[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |New | |[VPN technical guide](vpn-guide.md) | Multiple new topics, replacing previous **VPN profile options** topic | From c6a8c9896060175dd0a4d00508b58475bb96ecc6 Mon Sep 17 00:00:00 2001 From: theodthompson Date: Fri, 21 Oct 2016 15:24:13 -0700 Subject: [PATCH 17/57] added guest VBS info --- ...loyment-planning-guidelines-for-device-guard.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md index 13b3f05f42..4cad3f619c 100644 --- a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md +++ b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md @@ -20,6 +20,7 @@ This article describes the following: - [Device Guard requirements for baseline protections](#device-guard-requirements-for-baseline-protections) - [Device Guard requirements for improved security](#device-guard-requirements-for-improved-security) - [Device Guard deployment in different scenarios: types of devices](#device-guard-deployment-in-different-scenarios-types-of-devices) +- [Device Guard deployment in virtual machines](#device-guard-deployment-in-virtual-machines) - [Reviewing your applications: application signing and catalog files](#reviewing-your-applications-application-signing-and-catalog-files) - [Code integrity policy formats and signing](#code-integrity-policy-formats-and-signing) @@ -96,6 +97,19 @@ Typically, deployment of Device Guard happens best in phases, rather than being | **Lightly managed devices**: Company-owned, but users are free to install software.
Devices are required to run organization's antivirus solution and client management tools. | Device Guard can be used to help protect the kernel, and to monitor (audit) for problem applications rather than limiting the applications that can be run. | - VBS (hardware-based) protections, enabled. When enabled with a code integrity policy in audit mode only, VBS means the hypervisor helps enforce the default kernel-mode code integrity policy, which protects against unsigned drivers or system files.

- Code integrity policies, with UMCI enabled, but running in audit mode only. This means applications are not blocked—the policy just logs an event whenever an application outside the policy is started. | | **Bring Your Own Device**: Employees are allowed to bring their own devices, and also use those devices away from work. | Device Guard does not apply. Instead, you can explore other hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. | N/A | +## Device Guard deployment in virtual machines + +Device Guard can protect a Hyper-V virtual machine, just as it would a physical machine. The enablement steps are the same from within the virtual machine. + +Device Guard protects against malware running in the guest virtual machine. It does not provide additional protection from the host administrator. From the host, you can disable Device Guard for a virtual machine: + +` Set-VMSecurity -VMName -VirtualizationBasedSecurityOptOut $true` + + +### Requirements for running Device Guard in Hyper-V virtual machines + - The Hyper-V host must run at least Windows Server 2016 or Windows 10 version 1607. + - The Hyper-V virtual machine must be Generation 2, and running at least Windows Server 2016 or Windows 10. + ## Reviewing your applications: application signing and catalog files Typically, code integrity policies are configured to use the application's signing certificate as part or all of what identifies the application as trusted. This means that applications must either use embedded signing—where the signature is part of the binary—or catalog signing, where you generate a “catalog file” from the applications, sign it, and through the signed catalog file, configure the code integrity policy to recognize the applications as signed. From bb062c06123ab7b7f4618dbd962de0df8ab2ad90 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Mon, 24 Oct 2016 11:18:39 -0700 Subject: [PATCH 18/57] Folded in more changes from Suhas --- ...rd-enable-virtualization-based-security.md | 13 +++++++++---- .../keep-secure/images/dg-fig1-enableos.png | Bin 22075 -> 17395 bytes 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md index edb6d77be3..fe1db32b1d 100644 --- a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -31,16 +31,16 @@ For information about enabling Credential Guard, see [Protect derived domain cre In addition to the hardware requirements found in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard), you must confirm that certain operating system features are enabled before you can enable VBS: - With Windows 10, version 1607 or Windows Server 2016:
-Hyper-V Hypervisor, which is enabled automatically (shown in Figure 1). +Hyper-V Hypervisor, which is enabled automatically. No further action is needed. - With an earlier version of Windows 10, or Windows Server 2016 Technical Preview 5 or earlier:
-Hyper-V Hypervisor and Isolated User Mode (not shown). +Hyper-V Hypervisor and Isolated User Mode (shown in Figure 1). > **Note**  You can configure these features by using Group Policy or Deployment Image Servicing and Management, or manually by using Windows PowerShell or the Windows Features dialog box.   ![Turn Windows features on or off](images/dg-fig1-enableos.png) -Figure 1. Enable operating system feature for VBS +**Figure 1. Enable operating system features for VBS, Windows 10, version 1511** After you enable the feature or features, you can enable VBS for Device Guard, as described in the following sections. @@ -107,7 +107,12 @@ There are multiple ways to configure VBS features for Device Guard: ### Use registry keys to enable VBS and Device Guard -Set the following registry keys to enable VBS and Device Guard. This provides exactly same set of configuration options provided by Group Policy. +Set the following registry keys to enable VBS and Device Guard. This provides exactly the same set of configuration options provided by Group Policy. + +> [!WARNING] +> Virtualization-based protection of code integrity (controlled through the registry key **HypervisorEnforcedCodeIntegrity**) may be incompatible with some devices and applications. We strongly recommend testing this configuration in your lab before enabling virtualization-based protection of code integrity on production systems. Failure to do so may result in unexpected failures up to and including data loss or a blue screen error (also called a stop error). + + > **Important**   > - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you simply choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.
In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can still have code integrity policies enabled.
For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats).
diff --git a/windows/keep-secure/images/dg-fig1-enableos.png b/windows/keep-secure/images/dg-fig1-enableos.png index a114c520de2c54e0b841126bb0763b39eb4d706b..cefb1243444fed724637dece0434f235e6cbafba 100644 GIT binary patch literal 17395 zcmZU)by%BE&^C$`FK)$3ad(H}?(XiI;99hJad#>1PLN=Q;_ecHyOrWn;P89j?_Ae+ zuJgyUd7fl=6Iw~GAu+2U~GvaTu7!1hjwV2=C7*E^_+rFfbUu|GQw*m@r6SU?ijDrNp&-*3OKT zqezGG>tY(61?eJl(-iycxI=oZMko>oHa-g4XGtCvQ@bG}fB%p?B8XI+gfGpM97>7i z_;XobASBsR4MPCAHcA%T0Ou!d14#(hI3w{-tQ=3J!^Lmfi;Kc9Le2A{T-w~t(8a~> zMN{2wzn7k>`;}`%I+-BEP*s(J*9r>Hr^~B-x&1)!6Ul?HzZ+S?lImxZ@6Z@U#T~or zo$Y~022K15f{ufpC3Q_r62`;49)eL}H9JONW z_$lAtZ*2H5lI~)F3+FS=SJi{loIc@(o5Tw);$yh{K&~gOu@SJRF84;Q#D(9rhF-@P zNO!sH2&A&5p3`m01 z=-kl#YS~OLXnJ&BD9w?+MWOXxI6aLLX1XP6R_eM{m$;RyquZ@z@y1fpDlBInLJE|*W9+I=y^G?q2-yhv~z23fh90xVKR zJ1iRl#s^FK9kdvxan(je4};5Ni)j0a#R&Dd`S`sN`%fFHM3e~)Oh_$X4)y_WiTDK#WuGI|{)dga3IF6v^G0^O6C zSQUKm$tabPKC5yq&Kfd>$#*2C?Xo&J!7@^jT7_65Z)f-R5QnWl$nyBZ7S+)XG9LrJ zL?Luaq*xB=QYqL!;S8ACWi*6PFI_D$)Lgbsj&aA_Fbd-{utUbq%gXgatd}~%du>8i zby!1T7&Hq10_tXO=Hf^S;2rg*du?4kHvFFR9HFKEwR2ESp%y|lgj8?N7B$l0P0&bPD>PdyVrKzRgMu<7X zsdliVv8lbV>?FjAu7srMQF*b^9A!KzR%WA_?yvU8PkRlW-y8u_``o^ztL3bLcsP9F zHRO^#inN1v9Gz;jA#%^Y0h4d?V~Ji7Oj@xIa>{~pZ0R=!QMtb^<8<~yUV_IlbFZDq~u^0uwR<@pFZ56 zGG#~*J?+*QLDMv~l^!k*1qe=#S@8AK&{$}r(;T_oZgp6>4N1~MGX{%m*!8PzXVtk; zlA?{2X;*O4;GYz;%>uR%N?Y-9nnHz}I=+v7Kvx&OXi{KW_TN)cYli2-F=zH?WR(27;`5@ zPb}3j__&@#j7svyfBWLxv2wXcy0=q*dn+k{!Sc4wkvLx#h$|2wSTL}D#Qk9^kr*qh za0;s#`M{|qpc!xK3t@+hT7><`ZG+@UC9~aH`6{z;Moex9TO?cdlSVh~y3t-!m8|J!-?eKri?k(-84kw=#e0c>3V#)T45WW-egAN&c6S zO5-ZvqC;8p%FR}5PC$&fzYNp7a{J+S=<#rb1$6$XA2=W4nMFHIjC64@Nn#rKn1+(8 z46y!wzP2QwM9?mAd{Q5DdwdS5?6dz&I^wZ2gRfqP{I@pojGXbQcUn5|ZG?vd-|RHs zgl}DY++z^7H`E=@i+i|2=W?vyBgMs@^OfqMJilwP_4p87DHoLQ6a>DHbbi^IU#!-3 zifJ}(Md=GyES}daXw=vrkjMV}Y-MzcFTfKxT{7O?Qa}dHij|qeITto#uONTyDtN8^8k0oaZ>-nwk4W0r`!LIOV6jjNbTC z28ZP3F`xPwX-ZF&Mo-`i>)@LG^3AGCu;X{ghg@YOc+wecS}OA?hdFdLWr?ks%P7(^ zPbIg(irtY>Ro2V=t5mDB7g%)y3aSvtLL~!aeGJ07eK|WV)$Ub-tt5hUsZ zEv_5;wGyDzjGx_H=FX6jEbD>s2O`-iq9Q8hNnjSwwSnSOzudf+_Eq;!TZ;a>NlSqM zI64<<)zV4GzCw78Ie>s+AzNGW@f!nRKv8P zx4)T>HOG$#OeiFTqnPK4{A}Nz8m7lm_mD?gs!ih@-NwX&x3wtYLlcNHb#BhwH!+W? zUZ+~k^;p!4;X<7GO^sHfOh?+w?kz@UIGt!13I7}`fV|}t!-Q$1s+{>}(k91wYfqB% z@igWZv1h`(WlxNiw+~%s^mtlhBvR5dJ$m(5(zJGUJhP3iGH+iTLtn{eGKy~fPq@4# zOt^V_{NvGCYe~y0H!>Mx$j(|Bj627Q`+`sDXGKSnmSP3XS!v^Cz;{MR{4HLlKA@ob z7UR?}bv#`e%C>+?TV)}9yv1B1(2)c4tru!oo{&XI4()j<^{4Q=yQRCk&(!(KVAA?A z)oYmbnA8tgT|R$Z*H&A`|5iN@3+1`roA%LS{3);;7F7YSducQ6Rv}H%g43(rw!Yj^ zKO~0(EO*%mQe&esUAJy57IlN(1Q3QlB(xy_+w*(8JoDAjLZ0_7ka9QmyZr#)gbGQK z$x)}io4d00QDBSH|FUIwLe+sK?Zk{Q)lWv1w7J~~b3Cegetu5)EZpgG9eTg<7JZ)S z<D^#Oy-Ak7fivKVPo8`8Mc#-dXX%#V;UGlqS&ouXOM{bz^YQsmX2M%Y!ZC zg6-|`5Q(iRn5#G>R1uyi4F>u#Y6Qmc=n&?bCTi?7*r#DJ@9*Nzenr?iVzM0(qY5gr znaUMqdVaV^UUo}Lxn*QenEO2Pm)W=FpoE@#Ujmn+IwKGpjD<2C+^>F*p4B<7_8wAu*mvlr_;GEdtNcuZAnzfOW`%CKjh!IO{&Rm^ZNE zahud^WHJ=H{OmH5abY8>Q%FtflLl9%%AS~hlxM_#iugo~gB9`VYJmiYoY=(|`NPui zhpAXpnKb=lFUxWzluQji6a;Bn#er^g<1~|%k!H>*3=9H(g=GLEX%j2lI%Rz)n-CH| zEPuBcH9UXzBr`#ZAbdAz+EUgJ%ZzDqmzO|MB>wYBM+a{Nw56RU0s*OIfrhaGArKZn znEF^OnB?9h6FXix66!wglRsCt$Vn*Ahu^N4!5VNMDH^^>+2?9WK^TYG9}*(zmbi<- zXVDs+uTpK(A}c^v73)tS6|CuqohK-DOx-7bR!P~nO)n%r!3?y{O><2ddB;{)^>b9xprc$JrtH@>PW`>b?+8BP{+)Cq;us0lzAmH0~9kW;gbbAy8rwtcyq-o*lIi`DlM zr_T7xdIveI3jYI6$gHm_IM{$B|eCNN-1z(r?Bd41==h`bJwpVQ&# zDaWXTn>&s)0xs6ZO7M4bApH3-7b2?z`V{i*7t#Yv>ZY++W(W6DY9t)k#WhYw^nD%W;U+qqr7Bv0iF3r)F&_YuL0wy=1U z@}t69_!utHx52l&EhT;Qn<3_`jjb*jTxG!0@3T(`C+c&p?1@MrM}*H<;GSD3LZD1H zNlS=O`aBaJQ6RZB@F~eWf+MRHrkzsrORTzf6<9DG6CEQ7PF=B{7cRw*nQagLlWl9& z1bhG=!JhAdBPdpp^Kq@t0V%QyG13TuzgWyoU_c^PmlB3+I z#mkUm*ACPM{V(k6^f@V{EjmhA6?T|LkvnLyt9Zoxb@Z~Dc{*+A^ghJs;++J7B`C)H zztk-8xBRTub8~!cmv{R0oC(@dLg0H8h@7m=z6Kn9q#oZ-o{(^h;Skq%O-e}m=rfI- z+&FANl3qyal0AkawJG*h^y~vF!bj+rB5q{*K|BY7Qnl@GVr~%_F_8h8Oj{awW)SUK zIHPX3T;=jq4Sqw8(V#U1$|O&Wil-C#E)29dQjYL>_P{XWdfqI%q3YW{;Q=ip*m$h6 z%2ayO!a9ePRv29%Y~aHs1#)r8FIe~`CaPL&Hmz`4*}N4VLKg0Ubi-zZOzKYFInE~N zj$9R83!`E^@_qcS7?o4U5}XrKWH>SDkKZDk6V1$RYA0)Ec!l)b1FaT7yWLxPVbaSi z_>A6}wn8{&DoLh}vPEd-hN9zU3&rv;CYqfJ2`2yCObexQv-l6#mVU~lP5rm-sJe>5RV%3Nf6=R1uAWxGBDlr_BD)=A9r&%8s^=~m4S>DXYiNomteAP zb`zg0G9Jvs5AD!Yj~=QXo4F~6t%-?Am;0rQTI+UrGUn!ZeJ7P*MNIg}pX-8$oRq&{ zKO`9;KP?HAON>OLOZ5HPc3t97oJ4U+L1>uiQ+7Geg|U^@Mq8JFwH>%yu_{(v)ml7F zC>sS{b$f44#`9**Z<+K)AQ%NLl8~+uat)(j6asITAb<8ipfE(FrKxEV@b$rDQ2xJN zl;3FK6+dSY+ZevqJ}qpTe$+4WbuQzd2HTG_BZ^wdCwvQ00JEEO+yw9E^1 zM;k)$WBhI+_fdfBULn0DS!XUE^JllH?bJl~{rp5$v->o*&dm_wUVm6zcsM6*SJ-s} z1tw6eO7W{60j-~MNgo~x=c$Ak(K%0wjuvVLhb(O_YjqR-m!5G-PaC3J$>Z?v8dEEt z{jk#?7lXaJu`dP*P5d7xt~%OvOpV_bvuM7ow>pvwWZ9w#P{UqHVo%LU?CazE0vx}a zU!gTMF8wu}RRnzMUtCBs=wKbO^;il|HXuTws~*R`Ak5^zbsi8->tA0d-K0fSCH|zu zk6297-zb^Pp)t(1iHwLF|10d2FjES=teH2{g>&}B{wb=EgeX2p(>wO|_I6x1M^wZ$ z=yf6T)Y+Le-{>sMC2^jNPifA31V0`xH>=?KkCdKB-7akfVy zs#@M%5p}l`)nwA~Q0@K2evr=#)27Mu+C6LD%Ydxu!;_+D(48$j73l?B$nOFx9G`FiS}PCw?;4sH_C=u}BXT^{1t0!|kp_pjG0eA91#HLjOx4V?x! zeCGPh`Z@kvzxO5k^kw^pIQ^jyz8T zC(+U&VhSM5R{SyCH57A)`)aKDLoDqqN{$6f#_ufpyk&8f+zWLKU~3v_E(s?V`-pVB zv6xOd1)O-k-#{a$cJ}}V3#*12?TW?z$D)5af^BDUMbb{yH_&k%X&_uJS%Gx;(vERp zC+fA)WtC?fdjF3QoVtp-W;x7$u0(XyBX^G3z*oiB-HN4y$5kdeetbpPx!`J0># z`YKtTzKw0Ksw1`(5W9!7+|w0A+ZF z7gB3x3D+PJARFM>0b)Pw(DFTG8Y}+eFnSnQW$SY0C(BPC%Q?XOeB zLC}~vg_4i2fi+n<#Hi{$aa9e*By(|e-a{l?73j97Mb^g&UwOXovJ;~bwK)Wo{&bWJ z)ACUhHc~>Dw@^XMUqxGRIvQt>C`tX8l--vZ@w(mrXSKPY3E7rOf@(Q?c2I3~c8-2% zEv;i$7@splO*3q!HNE5)S;}iD0r!=J!lrhBdSDJz1j0L4-4a?g!J9c`t1MD7`8lE! zkN5#p=dl{BG^nMxM>b+r%L23p9Rcpk7~X-kf;nu)zWvEkoFAigY{j=?MjU7Ax7BTY z=0go*S1qol0EhmN-xzl=hfaz{AEu`&76$xV_GK>=S0xPL^}$c5f0TPT8fBa5fg1kJ zBAz!zK{7%*vU^FY1joGJ{EIzXu7`6NSaODITM({T5|bB^+fp!63(@inrHz0;Z<82e zrPTfz#rxmG-$>$yZruK?5N#`jA6f^-a%XDF9x_OPxlt($niPcM)C$t>H9;kuR3J^J zhJO4oUqd22cg(vg(sNuh zQQElr#hXglL|s4iAj$D(wIOImQ77fHQ&S7X*j|g9U?-cXiUcN^bcRFvh!YdtQ{~d| zzapwgNwBKh%YWV96Pg`M(u-E#$Hw3pp$?I#1vV$g-u0#0l16I1%_GhX+#ZS@W7mq^ zntaUXX3uny%;WZvbZDDd%Hd7M5rCWjXxvh+boZTwXP-CsFAC;D1a3r-e3_djfkqLt zYZkQtCFrZ(w?zl5_OwiO4ci6WCDGQtnNEp3hM2g#?=QRO%pdbzhUmH^`%C@m%pQ12 zE$5Jj&0>YN*WOf_okiZjA?_>xqyjQs<|X+rlUL$2C_%px(CXNZJMh7CCAe^j3w*N( zrSJmesi};|jG81q4nm`$)pgm01-uD?$x^6t?z1}7yq9w0xo#&G{mSgyTf1JLF}Amo zGN_Fck&^a^=Hlh5RI&7SH2R~ztDB&XH?a(I$!cir;eC)ds5B(R1vWYHZ_=%MU82JE z4xj8&1&ptf?o*`Ep?{=Z--=xL$%dc)cC=pC^d|$QO}MGFzt&+b@{E1~XkLx`);*o+ z*6;a&4d14pBhzJo+Q_u*Q|N#8GVWz%W-)@U#hn)O7AFbmDz5Dz&-|CaCaKHY~fKbL?ysGsX`;)(r{D}pm2 zPZ4>Ywl&;2@iyY86N-U|Yk$xl#C_Up=5hqT>)5mR!4&CH71^L(0`J3d#H{p467Q=L zRq+?Ie)I^J0kqrq$lZuOocWpLJ=u{wmY7GzZ{86reT~!*GztYFyaZhq$E+;1D;s;O z3{VmWNaQZVlHN#!IN*I?7^d+3rIaf{H18B(%$pm2FOkiRW4`i3>Ki)X2nF|pC4{(X zp^2OCcb!cpupfQkZ%*YewA!tplogD8w-ZX<+7+F*(aXFctN_YcFyj*niWmjCU#c`e zh_BB`34S>gQIuETb?CyC+8HQweI8GCyJXwtda=UyLhsKf6n*AU z)&E!@FM`CY$+it{5X8-Y;1Zy6Y~|jZjsgBAYn#-egHV;lY1i?v<0G|bNreK5&K|7U zx4A##oXz}oBvs;FNsn)G{QlRWzyYn>gwn=AcDU?x_tp~bxz3nQjs5oXpES8HTrvKr zO-B(SkAK;>okQR3i_Wsmx`xUbO^%yGHU))vp^078v<-)AlRx$q0}=lTZtV#L3KdJH z8t{OH{!L7P4b1hUfhxlKhBj1%QJJ5 zI!94b%O@1RVE;;Z&wqkh%QJg(j@I@r5y7NF|DgL(bUDe#=a)9ZB3Wpi^efRatiFIWG?aB>vV8D-hgyR@I3hLamg*pQP5F!2%kB%l3&a!A>iV zKMj*;NLdYs-~9RAy|!Oi0d3O&KAJE~_J|L(q@gIopJ*Lg*I1VZ!yshq

w%pY#`% z+FgIyEc^Hc1(Q67O6KH@tC~VSVz4;hedpd@8#g&szd!hC78Ke1Uq5J_tH=8u)auq2 z6l|Md(oGT-_c@W)=-X;F(scG@v90uZvmQg>^hwp^&@VHP{>Zp{mYC;bVO; z3zNeIT4{4_e>x*De@{}e+c@v!2R#$;(S{^+btn@w{HI8ihE64)8)6#p@9*aoug5FX z>cxy>r1(qCRjP^89DrQ=wEx9*_buT1y4P6WHztsP5H}EK0wjxbk)(CKig+u$ztbD^ z#B6O?XB7HJf)#1=He7-vuQl9HSDE<`H6Yg_mI4y&P!@R_0${3tec!vyp_CX<>5VxVl*2^4PwF^2v0x-)TiI2Zj?@_Zk(-VRP-;zt=yeriP|LyBRTxZ$59o@`Nz+ zl3H{K$bC-GJmuL2c?Y8fy&QJT#9bsbls_9`4WC^3utG!RG3zkM;TpoHs81E5$&ekd%*2PFLV&zaRo@A+n4HDAbGrJ?qUdK%}` zfJF|UVrEW`C5R)UpBM4nCT1XxPZPXD4^45pj~p_H|6`~BeGjoY?%l{7h!}F;FUKCQ zr%8qUPC87xo-e@QA&^gC&MV|zqzdAx*AnDq;dimVckTsR@i%|H)e1GK z4cvY84!n9rb9@tgS(AB{4H6Bo=@11$Wrkq5@I;dr&1|%9^!loZ)|{b3l!ICOI}=S5 zxN=pW<3|Qqorbdk4RK^Js3b#MK>F$IA8PzE2Gh*PkyRKv7*Xi-7$i3mTXJBH)W2mk zJ7<-U3Ww^r;92{?uRF{-bc2jORyLlUt9MTOD|~^MZL6WqB6q(X$=9Fn39swd+gmw4 zfd;c#kK;cC4Xa`KMt~y#Qa$z_3XL=x|K85>rejD(@rO@?My%h$bNxs3LTJM%B1w}& zM;Xc+rN1b%a@aTv5IKd`HMy@rk_Y0&Gd@VcJny?swxjf2;hLLN718rsM+^2SZo z?KSCsniZa_;Gt^m!Hg@TSxi_qCfD{30N;%HFMQ47pUTJc<9v<}DyZZH{0lQyuy0mo zb+@J&&To%xf>*(ni!~ATB=bGnptu2e)ZV3-ihlbO+1u;-ygChhzeNiAck}1%q|#Z@ z4p-JF=;`TrqCgUW!T?A$$#p+03Tw1ioM#ahncw%HqT4x|8|E!x``u%Wa#}PQ$W&xx zKN?N9&_<*0rhAQsavv^0y(aQJY#a1=O1D}0dN~dzf4k8Qdi~30^3{*Kd&@J&QNrCH zY+r2ob%*z^JQEJ!G3DvvZ>HMH>2t4sSr$>27be1!`-Q!a=?k%bxF1UQI zBPqM?DPfsPOU?C3o=>M9QE5_z+mDnYAwowJ`3K#7EH4PUdMfA*xVeOaz176bW*}yT z=!ozD_8G*`5Z+IA|1}?5ej%ztoH$MYP6Bh{Y^yVRlj0Wb!hZ;!oVziw`fDG?u(m#| z8pj*hW`H3U#RMI}*N!v1oZEW71(To`IZ;ihLfm9Cv9GP|?$;O=+nUq)H(P*o-Xz_P z2swJ4aAp6>daB2e{#nS@4_Ys#tDrs8r>-FnKIfz!&26(n) zhF2tR@-(4ugf25~xR@wSfQU&v4b|5MxY@1yirj{ekMX?*dIA3W<@jQHx{1*r%uj6; zC!*NfGD+v<{V2yl8jDOmFV_7xb#*tO;Wg{67*xb;azP)nHqSUwP9QQ>B)b2@-{dik z%)MKrzD8Pbz&hSPN8RLCCsPV(GfD*z>^PV&Rwj?J-0ndS2M7$B58X|0>7aLQ*?pIA z1$D0ej@v*7IfB@LuA?B9BD|Mvvt_-T*YZ-3)d`+Or<(Fl;gY$8rE~e43nqn=pT|c1 zYpj@_eoP$%7E9$!8!Ff*RPOu{KD0J6VwvLDH}v40PZ*K!(8Muf)o-08z|b;?|Jo0b z9!&|pX%I8)dIo4yx2&=~U&^8sjha7uf134qH=WSewI@P^WRYA}>BH@(LbVb89XYP^a_v6L8XjtDu!C_z~*t?1%Y&`M7uLD^oX`|UHh zKlcjLOZI5HcrR(3l9GHkc@z8Wac#y5%ZdzdX>J4D0vq|K91BOxxMZ2Ub#^sA75hUv zU-MfnwNo+|dK#6sJPAZUBY4q%$V7hN zxvTb`T(d{R&vKWYYqReuMU`_qIIF3#{A-el9_m94OJ6F;`QxUx3ZGAuPj1J`#J;jZ z<&XI3>PQ9~#+M83LNe}+M`1XOAD;Jp}b^*08Da`e+Llf^H9)p5x{^!an52@DTe`yKFdbvSImKuS{2X} zeo#|6Tl7sFva$l4m3gqMs$u{r5!Rhnot-~*HZn{qqU&obmurU;Km*o>`dQ^5U~lL1 zV%@cum_dj30gQ|;aJ65c7IkW4@T|UuFXB01_OQnnq zsFXehv&yrDg5FS16F}kJ0I@wa!{ieil&dR4&1G#W8Ip-y!1J1%M@g0*Mon;eOlf~? z|J>1=xKezpFda|Ifd)=)D;;gyn0>XDk<+f%SZaxwA!bYCrD8&>-Tc!?kV)$;AR^Od z8=~QDT!y0DoR#_+ZcQ(tI%|>&k2#cbsgqRa0LZWz z3C4BaL2H>{0}Ms~SE4;rfd{FQr?sJO7O>ch(&hLj^`85Vth@G4tomIP?@3{W|3J$z z;bgh%_O<|auAzN#c6RAPMeQ^%&24I7Ez(*K7KjK?x$16N3))ag>nB?gXZ%u)(z`%d z5i?1kKYxagZ<8+O{9hn;!t#3uh4E)VcO_V-f+?QV5upcD!x@s_$>fR3w#Q5B2-w%J z?8z?TlqTe5Ujvn0T(NWExFLjBJ{kB$)B?!c-s=sFRcOQ383hVZZ}D5sQ2_92-sayV zA$}ms6IQ30ci2IIGhSVXm@^>RmSb{9vg?6dTX7OQFzVU_J?EO<@$ADHFtjAm3ce)- zq_P&9TP;r+V7aD;aG{sL)H31abit|?Hzj3A5Yx@)^qB?x1FRQWYe01#0X&bE#`GKMz7Yptce-w6CV>?(`4 zhUiCITV<&jdXY#_r^uA=a2y|c-hyg77tTrj$eG5bR#NhV_;0cT7vJcdf;c2m7UiH! z6Enl~&Z={x^-CQjLfo+IB^|OD=5e%bVQTEO2fJ3-CJqbxp5#E_WdQOD+L~7|C=l*$ zjri8H8$wJU7^yawHv7JX7g{V#8sS>rXq zYZL|YY@Zt1W)IcodCKO4E5-7SE}o_y=(r-W3}9PYjT0!$*z6#&ydTaG0PO#hP@`H3 z0jDhp0w=jYt&K_T^KF&!{F(-JSmSJnSF!1x`|d(OVDCS3*Ks6#b;e*2CxG+~y|7UH2;?NJ9aCK`{B*(ve}{##G&-oC56QZLO8H`7)wKdgVj2CXqPXCri2l z`h>=J(U+Y)K+h&HR)-vD$V}RD&H=D$148|7PZnug(%>MS-w=K25h<>hcp@EL;GFT1 zdRg!=*6wmZ)t_m^+=QIgbTE2h-ktd7f9L>+sTUX;0%EBG%cGpmb}7Vp1w!yb7ny#> z>D(W9&hwh+2D*Flv6!dvce>s{%SzxQOW)vrC0V9@MCii9^?R967TqOm0mzXIF1%bM zY?L1c+Ck)?Ea@&Lq|mQVz%qDQ=;uLmfZMPXy;*@Uzq}p!-DNx98hsh-tjsi|5TNYY z)*2Si-&uMD?!Y*+YZg^*V3L$MG$liAzhfgj%LzM63^|SCjjsVy{Ab_g6V{LaIZX)f z3heQJtj3eCNn`=)t`nuWF1J)4typ#LvVxMhv+H3R>(JaKXza&lFZ98a&scgi$ZDRS zuS-|4(aoqUEW=act+2C6XydnucK^9u_ti~s*cNQ0EaY+#8U@e4(8T8(d%J;GbT^*{tM5UFCsM%yHwdjlgSYY(|!PJot9UQa z`w7^Ve&{AmH`NsPBtTw6RLN0~Sr@dk;UQ3t$Pk3OX?H1PE9w-nm>f*7gfBfuJW#LqH*OpsmF#A9RX&OrBwxldtJ6^u38DNg#z8s&t9#Q39L6mLb5khTYG; zMC=yyCnbfx(bkD5oK69$$>|mv9}ZlpL&_TW{d57vbO}YbRqMCp(i!GFi(fo55$bR< zD23?n0j2yu(7*#4C`{V6>%Q87pNM2hYATvqJ1R+h5l%BeCRAKnvGFE114!r%r=sbPB|LV?Vc+f@J(?toUdA2P|5bksK=&^qN z9PWoIuB|OVZ*{e+m5gEs#$T+xA@YD?}#jnkgsRU$I z8Zxrad%g=({b)lZfa(m9F|@C9CM8^!u-T|D>zBWm{IM_)#v77z&09UIY{n{0A;RzJ z4Op}AT>dbjvU72u?hwP}3Etl+JUt=m5NA#2blc0})SRp3(qO$qV0CaGXC7})Y%CFA zZAae7@%f~UXXf}Y$-U;XUz9~ygoPRQoGT3XtUt zYXN|%X;BC$ukgHjyeSt{&pImxQJJ~(^8DtXa)th02S1rZDv0-Wu>H5YZazx6vqzXnKllM2_r ze-Bx7Lj1+BbFRj%76U+ia&I8XUAFh_;HC^>$2SAQZ3*b85*8I`efu;2hUi`roxPQA%M>A`Tpc?7R6XD&%cDPa`c>JT6ZdM zekt#DM2Yw3)t}j=+0pL9I*qrQxRfNe``77>$3dN>MOS~5f7cPJ#0zu>-*%TkBNE&N;$1X-_~?l4KA;_1I6<@iT9L~(LA!KUR4T}c5tT&0Idx7$ zk3i3C8HR>}BT00L>uvh&{m^!!!`->JAokSbAb0aIkIS~_WirbYsg@}dkd+DWo|DK0 zcx!xUX2ESf_cDljZ+@78tSvxL1vJ<9277{cMvff2%U}k=Z zL1AFj_+Vh{I6QN5yXrRC<6*crC!O_CR2D(iJ(+(yB$k(yNfMqmfnjLzM!NfSQ(skt{G^ zr9r$H2=aMs6891UkGw@Z;&S}1I5;Dt6RJ#fS2n58T zc7L>>6zwyBE)G^jG#JV7N&bnXATFnCvYnV|GF*T2^|UQ#OV96SZ}$i~OZAjuf7c8q zv9mMDvn>*n{O;wo*5dEXXi9OA@8R^f7%<=YDdikNm7#b!5C$euz!M$@rsBQ)|3C1+ zoFKx$j4q;YhQPtJeEJVc3+ON~h41}f{_k#TeD4Da|E|CP@UgJ4_@+9&HS-#i;jCiX z@$K&z6pf1yG4h8H=sq?fE(y+4y>0FZy5#06WKtzbcMe+06;LJ57ECeh5iehW5-S*+dzzXvX+6p*=$K~5PfDi%Vze6&2|jTVOIC%S7@P8Yjt5uX?52FO*Bo~ur-=n@m6{K ze)J(!9Cw0&kvP9zU!LdEs7#$ipW?{lC!r6jLC2x>{?%PK;Yn;Y zpL*EcpW|5SZRMdWg#+>Z{@Qa9W+8#<_dkWx^7@@vRG@oz;Smy>)FNSVh(q$ekS4lT zCBE)qFJ&L;%`h+be_VlE&EAk^%-6pQabA*8ov>+jOPm1gRsxUN3J~Q&tu_%u22#Wi zy4Sne!vayMma}oD1d;ofS>xw=k?V6yQv-n}kHNoVziWj<2d}mV?5jzHmlwrlnLV#n z@GA_L`2vmnfpI!~+q}r3#IEWI3`)RSi=S?^hn~Oj2@khY|KidI7&S%E6QRl;q@LIa zZdHLO1D4{WXQdYmW-4=D-Nc{<8Grx&-PqV@^xhEVeVyeCV!!KOO9>ccGJU(4eJ@(p zEN8nog9><^q;|9#)Pe=3F@SarfmJe%hFG|+?#sRyI8HLvISZ;|7-ZZW1YMfzWYTG_ zTfYAudDKjM1kx z5<^r&KEfxjb4GFjPWR)vm*;!SED0H8m_nYAPT2pygZ$@5!JXpo9u=bpRq&0W(j6Hp z@C4^u59SznR(8JTvh7thC9c3K4^|0>@zCoRyvIEo%6|Kz%J{mC#!D`e4RPCcA@VZoTK zEG_9dKS4iW618Nh-0M_DA{2>msLYz*10(!e2WTqK*VqxJsr)p|bgcX&Hh=%AmmL6q zQIguSv%Gjq-_z-Op1l@(8k;sQ9~lQaUe;2kP%vl5KNZ5qRS~sk!%^-%6UpkFV$478 zzD>GZE_}8Wxl2XO9^JprW*B_HWkk~Dh}SI=kJe1@A)MR%n=9Re4>WKee0)+$2s1~S z{&CJ2pkWkmXZyWhMZIkIj=_z{2lK)Fqa;d@s;9dJ<52Dog`b+HFGnUvi<2%-*3wY1 zb%ZW}%(*Fj^>oYOgX) z|79^Kkv@rXDb&>Ax?}_0+M|D1yUitz!zh6H@ibQatzDz)hY>1*u!dj`(Dj4|1ax}g z6WT#zbx6`o3ZpPK+~0)XLw!$6+KUK7a15kciyxaB>`p&1?5+Mtb{r@fM*PG5;Z6V9 z2>+NAWlBysX+Pd>SbTdF{vseeOLu)Sfdk`;0uNor=!?E#lXsa)@ApT_bCPG;;k}&` z;$)MW_O{?h?vbd@!4VQOx~w7#mHep*B^PIWZuN)~hVS2n(gUHWKVs>TPxYw_?1>9N!!cwDGCxYe-Jv)Kj=>s(32$j!t46 z=Mv@Xi=9JO=3$)i#T1L=wC#rQm1ZcN@nI@(-cO`jMU@f$%Ra&H&h`IELBZ4~yzJ}^ z@A>GKy3PmNc&B1G*4+Ny`3} zLo4d7#jXr%=jZu+Iy(EAXzzhiy)C@s0;D!w2!L78gN{W0ASnh)jeHgkWCrf}yeyoL z-duxP;sRA_ft2x`>N~rC1jCJwn?1*%#S0B{+sj(0)Rlx6t-oeVK#Yi*s>0r{-0bf8^! zEDNm9TC%b^BwOK;fRO9P1Q}sSgey6WnR*>~(9bqo3tE&u`p^cWM)Q9~8^aHB@Q5%c zOHC&P#Y!}sDrtAna2GN3=1p+ClTCR72IZjtm_Jc$tJxl9f#Qe zUP?d^ug}{vZx{vIdM#%WD>H=90QvrqdPWXiV^?g!kA2&j7fNsvA+I+L?h6t zHCOY%2a|m(R6!El$>RY@J*!7u`(x$g%^2_X_Q9SZngm>ZG{{vY6g|?F* zB-O`NoOevCwIK#B5N@)-1_cgm%QY-Wa; zi1w+$GgvuGA+MA&xRV8kyw9zeQj8d%HTHu{u2lEF7*Vp~l*>WEwu}5la`PW^Ts0#% zuLw?Zn^9HK0nE?mn+sorJ#Z;j&}oNb3#3i6Pj_}CI+Tdc@9yrNo;q`(71og8?xxoL zN<*c>8;fpg;Y7WW_x+kWZ|rj$W$2g*&-20L4RK2K5I74f+fnt+g0Bw<&IVULt{orS z`<{@Kk&Rx1-z#E*M`F`hICSj=c)gfvxt$nn{e%m4{-KC3->`YXpMkEO%WhKvkzUnh z+WWLWGplV^H%eCvJ)pG@)o_kQv^IW&s@Tu-3@r%TZ?c{bnmOC;5s%*$oJ*7m3I*uVZ?Yv&oJo3HdgmsA&lLW40eTgYRSS#D$Q8ibilE&JY$8yrxh=HBM#+wTR@ z&*qx~Ce;3dF6}$KeI+}K=MbS_*7;O6!R7*Gx#%RZH-X8Fe8)-y35-~g7u6&h%;;L} z0B?ye5=A(-^EfI+w{_o-fs!?|SXX`AT0+_SY_ExT;jHi9f(FCk5n>O88h` zJ&%2CP(cJHtANT~Pq9vt{Ifa17_%SdC%$O>!IsRd1gIs-6n;sIPrKIN7zZljdND4< zLMz@CTLIMjwjtENbiXU>H2{S1=OSaBj0tEUF>52*)Yj9he+xu|uo&9Jc%H3R^G@k_ z3%~yt%%b-AkwHHR(lGq3ZH$d_mfBqq4yv37*@|u z|Aen?fL2*V-?$*yrxuT_LaVvwupC*=MB}H@=0wnJ?#QbZ<&$KH(}2a0jr2sx$(y{_ z@>vx>cX{Lm-G4$-8gu***gAO*fcw#T1$&S7^~<_t6;ocj#%W|t(lhJJmoeTpT0E3z z7pKWV$)&mnlXa&F1cLREw0CL`QfG)O05301+*0(#N23Wxg>`xTv}+?~CJt?enTa*; z<}!yjE1IA`T(6{^O-c=l(#)evG(nLC|LT}Dj{6k zVe4#0O7~_57qGG0lT2s~-VyUtfSyFHNLVQ?A@-?;z0yu75)siqRAZbdX3?$#aJK;1gdtlH>7;Jaxu z_~20pAcp(T;9$607U$ae`T6awr@*QDI0*Jzxv!_7r+bDbs&9CI_b;smZtv!K+ngaN z)NNCNetv!qSyoo|>K`ze+u6MJcFac%On1x}@eQ6~Gx*Q% zp>rr$$`_u=Ce-GA?49Nv#BE~WV>&(bYNokr z+|C#u&~`wCqu91fctmbykc9PAznO|&JM`MT5oum`7H7q1okFY>|+itgRd1LEy zy@B3F9ypXwZYGVzP+cX1wnUyzM8|9ouF@Rb z9%gslZQ8YYJ!#&^0=9A?TzwLBE0)`-hj9sBsT)RB;ZX76PII>&wSPm8nh@;f|CNbf zX1g9k^Pq(O;A69E%NU(1&28JmbnONJFf|6S8vwxUz-|D5-2ecv8vp=y0~noee|k*y z6(0D{>4Mz=Hg>yDkr=xrIdJR-pzZc=ip1D0$$?`x0ByH_QY6N1Ne&#l0cgAZJqA~2 zS@!h&efh)t^QZL>>W$5!UK)WIyKUKYKAP<8O8X%ySwLW4DvV49Xo^F0JPmc zjlrAeS@!&m@x$?}ch&M{@!hNAdhOuE*saIV^w`ueUcE7frAMVlD!%S=;*lcXuHXGY+*dz^4W7|e!HE3+7Nn_h)W1}(uC+&0Z`@8qPA5Qkn zo|!evYi7;tgexmbA;IIp0{{Rd8R?Iz003AP=w|~94*GlU)UyF<0CQB85(89@6C8pn zkQSl}q5wcmEW)!f6sQgdl-6+s0FZm$e_#Xl#byA2#-z+gQFXUZr@!732?m@umsBBB z5`3==w_slcwjPXqmX+`CB?@}3Lb#g)eA2X!`x7iH2(M0|(6&hIY=^|<^c}u$$^^-$ zk^D#`9h6EnCv6n=QZ zKf6bU6x-e0IEYdEhPOBnk=^F73rLW(rY?4XIj%g4v;NZs0c*1n&x;$CnLdTBNZ96% z24U`~MwYZfP;qV-Lj#TM+EpVuYWd;!JS$6gplx%1=PMWFCTc+3M-`m3OfpHof}Le3 zclD7+QF61(B~l{U&dFCU30MRNolAk+riF!?5)!Kq`IoWVhtFG4+*<@Kf(4h-Q9W)v zx-f(kza~6ju{OyUL&f9JY>!vXnP6&Q8C|{Hf`+?bmTrz09zGzoTp%rWQ44yl|7mOp zHf}DwAM$kx4eFod$Fa3laRWC1mtI@sMc6_*qUrQ8H4Q?Wb}mNX!b79OzU(KKF(Lwv z`2`FcJX4)CHjhxu9x;fTs;#)|GkrPHeGa0jT+Q%h@Rv>hrkhwg{L5J${LlANhyC-U z&LzTTRbZ}BPK(i+ib~6!;s#Z&yRu5lQ1H`(up5LEYChu?@?u=&!$o{RH_m2pV{z%K z{!oejQIP+X`iOqnCH< z6H#6r2*GLm-_x!Xlg#?;Bzi3)DI4*qz^wzliS^OFb3qnJ5?K6R@!6%UO(|_N1iQSY zmvJ&D_EFjV}wD5Lu zLJZTvoVt!MHpw#yLgtuH>RL~#xx0ct{aTQIX2PBw>T0_rT^4@29 zZ=pBLeRz!$ITdv@!yfB)_<`vIC- z%m=fQ#IW}ghxq^|MLKQ=ZdZH{~R`t`qU5mM%NDl^mYS z>+x|@FMJgE^40kB*DBWyZ*Iuq3BmQnMbey*K=RFB#n$0yb^O&BXH8a$IYNx2m8(Wu z=S0xMWLiuwrO1oE)sL+`r|jsK!w0U0AqaHFuP{-_`9eUC3~TCx3^7FU-Ftk|R~O*j z1?%%LFskIbVW=xC=!H8Eb!e-E{%$1aY5AZjd%JpRwO)GnIYsMrh5ETPuARStxwi7e z?zh$_0=PI>pN9cl+7Pxg`x)#YjPLeHxQHkAbvOqEQ(ESz7oG{<@&qF%9hAKdPi=Ww zZBRBG>Nob!%`^}Jd965w=SsZjwQ^kjby)g%Sd?DVjDHg+I*s zm-R{Sl5OVRL<@fdo&y_F+lCE14o>%f?CRqK99}u}vBA$SYa*665bl{t;pswqWHAHD zfh`mTU$!&COF@0_v#{-wfamHOXWiVD#LqDBTjWB*!!r^D3#~!yAZwwoT76wN^i@Ij zD9Uq4jNI@#UdnhtzF_P#r94nT^&0<p${i zza}fo4rbr4Em;qeI?6QVrDx8hz+p-&WEk#gB5-}viZz(K_o-@CsO6rK_W-RDE3qQ; zZT{j)E+;+njW2ZTu{{Z%r;m}VG-SrIx>Y;8{I7ma?&A1MyyU@R8JJ z{>$UB2I|o{lPfxELF1E`1m>G;tTs3WR3yUWThM&GNg4J^sqccxt3otT!qJWS+0GV& z9J+k@Qx7usVF*{KSzpWDqgfYG)2`Y{kM{wOK6Y6Bd(m)31tBjF4-?Es>9xRuz$sFB z1O8eml^0E>A8eR7jbp#KHi>^ArA-1|`R`EyRfYU3KdTN^4n;zV2?$jNm^VNn}J`+Vx{b>q!&4JZlcQl<#UmD$Xn4>u2-BWQEK%+K+?3YmB=A^4!u^KjlJ6*_U@ zdI0ccq%jQ3fit{yd;p3KlK+yKPQgw(su}-(99{@ z!SzuwhLipXUqcnXTKQN>8hU(j+DFJ|&U~bqS7nLJK(}tD4aXbzJ^a*NI2tB$G{|m8 zB=ViZey9OarbIDxJi7{hJn!hE?2%u2ec$D5?BO7ne&OkM8WGyl3eJ$s<8QTQm1vP> zWub-gghw+Dj9_vHC3u>MiE04WfP$8n={U?2Fg0NkctxYq`y-Uvo-kv3@`hmRb|}ua z8RT}ueVz|mE~1AXJZ~UBqyu|;NR2xjllOFuakz-$XA7Mtu{)r zJ9t}w!rp{iBr|>piVK-k_wkp?cP1sOt?8!x1;V9lkDd(v%e2gxAXsb;!n>~QSpzq|BQuuPjnHeo8aZmsh{+bNnS z)#B%EsWmSfp*y8r^8F#zH--%q90jJq1l8kq*+R|Q@nn9vk#fwm;gl*EgZ&G_zyo$Q zGb1{ZCt6xP0!p3;HlNw6e8*~VwP%zlvj~I`PLuseMx00Y_?6QP(1-Nm46&5hsY#d0cuql z%s2wg;$caS0QnU)pZ$wMh0h}Wl0*XpoEXvGdG*wc8L~nxF41E^z0-NQu4LB(H;)~2 zMe52tnIGNc(!WRx2I1t5tj~z3Hj&2|5buC~mqtoN6tSqdmX8i=Gi49%CIMe-?Y2pr z4=hXx?bOq>!U$d$Pf?t-$1F ze!S{n=@Z*~XT!sVFgx{Rk0}heuaj!IgJ4~tzEF{R9v~N;+xKN z6jVTo{PtBq=wY)d=A}m%2w5rS>>^cIAmgaa-wi=+ zQ>johw<#WaOE%Pvdf2Y2W3t$ z??aLuFTW2WC*;(ZtsZUX@_Q`I=DZ$p1uFG@LwrJ&E~f*|v@Saz17QwP;opP^f9KAT zAmYBrK5rEr%fd0QPjvjcOYnPk>bTQ<`Z4hg#ag(5;Ji(i+&-$aNOVukZWv_mV*J$Kc;9`7Q4LKs59WxHyPen1)b z!JeZ_*A}mQuJHYFrB|_ceq{}@u0J@J8P1>sEBewYbTIlo#WM8~=3y5XK`)wna1@`# zp@Jh^|wJ-%x|eL)gYie9}&Up*sRMsN2mi)6}yY)~lE_ za?8b(a>GWkpyfIxcqW9T5tI+^t8JSHUUj2(l+K-t~2+qZCC*jqJ*Q|u#z*9YaJv{}l ztPz8TeBG-}s)J{W3jNfE&1Ml_k$1}^PFV;>s}uqomN|kn6Bqn&e*pD@H502038qHf zZ^%OP`3g`CZA8w$4;(5;aNDcdv${^ zY5oz;h}BhiVS)u##LZX%``gMt*aJ9-8%SPz)AW!`OXj3SUNa3VxYN>%0_+vEa+8+AKYQ%8F<*gTiF~S50|1jyMU~JRj z0B%>WSV_xZ$>-_uds6>wS&w$ZJ6Vq?_Zcp*RALiLghoaiu=j~ zJ2M!6oC6VG?U_Zw0V&#U-K1u(^v5juVO; z5#^&NZ%q&&_YggeqHoYoi$p|dKJ`*}WX@R4nmrPJ1PTfG0@CGuzaAFiZW=Ljh2}(v zn0B10fYtqx6tu9UB|tOgU4~%W5{-G3z>{X3Bb1FqJKn7V)m(-!IS<&=ryf+($9`k1?MLiD+6}2OEY0=rH`bNuaQxL4*Vw1`<`>S?A6b z54}D_+eS!!mnfzLh7x6@!@piqaE67l3{Eo2R7mD0pl)-c7mL3 zOQ&dJ0E#^?{hdRP9NMfPqp+<{_ptrI{B8X=7bK|4-mn}>>=X8Ou#}zRxTm(Oaq!jl z!CU_mQMZ)3_{H#_fsL$kK~CORj1aJ}RZlCn+@vGcO$Q{fFC=}}6;uk)lXZd}hwzG+ zdS+VlyP;HpA=}c6+J1UST&RKScFIvs^sg4Rql6$@@Lg$8LMNrGg!LA^j(6-Vt;gx) z8c9iz3M_Nyl3#a?K)7oPAzk1z{IYBou)(TkU7mKt4~Ye-NVI0YeKp=MB_xloMeP1p zMkH9ZB5X>Shpe{0jfwWvdGVhtQ~dAlkI6yc^5>G@=QA!FBBzG2=@*m#r75?!o1oP_ z#p=Z{&=fOL?{lrNv*5C+;tkEAdzQ{7oXb$<4x`=C;b_uMpAkV-|tPe0RpNf${-*eI4+TJ}>kBu3Nny5(sY zBxb0jH9A>xgj!u4n8=goW4$xfKEX{)aJE1ROp`P&#jfn6wsJ|qTA zWUaw@S(XkiB~Tm$+rXhlK@OQ>HMf=Y-O*loI#(j{eXifwoYdC5NE0EgL7KuvDFZLA zq4C`J{3%w@;df~3+fyX9?{k(^jDN$g>*WYzoX-5s#B3*etX;GtcW3%dcp zY?&0VMsIN!S$az{S;;4ig;sqpAc<;ymc9GH4lFXHhd8DI($mG_;p^D z`843`{4)Z2acgb(^MESBw; z$*Gr)!Y_l^IZ(b_kH7!iZ$3Pz|`3F<*sE99X9bzCmz?kY)OjZZ2ug3xG4LWP*S610)R`j<h7$w0t;8a1%cQRZ!J`vRk5bCkob}rx=z>=p~N~73(6jo%6^v zr$EwIU0ZKYC=AXV`J1fdM$E1U6$|wxFAf-y$NO)ui z*(1Xx*{cc#cP#;#N0OqD#bCczAStn8HN^^2t6iJ}F_XWu&8oNWs~1(h)QgY^R4&nd zn`3wDky@(opfZj}bR|4Rb!#|oF?_lHoF?1v!|y&QNe8u_wiK~=u->YQa6=bk+qJ>6 zSGg(7%9v!da>e4h?n|xdiGC49znJ9q=UjP;N(FsA&hq5->-p6LAn)Tc))2V!2Ahmy z(Z3z0w~SLI%Yq3YRm%xc$N5V$xo`f2a8;2vNX~LzCOjX3JxLvu>pw2z+KR;vF1bc7smW7Rly@($^7q|u%MLe;$5hd$#Mb5JY z2z_w+yqc~PT$z;({wKkyIp3^f(_lGd}jXupb5w(Ixe`- zsYDUx3yYcwUn`&1kAtj6oQ1zq!6^fC7ez1268w5tED8t`)v<)^t$4zywNQ+}AE;2? zJK{}g==VtoT};f=uvUwOopj!Im4H7>NL%j@bn_uq5SD27Y@Kj4SI0!z?}{` za658xlyoEMoNLChfF}^ix|sa#WKu99!K$a?P3PDmK9rZxwq~Z3Spn&i8IR`=-ic!y zV_(OEosH25Ls*Ix2k1l*_a?i=B)=`NY}mjOBzxXk-B5tk5@S+BK0sgG;4uEF&k45c zttX=w=G_-2NV{Cmg}-K?)7x&+n~iaLyD}{4n#=G11|Q1Tvmajr{MSjhp)p~~Ko}K% z2dUG;IzN_<7qMg(3i@MIt75+q>Qe-or)s^GE!WT1(*N}LmSxeztf|7Op_V9XACq*| z`cI`*363(qb((SelJq1XIE8GGlxoB>O+30>4De_r6iIaP?GuUfl{AW!EDFjl4P5QL zzfQT*IzLg=;eXEp8gF9Dk)7sFE5<|7sXpknsnQ**T}vC56qh~fN4+UeH`tlYd0`4u ztN~Hi!q)%oKPa6xA=x-_7Xpp2Rv9~yr&E#tp_eglp5OXcgFwW~O1kbQj@(UH_2B*) za%yA?m9!5#R97*!Jsn%a%->2Qxz2_D^&^6|+-av=AsWt8hK2d8^U_Jbo{O$<5m4GEALYUZFv{VP2EW7DBJt9J*|ZB%Rt`%gK47By`CPaHM~ zp@)8qB>7#@IgC-C&}K^Vx|f*@eFp5&HB3OciB_gfs*w7#rMbQ8--jzo4IN zouyoRC^Ycvw2^zAN)HZcw*qrsjz9@@pU=btJ{#T-YAJ?~-zae8{6TgisDr<_v@`8W zW$*3jaH*FVi6YNLkObN7*=$~EcOtn~pvJvtSOvHM%X;9ki);>ALh&AxZLtLzRAEzN zzEo^?eh;TY2rPamO7kv;Wn0QmO#xU$HyLP;t>KSi!YF-g>_KZpNa{{`rB3$pf4T0R(Eie0 z@rq`A)vv{TvIdz^&{w>R5paV8@lLa-040XPW3W238hg!11e@cKkwpzc$~kW z9*YGB4oJ{@hbw?^+SKceCmHx;f6t#6YWC~-%+J3R7|M2kwy%Te zGyY}BgLwSARMgbnI#eY9q?$bkO-ltEQ11-ksu@3<{yeDx`cIJbQ@ukMu%Dp*sJ zYRtR{y0OCY-w@UZN0)U!{@0*J@^7Sgj*_6Nu>d6wLd<&{dE~+`Fwj_ZF!vTdbPoQQ zq^);IQh~4BN4n%j#dw{wD%*0Y+l&fY5BsU)fkAxx#*U4h*n`)RD<`F^5iX5mK7)zB z7dZ+Y41$F@zh|-EO{GFPugNDp(g;qv{O9us;%JCqDxgmei_8$h@PD|;8^-*n461G$W#VH7h&)feGk<5Goim>2g6V|a32=(i z$(ZU~jwz4kspjHy0s@~0*SiiTzs8h^i(9W)=i&2m=q4%?ncD^$QCath7=SGJ7dfgx zEp&fS@KyGa-@TvC3b^vdvUx#nLqn9#3JHMxz&4SL(A>7a)Cjb;fYHscZM>-tu6jVs zR~wy;%4Shx_aL*js%rPJv)E_-B^p(L+mC3baC)(IF7$f;<(J?EKw+0H87=d+ByKSz zQ^;FatUy@|P6d2$jnMI?;}yZyO5m4s;4J0@mXjJ<*(PpG%Qp&KLe|KVnufLayAM<; zib$!opQ|PGt zFtfCXclHRj;J#p=pf$Gh%WUck|^0(2;xF-4|TuqgVscj$K`b_(c2Mft2sfpB&$dF)5$0!p1CC&YskS@{*x#zwNr5m-4jqDR{L< z`5wy%Q0arYm84Q?39cY(g1hzmUim*&<3jW6p#P_x@!~i%b`5y2HFe(hJXJyL{k+$T zyxv9w7cs72dv{Ue4QIaOd+||4mG{_sfNKDqh(UFTy-3n}fWk@!j358y>`QfB(S*;% z{lq%q%Pj)8&!dox8b1fI6bZPV%4`nXzZ@QLt zmw=cQ+*^x$-@EApIp%hUGh!*%c9zHPKks|61j3|3m(D$K^RB0t%b}@dnQILrRqJI_ zLSXV(!-r~7KSnqT(#-f!aoBS{wLq4QM}{a?GbS(CGg0i`Zln3~NduMe)piJoI6`m= zCTeh2iI!Q~pme}73el#qO|x$2v6*%qhLp()L7htiR5GT$MaTX5*IK;ArGr03K3iHo zN(qF~3ekF8rXLVDy5i7!Hybrk+OIxnFK0{i_Z>-ST4xaR2*7IGNhY+FlhDnFIOA(%QA@DVkbwsgYwn zQ*M~NDCKUl2Ce3&rmGeWx?&65jQr=3S!GPa$h68qjHEmD)a6ImTpR&oct`ZJ+|4P= z#M^vltr>%a?dp+kkBhO5>l_IOb%Uji5VsAC_G@{xUZGy2vKEF_`1bF%$XnxD=4*sM z+aTpkI9*gQC4;TPC}=mF-D?w2kz_YvOT*%kD-%*kT}TmOGJCDKxffhT_qpa{f&p0h zB<5X?t_=>1`UP|x?|X5_1*Gnvnb7$$EPtykI@CCHgJg4z&v5|{`rhnQ4alC(3AIwi z=@fx5SbH9~r1p|_+j19D|OP~N=7 zNp(>+^_r!V_{l#mu+WKxDRvaY20-ngo@pY_N~tr$A9>)U(_8#=IJOca#4K8%Oj@t|Y@!tdT>*(N zw{!;2A-?e;70-Hn#_+4ELg}|MI>*Og_>BG()vu~>3cCnHoDCQ10o)%1VXt&V+k9yL z7{_D01;sz74xxPZ_nvM2b%r0N1aVie0n?rT!(&qlrqk+S=vxrC@eKGTH3{Oxah{i! z@ZD4=&ThY7pq$eZxqB%QaY*8ota8Y;r&a~sP$-R3bXt|Hgb9{LX#G{~T?+K;vDUF9M*NZyvfmSrFon z_LC#v^I{S0q=-efUFLeaUAet6wMkB1bd>#0_%UEaI4=xEB`ITz6X9if5cJ`FIeGfE z*cdUS)k#~NFQi4=KePC`+HzsjkB%T!Tt ztD}1EE`m-Ehr3;-Nb9g$ooP9`Hd3b7m-S7vTW8P`GOVjjdq_T)vNWy$x%~=u;6B+u zgs@`Uh+9mb@@= zGO5HrOJQ9|sO36q=>0hVd4A_NM1m0mzX>0lK^oqD-QYNAI}_CD7Pzikz7ai&5xnAO z7)!8-7wz?NPjCnyUysk^DE&U_IblERvu{pms-hT#8o$T&fip}HWh3BzHR^pwlYrV; zrl{4FTp|iE+>c>)l!6Er=j*@Qt_`2W-%#;WV+~o~SEvDUtS>L)$myI_*jii$ubC*u zDgL~No%!zJH7H9GeI9*@Wwte4eZ`-OvVD2;8$;?!yKqFhM5Tp6ggST*QbbTrj1~ZS z9~H0+B`Uu^oTMOzoSwcsXT2bFImF!4K0W*0xA62NXJhfTsEk-TT?E-2Q9);6_JVjR zJq5+{ryBrLLXT8R>{hA|N-N@fG@TlPCkOQGs3#W>opsc$Xs9|~f3>b5mIzhA zd@dW`_?h378z{?S1F76YO(ywc+_L7A+(dGZOFvMaU9HvYfsloBQ7au!2*%CV<@MNJ z(39OJVUG!)o1~r}^7>{F$r12te2I{`>ekd(kc*4P0fAY7ADs>S^9MzAQZ-W~RP>HM zC{l|qHf=auET7Um+Bnk{U<;f3ue)hnumk~wAM{|d;7==?%iW~#Mg@H2B&C0o!VUO31a88z;Vg2C*!eZ1wj|ihcy{C&#f%&L|1)UZ2j+sO8K$( z9Rm7KHctF*PzK|FmKughS4RP~B(bJ_)qcKS^dUL$BeV%{mq|A&JA1zezwV}LX9Zwc z-rrF}IeoU$5O22fQxBmT;0gOEuHaEHi)2c6mT&=p402cJ8obz~UL*sA3V1<*q0W>4 zxM#+Jf$G*icC&~whBY!TMv1nqMhw!|!E6aIFU1Tk!PCo(q{#b#ZL3a@nG*G;LJru1 zc3fhomYBooy{OXG6w@ly6biyeitA7A)k4ll2$`(z)2FWk>?M9}0RB?xNAdaTCKMFn zl0NnEemFb|;XqV3VnA>|pn&z$eO49{r?P%h6kRL<^pkja$CdERkT7p<7Uy;Pk#U?O$t1e;I8 zec9Is)`&2klYYWhNr;S-=1Yv*c~Nut?N%(AQG><@$IVxF}lGRd8_sXYimuO zyl_MV<_Z`Y`j;H8Hd6hA1~=ct;8va=E~!0EEmq*ePtKARq<`@NW$6BPGZ%0EKP64p zAi0TCk*U-Ij~I3=#G3M;O8E*eSZ)uid{Giyv^d-fwoS$_lPji=hCau6L&-5UlD&7ppt=3;p8MZ zL~^uqE?rF4rufMVhvO*qw^NN4wBlF`#r_NVU4&TdOhj-dc0>Cp$Iwh7`LPKG z%q9vda8iyBozVyA6p0UnZRKfxGHG!2pk$X**k?+RI`4`%pH1i8MGSoDAr)^7mV`*z zP-6Y@w*0Xd;fhq0ZHW>aD8``VpPWZqE8P#uguOG}mNW#2Ks~wVdKIPn4+;cvH)FO) zq%f-kp^z!wKW>g*e?65Ecw1>|*h}93Eow)Vcm8gtqpK z`WCD_K?t#)v*JZ8NG`zA96hFT2t(*dbJHTMy^gm?c>aNI_|pgA zAj3B=oS)ZiUZ366P0YFgFf6KFrUQbw8(3Vq5#^hm?QWDS&;zAAB$& zR>}h1ecNXI14*YT36%dus*iXQBw_dxQOlMIjRgg6l?{dThcA#lBpeiOK*nzmn*!l8 zrS(7ucOnygoJT=;wTM$8V~q$(uYjm_dAQNUyFEe3RbNmhqeMc@k$bgGhkKN&irv(WMw@DHI=HAM85ISL1AG{=#8|cM!z{)h}JyuExf%4x&J`qz`XPre&#H4wRk|vo73|ay3pYMpsjF z;o|kJB68R+`wcNQs}DQnrQ2rWHYPo-1Auf3VGO)-g49a?qe=x^?X#R%AxctS7N=5q zYa`;Lo_3o_2NbY0G7WX;AuuZPS4}1WkvcCw7JK%dtSKx!0mUF?h0vb;1J~?92%cX3qn?V_ zv5At$|7N7zwlXshi#@b}T{u-CjsETrV9tqzDV9a5Nhmd2oVNt=u{%?~B9>G?=p?3h za9%o>TNHQgLcHAFGoSUZ7knf~A)X9Waur ztXE^8vk#K$=VShd4n!N+1xvJlN>kGYLIrVrR#wwUo1g38v>x9==PRfmw1pKVJ&PIB z=_D6BrzA)@X$o&2kE?_)dq1Gk==g&%?Ps&|5EnNHQu+&G^R#Cmjkc$iyyFze!dYF% zf8LhZ0~+7CJ6q`TYydCJ$qR|~=NoMKsmUfRoHXJ{U_38>ph5=T%Epetr~_a{h)B$@ z?)(=Q?I$xMEjWasdfO3`AC-hlXCZ`SPm1qV zI;@*Dz!7amULhK?GwS2MwMkWGJf*Yf_YdGC5b>yfV!Zij@7!RqsDhp^JVks*zKY(^ z99sl}Oie`Vjs9)!O49|krpX}?hs8Tas2$sXs!P+Q{||5dta&dK z=zcE$tJ3M@2_JYeE`=NWs05Z2VLA=I|q&*)o_PT^#hBq45rFVDIyGp4Hi zk#Oo63AzsY6&)g$;C_8a{dSS-rtsr~c5o7^`N#i-2B+Rf*QtL%aUAk%^P5wl zPMHb1g|?A#*&E(@35tAp(Y=kL)ncaY|K_-nGSTanx25@4>mPpi)JY{vsAt37$#pF) zX>cGsxPn@1t9Si^-FXV>)sB5&x${MdSgcixK4w=@E+B2gL0P*uP1Ks%q-9rcFURWUeWV{diNR=XQ0~ z0AUA;g`kM^ekBa?N%rqVS`Z)e1P===l^XYUb$IolaHPVnGuQm@3rw^*Xl9ngDZ465 z+Wv;Xv=W2%XXI486MBV;C(>0hBueX*0D5pW<*Q->L1m7`NKZe9Eo{TI2>*+D=w%MV zX>QZ7DvH|Sd8)!hkQ02*T>sysqc{7{<2fO2+PSZjCFC1_i|zDf zY4}BMX?yd<%qlu6l|>Do3rXH~!cexJ_rl)9y#e&v+FFW&;ya~iE^0tRF7k zn(K2?UqKilk8~G?&8~*eHzse(m7cEKDjko^-q6kpN{WLs`Q~JNJ3^&DfTErL-?>&n zR*zGeyJd|YmZ%?{&*{cEBOwo*JuJ!5x<02%7AV8q@$85_H~>ta(>bjP!Hdpjht~b< z4uH&%DNYEhR_T*|f^Tx8b8^in4UmY*rKwGj39Q(r`XTZ7I>W>&jTg#rD z3(*mEO#m9i@~ht({lnnN%(+1c1x!5NkJm`tK8Uvt@;j3A1*27$E&hfpFOkGiIgd)r z?bp-m>+5eVPu@VYwl(j&HA)|(wPZ&e)YWBwVJtN`=fmzQh1}{JE1dpSoESsXHu67U zGM0+LhM)`Fpc_`#y)UunuMe>~K98Hk$V{Kw?yo`Rohd2e*FEk}Pxj~jhJi0Fj)`6! zl6HRjOKy>E{%`wy4(kdcos4EtT{Z^{OkM;Ol-&LO@VNlL9TGGMAzFl^%Q)Cxpyo6= zX+Je>+A|B}H!RFv)Q>w_{o0JZC-A7bXSB3s6IPas`C|vOe()W)J;Y~3Z(ZalnfDtm zZ_mPOF2@zZ_g!aquh*@HPs_jV)?GKWe48PBkg{do&dy&u$U6GhKbP}cE!vJa!^jl4 z6;h}^K=0FNf6IbNW{tU0r8-A~G9W{?KNDG8BO`&nrHS@182KbO5L<(u{CE0J` z3rmw|W~gXuZ-C$dDpb4Y}!B8A;vh7VSn`w>Ak{$zqf$cqs=v0HIyI$YLoN-zip#c zxFIz*sfO%`rb{dx<~aR+IKp=`V^sp6PqQ8Z4eygS0+GOhu<;4{DDNOga{{@UU$6Gt zT|gJl-pCF4I3L$iq&gs01ltAE|cGYffc7o9_Zp(Y~!n7y%X4ULVSpFTCiRzw^5 zxjoxXfM%gsQAM~yFoO2A+Iyg8YKt9pIKHauHITY+kdx7ZtL}!okbEX#zIp`UG$7>j z$M|%LDsgDWLfCCL+PAlJqeJ-TAE-s4s|O1qpBV$^N4w}J>w}Mj8BQ|u+PRZA{E8p# zoV*+)tCq_Q#XG!AJeSRn7obow%tgfXS+c{vH0^aaS@naN~T1-lkK6B>co?)&)eTWc_X2$a2^jK4mf=%YQMWJj6l zkC}GNw{*9P^?k+w?h|FLWb?i@2P}#&z3amr}|&!{nhQ0yE{bN|b$7m5cQh3B__h@ebyj zqZaBva;QkU4-s6ShW5p`Eqi6D*oLL(_KhtTbVZJo7CUNW>~Pl>s*5*fr%y-iEhHy^ z#O}~z@jC0t;d6BD&2c_u)VgIT4B4Gfk?QiC-sr#>mu_F77m!pTNq@N8D?AeN$C zEZhRdg1vy0NETefvZ_wqI8Zdd`*E>CxnPbGG!_zzSyko_^ z@c24vrMaV3N#;@AB72kC+CDEAHTc5bIk%SA5VzrXmiZMH_RkHTqVjCtribtG*1t>> z@_0cjG-7u2fBsy7CHzw@Yt9Er=BVU)la#t-{e!qnny1XrWbTL_FqX23I4j-elSVOw zIz!W*>J~H-^3FGnqVYak)#X7n2|S16658QZ+o1yE=)T>}vB=HFcU9tEz08VzU19aC zkF|@*jfIYnQ~xuf{JjQb96dNZ|7_|1*h{Uk&lpS8=br!9>HqYxb#?q^?A>an`#Bak z7NVM=>8F-{>IM3)+G3i;8A_II+)EX?eKXzVdK`JdhNNLC>5FDfTGed%-U7J7ll9Gn z``&zs#Ej}=$y^jisaeZ~(>}j5eUe$Gt_9i+X5%L(CIz{}dQII20{Zzw-elHD!@vv6 zM8|!%gD5k+{u3swo;-xWJWkPLW2Y$ibGv>Ap%M`xbY)%j$w+jXMF&>Y&ba>Kb-m*sS;EudN11{nMOj@1VP&S-@qlD zCp~Zo^Sd3{C76Ho(0=iBf4CC+C0{CNDBgEtlZ5+>$0c3-Mb(xvjkpp67!*K)LH%W` zSx8#3e^^Wo)8jYApg4@gu%if+O$_gk=C&`Y;lQBS(ZUc1K}^03P4oKp?2qKSMI*S@ z061O|PIo@CZ{1{q0Ze?{`m~#{P@*)7)7@Xa<1(X?f|Kd4du8H6kt4oQ?^wEAeNheb zS5_VJ0|CnmIHF$xuM-S);EcasRmRv#jDz4=9p&H8W7&?-*;r*@r6QRP9T^*V39dkq4u3W{c7crcu=5OP}8&itS5j1Nfq(H@J7TZ0SblFXDfZ}rv|-LC{jO~R8?JkU7nP1X0{49+Anfx zK!YO+uRM-3{r~53YeDiuP?|!b9pY&i2L~yMV~7|I4gG1#6Z~ws4Bh-K?X`d9pIPel zuo&HvcHKCJmd7+8p#x^}r25;elYz25^|YU)4`USB^iBSsC1>*R*HJcAUX^xIlDL{+ z*(`>bfdt+8QWD88XB`0%R5TJ=v>&8Pt4!vbni7B0Zp#;;egPQga4Kb}!(G9W23Sco zN6BzenEhBRb}}?67fzIj7gQi=qQXc^L+k$P0GRwLp}<4tMNXk?d+5UI-sG2jhYQc)DsI~mf~heU zywecRM-1tJVWvMZo^D*PDA1W%10BAjY}r6SlCzMc7FovGYelHWlXB=mTg~Ckzb9c;S9>(#n!4wdANx-Cfyi?)q{D_raw*Bv+`oFw|=`1%E!HI^E_oK6I+J?c;$><4_hHa9|fnyKo42#U0T)M zo?^N&NwXbO)|^zsQ)R}a26bbRNYd~0$u_#mc*uFkQO1JBtck^{8vYXL?CvXF?c6MT zDB4Y{&}as@ziO^QaeEKedl8$D`Hyw~xBn-K|Nrw!Rvj+S_m|Z;Y>Y4J2k(itAGr)k8pc8&z*bkfD zE+E~UD2uD($8RA!>%IE_I=S*dD7&`*DEl5UmXyH=$=G*kY!O02mW;7yqKIT^l4Y!U z3|U9^U5tHavX*@bBSi>M_bCY5e;=uuT+iqv#l z9+)+eUZ%B8p0%U?rb*03ghX~ur{bJPvoht&otzHph@Ca#3|JO#!MxDY0`iuYgIvSa zkIzplr)b%-@$6RvAB33N!9LBC3j>mm=7aC~5z3SEhlEc`NB5_FW(m_rUw(y$&>23` zF>RFDkxgt7ZVQ*_i>TXpKFHR>hBbmETSOne z^;{whC}iLTGanKie;^a#O)`XR{prKc-Pj*ihj_QxCydk4m9=E%IlzVO%zNzDxNvq8 zqp)H2t?E=%x&`y2WabuKajpD)D~md-%iV?kWZIbBCdH20Leu^X-rlQR<>i&xIod{s zb6evs%rK7w5i$peB-l?#r5FaHvM-v z+8Co7{3zfDV3GpB&=J3Paex>T?eNQ$1Ce#-&W_O$1HUA>p0i_*P zX>+3iVzjZae~y$5n=+8l91M>m_KDn{SX|)hDgpx_RNp|dh;;S#U4eqAe7-P!o1=Dj z)N5cw2yjyG<&Tc@`O2pj6x`%fr7MY-nOGb%!LBF;gHzkqcXe1Npyfe54q+(QE}wcE zSsNJui{~8i$#x9RucT1MvVQSNdA=SCAByzQ`wpF$_Pf*3T#gH8{x)IS(Ou2(;LL$z z9jx8fohB=1UC&r%%Nl^tzrIep!ytmjDk>JIXTB+4U?PiGD9*3AUMdDN6b`njDLP*g zx*<{UEX1fdLT@CVg}MOP(XqpDD7i@1evKV7`Hj+N+2+a;)K^d&yxvCb2s3Ap7 z{&ykf@jWdc!`>889Y7u#*3%E;`o*E3SG=b=L-4|m_P=$hHjfTFJX6C6$XBoa3bJ>5Vtd&au6k zN=s`0c8u7p0SQa_Ug2@8epK2nT7*11i2Kfs4!g0SBNn9sEA$c}FD;SVoHcWmoP{Df z#!h)??`?1uMY+BN#(^Rv^HacMR}0tDv$I?_d;3OgpsTzh_;Fc*QkWzS4>c=eZ@O zz6BhJ{(SaltoEr#m%IE&pBsKb$;5@COv0m3ZNqYg1`e%*|NMEPY@We;pSYL5716gZ z(fpnbwqIRHTwq6qhJ1Qk_-)uctVNAD5tH_X;Ge_zV)63J^t&8dl)qbp_p3P<7udH5 zbIwG>3vOBj8>ffQ)8vbb?Fu1C33AP*P#OAm@cH8NtBDh^1xXFOY`bqgxe`;CUp#a2 zZniuXRWNYr$J^Jqq_2Gqu_U%cYCs9QwB%Ih{+C;>2+-?RR|H3G|DNS!ZC$l;(}SAuD+!8$SCb>SMnyHV zD@O;fXu{AEyuY`Sa+#0^hsr(l%eU^Pn^z1JU^zSANCzp*o4JnQ*aD}kszw?-iaFm( zxTEWze8BWKb}`Hgha zdc&>@56)rEX+*aPt=f+TR@Gy!=(4JyhxvcQ>S(W8v8=4W*OkK4l;O$fS#x@Te*d?T z_-We}Yb7^ndv=Cu=dr6$6Qy9Ia1SqcnGyYIJ!F-~;u|P;1u=u6Ri^ zg@I@^`SIhuO&@DWG{EJPNG$UJLEuT>olk^#9w~N224^M1kx#8lBZvy+%(KdAbiT<| z!~}b$0s%7H)UO$Z+WC)~!TenjkJDtsJ_{Al&(J=&D;Ct_0=xnJQQuW@3keXGjcanh z^zJiDHNwAmSi1%AJbOqL(2J!dI(TZP^&7sZseeW4XcO@Ss$05 zAKM;Av~x(4LO~{6i5T!RC3xT^b_(Yu4o&0M(6mUSLJ~Vyo)Ak9qBbtvrIQJyihC}NP&_3@HUUsU9}Mwsi@^M-p1I{L$10qAlT<}13Fbx!kta;c=mpAAuk4Q?DmF2 zC+Veik_Z`QfGMHG<HSS92)*Yd36}`KWr2%QP>?MUjZ6A_HPz@3c)x|)A_&_a zzt{?IFf4OZ<)RUK&rTZK3%cpm!!Nb=_Q^u!KHFq*$QxSI#nsfLJn&uL z7su%B1W&}SdA#XSh|E1Sh;Nsq&xW4-IL>oo_&}UAS0*t;#{n{OjWADEP0LilN!w&PI|KX>aI)nN@jv0 z2U>d0=GL&UC5YW^FT{GUM0I75)YG~L;I5+TYZ?2be&zucPedILNC44N-zLE1h3{9) zG`kfdfHBpizCwAbG%~a`sz*EO-K}qf`L;1?Ir_p0^D&LQx;3Y+i|Psr&xd2BJk(}TedM$%Tu zkKhC zKnTGm(vfdl;AiYSZwjuyxVF8;!eKfrX1yR4g<=Ng0`JRMI-6CQ_Vtd{y)}%%VG_({ z>#oOK1>ThjL9{O&pA53#amjTO3#bxuXl2x77OCd@R*Csk@ z3grMcQVZy4N;oma&S2|rgdM@S&yB-8*siK-9v@eaGMsH%ik`J`=#eR9?NoPb)qX#Y zlM7h71fG2ZC`o?u=)Fw3RsnFlOAdKSLrNfg7ivCCDLBx7;?33y!Epj$dr0lg@8EYj zSPcT`PG9Sin9O$9TSxX^+;YJu1eR)eA|@ak>^!y?F0iK>zr46pLQS&lL5K$s?aDktP6{MRF*wO5w$) z=?o+?2?x~`3}4sk%;GoBG`j^AMeWJ(AFFp1Cu0i?UwxS3+KJthQ75@h5);OuNWx{- zKc3OjnIOIxc`_jBTfB(6OVF_+%}44|H+5Cw+dI$68ymUcBm3&Xr(CK8l?s@-eV-*toeC4U3b5+G!M}c))?Ns?W|{pVz8RUv@x*`tL@<47-hndh=CkHR5~R zUI_xw0J4Zi-?d3s{GO9M6#A$P|=*P9hztu!3?uF24XQJgIauoD5e&9hXYqQ2AXOKO_^-77w1x zv&5sFq!c}^qG#5_m}=Yg80>(!(6E7gObq2t4-jfGTh3D%N!H~DGA)IC!HkPe0#h%A zGjAjw@__^2Qv>5laBprP-@r1|-^haSdFQZ-#tPR!H!7*}wQRBgYe;&2W_* z!IR*Y$B( Date: Mon, 24 Oct 2016 14:23:14 -0700 Subject: [PATCH 19/57] fix typo --- windows/manage/waas-deployment-rings-windows-10-updates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/waas-deployment-rings-windows-10-updates.md b/windows/manage/waas-deployment-rings-windows-10-updates.md index a29b84d76e..e355fc1fac 100644 --- a/windows/manage/waas-deployment-rings-windows-10-updates.md +++ b/windows/manage/waas-deployment-rings-windows-10-updates.md @@ -26,7 +26,7 @@ Table 1 provides an example of the deployment rings you might use. **Table 1** -| Deployment ring | Servicing branch | Total weeks after Current Branch (CB) or Current Brandh for Business (CBB) release | +| Deployment ring | Servicing branch | Total weeks after Current Branch (CB) or Current Branch for Business (CBB) release | | --- | --- | --- | | Preview | Windows Insider | Pre-CB | | Ring 1 Pilot IT | CB | CB + 0 weeks | From 70dd521bdc8f9058a37ef91b044576d7c860f352 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Mon, 24 Oct 2016 14:29:24 -0700 Subject: [PATCH 20/57] Updated item label to say Azure Information Protection --- ...windows-10-management-range-of-options.png | Bin 130090 -> 129765 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/manage/images/windows-10-management-range-of-options.png b/windows/manage/images/windows-10-management-range-of-options.png index d295aa6947db24949a245b0381ce9e60d88c94dc..e4de5467098e99fd2e66c117b03f0dc336b4cc92 100644 GIT binary patch delta 77337 zcmX7vV_2o%+lI3>*|v?H%?Xpu$#zZkgo%?expsCFCpR_OoNU|X+wcE=-XHd{?&sFJ zu5*Bq85LSG zL;4Q$H>skB6!>;meWZ14T~m1WvsM4LGRDSZzRb;b>2_A6&GS-uKsE7>9}NvvwqCDT zi4e!vm{#)uLV+eqX5Srj3CR<)gnL{WL)_WS)@uFR{`Fx^yUFm;nAf+Y(CsS3e6UN0Tx7c1xFVK;faZ%_ujtz?`|I?c9afpC! zwsPi}jX;OdP1j=S)}&F(%2lxhpNY1(RM!bYg-IeX+ZT9=|#Tsw;ii2QlY!qNznMbS9^PVYJs?ZY!7n#d9I z0LO{={LVMlbS+b?z_n;v4Blwjw}NbxLm@ZvgwLs?Py=(S!ev-#+ZpJgJsV8!{L*Fl znZUm>&gYG4Ypc=nHK{}R=bZD4$Q6Y``}J?@n{3%r!~}waJ59AQDly~xVSykzQ9u;URlvk zC(}~Q_6T6gU?ix`qBW5DB2CgXUzx!$3OsOD{oR8=g^&*9C3K-1?|2p<8d9G|?8e*; zl6-f>XSc>Kb*V{+7gScZAzuHix*vI{YfaZA3KO%~sLx(Fl+IW6Oo=FTaj?LjEU2JX zyn3vV`J|FX1ys7*o&8$RX4s|3eILHnXBp8rC56H5wT>wsr{ ztM!0M95xz3;wc}24NtR1QwaguT<-)FHPoE134B$`m4 z_7r#?-w!ur*sL;TRNSP6ymgGAQvTsi-_%1C7M#H^V7ODJMtekS0_t9g%*$ZPEX(KM z;0b~EeC$cblxEuEi!5hrBx_VJ8O9mwR_Z&wE>Upb_UcdM~fa+p=AuvjKn1~Zybs&1w7EWvzc`$utJqu&?;j=xs+{azC>rjJc^D!T&zy9%Ek@7 zUu=4grMl5>6uDt>zgQPHiD+6CxEs{)KlT-b2NM|f|8x4nghYg>Avg<)aILd2`*PEN zpd>;+U@+9>EAwA)N(udbv-m1gtK+IHc3DnixO! z=i~!9%bSQhA*?#_%NKAh^f_?L`g&Yat=uA6-pC%X=w)#ccjJVQ9zsUgl=I%j{C@n} z=6Om6(^zu^xz`J*JVZEw%`X>pAYJPUCQay5$Kg{kmMxE7j3S)IFa&aODOpBr*>s_@ zpf4%yl!cGonq%3Rz?$07Vv(KfNIIWNeG{KVJ zIa5fQ$lA|Nvw44)6vkX7g_HUn*V`bW>8aK7@Dc{c(fQ_Eb23Py4yjvl-%)+#w+9P+ghf4WMF(vqA)iE^T$ZG9m8womp6 z$;7*doCEGj<%z)cK6*QWoSps2!e|p}Ge>e@1X^;1PCBQ6qj*TV*0PLE;X}EMHx9xQ^_dN=gjrCE z@rxJL&FC(FMCf4?&=s#g=y@vuFTLF#rLv=;%sEUN$i49K@ktqxO5QZQWW&5h7DAtg zAIOaTsf2GP9PI>aVo7r)&sagbl&&O9VX-)d=>j+&{V*E5wnO=!lw5RL%|jxyw8%w| zQSWiS=#W|?xx;P>dA(=mzMOQS{ue_-*IT0fTwr44gv$ykcS&oYNdmcaPFWm1@l$GP zy{GFOD$nlK6HijIc~h0`g%Ez>ViXP&zS(jVU*f3dDCf5{dUL7eAS8IM!Bi&4UlU}p z0PT;f4Y9iXT0>i`ptek*U*ER++|Kx$9qyY>zN^S*S`2i;i}D|ZMOotu@~YVstOp4Z zXo}c=pO}Hmq!am9EGr>m=@I*IwnmjC{jNWn9Z6a52CEy9E0n?bw7$}2cTV<-Q!vbZ zUsiBcb1eSCn#FoSr)Ih_R6u^8A@GhB2E?(;NoG=nv*i?Wm+D_aS`dDDBi!-bAVJR+ zbNn}2fJ(*9;q6K2b5zQWI~ctEj=`y2UqsAjTdUyA!`a;v0)ns4VACWe&UaY6bgxdC zPprrvw|wode?xHeF*8HrZk5{1YPc;qQYP}XHfgm zgrE?F;5urSGKg)OwJK6ZaMJT(0kHE%sB-Z*mJijXfZSOZ*=qycKqXr6ipX103jM?S zLfi42*9*-n{fr^I31?z{0L-rcyvoF#!23_u^t2PCj6PA4hm1H3$`I~SE<;V6Ay*tl zKQY>P;v#(Skv<~uA&gV&Z6}qf5L|{>vn&;vQSX;;suc)$$S=GXoy+#bfJU!qCEg&U zO4`;Kdr*UCVn-~AG9Rb0S7%Ad_~7EkBmfsQQTuH_1-(>bAz+aQKK9{@Uc1j^!c3T;|q(acln3^@NGV7KKmtgfuzDv)5rf-U|Kz2R=^c)j?i<*i2Zj z>~X;A$@b-~5M5X-=83?BJ$@vU2OVm6VrVS^qSRBqGQ5`+Ltj^>aw`TvNkH)TzGI)m zuJ!%Z-yKrOsX~>=A@vyDN%a0~KW>~> zl7K|=(^0{^1Xj2F9m5`jx4aPhMh$gX^LgnWYd z=_Ug-{*)VO-maAjekyzMAL~j<1l0!-SdgEBT#u^_<3tfz+urNzU`eyg$gEZOD<2LO zDaV30a2Ig4uQ~l^HhLdWcu)9IhTGoVo|q3gMY!>K>u_e%v9#SBcZ8e=zfwTjc1rA* zz@a5HJ|di|z7&uRMS!kLrF=N#5>UM40Z8EJg;fqHmfAaNeGDO2Y{uQ7+yo`C5?r>E zjvTAEll33oZ6!oA`nV4kR`e^(610eC7Env0t)Je6I@b@S>#pV4Z>qIcLo+ge>HXug zZQf{HV@T-SutgNGdgJ+5a?XKK>JlKK zi*8U19x=zH*Zn?EgOtI0II76MWn}(B1lzes~hAg)M zWZOR`Z5GdK&ufonyyO#pMRK-=3(yyG2N2{Dp;5c&(>AGMof>-gH^Ik*vp%g-QUdCf zL|j2W>_6V)!Q+25P$Wi|zHq_kmeK)9v+3^^aX$*KMQsu_sXk+Q{1(A6w!QhZ}_01v5_^H>nkK2;-=1kbAw^$z3FACm?mOJ~OSzJhDQ^#}symxAS#@1#ijIJ$F) z!d=aS=@0%zNzcioyZ_Vq38JE#`f1@x``a;U^7Tv%hMO={ZMMaZVhPO;unRUQ44Q-^0{HWPA% z7+vfqLPZz>ETj8(b35<9h&MEqu0C<#BgIolhOQR%DIE#bcnw;%HH4AeHgr|01MmUV z0a0Y|BjYLFOHm9Iqi)=Z!0|gkDzfw0b}9>UjGRE{-UCJmixi~;yBy*O`G@e0{!4{h zJ1E_nrAr!|7Yv$6t|E5(x>evYVXnID7aBaX`Xrk_j$t{0`3)W38PQhh!n`m6hH#@J z5JRXOJn}Fpm0k3Yz*vF^52oYi{8Vd^1S^Ux5dP=B^IPJCN(wGLoJbAu>ATQ(E_*^* zk!Bc4=)P_+t~6F;3%CN745ZIO@Q;~9>T5r8|0Mfoj46w1smEU}iQ4(&sy8_GNLo2% zlXj{cI5fyOri0zT3>RQ=Ah=N&%yJ5AyPhOk92z89{cSh+oC0w}`wW^&3?!(ORVOMlAmo(ZPvObSXofX(z%>~ND?DHT!fRlt}Jc@n? zHmt80RI6gQ3*blY`rP%cERGeVJh3keP6|`%zRm*=^XQJP!^$uzmGaduA*|bquvu#$B*I>yb)9EPdsPyZ@>fm8@oHS;@r4Lb{Mu(McyB_BeH zhigBgFzZ&Q18c-$Cij?_%Y-kK_wOMa*>Vev+HK*za?wTrHZ7c~VO3$_bmb5;ov1Ar z1bqORrrFIa#?WAasS9{vaX!&EwE{tjCQvj2l3N*bkuM=P+cIn7u3uqI63@$(5#kz)9Ao4%{H>E=-V7-QUv2emon~rMztZKF@Vk z3;6>171g0k-2$Wsv7z!7R$b&Y_q8D(F<4&UETRvwv|cb7Ba3&SA)tzz z1qpWSxH=kL=-ECV*gKYWUP_;s+uQpOIfx!%-3^da~r^;Xue-7dZOqlfz1gVqtuOQ`onjot7J_N}8 z%z@<`uG2!*A)BxFe1P|UP~3n-Cw7}{@^Lj`U2z-s>^Hj-F^Q_$DQK{dF%Ofh{_5ox^XxS&{XW6#Z!%2h|OJ zpv#3Rf&(s{UiDhpL_&=C9Bs9FfEC%=Y~brnwDfbRwcgh|W~myB>C>%dTwc+nI)iVa z{+-?aN*d_>`0`>n(4z~gKcx_SD6xIo$X z*x^3`@oXvqe`jk1Jto~rvF!P?(K%&s8-jwA)5Wy3(7)R5ZjJ6iyPuZRv$Us zcN&~2mUgR39Fw+?;@i zY_?)y`OCyf82zKj)E#e;oH}t$7J&I7$%nieaq=h&ksCth3m%#neO|q3$|1mo8_10Hmq>+zy3#XqHY|SO5Gfy86-^-`63SO z{L9UUg29dcMDT>PcOun|Qg}<08}MGYf4{Jhm$Grakv_75+7r=(sc0;+7Yvuv=ieC5)c*l5Mr@O-1Ikzb(s)`hQC5HNokn? z_{U@kdo(JU>fXU|97lN{Sw>J>Abn+7E)(hq&xccMb%_RvjUjcBBl>b(5+_n<=2%Id z`lsf3YrXTXk!tg^Z33}$s?@}<%wHN4=SG2)snL3grS)ehGW!Y-FPFLyijB}P3$kxr!n@T?TA*2{A$Os(-vb0u@-Q<-b_#kFncos2}b zGphP3vQDNg%k;U`Y5g$9#oI0~Xnm zZYfKxJ@_y=*bmQRV9$QQ%C}09`gce3vKk~nn}SF)( zdtrG41e_{%8c*tLq#zlhs9Gtd@2uob`7!L3g@m*q?M;5R1C4s6y^F1jA6WT+GP~YR zdN3$$dm3^_Vu5Ik@a=Dx`xSBvFn(YAw`Q|UAaNfSR8??8*kYI259An0rGry&!WiUmQ=KRc4@IV26 ziU!7;m1Gc+1ee7KZG9~ztG09k(c}4n;lxu-IM)1~f*Qarl2*1|66WNyh*g}y?(tZ=}Mdo)&MrUdM z)i~;O4BJzi)T_`p;2zo@@tC-q7mDEXLA4y^sx!ly$wuq}$ZW(T-$d!6KiQ^EgYwSKqqTi9x` zd3!Epb$zY&zB@DLZ3fYJ4SFqWN?h+CRMOa9q5Hakr~qARJLcNIu5e)ITo}LJezFlt`a%`P^;c<_eUJce-qIWuC}d1=1we2!}1 z#f2wL^zlSKC>vC}n}Jxr#_Q@3Q9%jYcn z+ZuS(6TNc}-^G{(D3=tQ*9?1gcZ{<`Fp|L2V^oN5I(n@nJ^l$t|4^3QD+a2TUr*~D zTio_Z*gBrc=Itw)*D#{gc`Y!g!zzc@U`WaI6k)#IJ<#vu_iWN@-~29(X=%B5Zi-BL z3oLtm@l4Z*FH2{Lw8*v>eqfo>*a@tOQWzk_bcski7AA5fu%o8QK2AO>|ZS9(-)c?KkC*58LxA6(GXJ^ZoPYXYf=r0Re_u(e2;}7wghzk>fkFDVmOU zi=~trVh>sm^rPq?(C*FD3fD2tn`9K|p1TxlIFX1=3iMuz)YrrP`KJdKLsZIbNSdcZR>pU^90f@SFj3_)gXmK-iaKs~;+ zz4On;lF3&wH=8gWf{o|j zwCE9)!13L_TB+j4EE!LId;CZcS-`Kw5+|C+x>)JeV7%MDBfhbC5?QPusC-&UoqH%TnH0u& zQHo-g*%qZKSrcig)yQ=o^&O@ghXW>SmIGGn8n5?l-Jdrzk%~_W&>RX z9jxzeOl5Y169LbA!oU2XVuTNrOcTvws$ge8KL_x2cUG8*HJ>B+kiq=)ctkme5#mnd z%nNRvI(l9z10MgDHj+Nn!6nfMHE1-|ot}nW#mpAtACV|`kR!jV>mlw!lU+}?YmksRIXxg z0sPusO-PJ%3nCRa(sw0WrLMTBQ>0TzbqlxvKTCtMn4}}nJC+xN_)`FAXlMlE5z>tjx7ck&n z%T;%FB>1OQaDU(D-tXGvTzR`cBFJa9$$f5I(*-k+z8*vOTZ5>Kjh=frn4jHnKyHC+ z^YA;y_}yXp^+9EcB7};PJC)wQxPI+9WUoJToe6JV{Ps`?+tu$I;IzeIyDRr*wUtV-IE{|NDazbn6b;!-7)933X92pN|6tKVWRc=FwkZr`0$(yGT_0nRh!$efoLk;GDG;M?A)8zOPkYk(Rj~99s*PEf~0l zW7s9G9W}yJVoAt?tY%JT!$llT1LToS8YT;w)8&kgG=vEnj9_hU0w$xmhI>K>kuW7d_6hIuC-CRbE|4)5JEgce2 zb5EzYnE)zQ7aKxj;pTh-!Qr=xyy5hK@j|1z%yYszWRQ(3bJ96xT+{nYD98LExv7_u zjrwch6o2kO1{C7*_%w`tY`!Znt=PgW`en3=dzVvK-qEU*F#*8f-FZeMBTkixERJ2` zl0j#s4|KP6@po9vJzC~x*dI$EF;g`YcgjifyoPR*$)2fQ@D{j9e$}Rfxw4ugeyX#w zHc~Mtm&fj;YG#j~E}iG`mHp`ZT5TXiwPGlES~X}8DH|q<>ZZ_Sg1nMYZU4ie)eA$E z$N8Kgwy5kkC=JZeFK0%0NpzMjCngZ-$-XdTC^>)K2^^V<-BQ6oY^WSOWx;belhQI7 zl3xGzO?*svG|!9VA(eYqm?p8pI_E}~s~i^H-}?mF*B^2kMLsnG ziL$%uMOcn~F=Ua0Fm7sNxVP~0V~NfMLUmT&C(t{c$hJ27t$t+0jK1-Oxe+?d|7?S| z)n{4J>4;nB@ZZJcij^SM@9kPK*WEx87i;MO@F66?>W=yLDrfiAg|+iMclVEVVXl(+1L1%~BlBzA+Ktq@f`E;1+pNTd8}T!$ z#~+TW*yRnQ$*i>R27W8Yy|XAcjQnJ2!V7^LkVtm06HgX5nEfo=4f1n*9Fo%Hqr*Ts_IvnW%@-c#h? zGht5o!o|_#IFU}f_x+o{ivU8F@A;>2nSRTq1+PHAj72%2i{Ig46h5X9qj7mQL&}tY0 zOYndw@iNhqzRl;UBGhawmkX_ezVSrBHrx($jM8kfy^GeE6oCX47RLI^7K>>{Jk6`wv;19#7z^GC%Lot}hek zH!)bO>jk`J&~7|;=&I@N#sdnK#k7$#sIGNuM?i@$6Ql|G9VH424JUwmHuwFG)_0b>CST-GV!>2x~F8`y58Qvk&ShdNxff3cDsm$gp=&8!eU3 zn1cfzpO{`sTwFXa6EYkAv-J7RnBLE-@i!^ba{Gq|xniYQ-^ny02=Q!nX|AlYjk5tb z_-$C|+4MCD3APapq!M^WWS*ZxdkdYsSSr-2O%IqJrR8d-$WXv4=?@u8yN|7nvj^T5 zPJ%*Dewca$N**Gbyhf8=at9(uA%Dus51JP-_J`;pQA<&d4kyjeZz^9EEZ3xBFTZj* z$#7aw(sPPz$Y3Nue|N303I!4(H+m@-t~2X*=!1nqbFk4zk73s8Ez~p!I9~MOO9e>T z3~7&L*egDR23LVaB82S(X46ZfH&*1b`h|JQ4xZ5=0^gwn)V>Q;JQeK!o%vh0Cz4rp zhIIH>S_Mn`3RE;y@k|Ik!UP;#=&>T3 z{>mA|fQ{Qn4)}Vk!WT_((+Ws`veEI<@dOpUArzS;puIFpzL<;W&Eu;Wq&R%t2-X4f zr4w!2&Ku0>?1K@8@uw)Hk9=S&Dmfp^7+2#VG!8xwW{S$~a-l%2L%x#}xS)AZ{S!(( zr<$V0^D^N7*XjEMUjXKcrVxva;Av!Us8ZeWp9UmVtI42G3fPgLxY#L*g>D_f zC41<~@yXjXcJ_N}q<;Ck1`&Z{2UV+dIa3_5uX%sF(z;PBt+LA`q`%+k`xw`XrqDL zug)1&@9e8~o$wbI?x9qT=1wUy&kg5NuYdctYHyZ~nw+PP8Mhaml7Jz=Y&TN$@Y|cF zv*=Sv&ca=hN&k;d_y!j$CU_vkGo)UE@ki{Bt(^yLg!d^law2O?Ya8nn zo$lzp+dK*+^9%+psRetXP^DG`wUyP%?og6R;#Fi&2GF%Bg}WOu-@5uI}-q7J76IKVN>< z?x5rmeVl=dkhwSpk>x$M9EB9&ozwhoO#~}9qS7QBFuC&3;&Yl6;uDtX+hNE^pFs*=V6;Zp-++oyiqf+D@ z&LxxT(?_-afDVCJlBu_a?SQ*YWKDmJLOe1!F4NWz#wsBHO9o9z4ghEP&d~H&%zbX| z&N%4;9{@$^v2GJyMMBg?(@&ez8vX3(Mvgq@UbTHdg z8`CO}%-@WO4-KW_oavN*Y0a8i_!w~sv=u5BwcnMEBP8SNU zEUHAwS4BAYB6j;hcL!Kk-bd$3sBlKmkV}-Mf1Z0}aM}@Ia>|+a*G9E!>R2Nu(Y+El z;3l|J*TyLYPomu6^qZuIEKMoNKX4nSihAL@ZKA_@3iB)!yU6?csA;*mZQdV}Iuy?i zj%=lQ(S!sml_*$p(?LgCD$wqs<#%#ck?Wx`zX5{Xz6yR z{Bg=He<45}dsdg$mMNaW6}OfDm!`V3xqGxDp~7DMS5Ul`+P)@~I(7N*23}s;zbkjz zbpEtdM%|ATfkeTL@Ky{_gO0o&Uy|aKH>j_2uP4ajBRNFXViLkSxRwy&k%H!Z>2}!q zCEh7zq$02pck%qP-34zti~)@2y2?doxiEfrf(O>nn;N+XkrZ7nw(CrTo`OLG$eeWs z)P~F&%%08hkq#dTU?b@p6iY)45(z#oSacOXeh72_uX+52X4c{-9=MX>uZYXdqQE6m zjG{8iJ6az98=tFNd^OrzRkR2HSDR*z^!CERAD!(aALBkBH?cv;zx%FKN- zZyg#M+}j&K;3u#=66rYO^ial&7Z8W_SW(D0R-m%!7TA&dd3>t_BXrw36?fyvEEm$)FQM>x3{sf6wUpgNE4vbQw@=yAcW>`OnQmhA5?>meP8fKGFz#3Bg*p zM#ox=zE@5;ck5v|M=T8rU30lCn8-w0$xrxKLgTXbeb$J^V0oTCcXq>T@hgnRxWTCg zXS#cfLE5dF{!jM8$b(YOl;GgMm|YOv>_LeP8r&r_uy-e}EvT{d)aniBgNgV6OTsR+ zu}h)Vp!UYp^P1ab_o~jNYoQh9L_(0^^V&PoJ0}ipO>U$vYR3=bHQ}d$54x2EF^KGZ zx$%R1y`q-b5u=N8ey|!tiR3O6U)CVDfUdP|V78({9>Yds%g*=zu<&V7kJ^d7a!ST^ z(l;JqJnnkyn!R^=z00N82yg%oEmhS60kK0H+QSBmsfgVeU9!Vof)agV)4mS}&K@tG z%-vtD0J;_|)JHhxQJ7vV*UFU1DuCqzc24zuYn{NDunH;vmOaE*dVjaYZ!AdUx9 z&QJLH@V^Nk_J;_2iooSJR-a(6+aGj?QeEjtr^n=HBNS^FzpmL6NzwrqvPDH&Tdk1M zcAod=Z(gXxu8-)a%Z>M|Vtx2ha2w+S!$E!x&H_=;NN7c4=}Gc!F$&lOnrav#)6@eW zs>2w}I(rb+X#x`MAgNsl824Hty-2vPHA*_P&i8b$TAfl{TIw{VV z9~1Q(>uqR$4s+!WhH6xFYBoNo3d;yzkBmH}V`*APscQp4lA4jJnOvkIB3*}{QzIUj zD(XMF@dV_NX0N?M>L^Thyh4EWfUL|#48K;0AFsvI9fU2e9=CCAqO@xbDM@A*3DppD zX??%!_%sYKx2AuGY(1ANh=UT!J|jpRYw=r$*T;B+Q$6*g$D`s)sdCs$R_$^#X|fxT zvcY{ku4&1DZq-I-mvL5DMd|24!v&9%M@?4bCQLOWKEvmsi)WXtL3#vu2{{%1S@>f& z-_;fXs!-vACtGhk_R1xyZGRu@XmflmAj{xV=j8%EWUS$1bmFSS{4i1o4^}@92!R0D zf1fi+m&$PC36i-EMAY^xMTA_TdGbX zcmIOLrfgA}E#u-|t`(0`Nv)WSbhn3gtbnpSLW#AmMhRd3zL+^XrwUER}xN2kO%v5HV}*@*I@RgT|K>6K1YM`08_fRV$Qa10r#z@KDBy3uZn4#s^O4!D|utz{}Du;XLLBH~G~$FP*yG zU>f}9t4m_FjyFZpL4f?`&*fj3ssi3X!04wBch=LD(03V69@k?;uXvi;gLYYvv|2fP z;DK8L;LcW?{jcToLEbW!a=9#0!jo>Px?C!KS|SE@oX!#u*wU`D8gYlTFZx=0;{(AU zB9dmqb%=jost?d|wpWdSDD;*7Sw$@?v+?pJY-}y$Xk2H-13n}cbZP7&F~B3pq&awV zmbM8MMZV5~h{CnY`-Id}rb3wbS`R+zISRO5JQaD`C~u`ZWl~_;Py& z43B=5QtMgUp&GeEylB%{B>-B!#^Y&D5YX@=}Jg(k;)5q6bfDlVjdhMPr zf&NutCrA9_i(Z<)g_YGC3;LSOcRiCP`O#ene^X8hhXd;Vat2z1))m{M6XT|75stDL z(>JruV!uSROx3!SI%1p3XDH7Stn0hovN3|JWi#~d*oyluw zAn1p+OTA+*c--MWJ>;#=9qNd9h-iDJUTP+!*01mHi(17L8fm(69@?xZE_)gwhhiv} zjgq1J2EgmEr7?o?p(8*Sz>mfll1RljxA4X?9DMd%DBWd9~1o!$m;K!&^*$zs^1f&q_k&uMkME%TB40`L1hRrwc80%n~Z=*CQGC~x55}7lS83lVEu%hC6vR|V2lxYN$03>)gk){ zyxKrERX87dCBFnqe^4h+G+f|AmG)2Of&a`KPJLk7(OfE9E$@RcX+1&x2*QvJyhs5= zc1;WuJw3fUp{ir>PsF1vW41q`GfDK%XJYTw?n7pttkq z8-y*a!}rHXRK=^88c!b!MtXY}u~V_z*2J>72)-}QpruIqm26m# z{#@O=VTfH=#eP1e>_{ZOx9?%SzfAf!hMN^o{QM9y!`{B+q4?Us`~?`#Oh^K6gU4Zpdi$PD#lzj%2Ky-3+gDi!7ds51Zu%@EY1T0<(Rz)Sr6!|9s! zS^B)mqYUzo42Il_Z4syavfa3-2oydBh1Cz%_>DA)g{ap%(v8TLJ$?4GMP9!&FZ= zSl<)H^8+ON?Ux%L0_g@=b__v1a%!lABruAz0vYqrkwVxHk+m+f_@(vqde;t-pzT_* zY>tnoq$WeeqVoHB-!W~(vt2&Zk!s}G1>N2C)svBU3E!6#d?N*jT&I2+FMG~(8>QAe ze!Em)9q#}h1_X1JqesJhCWpT;-H=WGR*eAHPXgxB9gLnxQR-^>hfp2Q#}FPezdtBn zfzr1IzQWRa)KY{||5_N583<}lfw6pFJ9EiOlohL90-smof~JpuV$KgK%?Y~}L`Ij!I*E>xsqKxp85q5naod({8 zfjvbWMiySGYPi%8+R>CMDe+v7R`w?Y)>KEm<1>opSf8o}R;(6kb|PHL2N#m7x}wPk zP3p=YFU$*E-{%%?44)xUtGGPi;Nd)CEqUlK^72fTh|M$uVaD!@sMLCADJwaL@;Nva z_Pqw`i}IDVyo4P83)pfX8i71s?%M`XaeeNy8-6d;bi5hvDeTkpLD51jUO&O|bw0lu zr5>-XF+^Qom;8D;H1~RaczbM!_9E2(O=n!$9WRV-1cl@)~< zQIvNHW?GiEo$?3I$Uky=;L5hNNCW`;cK%H%neCndG7kh)p0?22 z-=@&-NLGB7&&QkJjvTbJn;a(6mpuXVWt{h4fW>{2TImN|v-N@1G@5T5BA@x}W~;)`hwe zxO3)ckD{5`BjRzsjZ7KJ@N;I1=7dwS5;?TU=XTYUE92?5XR&(KnIIgkOwo@I`dIM# z^-(#Uwx34+M;|$~{ju4n_h;4)*nj3*ZQlO9Pv-wTV-btsKF~ZMBi2;ze`|~(OkBfe6-QOCUuj*2ke~3Q7j`E)rkpGFsQ2P(Yy!@fk ze7=57U#b(uAA3Qa6mAOnrAW zTyNBM5F}b6dQWtsM32#X^iB|+AXB^iK3nM07?Qy+xE^wCJ7p=J&1j zz3*RH%O9D!bDwjbbN1PLpB8(X*!IJvBxcDW^cTdzPo73JE*fZm8{1WUfjAHF9%qMOt4*v|nui!3nf1%8mq!Aq> zQdAS;`23h~w2b#|bq2d5(B=8pjkg%VODBKjrs-a0Yz7=fhuqh-i^KkIWBDlaL<#-} zD4^wun^UpSP@(>a417&2k5}M%x)| zF2+CgBAQmWxYg6rLE1T@^~0IMSv&tqOzuxVg|=*v?_hd#E(QjJpDOtAvp3wxp2;sA zHL=Bb%@1}`MRQU)s6>loCalb6nCO5U0qL!qOea#lljm$E}t#TK3!vBJ{2muHl=US5# zKT$ZD9^!TxjsJluE5IR~Jk6j+rmmOx&1%j})c)XA$@?wW<(a_2n467(h2}RGFj#}c z!LOAO3hJ?DQtw}yv0@`_s~66Gh-wP?{>&OJ0R{&1dA+cYtq5H8GIF8PJR=CwqP(ZW z$rO&69p#~#CY7Ktu~nM&UI!3XZN7Q^JO}Yj4-Y~Yj)~rRs4LjAbrJf`A!Zz3PR+7T z+FHZgiem9>oUC%Ex=N8n_W$v419wuTfLW57sGkGUB(f1QY_f&H5WifiqDGR{uMR6J zW3f2lI%MhP-8>|&%n>GPYGOKTaZhD`_a~ZAy*3SkpDrmFX8a}P=teikxOux8DH7lh(ohhQagmLm8YWxvi16S+9$@CTumm4khxEMB9bXrN$D;+o4=Zt$8b%1)RV7|Cordvr(53M4U?>Sp%_g*z4?{>=*p>*66b6#M=ejKq%xGlteV z^%p`Gm+GySWm2{ON(X7&Kwr|XN3yb#K6Cy!>WW%CDRYZ7{d7H2hcfTDd(mOZ+6P%= z{*4iP?YFZqA870MilsE(9VhUlccjNYu^%li@%?jHNJ!d%zS@@*L{DKhP(t4 za#T0xeGl!M>Vd~A;%`s}twm~0sD(rs- zkFVl?o+(<}Uzke!Vd_zH8HH8E0x=!SmJqX;4u9mr_!{^o% zw*aeOUqc^w^-*!UoEmA}>=gD@)C`S~Uyab<@@S!A=PHrau_Kz|ip_*#Gg^!nW+T{o z*y06Q5%hYgH^~^B$R8B zI@gqwJ;V9aZnq@0I)}e|U$%d4eJA)+dm4cgo?j35WNB!9|DLP)dy(B+=0~CWf~*g+ zUtdSTo!TwrzoYz#zrxgN$bw2_V=NVaFft@kB7GvyZig>rX+H)kpt=0To-~2<(13e_ zODMp4DNFpgCzh6FLSDPi;y<_6AVBQ2DLq7)w=HaF@^zAB{YaUUu7 zy^;jXtrQLo?U!=I;)=aJHDvhaA&}e-CmfntL3k0nn;o6h&m3!Sgja!GQ9tC^f6??c1K5dzT6mCx=IJPbtw><21HpKopV z`0~M9Wm~#MpJ2PS#oXXo#ymU4&FKLzt8nj&+)=!=;-hmUS8aw!2KzgY))Ekr0i+dV z^%;){wCzZuX;Z(bs~uA5(M6aotV_pi{Oc8Nvf0t{^3*aUwNNap;(kBDZrSt4=?fL(_!?ZIjAIsqN`Gnmn0Mv&arCMbgzsgm zYh3s+KmVDMhH(tpgM674e7RIW6Y+AQtW%4If6)rf74pF*)hd^s47#WN{?RwFze^oJ zphacOHHU-3X=`9-#g+MU3!}L`b__f^YrE&$In*wxF<@oAMz=}qt3E+Xf8_Dy6^upA2-3kd)YDtqgf%VfXR z>4W`Fuk(n~I152k%vPi`ri>>)PefP*amvQlD`8Y&n;|+opg| zijNI}m8pip2bY%XoqnLj?EEi#Q4lqa#77(`(c9w)BgyJtG?>fIVo*=)P3b9zLO(|x zJ2mm+jp;mYbc8>PE`oi?wIt9|97M*VswYT5xjCz=If$Z*lHj2K|GX`IZW>x3Z)mc{Js zM_}=!3Vv%QA;T9xQ~AdU!8kQwht)y`6Y(UlYN^uhnz26dig_2uoN_prey0{irQnK; zgGURJR)(0%`zj0!HTuKAVnFj=>WJ^P2@*|!ev@7bmpy)`QA&RDuKO|H)|>%uAD)o! zs;-jsp%d^%M%iTTUub`OP}?w>eBW&(DTZOmM~g0FiTGdX?2IQEXCPCJFuYeM(ov~6 z@fE3|FSxjSaDEfm+};JtRvlG?1w>#bUi3YLMENU~wNQ~ptMBt7X^-hg z2c^WaJ#js?0uQcjMaBX<3HgWEYl(*L6Qad|^@rdw7-{SdE?X&AhVfaxt`p5wLCuCp z=f0iM&xLi}H@Z>UCE6+a8`v4rBbFmJbI{ssCL*N(K^Dq*(R&D=Nr0d@S$W9)uCrpqidaySH?toMCE9n^@i42|!ef(!afFfU?nzO~qAbRyF-*vXg z7H^J#!HG1YyWt~e?k;eIG@_MA=hPY%1?jJbTh&y<+wIJvp3&-Rk(3#NHkTbamw5I( z9(%Y;*Ob2y|2;qj0E+r%y;{FLM8$Y#WAI%U>7;mfr!{VS)2^dnwB;d;By~T3}To`S)1u#pJUt0k>bHEx-4M zW4Oz4Qq-B1VD{e&RHz8CImx0&N~@)mkYdOJIDHjLds2tp1PXVZ zvijLAW6J0ugUHAv&a{INAAh}!LsP3#0a(_jenr+@C217=PHEN6ZJ3m^RCISEue=l;H1+pEuMsFF!5UE>GHwBNfQ#vkJm0 zR*R)NFLB?Jv53(|MnG@{E@%3wHjkvm)eY=GmCzG=Ucp^n`oN<|L%?(PRb~QFf0LJ# z2-&LxB%_H;wwQJ~jMIKnevII)pwd&GA^}oUlQP7&uZOhMQpts*=hDqivKNP`m;oBF zY#L(ZSDeu)m_!YwZ0qRr*l6qma_Se&ejJ^ir(XE&>jO0=cV(zEHL-`Xx--Y!uH z3vqdM>8VB6YouV4B?AuR{!P^Ah4&Y)zr7x}|Fap>;##(I+mq^N{)5wAoliH8NPs4h z^4O-t#`i`h+AU=s6olU^os)-MY#MpJC;>}iOu~&=n?Ua~_y7DN-41Tkv%JsnO=;`P z6xArOkWEEjC#jILRE!F2MFK5u1A^OFJh)H<2yvQy*+4sqRS)81aSHYBiQg>naW-?P zA#UFbDxl7$as~RA=W*632a^N8pNWcbYmJM}x=$r__$e7bw-u|!ixycs-Rsc2{k;)z zI`5oEdwrk9SUxP>sY{jZbp%AD!t|#L;jBE`zx(d0bJ%bB*2%3r#gY<342KqSwj*Yi zl0%6B0eT#rGr*UR?U*E8GSfrh*oV_}bA1cCulZHUg^?=1-*xgfMfwC2`hB$>@#1Z| zJBh5?(0`opbv|6#g@zfMJ6^3)=<5=u%BOx=E!2SngwSOmET zS#_cRf->d6^-_x2O;|$gfX|tv`%ekCh5R=0B@Fnq@5iYWLPHjPZGWoefgV9<8oZFncm%T6udU-+kX2ZUmm=;35fSQfw<~eEkl|Qw6B!1a#^Zk~S;87i?mX0wqFk%^t72wgl z2uB246n*jf01uo}gweHs&q1_3ICc_5Q;^(71zt7A%y4Yg{*#pYW!;fnI31TVZsAL3 z$&BTzzGar$Ph~C3JV*T|w7-l$l03^9HG6R5 zIiB*;?{`oPVXbmngoXgnZFGFIp@YI+sMzu$AHNYEOuB=PwN;YUo}TBe_zJGq01)4v zla^hPxtGNvrEN>(M~ls$6JsuWvks5kkUrWj>F7Wr8GW*i%9xrija*ijFS zvlCpM@pbI<$eZ4cCC-t-P0UiuMFYqk^EmsG_P^*8JDNguZMkhTVN2t7>YV^++7tD7 z3A@`r*&;FkhEIvHiSD>XB_3JH^dky2t@Bd@KY0<%xdI!c6?T_-A%duZ;cFPSvl*_o z-37fs>4@Fsc?)0DWvjlh`NKS&uDd@Q;OPxKU2bHlq=7|=2Vk= z-pJC~@7`QV54U>$KL*>l{69W#e_M@7AOl-=?V~0?Pv1+6kQyHBgoRUFTbl?lG^_Yd0QfPUqm(V zuZQ5%P0A>Sm0GC3i}ifTu<^0#FH zBXi!;SMpD$cpnK%B7Jr@ckvgP(~8|;=ToBFyRO2zsBjVmiPU2(hgd#kSObk0j+QqmjZF1N7>n50xxGwg;fe|tk(t%c`vta0QPzZwisEq z@82Mr8e(&DFijYysv=@6W6z3g0NKQ8{(eyJ28;Bez^j)}x)-)iF0|DEH=jhQdWJ^2 zl7rAn+IiQei5{#uwxejHgt4*tZd|d>q&LY$NBp&u?bc4({64&l3(&Vi)i#;x;1j*o zM*W*@Y(U#LU2!~^`p!0z9R_7xK2-MBXC0o;j zMQbQQTQzA&OG5|c02F>=jbb%u{b4D$8K4YHKd+M&k=x8|F~7MQ$!Z^0+)8x%=G3zF zR53<7UyjkHi`|3dK1i^_hHA)+!7@JJInP*qU9nor;4m3$UD?QxfgRBn6LP+0MKf6( zN=tb)vn%SeQ}d!d?5$8k+kKSoWB35wlIO6kC;h0fk&RO_V1kpH=NStTxoMJaj)9mT z+#%-9%CN*ka>XiXknUx3BYQxA`y;v8@oH2H#qybNfbLb={1d~tmDwWJBQkULC+aqw zJ9`VVg`0|SdD|M+*B_3Ee!Nvm!JfZQ5iVw`)XnLH`B9SEdu1d=(yu9Igk$!F=xTCk zL~CsJWQtQU@aW#9f&q%L8%i#WxsuB2)Wtv692Au=(b5k#jL{ia)x2=6ut=OG0{IDS z&f-aJv|7!{Ez{ivcmdTN1=TB)KwUPft)iCrkxjP&p)9=bXFxpHuev$kM-n4y*x7gM z*Pu44z!kzge?p5$?*xqm(M~e&o5S&+YTIqfrYdHa1_wq#HT-@$ zUTv`>%vq3^V4mL7(M#tMY4{&Gu zk|`*)rtjA>c{p^J$!=u}@d-N!u>dz>wvHNO5 zKFLU-`Hws52r*UI+2UDBZpFz(AKq_HD`rLLygIIPYNaM7f-hr=NPsrDm*V37QwUC>9#-CaR>L>qf~c1$%P5 z)1MPul!xJ`*@pbC4~4j5ei!4Bi?oVurL>|%DjGE|n zvKUw;zgv{7zE@FI;@+uufa{l4W7{ri#0@oj*H&d&ZHd?{P1)ZMK#&bj7uPt!gfJ-d zXHN;n2q#MZRJO~8LPThV3*IhTbPqzD9-ze`!r4XcmG@%gk+Vg&Bjx4yp=PO>1LnQ4 z2cLdsf4aEBHUQ8)VZwON@2*E2@eflQp7YwO)@!3KV+??01wr3HOX*ojuKlIP(-~lM z#P@dlD+rPP_A?iK893ofmLSU(>_CH`ZqrFHReY4#1*?3mhHaB}f??=Nj3$7FzPoSe z>DLNQMdSEAkD zg3}dGL%}!PH6yiuaA?b9rXq(X^`vSEWFonhjzBFxL-JaN9<;KUyl_iTj}heLZH)5f z{{F`#DnHXk<^#H;p1J6**n*rh>MiH&OGg|*8pXD0@P6f=b;_EJBG*MxHS8ZF!2zMh>bemBHQWN`DO}1h ziUBrP9vPV7Usm&PV9q)n?3(F5TVj3m_~2gD5wl7F1l@{eiyx=&x`+*CYfmFeA&iCa z(%3ow(6^v_Teop=_yj`h5Ekb3Op7*B%rHk{o$+Tl904h(u}!lr76AO>&vc!S*+yk4 z?`3;@xZ35N>06+-c?NZ{Jxi;_ii4Yi$=l7E=WKR>|K z@CTpmz$f$b-B-yzwiW+hs7tI$L-2C_;SSiA5;zdAm5-W&o}JRh=~ksRaKyjnig$F* zwrfDI%)ayQfy@GsYrXoE>RRQP)Z11HiktXAH6%wPeLHIB8kc{u36s$-nr$K9l&D%| zio?*M4#nLv{36w(0tM~%@IB)IK z@S`4ITLAQLsk2Yg-eiZUz@EP)Ly8&{B4oqx&}z-~=9gFl!OGZc4;8w~f^}%D(l%dX z#Pd-#yorp$*WL((v>$st^bu_weI4h?ptQ+}}~91uENT`|VHYNWI6m zKnK+TzKyzzyHAg77co0xH)5m<7?0b(L)@!xi(}jG&*5Uh_0diu!_}`O+Z>QSV`sa0 zh!|WNYobN=xn>0&RPv(*oz2JKwBQ$)Ll+?&(bt+)BycY$+6M!o^nkO{eTn+sVUM@S zPr-tsBi2EE3ZmA(*#z(ED_DEkr9WL9jm_>h+zx;*H!rHFrnUP?s>d^^;!VdD3tb-G zZmncWEC&W9hH*+E2ZjR1hm>6o3=O~&8_S?t^56a5eix&;eGoJ~vDWyY`Jl8P0ddMm zhD_hp=92;yUm?r9ufBUHU{g&M*DRXmU33~8{P(kn;n3gMaA_?caG2Ps|4@*J4I2xl zVnK0U$WFsdC@@u8ii{!>sD{vAK_d0-`(W#PeWX#vp!L9au-gARegdS-?aMtt6X1-F z3(Gv|cckdoLHc0qmqpd?@LU%^wjpl`g7C(5pZ+E*I>I|M1*5dtW^4{lxI`WIFCCa< zX>gzy>cB?bTDPW*kjc3gf{&&}yi0(5olHgGZwk;w=A2_;s3jkGhp0@ghiZHN zG7{+2ka2-c&(Y`=BvEplrFxzJq6#W(Q7F3&FAgg{0v_R*{pWKp*iamS+%XCJpN?*nXHSd{!Y1Q%-K*2TimB`~5k{SsWDtuYcz<`0s*aLC30Z z5WlW|VPn|XaYP8QC0bliJcA=07r8?1A2RDaGQ|T>bOA zK|m2x*bKb2v8Pi3isd7>jTjNy>v{VqBAU?{#QVa~3GP2>p6CUS^00Y@MwBr)T2wqC)2kK!CH&O zkyZcKYqzYtO4QduDY%qL@Pf=I6nIqX_O>(FHg7|y!S+3~nub1ka;JxZJy0;ZLeiiUgFxIF%nB>jn zXu4r*^S65M=Hzkg}9oHphT0!?&5`(xAt=aZ5nZS&N&FHmRJ1ddm^O*9q$`-Q5u<_ zFrT`AcVE~{m3rjdvcWI*Xy(098YD_8UlZUySS6E95V~oKgYXXg@|^r>;#!+gw?F&A zykLFeeuM+;P8C{kxzV4rEOWz#|9a*~kA=o=7#^(rY-#It;Gf}}I$k0LM=jJ?1jnX3 zz!gA^79Wm(`S17sO#en3>7%=T*)>1Xn14X77L!_mHHS4<1~-cMXfGZWf&F~MQM$*t6)rF~sB5<|EIPUVt0?f|b z&gV3C5*G6RqeKUUXsqJ#4%Jj>k zZLWukuwsS(Nsj5+-81bMCjR&ZqoP5l>)24l`^VAQmN^LD?OSSa1oRr#%i6C(tdghd z1TFB%=k>jhCu1O&i?%`2D%-sH;Pm5u@GRc*INmvmM~!5&1ZXaph_Ehj4mz2-K8Bj@ zn+UxL?ZhFx_>rDa7z z^@aye+!)TMaQMhqmYP18IjfNx40iiqT>Yp&5+sWP_ebT!g;Ka1*lKGMpnYE${Eyr2 zUd~r18gAYneJcE~u~>SB7T?W#318Bx1wD`QVo*1uOj`G~P}N4miRy`hCc>$Zi8DHE zG~zouznsWNPcs&%%XhN}B+Fr+%;noM4n2@Q5ljNYy_f-Dh8Mq^9wT2qT;(r7Om11! zn*!Oebej*RlcgRcwla=9mr#NGLQ-gD-8dP7x5zQyVAT&z1vDWLRFsonvecKW4lvl40- z3%5NZGEdcDv4w7=n*O)W3*o=@?tAuraWO1K0yYvmMuMG}R&MhZbqyPD@x_)t0yVxB zPBIMjKVf5uzvC}-6tqyXMr;afz>YKAZ^EV%IZH7jmwNPkz_v)h2o|L%Sm~GRz)Y7V z9^o;X@T#QGJq3$f-E7zR+?*CAdn~dUBtroY`!=Y zKec&+isYN^U)=D7Zc?c+qyy>Y?uT|Gx zVLQ3Q`dmz0DbK>yg88i7qVbuhCdM(ATkgObGjuPv5m7|8hzVr{%C3uVnA_?G@O6*I=-~k|pd+Z~NxQGGbS-{>-Zw_PoN#y;tXb!N7)S zJ;1q&F@8b=4s&iIx`lTxud@-3G?mz|&;)*+DJKhQ9Ztg5(*aYq11uG$Hc+#}0(DpV z4QCYWuP||}NCf6pnW2e}N(khWHE3#UREQst>#6~eto2(F&Cwudhb!58SqtFvKGolN zpK04oT}|3V6uAqsHDrPPzc0q(ZjfY7ad%m_+uS1@A~V3dC1##utLSuFBJa2|+ zCPz{Sj9JE?6Hj|V?$fF(!dGrB-6f&HB?_!4B0{!M6kedgm^+#9@F_7=Q8`#eA&Tt* zz&_QJh_Czj-Ai3zvA;Ry{SN<4I8OHfX(s81#?h_HO!1n}C^KVrDPLN&XggMiOg7yb zJcYPXy%oJW{M7Qp!?`pE=-vsW?;}ZFQ;AcEr8yd^;2>20ZuVk+W zu!B6`({nu9&oxrVw6!tcS#w854xaV!m9Lhr;b)Dd;C_s>izucE4hO-cC4jh}%d5=}D z307PG9s{D!bz&q!xNC)ZSO;vU_*ssw{2sZ?->A>G8OP;+E?z5xS{XNpOj9{8R=4~e z!PcO_AMQz@4UL`Vb$D?iauK>{nR{`V=G)@O`)BXs5xXgDVF?cx%j7kWj<365sm6YVq2!MzyCkda0cqm*cq>ip;h7@5A(m zUJ@wb2TGLD8w7Db4d`6GuViM+A|~Rm<6k!BbT>;EY}yLyqBz)gFETwZ_-(60K|3kc z@TBtB{RzQH5?w&x6&;4x6qh=epn`FjOW5WBOPeo$oahzUq#tW2qweD;^)B6La=BXY z|3E7cCb?iy=Nact-%!$lhKmdm7&qj@iSUEDpE&mx%gF2AHLLONSz$xU-`m?$BB?}# zW>Do)m)HZHQE?>`>ph87F>EvS;~#WMN*+O9^Sv7@!vR=vCG85aRUl0NNECi%H|z-$ z*~@)pGqKQuZi7tCUQDq$pPpgN%N8x;LWJjXgn}s7QGkfH9rASf%M~0x_uE^b7q#o) z_K;3pwuT?-@`-2B1OC<8?6Fc#Mn?Xt+?v~0%|k1;X`C@d0tMIAMqxRc@sq#4r9qkM zL`b{30kYWMu}3Fk)9_;3J<>E`)9O?4Y+0mphEvB4DE~5mG0oHk@qbDN^>T7Z0|r{g zPoQIg6B87t^zj8-q)os};g_FHKxK-dfgL|p!pStn1IvNq%j+WPH2(E{y8C;q4<$J*^WF4PnWmS_o);h$OE7uVVQc!$0cSWYAyrp3zf)fdH>e0J!U{5^!yu3Y>rr7=sl{^Y}%<|s1|7xA>6nlcP7-YU4pUWH0oOqAggNb|; zhI{$a0Q+|vNDGeDl>K^Tm6~5%(~qRWBW@El5?qiujL!T3+VfOFZ06fvl>wt|K`K9y zI>?fhXwN-f^X84wCgIG&yxqf9Tn35jbtgf)ppR6X(bi|d`r=LfcxZwXia)>8bJ=>b zH{r{33NXH7Y1l~ z>cip0ax0O69TTp~9M5ux1F#=;M;Y}!(Aou=X`m=p3?cfIx^KpMmqZ9}2_b9A?#>CUU)h4T*jtq|rlN3Xay&U1J|H+jcyP}(!)F^G;jQeQ8?0HY+VPA+(6+lMKXPMIv$e%}MB}PF zsn+mxrxktBCFAR7q5Zl!xi0=Q6Lx#B8Ah1J)W+YYX_*@umGFit+0=>W10fhffllvV zWU@I*9Glf-GNGeSn5Pm!iyjq4c7@I)kUty&p%GFO|Ciwb8vECR*GjykD;&`Xl`>-Z+~Jn-vQp{+c;Q|SY~c7@=sLQ+DAFo$+gPIbvAY9O@MzXc z@LdD;DzkyIOk)4ifF*ma#7*8!g{H`p!dy-pm0nwLQ4tZa6}@p>-%4j2uH3n(yCrxV zCJWb3x~}>ZEDL|DMb6mOoK*ap-(Y+*LcX)_fU6@2vRX45ZX@&z?KHKB@nzL&ljDT7 z*)RwUb)E4o*v1Hh|7xV6=j=>og7AQ7hyR|G0H8f5om(s-u!x_%(8u$G)v_wSYvt5d zxv9<%E>W>tLwr1%$Ia9YM-hRe6f^I|Tc+Sz9u3*-(=5;EQ!++_Ji{KWr~b=e{SH=v_#~ODQ68bZa}Z zU-dzfrF;-nFtz=j=8e6qwhDcEOkBz&q}WV6>SRMY%2kEyd(G_p8=qzTyuh@Aw9K7D zgLwN5<7T`Xl^2zyWJnSj%`Q3c?YS>q5kDuFSdsMTUAFt0D;-V=H6f>2nZ!{_Hp7B{ zO$eG|L}nRh!eJ| zaf5+5h&&r_6YK&40GB^}lT&6WA=}56PKvC0}l6I*z*9 z%5m||FSq7UL=1aI#Ai%;2=vhnW3RJ_%rN@V(im(HQb_*tPr4tlZ15f}nd$W2N2G54mYMV3G z$(~`AKQ}l!Xg%0559bNIcA+`a9glo-fmV=e+JBU3qmc2G{k1k*0eRR|r*(GtmXu*O z#rp_I?r`$3?@Xg`Ev+#_YEW3N04em)(q3LDa-CC@3R9DH?-5+^8|e$jxZ&;>_+dZ8 zlO81vJFA4F0KVw+d0$3Y!riC*K2T@y=X26#5_RuA*7nKZDUcgXS%&4Px;gG=e)S6G zF<~YXuym6WA&a4h-~H$s!)c`FF0srcWm6Wzk|6L7M5o$D6{-LIMPCl%IR-2xSPmnF zl14z=;+G|LDP^5Ue;UCCGO*M0A^Edu$&?rJ7!nx#DK6kY0E`zn@6cSfw+;po6~m4X zx0-u^!$;2%N=l8V%DaqacyyR)N`)dn6CfkLp<0eaDGf5P2&%r?@*E8qMp{$`uu_488Nh;5LX#ijBDt4o_ZX(^y4>3fTr{+flrt?fa7gK`|)PW z9s=8wfBS19Q*K9ku#?Kn{wXR!b=Y21G5anNz(vX8lTlpe9JcrI>1#NM2oht#)}0yl zq$!sz)~%~SK9@7qCV|C>6)w$rMwe1>j0R+Z!*gd#6Frp21{N4j5P`3+Y_;-fY`k6E zRHN3Sm6k62d$}8C9(+s?>f3Y8^y}TvUjDTw9jQMeSw;h2eUI-!V~^AuJ7yl}@cs)B zk~!zH%(`#fN&fBe$fGRj)o{jdDL<&1(6X)4;{jPU3rREI78S{wn;s*ZUd1Bve%$a8 zTO8-r)^Hu}F`>Dh9!nZL0Zo}qm>4BZIW@Utv{7bQ;ds>45;R;Oa<~wY;O1-A@CNX{ zQs`K`L&@+?9aM>zuM$S(;uTqrEdr0{9ydSw=YY`bJ+JgM*+~l(Ht=2lsX#NGuASFM z!Tr7&`D&Zw%LGW)lMku(=_w-8Z1@mZMR$EF0;3@~u&WGbfK1I1YvgWyh$hgbkXXfl zi8OLWdsD znXlT(z(T2TCG;=suWg{)oho>$+hZs=Ma!?(vOk$$dH?)c zChxXW0*WL~9{}*3(YqSk!>P|}$E%F|rWJ4gFg1$F5WUcrnM@dCRM@`)5kwM&Tqo&W z&_NVSEv-nJAH6;4UC&G~QY9Z*@Gdp4MtXIUgJReS+{ZdA=L-8UEb7Uhz2;GEz283aezQmpPtC` zjwBAhGPoO2+xfXH?zK2C=8V+p$2&Y?+xIzM1pJa32}jrw`{l;GiP zbtix{3YE?6^YD*-+7={7Qr|+HZMh|(IYwY}yh3b+Uh$~7tm~g4JY9jLIrFQvP6&<)<8glhVl)V<*>I{ey z`N(WDY?$q03v!XN>e}tz?`S*o|LBV2G%z^u4c=DGPng(JE1VFLl%b;hJwXXFQ_GFliPmEqGs%4Zuv#!bE6vEK*k6NbJHwkZds$pCP%X zV(PK~oKvgI!RAcFbEoaBBITCohE?{PC3-)OVuCZ6WFg^?J6e@@8LPdgeUm z$umE*j^978fIDTlJn90YwN3L@0Z3ev?hM=f# zklLiiYau+>U%6`T=ehDzg>(vS^&d0{Xz&y9YV`}JlRPj*^ZE`DB5v(J+D6kxU1Pi) zV_zT4u`MqK4w{|x01jYA6LS^&JD{{G+tD3n?j)u$Y){-M*28tFS=D}f?FR7$*Uf=x zg2#_I@jC#2%hQVL9??{kh)^k7tW+!(-O%WMqCD68Lf|Va3VUs#0oi1wBmX}vopn?c z@85=9x)JF{kVd+@yBq25kdTz6krr6GmTu{kknWI9=|;Nq9lyW#KbEtcv&+uTJo9<( z`?_jvjPSoCpAXTiT3`5XEY;)sfIRy9sDaT+eVj-oI!62uzs{WHo0*P^>Piq1tP%tA zu{Znowa0E_=BK|~^CbN9(j-mI2DPtq!{?Q0}cv10f}vp`Egi;Zpu z;Si65N5lI5sQ*n<&qt*w#g~~Cz157FY{84`#inQf+q&!f^9s=h;i%old*`$ z8gY(t7|QnAXz^<>I_GYZQ|c!iZA?{O%35j;$Zr|tXt50VcZ=eE?3Kz5`OtB~{k2T8 zZRi8A#2xzCimK>C3eyi)q^nu#G?n`aU^sp0VP#Ajmc~mZmykvphtR18vlM=1!(F}3 z5CN)RSwO-OygV-02t8hG`MUnA%J}ilqM0HZf_%1nGVSbzhKA?eh~bvcv+WG9 z6KgrYQ-v)F&jKEufDP(u*coUOxPIL)4Q5DLPmYz1>>xO2d$exCqx+!Eq*aWwYZ-&C zwWsK#ZF#FyMw_9nSsibEC}x%tb{h1vavxd2(~_3}96aib}b0{bp4kemg!Bv^vEj6^C`)!lt#6#-_FUJlr`>w(GXWellhqR@#IUzf+q zTZiR3HwA)RwSFN1H6zGFO4XD7WK#bFqE=uBdRg*T{>#DDz)j_-+U1aDy4U3>AlmF@ zU@V?pQy%>A9A?*`UC<0{xFG^tu}$XQ=re@Fl0~}T;AaT6Fb~1e$-gYH`x1o2F2?}; zmH~@V&$V;A<9jIb?^qk9=#U^QQ%#dt{M|I{4nZ1%vq485(zf-E=b!$b^FIchVG>Vh zTeeHfRZCD$!A}*-IU=_yENicGdpTLr z?wm8dS4^Dx#id}5Fx(OjA1tKd`swh;aUZ`J3Ej!u*6&62sB{ECfhb+py048GC6qpO z2mz0LKL-Q*+INb=G+ zl+&z6yX&FV@Ff#@YR|yTZaBS_%x^hf{?Y29)^G)d;uvJsIkoRqd{xPh))Dq6*vX1W z{vG}sl3Eq|6>&Cb7;B}%P$|OiyD6(;{F2a%Ntp#o3P;Ji0H2SVLaZYU-T^(HBwpffHq!&NRq<1p}YKK6%x;{?w^_n49sJ*qZ zt~mad{OUe)`6xmPzWPr&_Ay!F8nc~|t~*!2_<0crE>jJx=6B1 zi5OLCb{SZg3!HcJ3;@x|wK_d#q(t-<(qQn$7lc9GkPKPe0}?zHy1++e<%xCT75pf+ zL(S*qO4;(!G26CWN`eT~8Rs7U|wRCx1+=A&f$K8Q zFWxLIbC|Iy+tk^VgeImlDw90aC8|xztK9&Zh^Wd>K5D8cY9tWULJ19EM%+K5`@&|+ z&1#&lGyRk4-Uwn>YFLt$7pTErmTM!ZHpy;j_PzNxLWj_j4fICwqLTK{5t@rvOd^Mz zKS$k)1%UJ2@&Vd6dU&J|6)F-^DsWDm4a2;V3Q?%joAh^okz5V=I zshY(GI(4(-GY}A=_@%><`zYTHsfFliH>4`7a@rW-aC}crM2WX@d>K>6dRh53kKR6C_Y>o zHEl0YlZjGAJg&N~KALB3DwvqP+-%jFYL{-=0WZXJm~bcU&(9y|uq5|+=-kXc!DGWA z9TC>5MyA*b&0?0)_i0*=FZwR8OjI;6Z`C^}*HS3msLiRLBzS{JG1xdE zEQs>NRt!t^JB2*tw;CtT+pUncW+>?uL#q%Qv9?rM;w|T75a)c>%0PcRlu#JpF8&EsobRgf?az0^9}_r4>wdB1j>1pp-S+SM zuZXrUfbMH{GT_9ZV6`7;y7GbYL_=z&T?LOt^lESGi!zIw>3=(;e!{iD5K1$SbiH-5 z*Pnyt+TrxKtWGLeky@Ig+Jytc+Z(dqj1xl<@ovR$C zD~&I1%y7WzGPwr*Mq6a%a%+ONgws^?e(ulW57fXzuCj(a-6kCOu53eQp0TbBHLtSI z!kSv|Sh&T(=EoASNVtfh6!ivGs0<{1?{~C8V|gX0l3&Yaj=aX^E+1kde=QTR{`#Hu zORHBi^dd6Ie8{dmkqj3{lDkk^xZXzoOM0b#I$^E)5@@@SIBa4M6)q^uG?0JG=&~uX z^x-WX@oq4~E-HU4gtL)%;zL4t!HA@fj!f2~5Xl26SVOtdtVmv(HC~JvAihA&pbu(E z&jwNY#2%HBAKtCLag5;$OU_2nvtU~kl{0;_wPu7PD5CU1FhvwG*Pw!E5Jh)hvX%_T zhsdV?Qw%p!UT#+m^hGe2075`l;j%<^xWaZ4Z4^=yJf1vnM{ndZ-t1irU5>iPjO%5n zpZG}x<^uT&CT^kdy&U`zW!0EuJ+T>qDmMIndma0FhV(Z2Yw4!$d(n`*BU`L=^q?2# z3w<-X%a>{AJkDOP!}GUlMrvm-HZp@jMcebaZ*ejnT?CfjwY=YQm2zvL58?PegbVFe zZU5V@<_S|M*_W5V#$^(O`a~Kr4@eP1D6+#Lr@2v;dKC{;|}BC{=zziD{yO} zq7P+n;y>I#NB@pn`8M?|kp~3^%T8<`VYc`Y*+!wBi&KkmCM}3RgM*nR zUdNeY#J2!SEik{nuP~UcOC|6~qfi9w)32&TD{UWGmP5zcKZ9W_p*5%EhwpowU`=4b z?l_B9_?>Kr=OWslQ8^{5P&seJcW4w=Q%X|eU&7USCbYj&M5Wh0J4TRvjuJ23cIOvM z2T*}bNqxiMs1kadcSHf4Npe-W&>{m+5nc zal|A7SLvI{MC$yopT#3qoV1mgX?cM%FvV+>{E*!b{??)D_?$-dlNU*4bcsWgU!H%I zBIaU0z}Cv@ zd2@ecb*L68zGN2sNZA;VD&gp?qUG`9#|9GRXS0`Z`QE~Mj(YEY0C4;2#Q+3Y51Nz+ z6h3~5;Gr0wP**WpM)B}cj>X7myGpa!i&hsMR_Qy3GTAcKNjQ(>h(}^hwnVA$n|J$H zWTO3FWD5^U;8T_>Z6Eqo;o!O8;fYxfSqZ4(=~`??M|ll@cs0U(O)_VJx3{OGrz2)1H(M`XDe-BY}t08)_QU!)Pff2A#|->NR-^l30SG2CkHLeGoC6IzgsV%8EWn z05qLKU;ttR)uzZBfLK8KDLw`uR*+>%xdDg+c(i5!A|`xZ&z0#=PgBG*2lj3v5yalt zl)FbWU+z|>U>kxo!49L_Z$eSE^d{+r4e5&GvNHPr z+T|@q@`&zv$ZR2JxBYYDgw6$?!}TXK;;fKiN~iT~Orq0?3wH&ZnOxE%9)Dw`U|A*# zXna4h9hpRz`nydKjaq9a5}`BCf@;9k1IQ~QR2-7j1DSMitSAXztWqXi+V012`F45$ zzf1)^fuf6zQ1Yz~McM=6mq-P;rZw4FcuHL$_gt>RA9~#dTWIG*YTPaLYZyKzKo01T z_wsXUBq%>{=9L>XG-# z8L}^G!`4^}mmp~%C*!q5rfs}gXlsif4^2}<08jhzlF;KRFpe6bprAwrZUntg9NHy9 zgo6Q~0`VUw>9%g2Go_2xY6BYS6$GN#b}l5OMpRwf!f3VX{YWb%0ZR^-VJ#~xd|fM& z5|NUXWRd16d+tB^Op~bUo<$duCA6U*+VE7v3E#Bl0u)>ptEX@oBg2OdE*wodDhR<1 z3^Ge=wHo+ivh|4x7=#Fh%m-R7Hi|smhtcV_jftiYDjyPyBD-^;)%+#}a0|%tzy4m! zBzTwfDn{Uy@RK69g*K>QLmd}H6}wn_V}*@*1N+)K@>1%4q0FR-3!tWSscPq#J;p5K zzg=dvZ>xxx1O9tBt#2mfXnfPDfnf@(q3{=nx9=uww@uqN9y4;qx$4p@bKceowo zAh`<=o;Osbam_tSf2f*x=o!2PXqvLE_2>@wWjX++oPq z!2L94s|_&tF4?;|HR;I0#*Y%h_C8igdA}P7q1?sMMBS~76fF1^UFh0jqN{2R!lDF> zR#C8JJ)C0(%=i)gD`as!;0>tZBpPdXtrJacp9NOIqHIcq!y9J=;n z5dl{kZ5+;abBPR7SbF8EVU7rzb!wPIL@Y$P^=P+ZjpTorzVRu7X|&c4#XU>{gCmT$ zCQAtUiROEUX_G7AC_kHqFl)K9-D+GD6;13#^_fw;EmTKV3~Gk;H?u|Pq%J(&XGWFu z6N>BiRI=4g9&#Ika8J%VDh=5tE89vGtE1Gj6ux<`kAyr4Jx|F}Nxd+?@6dCUfA=(f zXMq1w6!?&GmG!g&{@z&Jn{xwk3l)DKuNX#!g~gUnsH+wE;yi1In~%bkTA8YtUQRLQ za1L2yfRa^D{t}02z+oW(qzRmQ&26f@sZ6SY?5h{N=pM}bvz(;g3S}1Tm+Npop)Kh`DL)xv$WL%}6d zE{IC+1Lf}LTH3)Ql)+Am%;Dmq@JF?*ZEC!yKV;x_XE08~6czAfNF0-&tA5Mew0w$b zawFj+&XArg`(aB#mNH4%yw<(|4&Io?GC`etr^ReI`XjZIg#y)w#IZ_#%f|S3eTbp8 z)HbrT>bt0vp7R924WSucc1N#Mr{VN0fLoQa`^de>n% zlpqUAOE*>&;z>G4!ZH$-4;TIU_i~k%i`5zo38Df?TB*9$RWfk#$lvq(;CQbOX$m;* zpVX5_4Hh@GsFRS&Fp>fg-=3(Hv*tQ|gl?+cqx%!@-UbFs^ql9#SEf>WgdUd_U zrNMUVI_HTl5k-TO2jZMbafO%hlKeO^GT8LWa$M11xBI;LJ;V))b8h58bGm2<!!@aQmo=n*}grei2%!zR;cV;I7?69L(0jR8Z}zp-1o)rQiazhNxy?GDby zZWz;Q7az6}9HQq_DNtm}VNd?GDkXo`D9hx(1kub}TJe+DH|uyj(74En(A4gLm^?I_ z4Wlt24oME1(6u=XyCfFE=cH3lu!V{n5DH>e zpe4`|tb@VuF`lX}@@jMszjAQX15xsX4GOVM2Qz+H@O$GA-_4-S$SPAEwx##=%L6he zd%q$mtDuZ4?#lYYx=B%qL@43RS(zbl(%>dkm7J6g(}Ev>NeSvm{~Z6-v;VI`5*pSF zp~egX>=G6adJH=Y>d7`;ZgUz5iI~I8>OtbUlClx%oW+tn67qR> znc%5{Y3q{XO!eIe3rgx?WzXWI;%dmOtDmR7yddA~R5wHy%A7bgRUV~|7a`6htH()4 z9rlK&W(ccY)!B=|VoEmRiLa1=X^g(S5mLgYM#+jDKeg_udXFMSj!nPiZCHRaL9hG? zkG=*{_>)CGLO3{=K_gpS9>qGWkVQRj9{f=`g3?W%;isbBCrE8bQr!Y;eF}tN& z!3Rw0T*b-6meop5XV^D?gGHNg(7hA5T{SH3>qR~CE^IZ`Cpc+%Z{isVq@FeO^NVwT zsDuNhUDYgs(Ae%($P%(6eV#!0rtRUE`WJ0ynEyVdR2Eii6FZheJSz&i^51OWDa}A# zetkCYfh!tSO?KzExqDt%idnhhDuesECO!%1beUupg{IkJI2uH=Wn4p}zmi3LeoYXG zTZo6SVL>3r({8fKA2~Q+g(%-=$2d<4rI&IPTIg$1Stk66m`3EJoU=ktk1CfO_6bv> zzhA#Cg0vldR+C?W0ZNub6KV9|>F5qg`AtKi z_W=Y#tC2%X<)A&>R9!S8QcvpS&Y8J{v zS=bX1kU}YX@7qw>h{(L3EEx%a-Nbsz_1G%FUQKb*(oYo71I;40!U^S*u%e6v9Wym( zSh&vF)XHu*h@h^3k`IAE3g5N)`1u=PHUPwL7k5vE&CxXL0#St zVHx}7{WV1V+sPybWf5DmfK$7l{77=`=s*XjdL-t4rq_j!JdJ_$x<179h0l?me!!QzqfzX(D*!l|BMjoN%XMeprVLqV;x-l`$)a@$AGw`i;G8j-9Vq4@pX zkVQ7#ID@*lOSq-_oK07EQ&q78j&%!!olQM&6`wlanHNk==3**uuSKs$9OW#OlkkqR z;f8TIbrg^TMg$OPBAgFNk z^dMT;eTDdCTa8F?iu};pZ^XdHB8Z%hGW{>P58&Q4CEF0$K}nR4ux^3lw7CWHRu#~H znR-W(Z-poqT!SRqS>>gtNhKTsjS`-{D;hK9laCvjf(Ogk(E+)PhZVqW_(1^ojN*_I z6`$e5k3!VRPZo{wG#O){lbFXNtqV(>8E>=x&;hsRHtJwS`Tqo(LE_=>(FrY=(1`H9 z?Li~ij0>W+H8A93hG6O<6k92kB~l0-LByoob`2W1b;v^4)){!<0Nn5Hsn*n^Y1MR;>@@ zk@48(lRX_SwW4h3_Oq=yqjuE{DSsV7grMCNL?@6MT)9qnd5VD(hy)aq;_U>|gp-1= zN=W(b1gy@wQqKN8gX?f@Hbu%Aq-zips0uHHuJyr=hmJy4=%0a)iGKYLcSH0m3&hcoyAZ|lq7t`P(db1i>+LL+ z0pt6}bD_A-kK4m3_s$?~La*(QgFEdkc@!+KfA0kTGpOjr4N*D+K?)ZT87bm7p84J0 z@=nFY^y^Tl{{T(#COnmK&DrxOMh~r&d>0T6xG@9c1u%z*d_DeQ7`NsQuo$lr4K8N1 z=w_ra1v|EG@W(s%l8Qy{hVe%(R`U5>SU`W_9lucvU8w}dXID1s?8 zx>RV61x{YJm)^Fbb%+3#AD_=Y(I#^?CV+IsEtS#jJSOn>jKpKEI< z|JrfJwXeJ6e=b*&;yRW3iNh*zLVqCYVJ&Qr%FB^a?z=p)TVgN074c9p-xL##IhQn< z@LG3Rl*bu6Pvp4zmHj3=Cl8mNdWn5#@P1Iluz@_5c zegx37L>_L6OZ{FuRU{6qf`>Bv!Eg#x737VE_oTj|SLFuxq!9eVj)PLFSd-dQ;#R}A zEYB!JX_@AW>^Lmnnf6;Ek%b+#=MBQk8~7zE%^4W#0>f2)&cZw1BIJ)QCe60c2CC_l z5KxTmy)$_r0z}}+T}uhl;njDObBTWzcH-KkiUx$N zmyieW{@?Q9xgrh6pGMVV@d|=n!ygIY%=x+;_)l3J%kDn?p$z zkfPa3Py;fe7DEoaO4|&{(5eF8d0jBjqa18>+Nv3>tcD7-Z8Nb8^CeYHa^nN>H4K}Y ze2p&Dldrb_^Lccv^K^=w{lQPSE&a2y^Gg$yBtv{Uy#2Z!R|Jg>i;EK#z;$QeOelBb zX`r+PtNkg<)1M9MS1Xy`@u6#f$H|LRp;%Te4VAwofAQOMRB_BcJR~t z0QNvB?}Hxmy_NH;WSX%tK+$5i)rT2JkI)FC%Cr81glha7el+%$#mzMwrPQCiv6p^( zGMe(d@i(=7iXn?gp2J$AS?I=;am#fRVY%Q+q5AM{8kqWgRW|?Y!!>4~^>cfSEPM0s z`Ud{~CZ{Uk$E6V3IqN#*9FP+1p+P~CU}#}Rx`zZQ-%5u;AH#uGzC5>WTD`rfP-I*k zj9S<`OzZ3OQayhMk$vI6IGWFnF`_X_K3f1vVffa0#nBp9-{1@Q^7yN#@$;QPO9J>0 z;;KAB2FvqbVgPi8We@9X+EfdWMsG5lpYEO4kf>2hs0$_Wf?-n=;;FOeVdaF8EnQeO zI1dBGBJ@WJ%KPm~IRaMRH)|MC$+W9#;|HGmZFuSFI1~FK?0<;YJb(4S4L26_jfvr6 zz^dK5M)ki~UVHs&gFtHJadZMlBn{q6RGsnz%qgti_95>M+N`GfEnS(6!i86mM0J8z zrgK;LdI<9>V*s18E79KzytoSfRfa&jhsX6%%u_Ej)RxvCS~r;uNAoPcd4#)~?Mqc> z>r{0cm#02H|B^JQC6a^Lr!QyY)=7QVa=HyI|EkFQyk+#om<+eu(TQKcsb{(Vn&#{q zMAZm~Ow!qUxQL!u9@(2)x-`Y4smK)#k9v#_f*}|W=gvmW7qd|gerj@c|E0vpz3<{Z zg->edUr^rZmPwqO66P=wbm$^P0u~n@By|ULy51j-Jc7D?6havNb@9}R|*Xr?=%s=2>H?2mlKN7C4(Ufdnw*>^qLOz-l^jqrb^tSUqmH!Z&Km@G0%C+ea-j;djYAR zUmuPbw`QUT$0Yaq7yx=N1$_=b$*|1N{bo zqFN&LxIZSsw0k%wZVZJi>*oQ@DO-F!u_97s^_|%tG|z@G^&c7b=c`_n_-re*fukvN znVi@)#Ma_$x!hj`=!8TSUTQ;YkE?=Wt3!~Y z{zu7aura0wGx02EyW>o-M^223VBw`+t)O`+&5<uTX^ud~Y?O)KJ^kjKJ8P91H&?`Jt?xTCm`qmPnao>%-awO*=jY~4{YZ!#<##$$ z-^4yy3j}V<>zv#B#)%;n6#qF6RDM#Wk%4Q4w%Gp39NdO6-ZObu}=EbQ=m>#^EL;=MoqCj8%zLxF=t)g6cYDfN$vc7@FkN=l;8De5O=vgOD; zLkZdwtB9Q8R=Tf`lSjjy-d|k-bI?z+ z6%o#9-ztGeTpRd0e%ehC zawSbiF4#^sdUepV=^etI0T{ZM1EbHEu^B>@9%o`(bKg9h-iwD`oUDi)^pIhi7DJ7Y z!jFrZtH{5J=E?51PW~m@XKvKJC2o@Bfh=Zc=JsrBiQp> zn;>DW>rZ5_GC#ew>!TE{bx88|@ab{uZJ}cPxYg-+*a>GDS8cV;F3F5Tt3^y~yk`w< zX23A6FPwg9^0jW3*j!ga9j*om<39SpxhQRae-u9h{Nt~!FZat+m9XkDZf>`oFLB0# zZuv2&40`{|K#82GGwJ`SO}Cj&G4=uR)8IcJuH*6R|1`gNCT4z~Wh9?EIy{*+zfyE7 zW(IG6^k`Kg29^{lojxEsSo?vcltUj78CVHEedEsIZs7K`sYaCgC{ZD&({>83)O|%mVMKOnM-4uwWHU(W3hd4L#fP@Hoyg)M_HB9G6|R z1cMus$l0y<#OIvF+TiDiG6tkVVVulsGlWroTWs!g)0>aa{WAI1t9ds8jWVi$hg4t5P6LruI3b1w=hl_Qu(nvab}B!>dFl2c;jXY#vhHycYf`6X7gXU} zwAj4B;}ZOi@?!>9lu8rrNPTB>MVs&SkG1l{J44IdorqU)HS7{6n#lFWsl#`wP5M zO6vUe80nvPmH$3m+ne})`2;P12dIGhMvr@+uj-lAEWFSJqkNhszW|k&&u1)FLSexb zC;o_#FllQmH5@8L#2{iYX~tl63WpTi=JSWjnSNl-6Ce;&Z9ZuFV;IYWn<(5BF>fd` zx8!mc_T%@#q>1~TF2Fz26fZ*kak#JZacns!#$y6f=MnG#cq?+z0n*UjKJtF13#I;~ zg<{hmSG=CY^i5T#qVYg?y;SLhMM`a?GB;!>*$nYhEYdO+)dAS4Mka3{uG|wf3v1?3 zR_9^Q9fOW3CrxT26JFq2Dq%4pf@O?>Z2`~w(5Hl>j9lpr8xuc7K#es>&z3zcGoAjZ zci&PybnK1$+fRFq_`-Lcd$$WVISF$+=@NS{cOCdm>x|V(h>$F+@d)TeHXUgP`c1S5 zJ(RdJ;HU+mh8HYPNekAu=VG^%tLN5cTM&vL`4xm?+}?GXDeG(T%!{CRkO5jD z+0tp(--jT*l6a4IR$Tgr(otSnN5o}agkYuEQKSH73-9IB5!v1g%no+bk!H(=C`mkFm-*G3#DI-^xgEc@6Y zHU~4EWH{~ja$SmaGs0;%$H3w+h6!M~)(t0E;QA0eYf4J9w*NbHDYO3LXfvUK?TDgU?Y? zwf`X)O|#q`&k2P??+=ny{dppWVBS3WoL4xnP>y0r^=HwB{0s2;*?*KM={ukg3E-jl zWO&;TG{)yZhk8B;DWep0G&!iaLlD$YvnAOu1CRqBlzm|XI!28m*8B4yHa-d3Hr~~a z1T}bHX~gAPLo|(VwCMnYuRaEj&bIg%e18HUV@Z#A(4b?KTFv%-)qo&R%HxeZBEVYu z$M+A!fH|-Z4eAzC9gI{P(;8K!MD*|him}Pl`_BbNxHI)0^^#d^3%$tUz;UL+8(J(V z%-)S?Hl}4u=d@(AQY#v&f|#(k_6W3MKPHsF=uu?Ney=fagfo1Pse+h64rb^7n)I>D zYG@+6bz`GRr1BKMH=o}9ZHe&=2aVTTOVv@rFPOw4d@&vZ&Si;1J{WZPn$%trVz9nN zTWUcSN5Cc9tyhl^ZnZUgt+Cyhd<2%ZiKkNxBmdF_nxxSY7dr7B_wAM;Gh4`H=DUf?z zn)l@K@DNXw*&xmA`uo2UFW>mh-NqmF&VeynjwAOW-OKU+8XMB+hs6tc`kTEDV&S zPpu_Et0VFL!Q7TEZ7ZMlofIrs8_friHt~jH(i?j6J8JkU3>^Q(@TY{k@X_Et@@L`A zxq|VMWEGiqz`-~n{LE;W&w=RXaUkqXvHBE<&wj1$#3t4= z|2kJ&EN!$5EgdjJ1OA#wcULjV`ywA5UJPB!)lc|p+m;g>=s?y$q z^7h3>*OZf)1R6R*H{-zcWpUS^I_rC#Q_JOG3P<;|Vq;g>8&3%dk*7J@H4P^|VoE?| zQagYNevh%X-zkUMjxWV%qos(xo<})nO_yA>Uq}*KIw!2PR5nZaOjegJEuUl6pxc$| zJ~;KizaVP<^9EWw@V4G=0umNrGg@*mka;QYH(_1@diDF zzH~ePw|L^b>-%Pk9t1t-Zy#16aURLm?pgWrE=xH+Qi zAbx|6c_`aq4>ZkFH%Unx9|x0baru$qlYko?E4?dH$S;e!)^F!bSuM21k?9TahC!-- zbc?Qn+b0%jfH$5XwAQ};GGB-*%H1vf#;&e{8_B8Q_yri);MY)`Dij7qK)ao3%;8rF zzln#&#>QBWXoq@n=;;DTJ=hYkAoIT8B6NQmI{qgWxXAEoaB|i)p^LY}qlKE}RfGS5 zM6aA|ONp}!WiOUke{u_Rcqc{t-Q9qXeVbsUP|MgtZ>hhR?-$kI*a?sG1xv0W{tmvj zm6$8h`DahRt(z{qEuQN+c9ZaBasG4bw^IbD_Q%L=iRD5KYPWu+_&AmEQLABTu_o5V zt@#&K_S7-eO!uMa-D{IpL0(CkM6ef)N_%<#s;m7KOFi%I_1>%NarBYrGOa%~X(A~s zV!vPn`X32|m$TdV^RexnwL;MeGgcJG-4{n~-W2 zZJ^q@J3y+6fv6^v=1-TDdP|#C@>rQsXxIVvBQo9_)pH>87Zp~wG*c0dhdj-(Z@Bp@ zML6>)874A<{%l16Z2YJ3ak){?SZ*(b8@1!SW+AziO$hz=SNqH9MiXG_m3gz*iw`thfaL%hqj=7W4&`%yrBO^5KQQ^3hI0{7;5O;q3NVM8# zb`TV2(@&e}U3#31oJCaX9xJ0sS-#{mM*W^9Md?k9V?7|f1WI;EweK6%9pPA=6w(16 z4a-7~Bv?-7-<^2#J;l$~>!?GV6U+t;-MgIwKYNW3lk|;eRyteSFH!a3{IJ@8acJr^ zhtMn=M4uha+4Z+Q7wf+&6>03Fsg9(YfLUG6{*4V+oRIl$a%kjR0URN8P=VlU#tJc> z>!g&$?Z$zG-+gO|+qC&8wjP$L`Cpz|w;e6;ZZ-en^?#Ct)d4IpH-3rMSmp?1)JB<{ zbg#rQQ1*v|tyPjl##Nk?7~iir?-4FXOck6l+hR^Zz+jVWA6(wM@^c{;rvxNeYLqKpynM(CPt3XnZU9+-9h~^0k2Cp={%30j!k#~yGi;RcyQ$z z8dQ@Vhi_KIpk}`X zVwI{M&i?XyIwX5{EZk`&98gb<^eU~%6q7q~E7T#CwF)1u$hL^49y3>i>oQNIQM27< zflu=vZp^d&$#bXf_j}#hPjbanV1?(l2pAN$?CA?!1xZ*6=0%wXr`h0pa~Rp=QJ2<# z)mV2j$kKv|%*@!E$Z+}Qqry(dpNHbhepLWP4Zx{^$zAKrZ3e<|YX=OopD%yo3N3-J ztRUBJSA8Q@cdrpFr{uUq%a6P5sGWrEUzgii9`Il48T8h)jvzh}hZo?TF7)P7LjX$_ zrt|6@^d+yW*BJwlbbMW79oe&zV(^{UW{8V>i@gxrC#H4dSm%C4*hPCt4d& z9R6nlkMYVVso8BnW-A%K47cvk4Q$k&U$_0uqZC{3J@*$>J=v^`v_ejC7CAZUOCuH! znwrlm{Zy6r(x^FZ9(>>m<^MOD$eSuii|=!)=0FEkzYXPmPLQ|-#!hD~C2}g&{xB%| zmGK*CJrRRjYDEiYf_z-T@{??XkCl^Opg@Uh__w#lf5&uB#m`qET!A3 z_01w}WJ-_v%cB2dibfSw;~X~%Gb9zX0}p}s7P-xovBLSfZ6BlcPD!5 z!LyFF^Z_0m!@H!2p@v>36Aotfj#!nk4=B<<%(T&5-IC=Vk@8NVHuc7;ds}L?4{{g{ zYWdBb zZ%A*-*c7U)%T~8Hd4%`)(l+n;PWYEYgIi=%!uIz2kx;+(m*Vx_OEM~PywB%-GijDx ze|Md0uFN@;qC{pEzqpy{zbFjrJ!WU2?>+ol3HBD{v4?j(tZOs1bydc_79{Vp(|tlI zgtc@a_CTl(F!hz=dVO_11&?)-2$Z{Rbbf2NdoNNwXBZWV{ez9$O4cRd7dmoEeN2xF z+X99O5=LsO=r8>6t}o`S!Ces|>?@+(Z(T>pZn|04aRq@#!!~rgVx>EtzpZ? zzZ7o4yVGd*tbS}V_K}l!tT#a(d^<_KyJQRVhkoDaWyS6Fxy*M>*y2D-S?0v+?7ZbK z37umf zrT5DH7aK`}NlVrHD^!uwt+DTbi7Q9E>w(^Xu_FK2OoF z)nKjcziMAhYIfxGEZ&Z{DlG=;f+9z}aag<(W(X6N(8$PI`@zl$>t^cPUMF4{^Cj z+gLpLA1=4ZEN&XMIp-eyon0;I=jeQ#adKKOe1hK2b>0IQq)yktsq)O&R5*5IPqM|g z`LQQAWDgHD31G2D-tubcN#h;6C%&Us}d099rx|$iM5wQOk+qbCV#6lnT-U`enSM$V`vz< zBNAzC21}E{*={zz=uj$SF|KAl=f0_Al0Mmjo90%FB3HKU&YN=4F;2sPtRDTfi>|01 zE2EwIZLrpD$4=tf(?JRL;Mpue&*{VQIk08sez_NiBx9jYz`h$tu*C4P3VLTtw@dL@ zAcB6W>9&&#W+%xi^>!zGWq-XiPSd|UJ&*ssUOUKf)h^X}g=O>pS>jfx-#p~BLFE~7 zCw)e5bBVNQJh4=6zlHi!&q1<4M{_1mqTZwp8rbAZm8wQG60KquNRW|?h$R?*kZYy# z?89d{;a`55uAgf~-GXZ9J%sfG+pF{;80GqmJeX(VpZxXfpZ+LXNe0gR{bdHe^wtd= zDJZHq>LQvT&N#QNJdd7__t!b}O9noNm%~zWwRVa>humM?rhe&|gZz&98N%vb>;if7 zK7(0N9}VvKUg_Ph{t$R{5S5?oRfJV3d}s5g!p~5(mCzcyrrcG-#J}{q=*oRGx@L>b z8`ru1LJmQ#@_HV~=GGFXowPA^*sSS#r2o`|G8M`&vsJjb=+|Sa&=tF+W;YnGYOTm$ z{gRIRy|ch7Q+iRHZ^f}7Hr;8&Gd+L^#vFhXvIyRu6tA)M?#0q?M7)>I3l?`$y*Xlg z-PK1tTFFY!JgGFkolGQ7>z~ma7SxB!WHa0`SKZyk&lOT{QSaFm;+;#~%MHwx>bu71 zQ9Zd^v=d-xFjX>-v2H^zajTv5`wMGK%za7A5FD6`h&0e~>hkTol&esD2V|48T>v44O>L1$lg|LG}YuxCjo zs7gGmr=QapxADtsPM9$63+<~`0?q-C#4G*8FITUb-oBjM_=6sR?YaHqhM;GLua)=V z!t-_iXujyTfknR6y`N3iK{_%F0xejRLRxM4KwBUXXKtb3)42aMvb5$%3puSy7Dy3| z37$w<$4=0>X3gfaZQ2v{r>*;fz|V2o&vg^RkN9hT%Wrc8!bk*3ws%V|g`LAPnLUzy zrMRw@Q}{bKuvM67Mv67wd9()Z1}{4OTy-5$u%PpE{NmKHa-&GcXUuy2OTY|FA*Pj1 zG(p-qb3?u9?IDCjUxfybzFd`Fo_0P@uOahHy5uB=M?12HY&o-BRZ`~_j{9?*T>kd=_rpE(YcO@G z_QZH7elKAjEaE#R%k-hpp2}N z0`50<-%(KQw{PwFRA@ZaqYW>m2`cz_Ja?LhNQ8QSSpM#J$D+0#>X zj0j-_fwZI+6$;n(-y?G}M6g?e8JS7WQz(wzHxFb_k|MMG@Bh9jGC(j+aa?xgayyWv zPm+1=ufE9B_StG&0{ENW&Hd*dF6o(!f#UJ!54>gbHLpUj_hQj2Dpb;U^VrKUr#XpI6=&0Iy%Oh%*xl3x0497J%D z5OtYDWrqPtu)k-UZTWe$-j*lJtGm-)EEcW@#^ThQz5V<$SkrgkpXSL4A7bLa_D{dY ze|->;^})zjjYs=UArbJWop4FI4No-lu3^YzzbF3=*pzT&i0+FmpMuq5_F_Bn$q1NabN-=`CF) z7;L$a#cMTH+IA~69S4}~&)rPNZ=y!iqb0h^F9KJEUm0!}t>zxu-l1BY{(f~|JM(Ir z_UNQ{PpJL91GhtdE_C~>=1U0`h3<8qa%p49J>GZiGrTBEx_Qa)7w}Vfd*9D86w#T# zrj8;w%dql!%SwErAd1o3Q!!<^kXW|OU0fG%v`eVZcx1yp!~i<`x^My{eoyYTX~3dG zQ@aa29??Si!LpUAn@-1O?IpG-cwm|9^N;3`iLc%K;;%=YK(MX~S)=%q7oA~Vc1N0U z>KVqFul1ofOalp>>Lip%z5(_+udtu@)C~6KFKG?j&#hjCBrlo-9OPhgg2|~3Fzu<1 zHD#2M?ToYozhbSrFW#sYY`N{|o_cpL?cSfIE`S?OYBF=8Zs^U4Tj87U4_-5Xo5wTq zzZbM0B^CGVi@ZMM--r4|y~w>nLdaoPw7?f(3}j@YA^ui>A(71PmDd-#0N-34%E0LC zl-AuB+J-B+5#GYFLN|Gwd*%6ZC5hc)G8q^gyy^fn7s*|y{^7kj;&U8s_SN9toaM_f z@(@(7e`=Tt%IY!Tn>62M;bb_(fXLj=xUW_?Z_Adicx%CS5I)5FFVtmETmdT-3GR3G!+V^hrV3}g7 zBPcvQjxYhxN-9#|qoZ6E$MarINiDP?^d^}7xS4>D;nq16puETqWc2ub6eA+h788?t z>gM(OqWpA=4LI(@0)*cD6?nO!0Z@qlC`e4q&|*YNzRe;yY7Qp<@ntlbSufy+^l0<@ zPFef9PovQ)oo`{OC$~;739hU>5y3^@oj3XeU#}PD5h_9m+Sv}t!2Z~Mpcobx3in-q z;V2}RSrsK){1yF}qy<++>t^L)k6;C=dhf+n+%LXDE=a4X4I9dyzNQ@?yvy~x6^;PqHJNi}_h){qq>jH7fh5bJw8Ko4%@dgOvKg}x zkr|*ojejKLry@~i@&p+T0ON%U3No6ud!sisJn8eh&R|}#{C^SyiYTZBPkWfkd*=$f z(&A=2!rf7DsWwwh}-!*S2jmXMk)QP3cTK9Npnm{BKy= z0o`-BEqtsN%AtFONmoiD=tFasYSwDDO)npX<~o?r-L2@J&cI+K!fN>V&b?7 z(Xf3;7h0s~br?K{!j3)1Mn84lnE5|#A<&$4j@z0Z{ zr!Lq++}=l|Nzdx!)+a}?f$%##`-_xBv?wniZpZ$>n6{=gn?*Onru_n^?eUM%cCk(P~}JLaPhfsOTS@#>GQxaZ#yM|R~B&1Cm{oHzc; zP&f_s6!q!a6T3iIVo{EjpTy>0Fs|Q{QT~Nc@k#YD$c}Q)tLc7 zF!?7*o<+I4{`zcd)k9Ss$mtwPs)yoI*l`p$*gpm4dOUf%U zw;s>j=`nH(Zn;o&75~!^lj^&ZujE}3iO-^Q30{Wt%ECE}yfu)T8#od`ohBatzA(vc z(ZK{Tf9K)nF|YvJG#)9&;*e+*g~h6vwPKkX!r($lcgS32y| zYc93Yn7kNrD7 z&zFB=^kquQdM2PJawNV&H)!#KxKEBRJ`OsMHz9nT_~ZHdqQ8QlFS8?!8Daeu$6hUJ z$|rC_W$&3}yinIF_a_$WlKjsJ8|NQ?!0HYwB2z}+>oZTY1ujoovOR`zvPn7kK3T$! zPa=ip){A(9=M&`KU3vf4v+ED7sV*NA5b<;0P#qIk?KLM|O^7&2js7tn9_7+iDYi9j zFyhOhzCYT=5;9Va2>X-tC@2GdOaz|JId-^h?%$Aoae>j;Vp7~TXzXO|k2k~iQt=Qe zfpxJ}x2N>)7Y2IUl*ocZfzy1~*TVpS#TPdU1ebeuo(MV%7&-SpR|LMS-@NQCzdl0< zH@&c4Xr6*eld&gn5xg?{HSE^G=hmzU%wPk0Md4e16`jsr9?v=+58N;=z-;kUhh)euvOrMlX)bND z%8XPPDJh-^ZJPF2gTaY=jSa&j_%B77mJojPXgyb-dQmnigoO3I&22k=ntuC%R2tON zIzq4=}wr(yEeCOna3@cX~}YY)PQTNIX6$BnyS z%5~5V>!ASt8t$`i_5jw)B;Y**w`9uK`4h&YAm%4k@kN5L!#9>g)-DEEjvq%yRrb(3 zLT;0DT>oknI`v_>v%mdz4aL7sA4$wT)o*sTs9N;Ls#{i4qwJuO4+J5)^AU;iG%<2z z-H}xCX5k$Onmt| z7F^YSR$|0aRTGTV{CYfX_I_&j_Ar3s!GZT@XZ5mh_l zD>3eZ=p>`#?*TDnpe&P2A`?3}0z;Q-R<XRnQ2 z|Neg;ddwZXNmvsb_{Ysk`dlY9SGdSQu8-x@EA&ccaAzSjeoBmuVIVuR(Zk%;uA?b@ z^6@cJr-Au^LGOLiS7?y|*ei6rBqMELm#~lr8TuV#j1xf{P+%7hXVPfcQ0L}8^3GyN zQ%d;5Z7K{QF(+Wz$MtGJ6cXxNT3+}z)m6-Cz4o)uq%wY#Z{-d zK!um;7*O_;=06@}K?beIy=`TC9zn$L+*dj%zbY zF(;JbTBz1Gu-+T!cKkS1-J$!&P52W1(HBqXDhk~WX1qi(v%tfHEkF<)E)$f|;__u) zHa};dASp?P2}M0`OUWpzmK~=^Iy0B}q9HLl*{*q^xusP?Cn|jjl{RPlg2O6M3OTLZ z3mSfMmjxZ1Txvgu;AE@tk%J#o8(VLt)>ai{c>a6;A?N&s*{7npM!0Bw-#a33{xj<+ zgx2$O{^A%3|5XCIYhzb+IzXc@kQ&U8^R@}qnzuEXmwN5;ywMi6=ev{icT~4$U$6X& zeCrgC?$^IiYX@$~grPRA#OOc0OL>4GE{8@2gCu_?GE*3K2TrFlQ@njA#q!j8wrQoj zC+-6b1{!=<@IB`drv%IAa!tnYvhR%;Q&ge~B=&>+{~~^2TF@U(I>cP+XJPy5!@%yq z9pmdcO)P@F;M-_BCE5ZGPDfq(qidJBFUt>s84t zpIk6aH_hl)xr<4;>$+%YvgPi_b2&n8W!%zMaM@Mmlfw zkz#if6@fx4BNli(Mz3nVJNe&eqfscmjDjq8JiCfN0_O$QTAKGhSN#!&hvL}w)a>}< zhA&Q`6+^(P-yAp_L^|e)f5f%+TY(}3Bsoreu^w2ohfxdd_H{CGTtYc}1$GsZ$}&Si zTRQz%f~Jv}>3_TllQnWTXB%-f=jzE9-~0dJ7awykohHT55-2nn4dz=(DGhT?9>tYbUD03;}Ej@7p{Y_Ht5XCkufh_rP^$O9c) zpo+B=@N^K5F&82Qpa0c40~pkDGqWe&H+BsqzW#T&HoI_j_^G<~>Bun|r^rVYI;Y(b znNwz`f=!0b@A373WXZSaJ=p^4X6Gu!KNvFm%1#?U;A(?c2hMDM)D83z4+?g?(q=!% zw{JKWJEoqb-`w}AJNJA9x*sNC=g0ZD^-gF8s$ zGg?KhI%pA>olM%Jrxwx)PY-&Y%4?^d3b#))Ljm}VsZqAO8-!SF#WZ?UF z+b<;0b11L<>!aDFY{Fd``xTWpG>JEBoY1BHt_8RcjsctuFzL@)2%3NJ9;gb;k1@$R z=xF{i0UAl=A*tbk7xF0PG<>=^yKjz(Bh9>$oez$Wb*CI@9gq-?)|F99*Ka5Va~IJW z=BWSM2-y!~EX9Vza^jcpDbaiuUr)1yy{><;BdJx&oPw_eV+6D9zJAM;>xe`>7a{WT zwO{x{w`a&D@n{h-T$U5z0zwRGa2+i$3sETm#^6?)mX4sJF{DAypKq!a^%$t-`JGBO z-9^0oK|1<(MOTBuFC&B@p(|1mxnnX~rh^*}v$z#C2`9oqEo<0vl&CQc(OB)P9qXM` zOCO($j3j}fr|p8W%xZF9HD|&XqXaX8cG#WQerEMbP@4O0G5r88t^X`_Bu1<|$vOnk zEeHz=*|{ke`9-kA$Ng!);OCWSh2glIn~??53Amv~imPZKom0vttpBsb&YL?QsDZ7= zczW}*`jVb6 zq^`#u-UQpT^VZxUaVRkdVo1YYAdv|C$$;XtvAJ(g6^^~pS8i(EXKWO-k5)}FSlc)J zCYogt4AymU$ti$jHLNXFXjXZgmrxnIO&S+F4H!IXUD~zZOsW+-U3-aJVn0qPQS#k; zh31Yuw`%=bxLVhfkjh-Uy~7rSb_dm{iJKtR$v3+7Qh81X1rfOYJM1%E`6CU8>nAtl zJD+%a8#aj=fhf#$8lJ_5N7ZFh_pbGg1R9O25Q^C`;8;uTGE@;#hi(R}P61=CsZfM* z*{VpmdrNO&{9T2;csGIbeTYeMr1pQLf^b&Rd%CH zt?j7nr$d%GI%FBAH&s|^lVm#>Ns+sYOk6*@bj>v(Vb!w`RC8gcdSH`C#OlUV!}}8A zOqyiyQQ=oh>d+q}GgH&_q|v1hyPFp%6z|8;%lKNTqzxVK*O)6*>3c&&RH>k&0K0G`3z!)zI`uip z*DeuatZ3q>_^dK8T>#`}XA-e0qdflr*#0g{tL+I-1l5|!y>G@c{E*w5=6VhV9(I;G zoY!y~`IQ#TMuPvDzK(shI(E_(&wRABB|0b?`xh9}be2oW))D#L9@ef?Utv-*b5u`) z27o^Ew4UY}jL$A#sEThPVkl8bq}(V*>@;*#e?mHlON{Pk2Fx5|Egx6lLItO8dDNH# zm`Ax*3T9mDPA(7AdXVH5yNBMExIE$U6=>~%wguf*UVE_7Q(p)J>$0?Lu~s!%`yqf`0Z0ST1($ zWqDm-uijM}l~u8`gSWc+ecKc0W!8y{YY%=a!3WOn{o7u9soGf*a({(%7e~t5zMdNh z-x)K?B7YN(3^MIh5s{o2O11f#YpZ9B*^oG-99nAyQ(T2zxUX~Mjlo5JPAl2EAxXl% z)innJo1u%+`K(?gDx*Q+R&Y$8SJR}IUZ*5G{+Hh9=I1-e8+)c2K%5}_`UA5hagFq^ z7v`b&w&chhmPaA>UmNJrU8+Pju8Z$;fA+l`qk^QpRrI-ual}=-zcLlYMY>6&- z(jOUnS*3bL1(TCP7Jb@u<#PBqY<`en0{CaXXNiX?`^}x^k3U;r4z#Oy7q4K6@_y*| zj0SPy^7BxO5LC8sca{+?(^!ss@gl&kKcy#)Ps7Q!?X?899jxzTRVAnh^UbjIeG!7@5B4+5sSt62rZcis$6pj!0l~gH|dBZ z*k9i;q3VT8B>A+?U`l_`($xpLSokRVbOpw6(9tB2re5SLbX~O_mwfJgcGj3DPE*N( z*&i0(X8J|%u4k;{t=$ino%#$zs7oTnUe?>ro{r3XlghmCjd;0>aMod6jz6#_tywj9 zVTD*isI<7y8|rtQ`>UsSwUo`^PQJC9VZk~QtXMT!>G0>DCMT852L}Vu6r?F|_-FgB zwOo%})B@`EexQ&Zp2+0=yfL4A0P9VOxOJcrlEVnbK($=*I4Jjm9R zKeZ6Ch^FTvlF(m?mIdf!nZ42Mn);2-(sJ@bJ6BtwJlxF?AzmbJlD|%an{l;ic?$!) zq`nM^?_ky5LN9A&UcEHQ%H-*9yI0?%I-GK6e9*8O%=*EuQ|#KBB*ScGPs+Zx^^2o$ z%p7w>d4$sW2UyO`*dGepgn1jdgPgv?#FcSuaA{Hm7lyRiPr&T>>IF89pV8r`PeXaI zZrLs#Yfdm1+t`Sug6MhDsM#j8A3p-dcPwcFY-ka8k9Ev>(zZZ@3drW)jmL#brldo{ z2|wQsncJlNactYUn5f?pmcH}j3rhG`vzq1~xVr!98-U8?fx`d3|#9WPr2x+^v*o{Dd#h|N$00_RTZ z^+0n{z+}IfsaXV5hzG~d@@O+;D6HjE9YzJ8wG@H#m7Kzuw5GOx*V%;qVIl~NwH>0a z`71$ZHJ#FTH|wm`BlJYB97Ac3RcKpw=fC?FsM?)heN$v%NAosiPVd}wA*?nqQ`SGJ zhoja@4gCmnk)+UdDwtmi@@B(ntcJbBHNY4c9_Jxj=#QX{b5-S9(-kW8Q=6-JQo+6b zdaABhZpx;h;9kdy^tOPQEXns58J~do@hFB~|7< z?OQbWCgTaV1{!N>z2Y#rA%bD7+C4TqHvx(yHTNLLrH;Fr*Rv$AQ?gxn2HH=JYp(}; zK>at`+;e6ei9QQii9(LJfN??K?w{3}*BNB1BqL$jb>_dM~*0XK=WOtY#ExSh@HK%U{lH;G{ZB3CcgC8kw zFHc!srdpWWokFilmRnn2p-X4p`X;2TgYOlD|e@mU5oA+qjM%~2{Xv{JI>TuL@ zW;yHQi>7&^Fm#AcXB{|I1%rUy;YcUK931E_4Air_prlUgfT83cT?MKq(I_3IF9Wdy zf^Mr6L`Bc{J!J9)521P_)7fNLdIBIYqP}O;Ozj>mr5+o zcd+Vpy-_q~8^YJ~4O$6x%dMv&ehROBbm4ohW4Tnlu^zZYL<%_VZ*gs%=_-8jndnf<ME84Ns3|E(bmh^Z&xzUd|zEQF3@?7PjKHRw4e z_Wd*(|Cu~cBZiU#*<6546%pZKWY$+ZW3;Zq26uv;G~2?-r0S?2An|Q2;vqIa(~m=& z&Nc1c*N-euRsDdlK+lt^t;8vGEdBLfW!#zo1htQdKZ(K`F%mg5V&=*GU{L#m!0vOc z=7c{__xCGjZVd(r_(-X`8d7H+tV9oFm$BJnaL_mBuL7}e$|N3RuBvEiI&(6c97mVNh zQ#%D;SMbYbx=EdU{)(GYs=Gj#pQ!UkLEn3#&+e@d$^(n`b=0AgJK%xRU^x;u(+JQU zw^!brWmnW`)p}SsdliHIed&i=f+udmS)A-ziw6}HTZ|*Wc4Qf34Sj8`K+qo?Gskk- z$=p^G$;=7M>2lTNX%sK!hE}oe)IFcRlg#`rHzN<&8At6$@b5lQ&sy_`-l_K%EgipN(wS*oIzXdAl=JQ5s%~+bQ*HwXlDR}lseebB%=@AM+ZfB4 z`js5psW8N#!j`ebtXx%{XzZW-V}V5KocsC>7L@Fo^Cj&sc?MH>%C`FY&#Nt~Fb59d zEd=|%e@K4m;+YcZ1$I97>7HUkr~@li-oxE%%Z$#BQSJ7wQ`=^6r$0eo@PV@WU~+33 zWyPz2*)3UHBZHZ`$Y(wuTQ!51LTV!o7o@uqj$lWZ?;f%1I5dwN-- zgw9G-$}z)P>FUDeOL^2LY&vPb=>Bn>GZ4<5IN|wB2&?n%@ZEIN*`aGax4t8QD~AYR zZCim>WOLEpztK;opRpn@ePny*!a*HL?tb>FqqO&pKY$jt1GG7S*~*nYQFX;vx}>a-1<} ztvzBfVl_r{Hp|+qaT!NeT#Rkjsk)50Lt$yYcrzWR3QeK?*6Tjg%&A%0W?7kn$){ULv!yX=hZ?g!QmXu4g7gOYPsUJf*B zek=?+?1*|{h;em>^EqNfjwMcaCf;ZkboZM$)CqDthOxcd`kslz8R6+nLjcN(j<@k# z2uIBv*$t;)QKTu#9EUR}XX7*EsF#P6yPoPD(F0<l+$+;yVpk?c2gI1WZjcxOn1F>BBj@?CZcq5^UAT$0ixHiJ}kCXDh z1W{d6Ay)ZLlZ^>)W<0Fb>=F>=YhR3=&udFCao~{J_P^oNr!tn8J#P|chP87`0&;qk zED)exi;Imo6J8XsQswH+7|;A-4$CHcJKpQ5Rx+5^(E9SCrze(qnfK8tpJF_cG$W1s z(U!OfNMY(~>N0a@fGA^jVEtkuv(G)*+F{8zhBx@&6J#~x@w)M*HkpGBj#?+V;R4Li zEU>Zz9V?EJqb6SL6~!@>(m)qD$^)uk6_zQNm9%HzJDG7i4m;+?rzG)J6}?(a_*txB z)VU&9-4%JcodW?0r^!@>P6DSOADD6q!#KO{_i6BPYFxDj&;EP~7z%CJa@g)mxy7T9 znKexbTz_s+yE|oh+A3S~n!~YB_lVxtgEa+>D@U9DAq^&<^pYn@_hSjQU{b0N0OGJdIv!xBV)Uks!oGH zO5}5Vh^!7HcfVHg`!;?ns13v=T>gznnw+Ge-EfA2H@9AdIs3IxfMK44Zha0A0AL5y ztnv6ukgXC%FmR;WgVQ)IM?@uw9pE4xF(rb|pEQ(oJ8pTvz3 z?(eVD>Ndz7M%1GHCmdT3mx`@>&F$ZbT*)zn=eqy0(lgkb^p5=mzmzmL=(2S-T(kZ>2QoZ4WaZY;MW-QfD=c9v zc1sI9GDDR%aHPBv=r}yAx{}R!+zz#CujJy1j=K|d+tZ% znc#-wd|SuCY0`bV3;eTm{s4jXORcS=U(Tz*cBO1fwung6R0j>bE;ib=B$xb3hrxSiZYGw1X z;O&pr+2!U7@qVDarz8H5$~2q8BaU8U^7CUwcaw@)nwYK`CWyR@VE@5;YK4ibSL|#@ z#@Dc}^DFnO1$-2BTId4DNx&$r)!F^hS^HK^2&cQr_f?mROuMI^UNZyD?nUxeEosa7 zEHc$$ak(xaM@o{QGNjMnl#z>EYpSmy-i3J*HOj(0g?rImq|a{d-rv(@sml4ucsOG0 zpPbp9d%d`h+Ahb|8xP;1wYTWDeuBUmVOiDV0AAzr)uIu*!x${VVB2zrX!khX2;hDB z)~dDq+f1e?8u8S;Ru-Wj!Ao8vlaeLh;B}%%|2Y}3BlVqfVtKtn1TG}A-5<!Bhl%XRFu8vv%My6% zJSli@Z0>m`S@=$&W07GIca5NrpY0lraU!LDygzooPcH=J-DHIH)jofGTeoid`tz)h|_daA& z`aINAKFot@Aa~0ikAX3;k9!81z_1;mjrqN9cYcK2uMRL}VP2|WAXZ#|(JsyK7`AV% z&m3(w`1wU4+X?}5()+b&?P<{L#e|tWIl9t|^{6LZ9N^$u(}HvRygEXx{`i?IDQQ@) zh&eUl{_59K@LI?#ypOcve0p@lOGVYanFSWY!X1fVW=b2%^Pt zP#RCS@LHdM+y?c^2B`tnK5pBDj$`$_uaf>c-!$-jN;MbZwI+Zj_bUI@~7>UvytSwb{Gw0JpC zPMUosy9#&tHhP(R;zPe@xoBtHN#1sLQQ}G`O{?bsnRvb5BzU)vLJ7>Y+3`tsof7It z-}UMQassctqZI*2SD4iDNGSa9Our!$*41!Rp+#6VSo;Rv2OdUg{II9 z!_P8H=1fgl43}VXEO)p0!fF4UzM$v3QW`&+#09+mTJ0k%1i4=h5kDz|ivRs+h6)3IUywFT`$DAnE zZq@*{=%^W^pT9gpKQktr0abgj9edO9yvp)=?6me+JMQxuBLp2`qHN_oa9j#BNS*_~ zmQeaYUq_#pWCk@?KThf*SQJ_c1r=(Xya6)0STFia^Y7&@Ilq2TsrLu+_=aYVm;T!>doCD#m7h2 z5Aujwh_ZOu0n#5Kb1%<;&u+`>5yyCd2S!PdR05CCHD)XNcB~nI`tA9jHiaDn7Vv#T z`9t#Gm*h^;>$UtNb^)PPL>dZ{_g~u5$`kVQB5u_uUSh!4@vk*+wdu*D>U$LPKP z<>y`KD?FLMJA0dsG|5Pg86Sme1xlkoNNvG(08-=^qnw)u%cZiv?+$T&K_dnoNeWQO z61mWP^GH1`pV&Tt_-jH7Nzuix(*W{__s^+SEi`b`DSz>e?l|s0F4oRp=D50*)!l>* zq9)>-RlF%^MNJy~>ZBZ$O(~5c9ASd|SEW!_q?NsnHIkWSSq_{*&&mzsd3v#%383^o zgFJAsK2A1#&plHaD^iFqbSmS8a>wB5#&p7^aFy)8U#zUDRNm)dxr(;NX#%}Q#2Ci0 zmAoli`Tg#*lAeYJOtOE7)J#P=#D%v`etkbtr=OJl&T*Vq{%XPgw}B^$Yj8cf(ELqn z@|(k)yxismQ@(YGaczE{)Qp0sL3;FRqn5j9t0@V&UXgPZ3BPC0!iaXVA<5CSKmU|% z!$QH$gRkeCuNOm2+8er(w#3p{y(9QYKsxGjJ{Ps`GyrJ%Wb zuj1s5^+t+WT&P~>NI@oNB|DZ%)PLc`7oD0_(UNkL@+gjGFLOL}qNsY3Ic7mk#g^JABofV!{I5(P2X_)Cx3Ttrz!AquME}HI6QVd~< z>;4SMNQx-o$Gb?`lajPGTC`jm^U4OiCP5~0M>pGdgVWC2ccX1j+&J}d3W-_1Y!I8w zOt=&AG%Z&@>jL$k%TA;2u_)62_JP9@DPUad`xM1P*}&jUXAdv=(uXs(#kk748t}Jp z-*B#ebCLMp7%^;rG&6F7xK}F3!G2v?5$%5gZXw=_gOyb|4rBmGj~%0zK&~ zwv|8RA@j=%OyWgLkX=n**;HErH<4E(km1lAlQz>{I&eCcHTY>^beGLw;3cZfxR-Gk zEbEC;MLmrcpcMnAJn#=AXnnhikVc$|#DuBW)^VSFCyer&Fflr*y$>g|Il54Tw>)q3 zC^EoXlls&&J>~hQDfy2r#JJ~l9n?{f0+s}r0Kh4l9|;G zE5o4T*#Cfy);8gIPO@8@g{7=PP>{> zj=_sbb#Qh*U;OnmQd4c5tueb)>1>G%l^}lP%x!<)?OA-=6RSURg}5Rp#G@5rZCkG2 z#1WqJH51tE@1(CD_7Ql#!f4?j$HYx1y6r*luepjDUqp^fkmPh?<>6KtUrf&dQ$BXc zN8oCQIkAj=PJyz}AC%{nGenOwRj7je`Kz5r;?N8eBeQZB=Ff4o-W$Z$6c3J_3cJs4 zY`Nxh?UOKhf5?=2XSTDk+!yyo(b7HX_tb7&1b@xKm*LuI2*A`qI1BlZ%>N_Lh!Xua&7iurGA+{a0;;EIjJnLOa*&wA8&)ZxGgMRfmc;e< zSaN~A+{gGTE$8d7VR?*aS3HE4nUFPEtOI&CUXH?WP+rHp!faW{acYF%c&?j?&Jq?#t-e*vfys|R95JqA z0gFAT^c?oWL)$Ldc>@8`QzZ99`4}LBIKvNcf=$N<2wZ?REnI>rSL(UB=OU?`LRzrGO z%9ZMz@r7l`CTB*@kqSMiU~~`LXYf;fgT`ijGY?*{pqV4mWZ9HXsB|vxcxPSGz3I?r zbPtY~oqJQt9}fT-b5>Cl2tB8}E6b)zqcOm7iG_3J$5@Y5p=)j23IeiWr8?c1AS*E| zeGa9b5PP-a(f6#*Ae3F=Xd^#2s5Um z+X(adgw_jv1AU)@!AEh>FIHi5O?_cnba1Y;1n8zo@L1p@L=s0Y@7I%Mf0_&+SNw2PL{sM8GiY1zl-!;)dzFTXPGZs$tmwEB zvpWIChApPowN{&jd(luz)pe(QFVw5JE9XsygAd28ji&4Y}{u&vW<0mldR%Q@0T1;5YuR4fNpdnYd)haGDk{^+5TOQ7`v^N6*o zv)$|cOthhA`KceDZNH?#Tb0&!5UYkSkM8-3DG0kDL&o=ynAL80Xom=N^eZ>4Lyq~f z<}W;(a{38}L-4~7-XQau{yN`Hni^G$EVB2o$y;=VF5`vU1^ebha}>!i&1D=Fp(_M) z%f-&$>rd5|;w(Ts9guxZ6e4du!dq*Q72cvQn%cn-VcY|eIBtB%wmLU$LV z&%Cg)`<>EIqD};JY4K1w=^6_q_ z+=*W_Dsn#WS)=n$T8!{YP7{AHOTYh~VLP)O{76LhFUv&7q5llkisD7~;- zm9(KForfBLsf-lK(#Ku)Ioq`y$o=Sp3_I^dV=lw3O~-9IAoj@`gK!4T&S6-xxdWJ+ zXG z0HgJ1G`bPIXxh-Umhx>3483T3{Y9E9iWDP}zD}jfeeamN06f9Ua-oppW$%W`(z*jO zt)-(wnr+bx{zKXBAjj@1oRIStxuP#!q?(3L~<)QZQt%XP7%a@?da(}+i)ct>S ztnb1j|7~7c0_{d>AYYZS*qNzntZs1L*gIB=&X}4>OHF5Ov|2MKeJry^!x7!WP)Y7V7x#n*L&Ne(a~{@ zLmMeEF4%(M7hyp*a%6rcfNT|OTW6x=*w9EX$YnKw@F_!}c6y36Tj_e^N!iTL`;%^R z!Wc=yaZ=i6@P^`by{Qf?L{;F7IFjbdTq46Ut_s2OMHw&}vJ^D^o(DZLmx3}y?AsBU z3e0!!`tOW&tG8RK$6HfL2@u0_3zZQ2v-*4p|L zEJBkU<0#|uiJk_DsBGJC-ASP{Ca=|kZpa#}RqHN1hRu3eZ<%6@-&q|#roL_?=qQVy z{+K&%MOst1<9OM=uMs51CT5uC&$Fc8IGVZ{wvzE9oTZ|ChZH78BW;1*awLTgfJ=tk zA>)3WSv0$Bx@+=B9^Pv{G}M(#2SAX01!6{Pz^YAZbku>jV}8e95tv93GR=u=|iAH-!7 zor`FhZ%1{~5ynrVfvGXY<}EAMxgRTodJ|`ihmATAW~Tf|W?XV$s@)mBKaT;4M04uGf^xm6g&MwS6*@;Rk-r2BVJF~#k8@-z)5#MPdHo#;EOG4)c)$f7GRl^e&LynB*tYm~?vl+N z`Ki%GV~-GK{mjTE)eZi?nyxx3s_tt`!_Y8vDgpyIbPGs`)KEkBP(yb~$k5%LN)91i zN{9&33=AM0Dka^hDC+ON-&)`Nd)JzE&pG?; zYldV>-0CU&bW4TU86S}vF&>pjjP|WPp0@s|MK6%rg(q8aZ03U=xc6}Ln3_8A5)Fhd zv2g}2q1y3T1eIW_*sUp?)N#;vQA%?-s&TmMl~>4`ZRaEBCG&Pnap+E@G5KpfR-yvl z0wGqWVfqi3_7^dx_>Z)&$k)!1%}2i8?b8h`aqw?L_m5gUDYf1RNU{|uUj&y;1Ffx0 zJk&<*PUt45UJ4as$=MQ;3~)x6MwkiNM%d%`<`a2&yna<{S=70=YQ!r`)IIlGLT%fr z$jZ^#$DZyAwCzMgn;B0I9VfI&Ht)sjIQp_lc?Z0CS}sjE#(MqJ-9upuYU8GAkjU?H zE)sdHQ9dSLY9K{YJ-u`8?ZL=8BIw1UoBT6gXsM?5D_TM+|SDwi%k6$U?YW4x=hz3jH!;t2RR zx60AbWH|R5&s$FJhOLbgVJTL(UU=idITNksOS($JQj|vd(-OCZ?~6kyqxHE7^Kx4i zt;Lgj0`e)Q&KlL2q*j7iTZ&E2Y@vXo+S<(G*S!{X@+7H4?+f24Gcv2~S*vv@<6ten zFewosd@=|jnyri0mgp2kgarLerfM0h&l=a<`bnhiq}-f~zk%Lim|dX02(S8q2~pD&20yjb#X)(pA~v zMi8(chs0NkOiy#z+mOIvfjd8_RbeNp3 zrjFh1nhl+U9WSM>zH=4hUD*z6tJGb!Mo=>}olIrQWo;-^pt6eIQA>53X-x{;7+Z+< z{(KeC!0*Yok@7+@j^tj3oFn-@@<~ zZc@xk3K$L%icHbx$z-c(#pf&Scz&;`tnl~#2XIN7{bUH7uK6t=;_m4t!D^Nt?rPTd zgVKQzxx(f($1RM4bNrFkz&i@r;TW7sdQi5dv*iubks{+?kifEgXFIs(mC2&yAsfTd zkf0C+U6LPhN?5a2AJcr*>V;I$_fpK`ZqX^6@D=Z$sAJP4u3T}SE3@H5#k#8iyy%SW zBW86;zj*RcIXL$95k~;~M_JUQPd`s%+c2KAk zgJ^NLWu0p%`tYr?58lAo{j(^wnk(>;vA_Gr%a8`F|5zvD_m26%gGOMvA#-8y@&eO@ zsDP+RY!hOp8c2PDyU}k<-h5B?YVb0wYwJgm9E}#~6TP=Hk1Qvrfi*;TIVJ>rl09A2 zk>#(OxCPh4{U#)<`vH>dvkRy zw6Q{hQbNuD9{kevfg)lMC5R67Or6QfyM2d!_kMA)-rQ;1Oyk}5PVE(Bzcr#?wH#I8 zKpYzQXOa!b{i9t?jh}q>&kjX{xt^hzSZ zY&|t7Mmp`bL3x%kh18Y|n*}TCg`#RK8aj6xXb~=s@)idXQh)$^vKlI5*-)t=@`Csq zZpV@1c&w|e6|a@Cbnt3;r=B1$lO_dYbp%Hk*HMqi|>Sr>*^O{ac#JlLEWXSWrs^=Ui9% zv34Ac45pScVR8Hk%ALC-LlfT(-600|Tp)fBmfyt(VD?>5k_$ncB$%5g_7RVWknr(= zp-JsxT(R5RI%O-0K!QAzrTSFKYwv%5U$zkqKU9trB>&6KmX9&Ii#8u!(X9H&YFSjc z0YfHxymy_&iEQ(XImsxHXGY!0o~x1l_j+W;`)*{GOQUlwOKp4#>4yTHcVY8u<3(F6 zjMr=9{%aSi?~j&^ukk>XV4SR7@f5KSRL4j04G%J#~*ehi|MK$^31|FY5D5KSMeY4B)bekC5T=(CzTNI7Pnzgdsm=g8NAzdT;oiSAM!IU-y%ETyIU`&YjiSHFU!e@b!6r#5DaT zj8D%pQUKLyl9Gi6B+p{igd?!-Z9fn(xO)7b9&?%W8%}!G#c+B`|M=Hy#?Th0CrjS# z0YQ&@ZNd;9FDe(ELzVKQqy`zCZ%xXj{Sb`L?At>~yF|Uy0ushkPL!gN0Oy(deC5wna)VNTfL{TMFun}a zx#yVJ|15pYy7|Drec06y0ufg%W`(cSSP8flVgSZC8s9a$Fgjoq7N zlxMfm7uo~uKxtLUqjULCNB}#DGdI&nOH%loKa-3ie(x7@S)hE2o&pf25m6$n4YBg)yYn-t&AZ`#F&%^+qtHM-;S z$MPzFX=-Ur-olOgQVI;qX0c~`0$^HF(R1be?sL{(44N&Afp$LGq!0_=(12bP_8M{d z+Mg9%8t{M{7YrKK&*-dOk_fgKXrOMyE}F<;HN9?Th~f` zg+$P2?$MCQR};CFa<#X^yQP-hpDMulMZ5NLK`>cPHObc+jFgZ71#U&v-|_})HWjai zuD$CATXQF#RXgRGEMD%)B1utD5xgS)L+=vHvTtJ@$yU5)Q8uoo#V@8?fQZ4Q-Bh1Y z!jCoQLa^4%1kyw@MKcBV)jdyiD|npa1RzE)d5Z<`n$-$5dyJ(N7Zw64lhw3u zgdIP~2?W6Ai5+%Nf%JG}IULrmTc@`&7v8ZswSI?`&3{cR@P(N<5(Q5BFf6VYaOP72 z>}XDel2DV{QjS5{F@1ydhw}2zerfY7{;jLw_& z4!eue+GODS`7fnUP9wy(M{BC|Syyn9+fR4S(KZ3P92m5_Q@ziUe!>t?DoM|9zH z>Ue^P-Rg-9Rv|c!vM%1Bl}JuVSlMz5sm^<~E`W(I-WF?bUmM>j+I1!C0Kf;+!3gFg z7oBet`gKUg*yTWen>WeOdIQ1G^xxdM&!vmb;3>3#4<{Gq7>Fsa6RBh#dAxP9P~yIU zSzNcopeo2Ngk$V|Tx3ihSqKil*Q|yw6Hf76StVUWU>%(`YUPS`Bcli##2Zr^-(GXI z^wDeW9qm{->wP%WEDrX2`v%dkUaq$eiD?*veH^3{YaP<*M}Jf_AiU4F*68mUKKrn6 zYHG@p8@|xhD1uF*#U~&BP_S1D3s-=7^Z)?~s~lH$jFTrs+o0@sl+il)Bo22EbgbDZF3IcT}KhC{LeCBx&tw0${ zPyb~xMfaZpgeDZ#eClvG9oY4@rH@}M=MH6Y5wdoe9C^C7yX|ERNyB|coc@?uj8TSW zKBd*+cB5yPdv2w6{U^}w)Ks+i^<$c1{WrKNut#e#BK8aM>D!_HW2s`m&T|V(CCIBC zd=;egY$z5(CMtd#r}OaQ`QgM?;2(wpqAXTZT$os4)7}x-38&-91+oicC_8kSy)x)) z8c1cDI^3Qcm^ewcAblI%N7}(XT39BZ6f-Xf;5kG*;wF7xM0wbZyAU(jrtY{Q5v+BO zsg0SG#DmCGOr!6+aS?1)VK-RZF^IZ&HnCp%9y4Rx(O4mrQL^J`Kby4M7S(;>AbW}W zkmgnG*Nx5x(o;!CSz9O(Fw^7XU|KC-0T}Qg_K1oE^K>3|qpzH}+84n&_pO6OC3r3T zBn?9K|1cxCx{T@5`w?!YBAh(pKr#U^xRewKY41nE|6<<4AI@+?Kb9r1u z;>qo1-!p6}ggZVVb?I|t(;0+O!X#{(e8RlXv(F0o6%BH^?}}0UpMKr^9^A5%Ep~g{ zf05ZDU=ANvnw-k#_hfd~+?wbhQiC4D86ER20jg<$PC48ry>PYlp0RZCxI5ZaD_v4h9wf;RI9aDH1xywXPVBMXg&P>kivV%;jy&MvOd zr+tM@VkWJWBB+%Puj9Gd7Kz8|$mBo0X_H5-hW+NQx4U^Z_EJ|L3XoP=+N{9KvkB8x z|BZW!S(H&J5f4qKZ#d?>@RM+Ja|(KrWRH}j*9E<%u=_+&-%I%JmiRgUd+DSH_wZ zLvg{*I2%Bp5Z`&ts&@S@g%RfR>2^UfD` zrAWt;zBbEv8RuwM*1CvU+<+}4aRd64-v%sh+hKM5_gTvx|7>{6`Ve02n}m|jl1IE0){iJG}QNa?q7IU@%`A*x@GOkBVeIb+@b z^<;r`xSI8ajbpN~sNU3U?IXiSt`3OV0CO2uXJ9C_#ovD3gTCsEV zuzzA49_|w?P&&EjyhLr!*Dw#eg)+~}N$4HQrIjTP|0Oe9y{vk-714964^8_cyuVSD z%`dUkm6b`$Y-(x=s|s|(NES$usqFCB(&>I;70ds3f7@qTN!xbyF6rliN;>X^l@E%4 zd2<(i;&fRZPDk>n(Zl_O9!t7UdQJR`V6s>;m%3`uGzWLNvN@@b6clUM5RtgTfd}Q5 zZn=ksD%8c#UtUSLwR`2CRcqxhN^N&*vbkGG=9rGoHTBldAK;PU#U9=WW|M3N*%MTw z-{rD0(wRD*u+8wOvIlcfDMpDdORh>H*Gl^yHc`xbP7u67ImhzGyX4qqut`ss^b5u8}L9Yn{ zNEvz`*1dzHB=5Jp?W55}o$kHXh8^T-^-=XGqQ$A5{o=0(_C+?M#hM(g^Ym7!V90J4 zr6*0E?%$hLfaX)%b?!|_x|Jg#fbk-kiQL!Z-N$OITD`Jb+G7U}=s5BqiBAg@$p&gb z^1a46CUPfnrOyVs1+JZo21r?*Ht^2n51Pvk01k)0eaU&v6eXDrul^;omCGr_Me2gT z0NN%wWIkj&tO86fN+%}3yQSzdRJf?O`@th+2P2!1gSpFJi-Ao=-0$gvb?fPG3kpSo zF8Ic!=L+`fV&LC2aM5g-Z^C5ES7I=lnlI+UE|-~9*@UfJs_#wO-vnJvy5Wfs0*Tg9 zv5#|P+-{U2N@YpSdd^Rxv3z>KXEp^^G(LmR(rr@jm%QFP(wxC*Ng_GPIJfm-&BD;JsmDo!^?CSujN$&JO-`xe% zK2!jpW{n#TnD;F&8J1Flne(go9n)X%`q2)X-g|+X+bv_;d|vfexu)`Lxi3qM+os;b zo#Og(>ylqp%)|q<;P%!ROP6xi|D$T{sG{AL1Z)7Ro~9)<@B1FB)E*s^w4xso`4Qn$ z&ONoGoSbFV!nxTfd(hUIJ1ykpelw~9gzo~64`AJ!QE1`6G`>B0{3=o@4g;w_13M6T zy~(KW`L8hcr4swLQwFmtiDULxR|XcUUf_&8@j7Vhq z9Xjxob8v?>A~T(sQ&zt7Suvl?6fKG8$VC7sl(S+i;#qP96(vF5Vvdt?Cbl2^xT2Bw zuPv{E>A{s6?rWA-!!Erya%Sey@g(t*T5c#K>g`DOHN97u+5$XZRUfr)^%%^FgJBIv zfsH9y5St5|szsVd^ZJFi$dsT0B$<0zPXvFDJ;?<)>_j3Y1noL7>6jt2Vp|1cpok;< z%Edt@l>DM`*fz_-iCk)T$OMV=hd$C4s}0pIz}T0+vu4j!N*> z`-*-Zq4eQNC2pqu?fpKYaH??D5DM6*wjCvvkFob!$0DCv<1n^sR+erG0LU_ZJ|XLr zsd7^>7ryfCvuc@G zoZ-pNFwnPJ^Wr*7|28SbI(wF4)EDeR9wyYFO6uI>r}+Y_6Nw}oyQx0|S108CcS1kW zdgAc!z+M=1bm4&hltKIs^tO$hOG`uTXF@~rIk^LeN_*{#$2Wiv;~tP@$X;Bde6kOp zYI>`&tTy-F0C_HWGtT=pgDq@Mq*Y;e8Vx?)_PIfuBCf8|R$8{%>Jx81U=j#7~!p zzcPZD_B&oAk?l$R&!^`q_D<<`#$|i-8&oRo4xzGhkT9*d$78+q8 zTHM#MyPX(Q(QMSj5(Eyl8)r?|uMsWjP$ivrE&+w*F?v32re~75@&|&FFr0agL&&AU zrv}e%TE*<0S{^_>rD75GvwSYC=6j2%R7kwYfXZZEeO_W=8q>KpomVkuWT=?f z5KYuRxJfG-rj)*Jw3nB31*Cii1Te?1*an4<+P*Sh!rs;<;3o(%WR{&ri<%^jwWgKP z%o^3xls2uJx;A^&VXN#77d{Zn9 zZ02R3&<`muoBhaj?oYhs>y3Q~epofBSwsgS@VbsHQ5sgVQmlhN6gO!b0?Dm!T|ppu zQoqtxx3UM-x_!CUmnur-eYA=jp~h16K4~N!C}W#cuqago6mG!Ab8!N4C2^FIS;A8PKiSX`Vqggox=(Eo7e78eCVIC~B?(5|}ul&lX zCrOAsUnac=GzE#nbgf~`*i?sF=#lAXJ<4Qz<}c7dRY1)y%< zzr^+s{Oe|3({V_?jl(Qt*YdX;>PCsXzu)y=J4VJ?5!-|7Mt!(WGW;m2r@s+D>u#ZC zNP3x*tad9{wblLeeMz}$Bx{M}bQH(;p-NQ{`Qy@N&ziR4MDW;kn9Z|ck^88?Ej<~= z=P$H@EO|===z7@t6hxWFCl$|LP(>bjBYFl${>ykCg2koD{ZLi7zO!>6;(-R}9Pui7 zOUJoitVC(GwJ7ZCLw4+UIU8G{ul(z z%jmQZ#cENgvSI(SbVzL^oT411SxLhYAO0z5 zL#7I%Ct0(oJFGw>>ZdeT>;V5kT&%sLr}gF7@lLltytHk=mKp)@OIM%ANZ@}Pp&^zZ z>qVn6KFziAyEenYK&|wO02Vx}phrX_HT9PU6rNGro2HdGq9^|am6L;Tnk5NlWygeO zhP4Vt_~GdNG@eseZZ{o!$x4YUxXcGOSXvX4_oXjDC*1Dpu*o&@P4w?&x8bSv7y zQKlecUaReagqkY~&&dri)DCK0_7o`#OY<~dcpa=sug>5pQJs)1n&LBA6c?R(Zi};H_H{qO za6!Ykge|iz_0?}jF@v;+`tEA)Kl5du&jj`yDn3kcp!|Vra{8XFmmFeUsNQbk5h|?z zTu06$d+8o(DvK!VZmO8M*Y1v~p;yD~@(Bn)NVchp_(~JV z?gu7HyLhhzkZJLjA7F(t3kNnX7+XkPiNPk3aHrv~oYf<|xEY7>54ML$xl<^MdZuyM zX+}m@U!~obc(D5ZV6SM$ATy?~Lwy15yltO=b-c@{>!t!}??t#Ls&m=T2dM?J6gZ^u z7*U`qzQypzTnMKW+UH+9+uHyGLHsqT%>XnM6-RZ5sdNj!AC>zKRX&CGxd6`fagi#x(`Zo_4giZ ztCiemuC?E1Tl~$_WUnYK#^npN<=9UbQ+TOo$r&DTiYJD=i9f35s27A( z7jF~3MXW=SXKg~SRRYQZ&bXE0iQ+{>;yC3OhbsLQf!6o$M~}&ql0|hb>t1|RILNa> z96qW(-Pc>LFKt-906L;fG&$!Go)-6lPGM)@ki#v6aMgqwYhYw>{FX zs42Q0#nSmj@NS~2#K$d!kfJ96ABC*84Zii2H-L-=&9PkIJHDUdc=;zP78n=5XfD^8 z3$5m-U*&Co^-sHTlqcE)UuOH@hV7O4+L?ae19=)DcLdwVf7&me{sXiCae!qk+*4I{ zjh%2vI^_}tZK&zsCOxTqr+!(fPFzI2wfOTx$)?%``;H|wwauhN^*=i*JJcoBIht2S zeb@XnLq@J;MQm@PKyF)qvCwp2}tmEvfV0s9&U+0|X6A zuWfWU99mlKTajTZ7fFP&uvGY%&uVMy!{qgbTGz8MNrML_2X^IHDRj^klksFmOQI01 zsbAiyK}Q;-nIHkitfV`SslUc{pSxH$w>$kRd-|6yFGA}P!D!RPqb15a8Y$+xY4shE zbGeUMDl!VyJ71E+N)3TRo0P?@Oc7G9)ehW?ycWMLb4d z8I2(yaF-9L<@P*D0EEZ2%hV2HnfdQ45)NGM?6WqX+-ul#)*I>Y6$8`}) zn&mA__zz|#*d|8OV_7L$`N`Ay9mS}9f{AKFqB-8MhEiR-ayf8iIgywh8u*vg@lmTv zU@0uXGgRGPGAMZ31c!z{D}+nL{r1gvzD4{erPbGF@B(MCLbG&(x{BOXD4(@>XqoJ0 zg0~Cu+3DMkHo+Or+41M~{;ioT4Y~N4z8aUV;Fi(y8CH6AoUINSjp}_^?aO1>+_PE| z8+0BRrJXKyU)w?eEJa>D4LCPIgdrcJINuM{@5EM6JSxSZIJ^r!&)A0BGn0#|H7HE7 zi3VlXkBivqqdzXlb<464gsUqDwkda}2TtfzINzAa)0ll;u~^Y$H!$8lC{I_}>h8(W z(lk2pPu=ROR%ew@k)xYbYIY6L1Ewo86M*?|4AxmP(jnVS=>~)Ho?QYN1M+4QBU!Us@^xv zj>ViR6J@qAuu>{g?6v68IFuP@jo+c`m!I>YC&3gtX%6VIsU*6jcED5qw^#@d86r(y zFbeEFP7J!@yw9VZ$!@p>O)1RdB%-fJ>3!VYgp8>0U&k+`RrWmN%B@9nA z&Wf@2e!;5%%M`PQ2wDcWZ@B}*;r=_yq;Wh|u7ZaLf9_FY_aol5!-+KPP`?j3eTXG! z4fvzLabd#ao6T9PW+4DL>FcXuZcg1ft3&i(tfpQ^h0 z+f}R9-n~UEdqAuS>SM|D9MUwf>pq|I`HQK`LV5Mc&Z4rd3YQ(3FIb8IYFWH1` z2DgpIK|qE^E-d3uMiTJcVL#$LudRMX{i55$R_8(9O5N@D^SAZ7<1YIfCHegwM86zz zm*Rc1s4BDkm<&ChvQmS@(@CCO=Vd(_pKlDC88$)Vq){M0$lH9Iujj zluC4qmyEb;H1_I-8|-=%DkpbRmAJHkK-KyUsBB}`)kLPbHfa^VoA8a2NfCHv%2y~J z_M(kzP^mxPqH^HNX8w8LA)c&ra-m9Gs0UoFGB@#T%sDU&WA{#aPUUMK4ULZoJyfU! z{V6>pnGFCI~+wkM}&Nvu`+Pv*NIs>&HXAVWWChY z>7wncS)$AF;_-mk^v5*cO94RFHucygiy<#-#qBw~r$f2vNTrC6(TpA059g<3QMWF% zF;F4%z9>3O*-A>Z)S!?HHMP^2$Ve2JO&%Veun+R_`xfJLr=na98#sKy?s*rLreVc)9$WcGfj8c#+~RQ6shDITZ8OP(%jihbwUe3c51S zMgrypzxMS_E7byXV;q`z^#&*&Lo5qXTD|wgs599!;NvTEebpE^hdxuHMD%DMI7h2V z^MlGsE$(^@XC~7%JECSW??nFo!)^H~x6-=*)@KCB7v%Q*G2#?JnnMDfLWlNHB5-dS zVrb1PA~jT$N6cBR-7ftkw0=nWBN;sp&rl7EYdKeO41u6zL1QL%_ja2sjEP8*z{Aze z$s$mP$z$=c(z?vN-}RR>u{^%VpKtZHMVz4Ru?7@USY9YR=vC`}u)urvzCEq7JOi9! z3L?g9n@KlB6*Ac4D{&?uSm@%exhXW&T3Wwi4Bjtwb+@WWL&$!29$O$>lgm!J8v{)` zf>WwcArpoTc`6gVv%J0;3Y#qW77pCJ*Ai<>YLDhBX`{A70lUr#p)gO1s#G109v# z1TMrMc;^TLsg(SoveHHPi&F&W59=V4pZx`?O8AVs4gs+EquGNcr+P&|u52qQ|CrJY zAc7H)?OjBrp0x4 z&Xbbm&X;Z2&-j5Jy^k12?)_fwb!a5&;W0|CRvC6Vwm}mLDggC)6TM6~-@YJPJ{q0> ztu=e6DhboX$XMJrJ_Z;oeaPJrc(HOf|Dh0vShhVe3E*m{S&p~bH2^hNdAWG&ys0$F%E1p z>XcIZw(ZSZC#R-bVLFGD9HE;{{hY7r&ePG+m9;%sFEoarMrvL17~qAoG*WUmJ~rFhg=ZWTUBW{TsZ&)Xh%=7vnQ=W^|LDCEQ-`o1?Y9It1zy#|@~7_z<2q)|GPMU={4j}%pk$bfJaUAR= z zMeCblRU{zumUQZgrg=9iifQ@)C(P|^@IE(__`tH)hdsTjgwX?>Oey+sK-rbPu9E{2 z3`0B?)DW9w_UE%>Kbsl~2s9!&rW>J26YWB`O<=#+Kcy0ehzt!Bdj>Veb-F?$eL?RMx7BcCssYyGg z$$AN$A?BK5y2(c96jX%Uez@qD@coj=8s;BGoWD1=;;DEgwE^qJTKBVKy$eVM`@Kes z3Q@=;n!gWjc2)ik;3=>^>_73CodKY+3YFv+>xx-F#&F`)0dqevUUTSWq@yBb*zgdpW(P7Gb$qa#qj zeNEUPogfx{ojBI_1T85&r!+8r>8f?u%rKiYr;Q0y-(J?%eg6OfRJH_?dx&PGChz+8 zr2rYmI;WmLz+7qmv8G`1vUe%rbh&ol8Oq|mCi7Zj1kNK6cm6Tq4V1UvA^Zhl<5IN( zc+)5J=24$8v~-5i7pga*t(ph(!YL9ATGC=2#sJ9wfD7?podAatFHz>^NPnNR zhbj)=?(b*W9-N(s9r7q{`@)0oVduZW>9%XakU)8jq>NjC!?f^7KzbMTCsWkAf#cSx z5ZRwowYn_O1S$&EfVSa%CLO4<3*UxfXg`|UFF^#7nM6By%F#MutJZCQoV|}9?}b3_ ze8i&%MA0gg>pX}~dJy>O{oIN)Wh2cpt0n{$|Hj_&oNBLma`_O zfFora6$~QZlG8I{>lelwOyANXQl(-yOUuFiYyID;-wtUcRjdwcR5_F3-Hynk{V(B3 z(|dAfR+3I?T-Lq>(vQMM{29*-S`(cibh3&nvW;UzH(X8$AkLP2Ocp2sTXZ1GPE z-5~a}WU5jY-I@YzIr2KGqNU51jf-`4rf0hn0a2};or6bn%%e<80fOx_&_tdzTTRj^7yMEE$Xd~0%Y;d zw6^I|>6~dM7<(QXgqokH>bDjgKd17a`JLvU8+x_Gy)fyvIkQ^HHV};jH_g8uo3DGJ zP9xT2@qo&HOX&@gC(z-{EAO6{BUGi#XP}Q$!P+b(u6dq#zsNhUyypC5yV%5g77GPf z4JaGo*bu-qbypGPq#b4=FbrDNm<*YyY`o^oS;?ne=JwPiRzfDTnt!>`><3G-qav$Z z;{!xLJ4aSb$XZ8iQNGH_%xB2bjmC&an>Q;yp@LNQy~Lk*=(x3)CMe-_dl#Sxk(Z*} zMcow5hj>xjO0tw8*(Yhf)hy_1QpbFF4mQdkoYsRGImc#2q+4V0gzs5 z>6c7?5v^zVH9AwTO`wL>dt>l=uQkm=Iccg zc%Z+ZLawLAC4TNRyEo!xtI}&)6PJwIdQ6^P289V2Rz+LRTOZNgE{81umB%Qis8H$? zdwsk*A$O>aij8M2?_dr~*sF2v=z_&CVW@=f7*HWPB|2|ZU{B;7#lp|Z9L-hY;9^Co z6dt-dF5Gm)`UgzpBUa!5ReuHBXSa(eUl6xE_)+<;Spe{!Ot1TSmRHs4SpBk4#)v@3 zyaRzrb|T*$3u`w+G;g;Mt=IpkZ+Yb<_;gY z-73d2`{QM3Lg%#;Vgo0^CGVyUZ#h@Zr5LHsZ*>Wd(C{J%SyZHeD4WAuG@r&X6T$)XSW9k5twkEDy9UQ#8#no0^%}dKO)aMY4 zX!fAaM8@>$*}xv7RYpkC@8L7IH_-V%$&CVn3F2wAq+kyt*>0YHJ=2Q0D3H#YWy!9A zF2GQEa+DUV0UQZ)$u)3gluMglMDJb*;rE0#qrkcYi1rB0I+RIP9-`3MubpERXK<#L=CmT0NsY z_`c}OMS14A)M$bazfs#DFhSv;q{owa33QAYo8ml&ca_m!_9hbinb=aD`dy1mDr)|T z(HMWiyhZ7Nvp^4kKVnST)a{-w>QL5V939n?L%2+r>aX?fWc?&d(Hxi64^*z3peQ=Y32OeHUTKludsriC;aP~&b|T~e zg+z5<|Lf^i_d#iu)aodyPIVhNIV;`c2-Bwjim2i@79P*Ecd*$Iw9%bOLk*ju;-FqQVV|})qlKCy;36FwkKJFW; zqRU{FHN8!Jwl)}&-XTAShIe1V5M-5^`h{GhPGaS;67?+b?!aE{L=oBq#wj1(y~z_sh|oPn z0P;nX_vK%@@zjWW5sDI%dL`a`+VUgx2{9`MNw|$Wemg-QbO0I+j1kW60%Pz4l{FWf z0y0RAJM?V;#2-QDc1I#F3 z6bU**duMz`{}oKXzQEv3&FucNP7X!DJSUVwg#YIUI&+dtdsPBYb`Z2&6^>Q;pHv>o zsS1pnoXi|(Dh@fq=)s_eU?eboQWifz2MMA6{Os>ft2k~GDmk5BTtgS~jgUTO@L(A( zdxA9D>OjEym+>;rCtQ{a;u4ARei2dfX5npTDIPj&QBDNTBt1+OtE0Yj{T`kzpFVt! z*Yi*(ko`(PBN&faF#qIb5Az&waj7$$W~v?Mx~?g?=$;nh>vW38STv2}nBcT{sIVVx z>9Jr)I6}A13y)Yh(6ZSxE%AUL`cF|KW;6c*K`*kI165>G`GppVC17gNLOjN%bgF>B zC)(~3dc+xdp5v|3Nb!EaYWjHa>xAt?f*(^Os6IBk*18MpYx#I~7*Z;*)sSqdch5>K zwY(b3JPfFUtb-f`K;*fyPthrg9MWg=5&NueEIz zA?P7~{XQA3gxO07w7c(mocRF2vUhIM+}PO?$7=2QPcG2LRB#s8YA$QZ^_Z>J0RaRg zUFPQI>!GBwFQ-IFMiR29K)|cAzwo90H|_y@2+j;?yF0eBhrKhWCg;_!!VF$H{`A#* zc<*T8pTNQuJ$~Fs`rLb03w54W7K#-cu>hTBhv_v5GiHtEhmEwxlc#tv3A13_$;;s5 zN2@$ZIG0`EEpHvdcH6J$DnzNg0x1I#5WI}Er?P7Zpb2&;CPrx?FrSk7yyWjoPM03= zw7JwZCUU>CT-)~qh4ChRf)+t_M920tx>TnLe(BB-yAXdH<)<4R1CspR)Ha79h|j=_ zCG*-z)l~sp@`Kn!rmcKXJJW)I9j2Qw^VHF)OJ$cK6r;A={wgCCLkSGJr*JSXfMlu_ ze0uHI80?_)R49uO=x~C_WiThllvArc+zwFpN}@n;oEsePzl3xq&|d zaR!gQlZv3{)us6F{H4;ac!oH_U5=eQ>mhj*irh*Kz*uVkhzE$D5Cf@@v0_Y9vy0Z}tOUb)@ z9xLoP8j_{y&{rN$DK|Ve4JME1~7QA2S9y? zsKJ1_z?cPAJUl+Kye`u#nS_zlN}Y`hdKScYF4vxbDZ|@Q3{ndX*VnZ*(9;3z(ut@L zF?$ey{`<9^(ba3nMqZi5foTxHY?OBYEp|_lOPQQ(T$3}xQD@Giv+o7*2}45kI0h?| zGN*rEVtqlmNZlH`M0%cQPuiEf0;K)vCO(q1gODXXy6=l-y6_yU5HahC?+JPIefxE$ z=VJ5WZiStf!Npi8Wn37o6Z=z2jz|+f*fOak60^9D8N!4_Td92FAf5XVu!7Z(2{U0$n)xm7~-nK26Q?K*}tt-bwl1DA^{$_=-R0Z>+Y z+|K}}Mt=2WL!Up1M~~~6HFOnjaBE2Byt!@EQSN<(-r(RbdB>4#OHmwzj( zt5EZ91T$x_;e{qdfn8l{Ga%0EV8>_&`4>QQL^)wX{6=sH(jD0diOz`RXRzP1o4#j` z*>-%Uwr8NEo;g;d&^N?4narn8Nq%tB0tI5!Y0ShHd@-X1 zD0VPqm^?{;DWS@pK>+Zt_#WoJ@b`c|s1kQFh*$+eSlhab^4>dzNQ1-X%mhV~<9^dr z%Wc)ESLe+c$e_Nq&RddEY2}Cb5289|KU{BrYc}kYmF@f=F&Gi~1~Y4Ue0zJn=YQFi zo?x>{c1Dj>;zs=b(f=vuuQ7Bs8;7UsNM+A7o~msZ0q|jfL1fW$j;`x^hf(N?>Q)BP z|DqQacF?sM!~74?&3YJZ8+0}4)eb&GbbFw=^zG=$-J=k~sxIkS`m)EX-!3li+Kigr z-`SShU2@~p@0yHzoFD78LwMiMX(Ha-$B!d_h8@Bv#@MfzzFXEAI{cB-)***H94sh= zktI_LuH)wkgXS5Et(fV*h`35t>Dz6|cpORA>V^8(%uio9w-0yN7Y*0|xxA$P6#p6)I+ zR^>gw!AkxT{)0apNAMW7QdpY?zV|t$tk%H7b1^CqbawkV62g>Rf!%L`=y^i)&~21& z?6x>l?1|P+dGOH%y6voy6G^!o(1$Aj+c=Nl50croG#8Wlxk$q?)ojiGSg{r(opy7T zWTPChTf$T7r(%UR&s3bSm#tfUL8&(1QY;SEQQF5l*VW;EnI4dL7*1ZfU)Jx{W7v^nZe-o>1vQ=H@dKOk`DivE+(g z-ek2?&V3Hvn?azIkFpQZe8^uk+9< zIILMUL{P-rlHmGwxvZ!`98=}BRWVko7wD3cWZ6>npO4MrvE+@o6IO~NdR2;v@T+j3 z`9y)%NZN_{#}1Y4-5_8)Mt6rbW5#b7#Hpgb`aGMG-I-b!_fH2{FReKFZ#eVBy7@xA zoXAK1rlu&5t&%R&tU#z}z&-S|=1l)dJC{@7U@tkGFP|1d!pr)<{P*W!eNiHBm$3=N zo&wOktm`ECRK7}@@Wr4Z$Ln<=2pA7~aGhW#vYQ5GJhfznuK0ek`~i-99&lx{JL zCKX5ms9)lik(baN9odT8Wmhz;eXusIJ*_uwIBk6XHgtRNFMl&-AC2sLV5mK4{kgv} zSk}+*ZJ$qV=||4%-GrafGaQNEbVe`j0Es?okq2u6SKV-nu0YuxwiAJviwZlR&>VK? zhL}#xzJG1QUUvL(+3y|(uao6k5LP|{8Du!ZW-N`*tvGT;LFhB%GMiT~{NL*xxxeFW zCe9(n;ZnZ-6yBn&9DWA8LkE%#z`elvIrH@cG8M)^;DlHx zJoROg_j=1ICQ)dsXoY5^*gX_;{Z0`$C@6rEnf1DDi&A zSjZRqOV3gBPd*ZOaD+LR$v!uw!S{@RBIIH*z2z$O52lL4K^Mg@QSpB;Of;yktA8xK zXnQYNF! z6?yawYC7I{`1oO^VNWIgvfC1%P>kWhCK5Feck1ewsu~`M7SI~XI+{J9y*>X9TzI`PNzGzj3_MiLQu;Ur;7PKJwGthevqNK;J$d~uc13n2uVj(j7M@RP{&)G z+)O+{CSf04ZB)=Sqk}zNk6IAcK$p>o6(^kwluXcVohz^X!%~+EMHpEge9W;8ArKzd zWl&O*43J#cKb8iEg~*)uCI_+q=dnPG7{atb=Z<5@%}~B=T!8gJ2t4uh>&`T!s1|T0 z#pP6P$jp;bl__mtb5&&{#d~u8WYMhs21vsm7^%%}Dy`M!C{=@@W0r5=H+K=7&%7xaXFa|IRuz zG-s}*-%m9&5X~)0n+@TWu_6h3E>pqZzh)dXn_CO-?$HWK3oswJU ze06mU&8YGNbj@(nU_|W}motkeRF$~xuAWWikvq(wp$(Ez#0zs_67d1Z^s)!?J=x+q zpYtX^)(Z`2xJk^vc!TS}4?ki+MXHVb*yrE$LYKw&JE8*oVpAn=8;GtW%{>6W=+xhH(X z^YvzjPm`OqK*PdIjj4F@c!zq`sz2DJZ$U^MUiYz1=d&+B!7uT?3BI*)xM5e>hsnq) zH^FGfe9C4%N*CnR+++|cKJqGuw?$hB|70**8o(uQQZ-k>Tq((C;jo&*cX$fOAZV=` z3JZ^V@cL#J!|lYa!mSLf;~HtAQaoKO z6W%<*6c8t|W8+JOtUdVsFs?(aH{+$q@A(-epLwNRyNPWeC`se~rtCjhZG6;(ja}T- zxjEEMfkZ}aca8nhwx1AKfPMTA!{MuVs*VQ)$)}QJKlGj6%0OiXR8Jv_QkQfa2?oSi zp!?We98Y35rbwyz=#e4qw|`x>;-{OQw6?Kzf_YyN4FT;S>gt6BLa*W}#C`+M>a;%T8~-;Ny6#p+vI zCs#O`>Nwd(GE*gjAQ+3=Y7w)`9uSOv=H7-f_B1<7OL_w3d9CdTncI;|ju$+On86vV z&EH?{Kw1bBx42>JZstjH^%+c*0scd8Q-@*o?^pu2*)$k&u@eoo=TMKl^@-k_4w&eY zSG`c_l#+9N&2>Zt=;b_)+86B+;}q}F{!ZS+V(jzreWq)mt!{mGUscv|GE)QGX0y4z z>+9>G)F2@->lj})RoWvVQmXx(+Nk7ajzwDTnJb+TK>j!DQKpQjknr~K@NgcBdWb%L z3uQj&0_C(kJfbyx7GSEj4f zn7bCqn}G1^!7xF9vE8e5f!ed~hUg<{JH5|kwwj43nTQ9cSd6WM(Cc{RjsqverH}v^ zcR6`-zXV_~V_IZ=2wfMvDT}xgo|NZ^z(j@KR`<+D5pVUwC{utRx5dB!MIIjgQl@y< zWbt2Q(IncZq6#b~Xyz9afB!jIo(@BslelZtfXpwuH7_r2;ql)WaMA(V$ ze16U~Dm_Wx`Lai)#=4cjstEro6PYup)p)JFt4veByKOv;3;q|g9X!)Y>o#!-b4fjm z909z^4ZNEn<>&CVpw41NOJ1kgEJ*z~*eLt#M&{WOR$ivz?8v!W(K3V>5q2k_ z9bIY3xus}+7JGnLaL}XpK#O-*#oTV$!JdLUN&@Zdk7fh2eQ#_cDs?Xf1P6Q&3Idud z>z~9+;=hp`h1EPCGh4{b7K7zR0}qPL_da1brWHC#HD`ZF`Le3iOEg1pEBlcw@JQUO3Kq^o z34g-5D5Q;&lq{AIO~uL=6}f{|ohggBgmqqrKGW=Z6)2P_w!Wn}pIasq_7w@_?#D`! zQK^~yIEqGDLW~qX>a4>D6op|I&6lC}zh*Vq(18cN08~;t3J_I+$c*r=<$QT zfVhepB5U@qJeFXk3)t$Z1i^GL)owKkN+$Zjv$3a)N4)>6f+goK(2n#jkQ-cjSzU~X zhviPyCKNo0^D!(do+(c&#ht@n;^&rJSb*Que4jQd4#_n0FXn!qh{Qc?G|CZ*f?&076t(L9 z3>N_I3z4E^W@YFCaVrHb!d|vikHARwB7;>2`VlKGQw3BBs|FDfPkPTu1&?M)8^hAo0hcQdNcB&3Js2-Y$clj!m%y-7#l?cOL_at^i_O zIXXUD%1_xK{67hAr3{S$OzD?-=g@B|Q}u^_K^3GR>W@dPFI6V?QIxWt8p8)H~-gL`od~7~aY!29l+h4=KUk9rNp1^Vo^oIKGDr|M)v}v7qF*C*Y5Ux+(r)x7goTW} z05M|`xstBSg7q=^MQzmIckTX0_SNrF-1stwTbK}zRz1Bc?A1?P4WZcR<#si=T?{O~ zDDIo9ZwhbbpEORE>s{tvRF8J5wO^+S3!MPkL1U0@$xQzhe796_dx4?x5r8!faP{}s zjltYl5z>O~<{^gS+-Wq^Z`@zkg0phjTu^Iv>{rm}U7OD@F0q}hivpqn)p#ZH@dn2T zPT3x&TdC@F!OD$6_FR6&h16?)>;;vEHwmYt>{fF<9fh1AV{#>k7IASBRm z&KHC~P@`~)mt^Dy(w6bWO_)c%i>Cv&1=KH<7J6S!w5*&RRQ8>Ue9^|Fq4s_NFm6`4>6f;Dpn~ZpGWEZe>$2a)j&8nmb3Bmmzb={K4mM zp^!-%-?$<~p4D2j&}o~MBxpk>G*WIu{ot&xB4p*=xzS3lS$VofjD~qsMIeAq8?eL~ zLBs9_@Uxhf{FoB(HT-p66P}roH#8uOOJ@(_$*Ybd@^xuIC)-M<7&lrAfpSBVu_ONl`7KCDlN?h&VtF%rilot&ERdjOefM zJ+;+uAHUtc81{K)NqwX@C1?r{-Xk??6~#O{D~x^8?!)>_M4q1+p7dy+fl;72?-SOI z7gfgnAkAp`TL>&qkFi&%@KNN}P#?qp#;ozY*j9TzUm_4^$)0819%28htZ(Q7$`ssF zJC-u~Ob|NAx$VL32S?(PI>rOdi^%(j@i?8kKj*rb42Q-l3+3M$DEPk5fepQ`SB>nY z*6>X-9sI-RE4fh;Tn=vg+#eR~4|Z z6CgU&i2FB^h}`|)z8i{>tJVm?X!6cAZ|#OOuxuji@3zz%bE(4hf%*fP@wruUy*G!{ zKY`Uk_~zDStI!R{8R%%p(L`I=RH4 z#r+Gm|IT?n7(Gl@0un3~uB5qQfzCPxtfFqo1<$fg1RZQ#qbWP{)4K)XeQx|Z+XI5H z3=Um3qR>Biw7>iW(i^f9S_aIg(xKT<1ImDf5J(Lirx+&?Vvd48ap)c_+-BeyN`o?j zcM4la3zAVZf9%#KJ0!ls_rBSv_%;4!9 zyt$mmcgRX?4*7YVcwdzWMPUg}M^Tf#>GDWYquWgL;UlhyRgkcatqe=>g!L&FTjylC zgvf^iIEKLcr94{n-Xh{);aXO93PG-H<{3p9kTe({56>4v#rKyyfK8Xz)W>X57T_{? zNFb|Ii;~K;2ET)7Xf%Hy#>%MdA{#N5S@{DUMs((@gP4Xi+AAS`sghc3Ow|G}7N;ZS|t)LJ|8@E04S;u@F zX&Ftt?+LskTpo8aJRz?|ig;Ky#CrzClZ>*VfT8Pf9=XKBLFGxY=lmD)`g;~eMn-oO z72oN0_*E-}ql)JbRrPmN@?7tJdH^5DeAE+~n8f_5c6Qgc-B{^Tko8Qg8KUm)pX_zb z$lgq*!j&GH#csof>rhapC~gwgZCvVN4lHQ~uAqE33lT2n{uqcxHBOfajeV zYFvxq{Rg+HL}CE;kGJ{d1r$olH-VsYh8U?tuM^7tW&{QYgKWl!zpM3TQM@s@~n_a70s>P zz1WBZOlRLYI_kI4qlyn2y9N2;b7jub@rW}NBvGzjCSv>3#4k|gpl37+2mJ~on9!~; zPb9059in$0lH*1_s<=$7=LH4-zE6FH`E|Rm1TXn%{01X}CW9^Y>jq)-`20uZ8p9%B zYoM*E*nL<`@X^wSVxT`CyI1W5o&AK3#m-XWmprctg)iZWq`o<_GUs*deG@;BRM{`} z5(EDwpCUcvxI16wx~R&TJenKt8S*-LSl^dnJ^#;Gy!Lhwu{WMF0g62ycDQuefzI-V)>UrLAua$xm=e8`yJUvz8B32DbkS$b5< zc5(1$SAoeC;EVnR88qA9kNYn93%Jb2_TKB8QGpGzcen)0g^p2r9B559_Zpd0}W8i#`;1T+kU)W7pZC^>!ckO}`K z-xNbQLFLp)K|(Q@1DTXTbX?*W`<=ql8oKY@w3M?2+r)L7w2+ZrU&aR?_7f%_{twPm zoWz(Uwlot+#gK}q%2?p{hy$!-lKq-YBpGM65DGbJ9#Y|lWz0OWnd8mipyrZYhdZ1v zV59aO_4NSvOC-A_55qAAsdOdENU(6)SLd0$bK$G=%?tA3h|=p|4x41J=g*}BJkoh` zTKglqm>TyL{6Q!M%=#!&;7eR)lHYpVtZGm2X6ZDbIcaW-l$?7a<^=Q)=u*JWm$&=? zC<8|x+(Q6!F{1y~u0nPC0-Cy&whq~=aF`&}b@WIlVl*5(LK)n3^3a%5sulRsfKHv8 z%f`dhAsvvm z2a*l5GHlSjxMW}|S+}zAZFi4qLZ-l=!cF|}yLif}y!?-$8BtXN6*pS!G{~xnHytPqgqbTylq3M zY>|2i>}>)(T9M4S+CM20bwYAb^Vdv)1#U@klhf`4Xg4!$L~L5esyH(g-(+$=Tc7A1 zVCtq%`L)D}Fiwa9?a{dSF$AqAD!E4nCrsrXY0aB#bbOV5-FNNZ$!=3v+H^_ ziPz!x1!9k|eY|B?BzGf~R@<*)H68UJ5$sRbav)U-oh&!<&BKH-` z{}75bPi)%+Nw$Rb@I*9Iaa6}(a3?>-v*-5+uli2?p_{5Gi3XaY-J^VT-)Z7rdHacn zct>JCk&a@KxwZe@w*kgpGsSv$|}NSZGl%vVn&QHelyaufQh)4-+u+ z8s$2Gl>O0B!G|B~G^U)!)oq-v#M z9SR6#_v^!(_im8bWI`-L01PqVNT(nnJ{KI;uW-)R)sCS_VR?k} zkIP)qd)Q+(>70Pt>O#>VJ#kW#K-0b?A<+s$ij0o|o=oM7im-fOqxCa|6h4-RI)gf8ZTKLHwS;G2&8gl{ zOl4nc=BD4RdFC<^_cFxg7m{oyS&IRC1~6|H2okX)4ADi=ECf!Xpg6z{;@*(SXvrtL z*td&_4jQtoVlJ6>hnx@you96_Y_doaeayvm!Nk9?cnOU{zHJ#@2FpGfge6e)^AAJ+ z4GQ7MxlryOPQ-MD@TLU8$cet;Tf{hB>^Ll8g#bctB+WtrQ_Zj{n@S0oQ&9}xW$M-w zK_&G%H>gKh%o!L>m`lz6pW;jB6R~{%_nmIEeoirB&kJgD<4D7fI#^p1&Fh|I+En8p zT(j6pfvsR~&Kys6fbEb_K)G3=y;$LKIFse2j!>{*B)uyy!g+xPPke|3X>d46)EpGl z3x>RuxCXRlxl4^zKFL>0&I6KdN6>^By7rbUr(qpqy@O6gU{5TmkPfFAEp7-Gdw<33 zeVpj0INk?j!lW8W@I#WjfPVh*9Y$-Le>@+wP#Pv*?t^<``x!DFq+40(%R{^r*x}em z9;~V)M9|D#ay>%KP<0u$?Nf#E(Pd7%O&jV(CHO zpCKlqV*3Aa-}HndSddRpXj{Y12p;5= z>?~C~v^*MDj|nz)HOIub{iS@noGiwrsW+i$sGCQ5MQmWhqds5--RP)RM}tGQG*Ujq zr}H;}7&wuwBt_I8OF_sReXpSDhjAnU$U{fj8%+y#uuVi}!vENDzQ8hIu~jt+8y3bX1}5 zCcQqY5jh{Nt_oAj%S+*I(I&^%is=quGAf$fV${}VOk`$0YKJN*^slA$uIC_{)G{wg zR#LY@16{})y#z0bKJ{#bt~tH0>+&1a?;fExo{0F3O*+}P9K9b?t~@&69d%W=xF0)s zIgxrl<@p);?9WAMbpBC(Rpu|JB==f>d8QFvzW&qVcmCJ)6n{Rxt;?=D`Ws;i(r)V= zN(wfew2!K-WosRU7AhK-^PfB!7uw#DcB0T86;L{3HLwn_$-U?&x$QC z)v1W+*xh|C=@-hF@45vq{Ec(qdBlDtD1^I0TFdH%0eE)J!5eV^6HVGXpHVSMT`7?R z)8WFG-hSG0Kh^deHg@;db%K;|RnDqw6g{Hp+uO;{G@%OtEmV;3k(jJ@K*v-NLfB}i z5{UKCU4wZgl-%)vUzrmouK0HpfCd$f+I(Qc)jbV69=M;dpBp(QqwhG&z*$i?Cr!Xn zJO*YZ3ITZWM)SB*WS|?}4(qQufwn#pWd4z|RY3*Hv8r?b_r1)<^|zONC(y5P?BFw^ zdmYRJt=q~3*^ldq0}g(Hzb)=P{Y;)g`kqd*rK)%Qq9g-bCg>A7OR9Lx?3%o<|A@kK z`~ER%^5zxT9T9E;n81g6?x>9qS8O}~N7P%!Mb&;$!_r8Kl$02BH!?IzcS?hFqriY5 za0CQyN~Ozzp&O(dM7o9=x|A9ix*Oi(|9PL^^OY|%XSmM3)?Rz9wUb@JHqU-Q>kn?> zF{qvP`Y56M8Pg&Ol8m;W?D3$?eM&2pF~LRFqO6UQ!fndsO~P<&J7}~2XL1vIv+(K?A&mgV;qRmJYnbfxvK8AaLmCjqS^0=4t9P5dld~deHHf^{u%62S1Nb zzpN7L)TzBJ_~HhVvuaD7u1RUOxZx}vU$RPy>>?GiEj83U{hJ&f`y127raS#tSp8=% z7=jm1p}W;J^DzW6-%uyF{9yR%NcyYU$u>$v(9w|VKyWlr*?R~#*Gk#rEe&BfYp?Vfu}pG1Tm z-9Rg6G+G$~z zbloU?9!bFvA-BitCu}B?wHYu*p`)oW@?FQ8S}0PZy>Ywd9z4GSO)IhWfp=?*qV!8n z*5A`j%U^xG{1$k+!kVLT;x~EtiDBWt+%7LI`y)9K2{N4ztGa?TX@bQUMbJm$_MLSH zg(NIM-vfS#NGyl89x%MHhRg7f>zPozm9_6}hu+v5`3Uy>-NX>8Z@C1?_h&I>^-D8o6EtB6f+79QlaMwPrP1u(H2&V zrUgZc^Gl^tl~e3GShDF?&KmCs94f>$ba&OflqY%k0y{&kF*Rrs?AbZq{16Rm0t9}g z&r4bp-g+NOj-38&t32zU72R!lcmLN^IXrCJm^r-ns#7|Ar1>^zcs-+yWA;)VIZ|@} z#CTFKG@&blJCfnusMs4XC{HqHqKZKG239dCfr=LDhe0Ts%E{kju47<8PG0zJWiBE` z@4HaaH0(yib7~hSb?Vih|FRLc*nrU5wMESRTF|n^r%iu43q7m&LDB`^K|w{1)-Bq? zQKFh>hG}rb-5U%Jx3#X1#Wppeke67SdS2vfEEJB5rhnCwl~8gFyjo4^kJ+SI9EOCM z%`(WtMhJIbxjyg^KiaQkT)O_cR<4r1y}+4Y;^aqARK%Z3F=#4wEl{UqP0Y|MZT z_LU|Fz4DHkyauOlXLVIWM2CYlCh?zF$!kAqHhW3GT4H;yvDy6MnAGhi^)@Jx>*aF$ zp}o&%Nl$UiDvl9sC!e!Go}_^lhmrTMmD6}#3tG%65f0y&w?#Dq_;L)#rN_X=_(>r7tY5Q@dMvtFD{xum5b@mfAIiNXBQt(#7AeP3+b$+5mdY1&N;S&5rlYnFMEC z&Yn0jIwjr&XwJu~2P8|WdMwQkBN!v2ZdlP8^^3&xGR&r$H3i!9)9g8Cz1vA2Z z_ohC7iLXhI>Fk0_Cx|hh{^@J)MYP|(tqa$ydMxJt=PhvK60HDU)Ph)1hHPwwMW)>+ zAGcimX@TOjAm%-V^H6B0mH{!ENSy>N;Su~bgE;TVJ|6+b*)S3J#DM}&;?dyCsy6Fo z&U931eBI#J@Tb=fU5y-xxug0H`H0uOitzQ7OBIts!3Uw75^EPS2EIi4RdC80Cmdud z1A*=MFm?hYRi&EQnI%c--5%M~&$~DtUjmyifFKd{-Ws39{bFW4PtUOUGxDKl>nZQLgJSNO3!c`7(o$Btn^ zyNq*>y4sAZV@1b%$di*KJhhPNQeXy9byL`T+3AxO5*JP2XJorHyY80&jB_&E5B9e4 z^8>xkF;3BN=Gn_(!hI<|2Bq@%#em!kp(eLU_|pkn&L2aEIzBA4nqF2}^TRUlv?=2t zoIy}uAVr6@my3i+5*)EcXez?OX9*waMrI>gNoq{GfATb-Y$<;?#(4C*Gu~TSSrZ8ol)+OW-!zBi z27NmtvK4wu1}K~X96csIW`U7MP?3(l*vpwNrcBw%*v)P;5~M?$;p3KB#>i}qH@Rd& zvUJXvVzTXKAkcZ{FR}!;8TLSMi%Q-n=cqN>NLFCI7gT)aySIzyLYk9HDdzL%m$HS` z`T$qZF~v9?ozRWlSoAYhz-I;S^jKOhl#fMs(Y%;O339>LO#{mBx z9B$N+A^~LyH`2(DAW3bF7XeT6c$KAxB7P*`dXL3i>r?=ao>osAC6?ZpE7n>*>}WB{ zcVsB^L~a35fMne%73J^JvZ`acc{e~Rj^~|Wsb+z^xYg&In|gOP_fwI|$0bh?-gT=Zz zI2g7#AxqZs>Klv8EIu0?zY(Oqy%MABZrnYpW(D>G|90lUF`Zma9?>GjQpQ;AF8dz4 zrtXwf0s~cx^P;sZJfvhBW4fV?-G=eS+`Z6 zu8Hx!j_QPqC6^w4#qjxfKNyeNYwf*zqGFundA@MG*Up-?Vlea7;XNDYPuKT~n?gAv zc)P%VS{p~|2fqD)k|=1`G|BQBM|0_NoDhxLIoxfN z(zmVrSr?fr$c1(|t+iM@HP!5lmfLoyf;h)(%-!&>9zla4;u07(Qrm~_IwgXIp04G= z1Y;#)WyZ)7%GX`F&L#}cIFXy`nhY5I)xZZFX4hCxyr)-IFGiOPOdj`1z7+}lI4ui( z@26;ks@JM#AC)o2>4!)Y7q(so2&ZM_dKYJJxqa*1Kc6^d*dsCvwnOizQox54HAamV zRCQ5Ap(lbj5&j{Nw?nkyFZI{p=bz2*W*^py{|q^bLRB=Ro)MPEzf;J9TCzB3p#XMG z@EG{^aFf^&yK8_vW@qs*jXq?A3Y%8Avz&I9o}~{h?c`&r7HI zak1W^AtfPR5kAp9>GV9ehYeSZ2>Uf0p^-fJ43h`gwHDF^&5Yp!cuCoa0uB8k<0cz$ z7MGS+EB^ia@2dx{B6|^LC+W-cgC#zfFuM-gow*Y(RDJ0lND?q4BFo)vq~ zKCs6ef45~K;*=UJ(uqeWZ*{1iHQ;c)ECHob9LXo3@In9@utWVO7lq>{UgfV0*5vUo za9N2{?ez+2c+4od2Ri-|~s$2o>lbq1nkt;o0AKCkg0h&Y@QkUQiUK?H` zoF0^*Wq(LUMK;-k0z(df^nF!4W4N>m%f7eFDjr?jWP;jp%6F?!4u9;BkmAs|`xDWQMT9V4>QvJk}TB5GEow7SQ7O=awxu0E#oOUgCrPfu-^3f)bjG_nXlw~bw`tLmE2LERRn z?<9sJwgy9n+eO?K6FyfswTXY(dr?g}{^K$d`&2@RPPiZM?bN->XYc9F0ApbzK06o> z(R)xDcUj)v_DqNjM)_aas9V0Y%J1Txnww8h8w|W0U#>H4 z?IA}p>oc@=_E;su5m7KU@D%H$K;~08ZOA^=X`}pDRA0FWIee%F&op6Z#()M)QQC23 z_`ANYJ@VKL@4n9XoGw?mxb`taoK+aP5z+f+iT(Uo79V&d@k{w5A=)UwQh`xi3@hO2 ze+B*M(n3!Q%-zuZ+wM+x^MC%)e%h_=0y-xNbM2YR7iCZzEtkjl7p{3B+Ged~v5(|r=_ z(ybhIIClxzME3(I584Kb3-u0D8heNyD*qucJokA}7UpTo89SZRc=dIss-r+s4>KGpF-{z#4VC>o?t+L{B4&X;7P)9PLwI0>7jP+!)?6v zU!K!kGT+g9F8|n6oUX2N{3^4c08t=%C?f8HbUe{9K%Hr!^2G@pFAOW>yn*wofQq-# z`W3<7e=LZodCWg!cZjg@t4%$j(t@Z_1%p7W89u()!PeGsF3=r^^tEzQ&_-ooQP3HL zCj)n9r)CxA|4Yc^pk6p1dZ=mYO10x5vmG>BU*K#+7IN<}2=Q zPPrKJ+R{et3NVh?oHmT=TP&N$BIN-AL>{((y#{~!ZdY95+)Y+;K7yD!3RklAsFRv{ zY|{?i!gn7^^wCi?I#CxTPZUUl7f1OJEul{#MOVdbfGOlxt6)zTyY<{87kV_LR<32! zU6&T^hc^s9=F}%UP*wili&(xMkR>pYk=CF-Wh82`eCe$M;TC_|d_4(d0EH=*L_+^w zl2HgVLnML-#RN^Nm^MCJ?V2P;)2mU6l0p^w`{?uD3Nn*B$NexUd!k?BUCaWwvucGq z6z%VeHQ1s=UBAE?#%;#a>yKlRG(=yNqhp?wwIhw@Qirl#Y{K%!uuZhtB;@5lzaz)%&nDxAwU`CVt}op6165a^a1`&~(G?>}yF>(yN$czC3^_c=NHU-(5y!xZpP?8g0 z5^K7>J14=*u6TX)0*W@ZHP?7}^>|bajVH0AelxNr0*1+7P65vC@I+d(;jaxPr#7~U8U~0 zW8+2)A@Fg8GsW2WJWYR-9-;z+I`b67PWom*fa4A@25OR)c%%(`gRI(H#om*Giqytx ze+XYDBc*2P;^WRvx?5FckVwQINptDyOkbzpF8La!ROwHr&2pJN?v!&Yt8#Dp*`T-|hN>oKEea5`0*uUTr3is{?OA#}Cc<-87y{T^ zrpn6g`lvIB zq)3au`;0vK`(qEp$pph}0fx*01VUD_f|JjK>6oQ`ZI=H6Bj1}n2X&+5!bcs^KiJbN zTlUtmj5O8MK%0oPSAv!sms4$8h&ERuWN|B2oaOp>-_IAEk<8D^e0rmUYRW0*+m7Uw zo}G5tHdBJRW<5zKHw*snXu-5i>(N9(kFLDp;D3%wnSGhn=SFm-4w*`U6R#ep?gR%< ze_g8lrJfDmIuY)$>ZLX;vHQX};N$T~z;g$QOVOMdi*&YLS>Td)n+n&G?z8Ro? z*h~htO*f(mUcj#%Hghtiyz67e*^L-yPtnZMi|651>E7dPUYJou$7?k?lE_OW`%jxS z`r$1egDf>z$q`Py+N88hEMLf%m)b)x^GwEWrewuS>+7KTEPz(}VxaPLs@X*X9w0E1 z!c4=^`r7{|xoN*`1cdjs3H9Esaq!~6C$higg4RjQ$1W<-(xQ=&{hJ=6`qD#rKoCwR z+vcu?l68acECnvc@0Yvkil>pj)UGdn7TaO?xD)W6DvEFRBn-&r46;g!HZHaa^N53J zic1O^301D(03>vB`>N=Lt_sQ~8ac+rWArj`cfv!Lr(5M#wZ0MZL|7q_B;q@9&Zzn$ zP#yrvTyW%lJbKt`-bJa0Ma6pNyT~7hrF-H+5uUjsg_fy>-#+(a-7aipKhe)}Xepe? zihv1LytE#Y2cxLLkk+>|zB2PRv6V({G&XT_V(10n1ckXJg7%-h_dzV#GyEZ=U-TV@ zXIM`L*6p7PGlpg7>d)RTs_p}=ZAAf-t`VGl2QGT?myx^_5iA0f-ac+wx?V4}va5{9 zOB;OgEUR+{gI$9OJ7MKnR+J(Svtb}e{(LJ zJP$rZZUjWs)2LG3od#`s-_{XF4MN(&YDuHTaf!^&-5VmUUMuT`o)e-Bab=$}pPn;2 zisPlx)SHsaRLZoCv~TBqy)5MviwCE2XJATQg7y3+Es{L#DYc_P8T@VRL$-#Lqbaa7 zQUpVy-X+cI0rezW71+1ZbYOT4E$+Fcv3ti(wj z(!nMbm(eWpCzt^&k852=%$tpfii^b;{{Yh$&Hd}rDnqNVE{|*!3vZ%nepv-3Y>f0^ zmF-Y;*)~wEHHRM1swY;D0;5X~RZv6ule+icV_bZLFrfM};&RCbLmUZDjmfR!4Rnus zrDVa0KOteEXSZP(q&de?9`=b4?&x60SC?7mkA3c()nwol$CHKlF8C7_laHXjL8oTT zJ_#F7E1(Mfnk@@^O%pIj?xbZ;z+PB*92vA1v(?E+6a@Kn)8RD>bkR?Y1@QkCdf$2X z719UJV4;Dgtna|!lBT*@rWY;^2bm#mx;apFM0hs$=6<;HN_Vt6{Bzjad=FTk*MKe6$u>( zvcIZ>Ad^$(B^gwt_}MFskvTZ-Fxx+?`Y@EEhZ;)RgNw+5x7Iu;#>~RCni@h z&lduoARubre?cqR&Ifm4O!9Fz{j?)}VlR1L+pqc5@1V7Up1$3&j6gXn{#Q**sCtzp z?luw(NkhEl%E$cI+?0qugoZWA3I}sGOPYi3kr%q7v$K`f3{PD{4!@+`j7e6w%$_pP zJ=Cgl^O!oFmbgw{eFN(k`I)rQBiw*w0ETNH*=XsY1T#&mf03vsBbOfwEj=7!Ez~_& z=W)C%BD=g6s$fXlKf0d+)=!QSacnY{GtWG(U-NuqsGK?{D!ebUq~eIOGk~teirHi7e-ycHyUR;0!$X3i6GGW1Xoa)#{{r~=a9ZYlC?lQ*LW*^G) z=fFNS#ekZ#trXaa#Z3Czo||0|i6~OonAndWO}&tfDrf%(0g^YEFqDCUvn1D2(@)*H zj6_zl4I6nZJe{?jh|NYU%^5+9B7Ba<;CSa9iH5^gn>^Lqng!;l_HZS%%WBo5jfNwh zKu3K02*2%?)KK61EnW+@6F%20#5``sg%iY7V`D+_|#P&8ugbUyjK#w@F(J zF1M_)Ms5?!1ajrS*UR~2{bQV6Bg+uMkkwDAR%J5I$;6zxKxH;gXD{A|Z(n0VYz{cb zbpIsYA{n$^a6OEKxR&!)9W(ZMp$Pu_!JqLynTp;fvF3Go+r=5R)LJWs^BT?*+$YW! zFrp0cgF?yU#7LV;d#Ogd4*g@1KfVSWTvJDJc38*Rs_45-e_v~9t7=N$=P~&|s2B1o zL$&$LQn{{H5&_QUg|qKv;w~<9A8X{7<%F0O^4ttM$6ggyPj3reaW)C6gy)6+CoZ~6 zB9|w=aA(@>LSn^TBq;WV9Lmy4idL&sy*kIA4aB5XYQdQYA*_f%J%JGoH0euitmRT? zR=>uAn#p1OO?4_nRH=BlY2iCqKm&6Um+H5`Zo{+%sLO9OpQO)gq|>uNoZSJg4H;I`io|_6| zQ(SS7djCI3Alg-fvDzuqm198_Hg4a*EHNJ04iS!u$!Yn*j;9`c7wsX>=a+|x8kVIaBJOtdp7izBPx1$5N4_?N?Dy%pBlk4qLSQbgM++0@!k{E zK~0)1L7)n^?bplb3J ztnWc&;c=pKlfQ3Un+{03Zn9bjU47M@g_L0Oyg<85W%tt;3VtSQ+E{3Mq%|i$tdcNf zX^?4y-Z=^f2FwHAR;_C$2YD} zQVm*@OIeBpjbK|XpQR?U*dnDL{j#C?##(5@zyr{3iGJmnVV=iMr`Oq)K5YccPtZA@ zNdba&;m{QeZzr`vFRjQk(y*(;jx@!n@tw}i}^RpdH4#=0_cT-buMB= zD~IeYBP`a|`efak@{iwX-UrIg&4G`Q9~HTxMxP!^I89%V3e=LegJ4{@ftp<2mi#Cf!e$9Vh4x!~Wg(T$v? z)2JImN9Su&MC0qCvi|;6o8=0DoF@a5H0v_15pYE1$Ka@`*{bJ0(FJklt!r)5U~VHX z-9tmbh#gAhRS;T_USzRf_FC;|kEz=Pd#FvK`lmk-J?z_O(=6zPH%=X|(o;7b4Yxd! zh2mtTX6;{AiCl4t_Yf3$9;?6g_stk_-x(Bd02Jobm=%BJHxP zlmLy*W4};{SesByX`O!YFIX){yZs2dXAGjZ*h*ywF+gbXIhyE%8Jd4tW$f8xn!>eO z6rJ*H%^il}p@@~m0s!DdZ1FwQ06|f;(7Q9x%z&C|Ub^xshFYNB$lfn;^UetDGZYCf zn!6bxfoJ+;#qPsR53v{rxZm>QKsD?L{a8cv$_2r)^0S&t9VV=bzI8yn;@5~*c@@h} zSM#YU^CZv$GsfD$`42WY<=N1$*!g+b$P@3Dg;1r-GKoJ1_I=%ED0^T1K7og+QCsmt zNmxM0R6);%ZKyk28rd(9HUvi&wtS@`NzK9Jr&+u@!80ju`=x+6WdWkLFzEXw?~C;t z_9r@hLJorT1JbVUC~6z4_SNkDX`{N`fP>C=q>#%rb*v}2DaA*WN8B~GON&*bd@WMfx;hwy^vFB*E(eh!{3}h% zIv5g8zBK?2Z~RPA;-rBM>*%OmCd)-zWdMAqq%J+wk-k|kD$QySrnb3JI|1Gc$&QyovR1~_cRH}5whvX?;)VA%7=)iPifvX) zX@&UMyTlm=HCr0n&$@vu2V%4YgdZnh?^_-i;a(v2IQ$=;8Vli!gt!;}lXn=^i!22f z@lQZyKFOq03UO-xAni!yqGcXp=Fb>S54o*+mqXi0&t5RodLJE)1&m}||2By!G z{>p+O^C7DIY)xIR0r3NS)x5xgx&y}}3EGyb4^xi;JM+{o%k?+mJKfz)ORFcdq5Y#m zl4)xUIFnQaGO4Q29B@9ZxlJ@^U5REf=hW`0T7Nv9qE?dv8M)g0&lv2#a2%f2klF36 zB4%*TC9QM3RHhVp7Ju> zAp)A>zYV1T8PK>A-iE`Xa}%%c-TI?3lsRV|fU%gCma=Ma8YnHdmw{zfr7V_}@jq

aA_L{mhY`^&lZI;OAEoCLi2&TjiKkP z$0s>)PNR^Uiw?!*>u=TEs=lEb4~RiN6?F15WFsatBC*iK@=`BO;P@nc zQf>B)aV=@!YX=mi4hnZWl<&~2VUi2Io?s7>XImh}=%Io>0qE4?-!~x;RYl2Eoh;QLs>iy6 zlbUyjks-qL3`1&O}?dw?wqo!1^!vzsJHJDnF5xs$(FDe`=2+iAxI*z%HG zUPdEn>J61nMf%2kw|@ok7QEPs(?56Xtp=+gMKp2CZi~1mQ(ssq+HTeq)P1@CHj;c> z2PZZ8i*Qf@4*L9yUKDy}mBwesOP`61wmMc>qIaTDSwokU>jM8&yi6)PC3RPwVIlwx0^(xOvLCNf>@}f z|G=0V+9iL`K*GHNQ#%{sW?^1pFjQl8RynxV2Bw1i%<8Us#i#F zyabTkSgJb@6sOY~cLc>*)#qR|U`aa1^wLs8LaBuD=^3@i3#8?({x1nLsSD*#g`O3C zlhpgZdlfs?Ze_mB1rM$;8ntaf0_|Me)E*h>76gf}sAf$H6=1X#SM4`MKXW_TumQ%R zDWfeTm+ZjRJ#6UF>v5YG6C7U5qY_rv-S*Z&QG3ho{~N(b1Af!Lq8RJs8QHz?9VprS zK%tKL9D;xSB$xff<5QuafZ}$6DobHC>l4sktdWm6z3>un{T8y^_!63bTp%OTx66BY|jC)w^B#mLIu_rpD*gh6Zv(1vB_|o-}OdRyElym=4cFB zp%<89>ao=y((+M$5}{F$UpJ)DmZ-N_}9;FGiFkJ!ZtxF62Kl9zxhbJmIBfIa5HS={-6JZ z`q7jt*)UQ}oA35!#cgHHtNeHVtW-9Fja{qA;Sd|6+c?wX9f2IN{lErp>*g{NEZX9X zpU$P>WN>V51z;&Rwy)q3(MV4nG5ycQ!qxGE)F7eY%%4K>#?RGUsUaWVSS-|A0tF{| z&+S^iL*_lmk-n)WLXzev+kakP=Tg8qQV$8h)82IgIF>iXaiW-fq2C>t#mo zR=ZxukG<^p|xXrx4=hkaTa>FdqyM^2ko ziBHV8zlzG`G_^`?Vp#A6+fsUV2OfC42yYuvZiIZo12umGFZr~Qg36UPKNyf7U|3+3V|1ColW|7+g)md_tL>QtbP zOx1Jfe*h&Zi0Zq)=mSAEZ6KNvJ(O6Ko&-lU`Uf@Y^%91gXel|iUL{-etnamyR~?(6 zmJYL7johZ6I-F1+#Q1kNU7j<#G+tp|?@lRF^+-EA|A)Lmggf@}p3WCrKkMWFs$7Ehz z7V*Bv$VMB(*~mmL8YM}7;SeO*d;8(>E;-#?{Y``a%1y^hSg}$)_XC#{_QCo1Pc7e_ z#rv)!To$ZSbEMXm2wb*U*l+RM81TIC_;8GT)E!K>qpjd}c`!Qcq+OCfc(TG{0G}WL z+c;U+2i=f>rK=nZIDHF#5yZ?*Ep_Z;uq!8nsBqSmRybu2)v%ML#~)8`V|cFM|6OSzJh;>cIr9*7k@b*Tz*2b+M2T{r_&r<*TIV>FB$-v7vjMC4#9${a4$BU-)eO z0s{4(siz*DlVG09sM`%rx!)b|U;K!nV%z%e!tm-~KR))O`2lwgP@*2QJ!UbWK#BFf zRdSj%P{$|x^N=nojI8O<`F1mvxzIC&`MUpxi-C{o!g@v&cv;oiQ&nGRKkxYWr&mx- z5=WY0aGb*LiBif2DwSFnONq2tJsz`C2fIvqhtH4U&upL@f4qJ-k1#~qC*>kW!wiMi zW}Pr6rMHQn)lRG?BU6jtFd1x`!(;hs;jPQJ9viHrk`C4%RUpp|vv>S&U|I?VG1Nlk zN(F3Qq@(mt0P2(@ej&c|5YFCXm&Z?^_6!j_5mL@l?XnaKwl;9a{q_AqJRjjwq(nDz z9Rsm8$B%%WRwHx*q@&fwz&Cp*-Y%wr+~i!!)gBl8i01a@RZ-x<@{8Lkf#t_CRDF0M znA=0kzZRcM_ z#Ha=~4CzLRFZ7>^U0Er~J%r0nTVpKx!oOMTKUm@f4NezKLXEshMrn|AHCWc8vGjQP zP6notO_~Ba8`_fBb-Phr1dD`)OlsWnWwZzfFjzUynH1)}>Z>xxBOQ1!)@gxI@WfS0 z$pU`A@@6#bj!!QI^CN)gByD1TR`ii1S7l~Mn%AVrREq^L)Q%sqhm3s_=D)-S2?W$Q zv9-qySw6mPVwlG0603Xwg`gfpF{6yVTA_i1VEm^_Vz(8fujgcNg z|1_^bchdL#3KFzrSLE4mQKbmRm>QBl9%SDzp$eIJ(5Il~T>Ys=^3OFHWl+8}x^DlKeuJ9Xj0batd)4oj?l)Ma#oy<|px7NNEI)WG@mhFvtM&t!;dz~G z+N-&PG9lR__J%hGWpZSEUp&C3vY{MBMddI)Y%I?i*3H>P?$P;x%?=s*6!?@ z5cO+s4+@jFes?DYA#eTjc4X$C{*Zu*^}O}2@*|GIHVDJ2o>Mdd*bZb4yoGWOk}I{g zgABQ^U=!7QAen-8t4xni|>gP}~xbhJos7)v_1R%w7`Cg{~Has09 zBOEl`2j{f`yA+BA$wZA+3pQ+H{eH$zPuQ@XaBZIpl$xYQGFvmpWGI2#FGh~Q^gSs; zS0w}TY=qq+!@(<_unZmdY_PWhk2o`I$?@){L-c=Es9ko)oFC_ds5?ROJYu0VKf#IC zM*}fCm@bd0=)~yVERqsTN(yp>KfAyUyUpNoz>%>K@8!WdKhx>1}hSvug> zjQ3uWO$0xZSg4AOqKWX0(>9VO*Pub?V=&o`(Ri76nJ*vkhsPEI{U>>pkqBvyR#&rP z3TAu~@CK$$vQpt9pq9*@%Rbz@tq;hg6&HIc?5VwKhyD?>{kZr22XwJ}dSCjn()J1y zg_FfB<}OB6iO0!;TEE1}nr5+O zUPt((fiC=G!F`Lv8#g+X?s${wr_GzFz}uBVUQQ8wImSwej&&{_#;}3{#_;1$@LtVv z+%~NjG46BgDjksI6^cp(bMVvtgb&G}?90%oa?CBLF?%|QBjK(jz z48GDmCkW77b#T|u{1+Sti1Z=cEsX@w!*8nm%3UIs=Dlxm^B$%Jzk4!Bmn?m-k+f(( z&-hw-yXtx;Q~DsEH!q0vGi8d6XVPiA2%J^Mo@Jco!0y@G@vEM!WMsoZJD;=Fbml>G z`YE;mGmTwMV=fpv`w$oD`$JRyP%%yo7D3auMzBa+LvF|a9`L|4D zqaauQax16Z_s+c+%aP$&RDpt+O<1Oh@&xni*RZNLYwBboJQ>{Y5L0tCL8N8hXyjWO zI%5R;OZwnhsKo^ zyDCkaM&Y@8f4YrhJPY-Hy~UT9^NM-yrIL5j73Tn$0G5{=4w_c(4{+%IiWN&UHVE&Y ztk5R&ViV)6|9ADch_Z>%!K^av8!E>BUchT>^?W7;G%z^)V^eO{?xa7)QGN)9Tgt;y zj46!qzJ=1}-7IIw+#oOh3pT{BAaAODp|9^mq=}p{yc7} z^Q%-=gu0W9f?(S~N>8MoohIX+e`R@;eCtZv`*xc7yfyi`ECw~vwfVIY%xl72Hel&E z`Hd`w9$_Bo4Tj4|&wWCvQF4wf#yg^S_pzYsWJZDZ-(McdVQ^x^BumI)BtO{})VAz; zM_clw)~i2_XagD8;r)>6`Lty6wj8+ImoJ(9HHIW$#tU4uYcAVZ2dNlvf(s!2YM!+U z$u-*(5wU*H^(NyDCBYcZnV@^846|>QEffwPoQEU2h-~HzvCQGVN%e0D%804M-ziBJ!*5l%PpfiSWo+wdP((@Aa`xdDJ~37g%AbTnrpqlp^2Ax$ zXrz(bsZ^l!PiSUh@pR~K>0lm0Fw7CB0R#^?m;^7K8F7jE2RbAG*^5bkr(by`^pevf5hLMUka=YdlcelC#+Dr@pv9R2N77Ra;`w(I8;DFv@uWK zqvz$mf7|Yqi7U2TKZgxUbfo?GeAL~_=UI2LJ>wK~^g{zq6S0s}v4h{^bM2Be7x}Yv}aq42mv9QXJgF2d-e^13_$SsFp(GVYP%A{zo^XD!FpU+Qc z&WOtQoD53!$d8fpp_cvkGBUDEoA#)=cXHg?~1>O_b(^Hx@Gs}BULbZN6vPJ<2%jb*P?21xilXe zmls9?ssYL{&4>oIn&Ck@csveFW7=w74fT0mrv04();d9cZ4m0-<19wHegdDFlZ>GI zfbArmSKeF2%d$~iYs$+$X#TUs6Cr*5RUFU%x0LGkd1C1sz&il7^2vh!80G8p3@^7N z?yVYKq2T_*^7l9DL!bMM@Z8;Ifu>KNG3C<9pgggdK35Ly%h3~yaD-lz0Qb8L$g1-V zSD_~uJ*BR(s$%h~2$Y#)x`t(NZ+JXvBX1i5PqWv*00D6Smf!$5^S`M5#wyXT!qi(% z3)(@xJpcwsZlz6F++&n9qs6GDW}am#$NUJ0ljLjLvfNagiy#F<}vnzQpx$P#L1M=bcQ`Exe9`5{%qkKt+<+z zJN2Jc9pWk`zqn~0x8eFbr!VNXEana=`R6Ea1p;=J2;8B@n6;XNS<*65?^;3>;uMS-!}Ps<$)$X0xusn*^?u+ z*=U>7`=KtLyJ1i8j4vt>C;m_XZRM@s+OFL-vx9w^yMunnlJFT$c{*tu(tUaU+(aY= zfH-S8P^5kxA|^!Ec2a{c>^a=t1BoGSJ$KTS zAsS4d^KV@QTFm7A%oE>JpuY9W{q9ax10;4m-zcz5a;%3Qk_^v&+-mw7kh>}q!Dqw= z4HJm1V0&3auWP^Zt4>%6?51C$OZ9QUrg|bNZOcfs9Q*C}2ns&}2VEi2G*SYx2|B&; z@XofVeQEg2F~NG(ZT;fmc=+BMoR`@h>C-;oc69M#VMyIeT^2=q3kkeX5dps!K<{&2 zhuhADlGe{*p}%d=rLaHLK1=U|OGyKY|5T1vh&J`J6cE zDnW1|E!uYW$jBChWW7)uzf+R~N>X?)BbjOUxL%3p0a!sfj;{M8AL@m_?-NFDC(5#41aBzdM~)$*C4Up&#mR; z(W6N)d>AGo3i1Uyb^Ir+;tbcsSp)fg-T`wAgcPM>Uj#_LvhvY=M|rsL_R}T!xk9ne zhk1u}M4g4`-SLH(8h-TMZdbO;MQ!Te$k!k&t|-{GV8Pqe)wgT%pHs|fvwt}>?^w4o zAx0ok)aUlci{Gw3*o060U$>!Q+v!cUztBch3WANWcv}n8n);A});?Trdso7Y1;CZS zXDM_^;?RHa?yXp20m`7}@mH;ae=L1PlUv*I?C|2Mq zd^)Bp`qGC?uKv3y+!Rsxgd0lcPmhbEy_?k)Vg(O?pbj_#uhY`7%4G8geBz2Yni{1#Jn-@-nE)~|Em zrrdwlnkm^kmPKpM`r1<`{G}kTq+g9z96!nKVvmA+jPDl%NdZUxwz+;PzPykBnZcg# z%O2LiI=Cj)i>1gDrF||(wQKKeevNZL&zpGGG>~NMY>K(W5(m=Hl5O0|$&uW~#a?zV zsZi!bdHLm5=L|nhAHDuS_n|Le!7UMcE+|y|2WhBYndW?b*CP?9#Ft{JKoVcZ%Rey=I?ka%oIB=DD?6K;BHq ze-dZ!!~ha8Vf)UD5RaFw^ynltf%rVMNcrj#q5&JM-{Uqqbu9eYLcqH?PfrOzFck7PnC zWkV?7_{muD6+zrJxgalU_zt(yhpd9}9~vctKU>ZFZ$Fi7k(twEGX|+%7<6`6OuQa_ ztqmlR(L3J-%^bM?T%npg68Q3kbhh^QLOiR+XtbFA0LkqRpz^u%f|hzRW8Uui5JN28 zL)ib;*zBEETadJLuNFA zpmE1zwVLrbF}oSE?2h@c_G0eux8MauXaKsGgNud#GH;?$(|CVK}>Uv`33{|5OKY~$ZI>xMsr>0x4}He3Wu2hP4yM_IMQ?# zynpY1yz{u%srG9C&0qfKgChUrNbCRV{Fl6BUjatEI(@MV?^FlcsK!#QpIq5q0ev?4 zUeaf~t6!}@)Xc&AFnF1f8EyUY%=gDFR9g5fCaFEDk4?i|En9bgE013H=G!lh<=mj5 zPrY$v511dhmGDB;iq5P!@J!CxR>?U@heL3%vBVt*&Pl+Q_i&}!*WmN3oMM(3U=19ii=g!h z+ReZ-+iEsy3q4x%{v#!Zmrp*GPK1Uu)>GO=#y-jg>H?KMtj8OC7V(^VdhmEWIRUL} zm~<#TDHt|z z;w2!9zxTj*+Kmne@g1ms`S&17N$FZlrj(wyMy-c15-x<42E>;Lxw;tts^5S+%Zx5l zXk)y3&!mg|xRF@45=;5K%8D|v_~4U2_3@fj$GELj-x~@=XB!u2TJafQEm7+?jHQ(E zvdXu(G~uS*wKG{0|B>sA$Y-acK}~5+gsD;J9xIy4l-9F@XaK(<~6<2Nk zw24**Xq;(k@!E20oiRI6Ps)!G&|^O>4l!64F+8wNJojm{wlgqy-Pldn-!@j-p)?&k4M-H`d) z`iIiqcc$rmuG1CEauNnFe3nS;;gUBoG4T_CEO(M!HGQ-M-z(+tYeZSZUa_}<+9BFK zHTc#1;tU)EVtgiP7zCJDNFvHXIKuRg+YCJ{75Yl_3?$s_5yWyM@*#5dyudb{q&7^# z5e_R18Nb>a$&G?MBY*?RL(nE* zk{+o&y-e2#fY$73(nY50?U^R}SG)=AzksTi>gw{F6q>aKdj?AKRW$qK!ceI%NnrvU zRY7R*U#~Fr82UyUvJb;%VW#Drdk(_fT6v5b+kN7MIsA<723nU5Unbs<#PF5nrCKYn zywso~+E}tF8eo*tTG0MLaodrXMCJn|wBGWdfBd~hXN8Y7D=;zZ6=6)EBG8^YUW#}g ztcUJ?h`Ga-d@#v5l)%ArB*T{dsnB|sJF-HxSZf~zH1tsA%1@mLbx+n&D6<>!nSoan zR&h7GyrlS>n}%Fe2D#U?!}|;*=--?qj6P0cdlRf=r(#u5&kgyISc|7yRJZ`N*q0dS zg1?-2w_4D-Ne6TeH8Hm4P2Z(6#{VIMq&B;88uzdFs0RHQob^MQr}ySqsz_)V9Clnj=? zv&2j?w*)5f=!btV<73yOW>`1>h|^y?JUN)wXj8kqK`!hrS(4x|fdy#*rp*#}(~xph zT4@+W{N*|`?lADvuu_WLM*heB>Cw~!DSzrQQ}uYQ{K?*c?=-?PpAlT;WErG8>}U$; zC!-mEL+K@13NZ56lUzyo_Z^|XK=W|3&j)0O2!ol|cBl3WA!1h~bNXtP2I#GyCfHIk zcGsgBgy#4u%bCL8lIC#$*LiSXBZ4Jf>wjNBB8b_HbFK)mRGUT07tuO&YqLD^dXkY| zcfcfC-&a{@GA){yCtrpG;CwHJGI?)jqfIL%^9MJ9>5w9d5Q_ZZMQh8_OK2 z(vDgW2VEG8+pJ246me>DT?PtdLopRF@wNGn-?*I+dC0K${1&$wvHO9~&TqBcrZIWk z_ZTK?O0cwN7@ZCT2xkvDg^<0tI#Q)FS`&FRSU`*Q9lv=G0G^1b{T-T4m9MEJrmh-L z$B@Ne`0iLaU|_tSPmRP>=*sgOLp6gZ&_H7@u5o?@MU5EqYtC{AUygHX$!}T4@A zPDvT8;EUT4R-a7BviovLYpz-upXHZGJ42}qf(QEP&M)hXJ_HKMCq%8F*B^t=Tm5}!Qh#G(_$*%7%H$+8Tq3XwQz<;CYlshDQzy#H3m zRAV6AJ$cx4r&E3w9~})#EPc3e0SeXl{z}?BJJYFHfv|7O;F+K(3qq5pS1?%!eL6^p zXCN7nWh@8YC&|w1A~=MiYgr>l8;BP_hyhkKKnxnYP~Bn7F_9x^I=L;T{M9+j=1CsF1Vfb5@i@9?E2Ps3Rs!JD9xS*w91%_{DtHIOeFMH zna~9lV+IX6Kt+9Fv?V(rDlu%A(BMX`iC{_7wEfx%}0Y{`l z$g=Xfw`JNTT5=N!@_NCJD`}Y@+O@V`hRw`GG`_rA@3k1LgCHZnp0LtWhw>$T&|JN7 zsLTWlr(I`*MvmvX{rnh$f`Yh%u!!7cOeO)u(jp!BN1iq^#?~0r0%UDJJ@GZ{Y+|y!7En z5urqxSShLcaDs5XDYN=;9B>UO$Odria2YAQ25=wXY*MTY;JCn_G7R8IiI3OwWINQ; zlnBj~pjHvc;_qrJT%*`7cE?gC4B#|@%8Bh)AsAYElZ+yU3?;Eynf-~k)I<6Hke8MY zlwHSqULB6FF7Lc%rRoVB1ICYH`tgLkMqnU&xC&tlEs9l#p;?$BiZiS?j}-dVHwdM# zYgYsN_ZuBCqeg*O4wBhJ1k7rnpvQ|yp}dp;%U^m(CT8c*+~yEdcTT|COFRo859D_y z%iu@j95cX9^40(u_A+8C;-o>z($1}k1Pi}rG4WGSKX+!AV@TD2!4>TsSM;M`6ot8E zp^mSS0ZAAnaEWq@x!>HZi{EEm+DK`%1X&LA6$%;ZCDT@`L7}?BA7aGPxmq$8j<#+f zU!m`rxZml%3Q$cyQ>Mv1%a4QOBTm_PmMM3&b41;nHgG~M(+H$!lIa^mPZ@> z_xDESiE45@BYBiMZ|(}OgET0Ma23dH9!AdEMmZD`IHK!0ye8O|XE-Wv%4L)fNv`^$ z;t`_ZnGipP=T#^2EwR`PC@&RD&L9(;=3_q7!ay>kgIlLix``qS~aYuM?#an z>#7MUsiZg}Tv&_&rCI{h&&64-)-w57FxSBk`_A&!L6T;zZ?vsumFlxFX8`InZY_Ll zPznG?L))bSh5uYFnlLI!YpKv6Hg_Pmu3YJt{>q^j*%UqWo%`io4;stv)r_|QMrJ5P z!`fE?$oo8K}FL)7m$QgVmH($(lw^`NZQj4bT=XN5C635lXK zWHI;=(iZh<&>Ha=G)tdX`+A(xrw&3!0C!dxrxM|QTWlL<0f($f2A?n>iKP4E-aNkS z8^80JZxPTXcn^){T;bGBh7?@$)c1R@ecQg$1BmXjGqd63QyK%6jjzC~-4JQN5KPU5 z{g&PQ9VI~=HbM~{rq5Y9E46MC=amQhN7^c`j zqC7!!E0kP!{nO?GKeugYOg~TUdAJ30pxj5IJVgS-(I?IJ(1VLR(^?`_sWMIYM5>d3 z9NqM8NBIN6))DwO#uEi+h8iTv7Uv&1i?A-;3^bh6i!_!d%V6-wii~2SRaCTqYA5%! zTzseEH%IOC1jH9^k%f>>o7`twKYCGsuke`htVDR{V;)rQed30kl+>s-vUXDbi@^{5 zzETM+OJ=&nT_!m$10jn>^imWS?wU9;);^4W&={di$i|M3O^2bGtJEYk4thbnd6ZF1 z52o6p;?f5R<9OP?6vh-F%H|da|anqBgTTQu$R&?yFVVzxs$?>dV z^ZEoHmaikn*AED(PjMM>5yiB)L$|mIaz!(#e@Pg{yHn)T3Sr7#*}NA0$+&!VMQ;*@ zcC|A(|Hy@J21_jBau?z;UeJW}FsaWU;W5@PR{*SG8p8!_PPq}FLN@u_e2 z9;CFIz^TAnb)}%2!ch>DeUs&IL@w*mjAu1CYoqgBpa$pGM4rDxQ^ZZ-OaOHC>GmVW z#Pcxee|HG^{F&#oHX8S}_jrUJkEAhDJ2;V(a^aX0F!fdPmTVDP|4rC?D>-5rh2hum z*qb*G|Mz?94Pr4o@NLaGtkzRqh<;)EK!XnY`aK?FMzGrN0GT}4vJBA_vwV2iN3Y?T zHS(hmh2jdX>f9B7jsd6EWr`e8qHx)S7Af%(T8p94BvvCW_3+$7D4OT1jpqhOsn0THlEzU6jVVR{FvMLc0s4{8EY zTU^D3xO2O^8cVnrD-)RsFG_`V=S7G!12e^=xz2G)g_xl|BgINqjI_g+@E`#0S!dD{1*rr-Bp>HdFORsC>abS} z@+P$HK%qF%BQHvIOe}hvJAa&6&ptB-LgNuVfsY@$C-*&w6b$-};=7f82qrQ55g8QJ zgNzV?x-?i*zOK8jKB>dSR(Cqy>{piXE(l^4p>HK7xLN$^f;N~JW4gF06Zt6|MUlYG z+5zbPZEhQ45x~@=X{lezR?ZQJFw11CtmN-iHT*oe{@ObsY6f5a6*<+!5v>Xf;RiWA znm?kHCJaS#f~Bc0ue}H~W7QAw-?j zVyT8Gkub)Kmf!~$30TY} zn_TC5Bh5Hv^+D5OSVK;JW3=W{S^>Ch z?PF9kSCO|!VN{G%Pp)w$B<uad2=@XOxksLmFxFa@(~ z2$q~Tr7D^t(F%uY{fGl1&PWBNfUVsn_v}?#4T~Fcxl75UT62cFU>>Wq>mF1{c_n6k z?NB-3f8Wvt(k`abvGht0CZYuo0Fg;&daY>1Om~{P`YJ+U7mNCmj6JA~OLHHMSQuYP zwGJ+XE4Y$-lDo zlSRnoQ7vACh}BE5uCQ!^XDFZWkvT!<8lR9m{moU3AmN+ZYeH? z?~j=Bee5^7Dvi12lqEw{e)@XyI$07F3m1tmVCKvI&mNMwTCiMRV$I}Uf*JzNd(iO0NGlS2jP?@et?*9D!y4ty4AC-qlaWY~g`(cB znK21tABwArke9F#EgsE3Rt15V%tjc@tX)HGxEOZ`Hl3Al%Bq3;rvTQfv?v#=k6VGE zB0psV^-(OATIBe(tC2oOtFbvGP*i$X41=($*)vX2w-M&kODrqmOQ90d!_+4S zW>U_r;TYi4kGTes!odcK=PCxjV~ye&>ld21N*E%@L2$YNEB`AGa|Q zWix~*kPCCf*t|M2I~o1YT0)9u4YBS`P+=F=ke(smHYBDm8H)IH9%-3Pvp@{(YGyo% zlE-Gk|0s~W&|X_PIh$68wi(g_E!NgWNG%Ky4v<8Brw|ALi~gg&2%Q?t>s&ATTyo#? z>Si&YvxmkHG{z6KHocUbNf{41m=)!R#$gHc%Ung<5`0DP8{0n=3F#HbCkPpIS)`~8 zRYW2&w!klB;s*U>R~Z@_k4sQ&a8)o5g2~ZcNI7Z8;RXq^B-Y7b5O(+pTNLn*6v4vd zagRF~i2Zs2#l1IjV%HC6f-=^egf)|=XZ z<>$B>YB9C*(I&Wn=U-VI?7W)R49u$A*z|SKwOc@*PRkk&i?I8bgxI+8xzAbkt-sNJ zAH)yXh2j4Y^A7{0NY1Js-Hno!(CpqawisXF7G;62skJdE?;Km+{? zE`WCCp+WKvmor{sr0Zkug**djwqyp$%&KCfD5hmWzF3@LT6+qI58$9K_9su!^n~$H zYyatsO7`V3noQRu!GFfG-(SQ?ZHu>y<1^X(7N(J`S;6U1;#mKyoBpROraMmbLm`f> zo-I(XoFGm|o2CLz=EU=Q<3gi29gyE*{c?f!rLs>;pEIHq^_vGSO3?|kj*F#C*};** zai<*r_kxvzW)H_r{>~9u8{E!aRrKc3dmkB7a#Ep#Z}7$f_rLjabc((`92=i5N-7!p z2d(#%5%G9tlf4~Z>clv(?B-f?MipwP4>3bOaxg@hvN(RNQ$MA5mRzZ~BR=BPxChU&!*Q9G)nP&tA}gpeZY2uFly%j_nd zV&Diz2Y_6ZXV0}~5SernGvL^9UNmwq&*pPzi+`AaLb2vPfbn+qVR(kpcPG-q>qL#b zIR!+u^8QMoxG(9FE%&C`7W4JJlq$Ct(+E_rzNh^-5U}?uzN8>yj3k>?3vp@zX)4w- zLV9&=MOdnHA+Td3(h7K4)e&ub*a10)pC7saNrUh0|7Q$2see!a-#_rJH9TFfi5mu6 zio3lXzAsicv$kf5uJLc)U)333y%5qu;!w&Y%f8&S#n~dB!pVZk&XJ77$=j}AUt2d-#L`xH(u9;Mgw(`lmW6n8Nyw; z?CKKlze~LZ<64WorlyZqFAnIyqTe;RJt$&zdJ)_4WW%)faykQTUHo*uyGGePjd~Qu z`m@8VI?g`{OnZ2#9cJV}Hc{ywI`aM?olRHg#t#W3vr3-94+Ujcq^{3cy3M&YgP`GA zNO3+VspoBjf#IaPo)L%l2?Tq3uS2)JqAXLg+D$1>9YHtl8D_<-iy*tIMq5G`vZ*?kgo^(k_;Y88_WBe4jL7=Sma-mo=w6_N@fYr(bePgdl&szcO}p zC5tHMD=$0gA@n3UpfUTh|GV!tE2r>@$R8Dc-f%Do4GdkXEgI&|Y{YZ+i%Q9(p)*q7P0{WZT0N4k zn$!=Y?2mXUBA3xIT6-18skag}?$8}v)Mi`u0tf{m1a12rDgR$_66t^OfN<)UmzI1u zW{9ms0QG7(`>yni^K6ZNXnlK&+Mpp$Ps7#%@z7vSAOv=*m|C@1t;s?lhTp@cnZ<)8 zyN3(WD-g?FUp6M1)}DXu(vFSwAl^R;=De&|B<3$%VL@RjB0}z~S*nh<)5|R2hAyws zkVU9jjFK%t@PS7`nMpDI&r%5_^oYQj!%^-dTlP zS}X7PnDAh9_pB^umYs8op#B+YJa@ zfj_)O?Lw}?CdEac$1r{xwg2jWo5Vc=YLuQYikw_w(|(m+&o9)TBCI~Y54n9J{g#*bjz!_ z(wsu7KL^n{kG~`^RlD;XoZ{v>sEK#_UpWrTn-zg9#l4lY-*GfbTlpoBw-nct^fY^G z&&)pIFcwA-ox6J6X?op8sAy{p??>VNqpNa`JlVi>+5*pf$@X3PGoWAUvRGPt;7~wO z`C$Kbi!o~=VTV|eM~@F4Yb)BqzwXqlFGGhm<+SrA1m~sTw@XtXff}m@Z-Ib~+&|eF z-QFWYfmjad{b|Bp7jXlLB+1C2n=meX#)IGMpBl|ISyaZll`9AjkA3IRJpI_ zZgYdj{C4%JK``Oq9q@;X;v&-N#;Zxxlsz(G2Hp1W1xHhQJt7pxJ84z5{{T~G$$)d~ zTJolGpShOs@M9hkr8cI5XvKtQuqP~Wh6{Y^R%u&2cuZi9DI;*paT<604NR%_0#RB# zn$9wJ2Q)YUKYszYnhqRhz4@f2AWqI#P7o!p#*I#rmN}&Y7^;YL$1=)@3@ipnQ05f& z>InyanaU+!+xDl&WBMJKe)p%A_o$ytk zwD+Vk(M{x1-S7Ujlp3@h7yKj*pTH@Re0?YP+uY_E`uR;$RoUwjQLhLo{j=WC+}QNV{sT6TUIWw&df-4YFMT8QRso-vm2!(h#dmH! zt;hY={kv(Vx)f$N@Pu zK$_j11gd+JXMTCH)hfjcXCM5-Pt(l9ZurTUoc964_NOj}^Ss;M@%_rX^K zvU3Z+fofyzKn?u_FsbOYrkF;ZHMW|CwPK@bXKpezDp0!UIz&QFb84!}50}JzjoPTr zYF7&ht_-HNVlL*_o+ORg3RH=Te(Q$LcpW%!eBM-)fl^4aw|m|G9BVA(k{FG_q*wL7 z*@wtKbryrwhIH%R6e2G;2wlqK;W{0};HTO76Dj-495dzg(c#IA*`<<8$$w+7TdOju z`ORXArxzRpP%&^=HSSB|8G`+*4&09bmEJ88sO2Pzdm}Q+ELIk_Ay`Q18@Kki0}t1K z{%8HzQ8fl$NMHWKr37^Jk!kOSet5r6m9-m=26>B)2+`ui@YX6YlLp1x$aI`0o}tJS zoNm_xbrSV^!*l4wRGKImDA7$V8XlduDfQp~m;m%Bpu_`ol{obf(4JErH5&vZ`)?IY zxqR005&J_^Iwbn&QYe@rPmUB3nU-%ld#;aF-;0UDneODxX;G1@#jKQNG0kHFGMu!3 z6xVOGfQ{`@%JHLiWXa#>m-=I`5VGIk3|o}#{;&;FA)J*_iOS;-luLjY0v#xbvwdIb zksGZFkQCRmIOWxT3tNG(G&j!S29ynE^V^zdK55QJ$jm%s*;v4>8wcsQwZ; zr&c&iWkvVrEeBfHnKB%$RUJKXG4 ztb0Ldkcc-tgg$eSkehg>sworb`&U@Z56dWXp)w>ajyG@oMi6xP5xx}V3b~V}=Xy}C z)!=XZ{@K>yii8#756E=Vvp^OC`iPaK8oyPyiXZp~=9`N33Yd-3*{y_!QHQd4VwjQG zJ1Y25pS07J=t?YyAspUmnkF=_$iL3FJcZyqpWdzf&&JULhIK_dfR{eyTXg$gIE#`r z7wXbBdWA5@VBsxQ^!Va|3NnQSVAnd$D<^JI=BHX9+P#;^Kx9RCT@ zPgCfL#)xa*%e>+nxYar(gwXbg%4T1%AGI03i$HzS+cYZ?+CYRIf<+O{pPd?; zm65D_BlHRilMy?Z5nJuwIroeBsK_L@{=h=c@N>X(Y)F;jbQ9 zWV7BKS47O2+f5{(_20po$GU!Q6UJ@Q0gscZ^pDQVlr-=xKn`D~=pOl@Qa^CPdqh3Fnt zMDrkOwG>D`ZrlaCo8(0gLCMPE|;c~9Am zQ*Q!pC#W3Jk-_@YgsYH3oZHjn+KT}1 zmrp$zzZrbq^SC;kup0|DuDUlJcf%TV8dt7CkG(($y{<8QA3T?gYCn9Q9LZc}x|?K{ zieURte%eBL`cz|cPL-OK5Vfl15QtYJooeG4KKY&JsZb!M=0e8r$aVM>4Ihf=-GBOg zOZ+V>`j8bCHqdO6ZoxWxXB?K_+z5QxH~DjO{6?@PtTGcyyYav|-@ z_i7Hq4J9Nt#QVExUu5XFtzB%|Y1;bbku!#W%X3V`*?ld`Hmh!|!CDWJ((T2L^F$L2 zE_yo2gIE9GkKu2xd%0`*q(^`ixU@WR(_U+F*KYv$lYm$ngDYp} z08Qd&?fXt?t{qHLy^e}$ZB%T% z>-91EPdL(!a=>!|v#~nYDdx9N4ixe&3;Lewc{r*3mJitUt9_Ml` zaul=c$)`_gO8^_H9L^mY$_JS}xpMR+mUT(CYEmW=-GGgV4T66DcmV1@Oh`^qQ?&Mb zgE!ow@vMo}Mmdd84|uKUqT#i$kAf85lQQRj>rx?!vsG<*VQ=5#MQIRyE<${{tM;;G zmiir>(OGH5#=3l4|IBQ-3flmT@S5zB@2f}B(o}s4yjU#L z&zCPn0PyzA5MGnji$|9SB3@&zqBJJf`za}#i5LleZ`n3AFB-`kyA_AK==1cOD(e1= ze`jxCY80{4OJzFksND4ZvvaZS^%ge*jV;FV^xI(29&)}D^+hz%p@yw%WpWay^J?e@ zW-#752)bN0&w7o&_43_2PD`9hPoe7*XdpC~0^hEPBZ?Tk8D&k%f2bxk+PcYf4pbJ$ zPnYPiYJZ?3Z@BR5-x;&xu3%KD{rvi3%nb!QczRJT+c4eh3!ZqTAfX}~^B}F$7*ZQ? z9k*MfAA*Sj)17t0*1$RrHQ_ecYxLob z=IxkyWv(ECTInR%++n|1{@RfaL$L{J1-!b79YD%rC&l+80pW#s^cdJy5uujXjpC(E z0eP>L@Eg~j+M-ukS>1Z;@#T$3Ef@N&=&CtuSA^QS-bhT_$-C3?71i*ZQYxx%qfABXE8; zl(wj}$godH=kvHkseoKh9FfSDHq}O1NN9_Qd9 z)btLWoLjLr^AAM1K_N@+$rB*6hK!{bkPEri<=v&6XKNJb`a-BSr`(OS+NWd#iA#K#j{EbRp zo})bJo=Z&c6#jojID4%{0j8$tLNDJ_z>cy;hk2c8fxNLGM_-o4qVKAzy~1CrUwm$> zSbt753P&Yi51$+_oB~ZRycqc`sf_5YNem<^t8AS7+?j)R(yOwo*ZGYKSx91g(T9u? zq)3OEQ)D7GOeG6to`CIqC})|3RlvQpvhn?&1&{v_L#tWxgd}#fTQGlY<@e6wZ5ZA4 z8H@+#<{qrGE!_uw(diageEJ|3lrb!62t>EJ^dzoV{j6ifUqaQah_Ucm{QCK=rMC6baGtaL39xXwg>Ki5%v1-4V&O|cs@ zlA1EldB56fEKIXnIS+c0hq-EktHw$L?79kr&Qg_)XQ*IEh;jCK6R$LCG4U!+aDuyO zlN`vo`ZT9v!l{@v3f0D#UE`&zm-bIl{~sZD27t*l-VM`QmR2ByKuiyJi!}YZGc8l$H)YmIgvc}ui)e9fk@14 zeXUrP?e527a~YTWeSTR73@K*|MXn06r9!|JV;IhV)Zn{~k7vHMieS-3OQ{~Tur0h| z!iQ*BCrj|E8z3`q{5c}B!+cPa>G$Vi>hC={G7y!tzV3Rv9JsbfAqjG~KuH4LNpr`^ zPYFRp7~BjZgLOzO@!9#%pWNJdds+?N5#&X(rIC(`-A8LCt!$>{m zfJfj{#*Px7{=ZD-aTAO4ixQ9jAdX2BGGU*z>}a!MSgtPU&>4Pts*LEcyuk`+Hm96x z)xz10MWfQ=>^(^MAT%)T1+_KHB3I*sXP{u(I7xYK1gVn_7wriuBaQ7hFMfk#F?r;a z+Jh7xUe^<{sz+1L1$+gSIR)%SUUM%1bH_3t6L;gy*aM+Im-j&OgV81Xqm6W3W5qnf z74F>5Nbu1Yjh~r*Gtt%07l_B`$B{R>`&GK9He?1ghP-_T)b*>M>dd!!G>%3wHo)@& zHDh?nl!>AHG!bYHr;5{_!>YaC&g8Tg6Wgzhp~-AHxA)xUENeCN=185sPQo7eOIQ~N z;p0-Y`D&Dqps?GneW+x*)f_FWe-%wAvN!CkoA%!lSF~*}si!#V>!eMthqP0T z_hBb#=~wG6YKhsOo)GaH^=W#!!tmk;3Y2O$yqs;3lXA`CZVd8{#b|SpVFeeVgL(_6 zzK2iMBS*OYaOSVD{I&vV4BWXKn}lWRKi=iNRpsC3ywe`D4l>6SI1>Nt|gvd~Ls z83Wx?IXmbkE2S6Xjt=B0Fz~+t*DsEzBc1OBBV1mn$2U-3x&%(iu!TH`1uDV5w+VY$4tL1hF<%df*S0`Frr;&qg zP01(O2L}g-`j8Gh+bhkrRz63zcw-qEsi3CzvrRsc+s9*?%9GajAI2oU10(0&<2&QB zo&Rz$oR(flCK!an#H8~%Ia=I*W3iCYY}r{0ezX<9n&BaLc9~BZf1|n9U7^;NJ2p@- zd(5ixqqYT4Mr-uujKR~7<(q$F9eo(8iVS~1rA^sIgj+!r8qvzs$E(IjV{+EsQftLy zsy?M1lyAj!9rno-)ZN{09{>?tzj4Sq|5?Rb*|Pdmyq>!I+HRb%yVe)gzVHVM8U^ex zXTh^+7W+<5vSdb4fj67RzKz13XM;~TNqi#zuH+gyPu@Yfj2LN{2$x~rUZ#%j!n)liaCv!&-#GnhC{iBZu^jui^YN-Mh-(Wb7qfv}A2Umm40yHnlL0_fN&>=6o;b<#b`?;(L6W(YF0|V`MD*0QzXD zYe5vke*6Bw%k|NU0mv2{`vlF|;`A^NO7%RMer1Sl&CDhe1;L4Qek5|^w^Un${8d#_ z4a4jeLDQa?`|5wShtNjs900+=J%U5HFqyp@G>z(b3-CLm4Du{qkc!@izcpG-LvX>- z_9~W~3hYZRn5GW?GOrwg{R>-fW~KfW8W`dr^7R&m#_Y20q28FPfzRzJACMx?-=qo$L3=26fJXQcs+V}dZlT% zE?TPhD5N7j&N@Ph6RZA+$5{E_w5%+5DYh7$k^>J_87JPygG%hqy!i-&u%8#dTZwpF zn{L+mVhAuHU4R~e9pcm6C@!K}t&BsNFbu-1T{Xn^V)OgH;~f~=+2fS4;v%0Vmm^T16-KT9EK#@$Z|dw5q0}S8&#&Y7Ee8A#lmjZ&dwCs6MkMq z{o&?#yUxl)&i5&!D0!t$DCr_1`q0d)bEa_oRVX3}JP=as*`1tN#AV3PZA7i{fvgRU z@9^Vl!yLo@Jj6Fu^ro4|o0%AP3 zYRU{~f#$qTc-i7vYA(7e+l)W2}$l}=Vy0;6J zy-rByC9y!a0Gi@SY&)zv>JevO6a6vv2hQ$pgr82{hChh}|)T#rW?Vd*4V94r*aVEF`~kM?&L=0#qWz zrfQk?<^?Y`j#)9weiu2S_shC`lR-Sw4!~1%2HWGRH5_()H^~JvP@@Kqar6qU1KsVK zSz~Ru`nX#(+IQrI{zVIkahjgyMbqMwz_Q)u^aRS_rOB+ozOxQl;*jGFcDcBdKv#PndbI%%gGk zjy1>IlvPb616F#0rAb+Q+_=Kpl$YcMVfS`PazLnxX!*jY(Q>t<_f~~P#F!X2Ct4gCEp3xSGKYb<`T0GkLYC}j z{?We^*^rm#pA^qAAn|N3Q$%wOS(5+xx~EH@TKDj>qIN1Iwv&h z66^Vd=g)o@(rdr5uAEyp;JbPh!t7mKWUzi~x$ibEKE@(VYTUtY+8Z&Q+(`HRzgp}E z^z(x^E&>yDZvCk)tto;kIMsmyIHv`e6Ct)5&O$kC(CEt0R>y}~t{dMQ9Pq60?8L!H z4r`7A?Y^sCZZJN_FIX`wxr^kv&N>3OBb~Zyd}P=MbI~--BG3z9s-fIP08DtrOUdjw zhqlh9WFzDKOa_zcqc3?F;;$p8rMhp2#Z zWPICSOMG2I*#6Gx`52S*fJn&yqvWySPOMd|B9j>vhCIm zk>;Hu(olI@Pm#pY4~ZXRl2}ekScs@9L!XkttrA~`;gc3G=_!!$&Dw0(SXm^PhGqri z@yuOC5(j&=OSz&k5jfIzbOeqa93#n6=wMQWTPi6DauR@zUfK8p_$Q_Nuur%_mCs)j z`~qT{OxLO7sD7JDEA;ef&4>nCY${Qw9szOWaT7g_fej+&w2MY0jOD%sh?)l{0ics# zLR2sPK<7KF$iO2A9TFpUvb0DyOqAu!<&;UaJ&4Fst`^d`>b*U3@wOZ;!KH8MRnaNR z^tOc09@bp;S%v{FsUMK8=fu4($WYSUvXz`fmRV3acAJdY)rPnEE*?w35ZAwCkrxVD z;YgKIF)8bxv|^zxs;&`p5A#l~P}M3fsn=kk5X#@zKV1Cwzv~+)Lm@|x%;!n@y@9M& ze4`Jkx$i0>AiMhDw2PZDMAJ9NQ%I3+fQL1e5&En|FHPe z%l|duz-XlyG2cf{k}rPq-}|Czx92Q(Wzx|AtPB;HV9oGr&FO@?ex8M^A=!NZRi}?t zoIZoVD?oMj^?rdWyRClBJzEcY&*e&6pwdT?35q(Z`?KyvIZ$M5h%^a?4z}|8hm)ON zqxpkiiX=evRA*;zsxkiJ2ip!C%$v7#Yqg(k?-axn3P^~*u$>d;>UAz}nUzcD_tJZU zl+q10f3&`QY3g&?1@pTJ;FvPck@S*BM!n?@0g^;6x)`Oq=5Mh&*-3s{7F89Km6KVN zpXrI-&7q}t6#tXIXU{10DRBZQ9!n;9lD9m=fOvj;%qy)Ix&S5U(Qq+1(%bY<6l;yW z)&6g`#2(edfrin+(iNRi=f7L1HZ7n}+1l=dG>pRNz@F;HS)u^exO27C>tAZxaz`i! zW?Vat_0RnWqUxac+cT~Zckk@nAGZRfB%SaX|Bj%#J};5yB7tT}ST!xE7l*hLocV1A`E;N*I$^cBkK-;T`r=0J5nZz#gAdi!* zkIri2Iy*PxxB@Awo|hOfD?sJ-v0n{9IuYO;TXEEK`0dajBmoPyc~+a}!?S-IEzeq? zvT?H>V@}Co?|QG-xX-0)KRwj%dW*2+KF;kgp5cfHeA%yN(8>cBaL=`@)Y}ceHKDNR zl2$t~Q`UphKITZw>4;Vvop$Rd3g$d}#IamF&q%*sZV+ayz_y1;JNxG@*ed~%zX|l3 zIR%E*mah}X9_WJvA%-<)%I%Y?G4_*o$4LucN1gfIk+jAG_l)O^Y5x8OnAdN#E-3!H zk!l-{Vt_JJ@T3E|axqn9w&_=azmoL7dt4~F<(~n40F(1Pz(3Z#1@aWHmEW>{f0Q5{ zlU0=a3f)`mI5q#yOCqh718`1JeV}Jq@W7fKQ_rYjW)_<%vRwPiu29?Z=|>z_FEPv& zdG-3C2xKEl3$Fz3!5NOoH!ja1G)0n%ka%E^_o4=XN>T-Jl6?-9)Wku1>Pdg_|RbWX~@xi-Gy0RL6|mj_g{YuG~;=f36u zHXRl|b5m+H;>se20*8VzYMu+2US>j=Jgs;NNqVgA1!tGsE}Cqduvvhbmu{aS5(3!* z+Rp3wzbDBL=}WhOmn#`^UKHUV9+$9EOfnG(3fiRO9J)gAYtBt_2Dlt}yx01)4xRll zrvsG{(85f%-PMZ}d3^kT32%aG+Y)~PDWQS)CZM}DGaP+1iV-n7ncs#x|>xAjOpqS1g!?2s#`(ZAtGDN_S zFyDn*d5#2QI5F(a7yowx^y5ZPmF;XRwtlL|r+|z0TuublqU?1`9PD4@%WYqqp>_37 z6(~Il4yXKQ_AXvb$zJqJuixZasvRQz?KfD@)YZXoVYQmHm|Ya8QSB5ihaXp^03jP> zlzHB~VQ3=6XBGr?yITg+4#oZr1&rcmiH{PeP2Qy4+$tZ4;4W^v?M+WgvrI)MZ5hL( zgjv7z`C=IxJ9Pe$l0+PB zb9TSGeWp4n33Vp$F8R6@7Y*ewxTY|} z@a#Qr?xnF)Xfp*MlbgTrg)B|cI+$ap3wv+a{Vz0-h@=7IlpTv=OKMRZbW{^+Zr98E z`T0BU^&Oosc@*+b{QPc_uM@ ztkL@m%M-y52Ao>9#N5)}lveZn5I$m2kMjfXg(F=ImVj^C%<19{(+N?Jx_usq8j-B? z&F%js&=YYGbD6RlxMy0`x}b_UE$S zF5un28TC>XDt>U==Xxhf)%M}s?Jph_n=Une>JC8wyKF@4Da0EHFv+(G%Uk!L)0G{pw#0R zHmQ&flZA~kGuB-N91#*(O{+mCds#RTQ0gX-3Clpj%#sS-%!Ks0^y%Fb-R$J66m!s& z$;o9MLH@HUCi{>rw33xx)v)Smtx0@k+ayuf=%;@l>3()N1x^-BYOGYtbgP;j z$sFdeUVPc`y_``X3Uq3OTV#k-IlzUcY+j2bP`oN{*nW3tAm6NqefU9jY>^z00!2!? zoe$)A?_!~fw7DGnZ`~_HN6SF_%xnB=s7aV#C<9mpUT9q{N;|X&3G3&v-E&RinV$af zxWLxv_KumnYwQ|h9Cm9qVH$AzoE$!s6Mh!LfLxAcfI9aOOb6ZY>wfLV6`^yryn2i` zT&YP*!x>Sh?t1VRlPuE*C&vMa7}(@h&HSlu_n!}3MbJw*Y8H1WKBvxnZdtQ$syeAs zH-qwx{wu4=X4sr(4^P#*JGlt3{SQ6h@_|BL@3mf=R`LS=awNQSJRBpwb$W%(e>U)* zu!dKBPmN6`ay$3i>o5m)a@q-5>~}gN&drGfrPtzK33)Lubc`oW-9Q?Y+kdiq;%O60 z=?}HVwAIYW$718*(wR(I2Uk8AZXHJ>NTzO; z_LzL^a9*M-bg|@vAm|6*o^k+&+J5N9bB*ZJu>rNe;_moYhd>kWg2Z@>{&Z=vld_R` z(=knmGnr6_hlmovJW!gHufG3YnXHs>_~e}*uds;7(DE8Ydfr6UCaroRR@z8dt+&Di z-AQjvZF!hTAg>b|7o+s*93+?%Xw*;9MOjq&5;H06HM_N1InIo;+qEENP1_gz z^!o#Oqmto6PPg#W+YF(vpxX;sY{Spbzk@}8zzQffkEGX~Hvzn!aXO-PL*wJm)eTOL zM6=>z!$ek8Z=5v$2tIE zTbTbMXvCL`2hgNmtGs6&h_D)_hVn)8ISDPd7x7-^N8zi(`}9s24{miOaa@5TyFF$N zYA8TQlHjk7uNzc>$Aj~_!^lP?v!s}OG_=NEqJc+}?6(OBSzm`FK#2XaL^yR@Cdcwb zIBnkxH31RlOP;dpyyo34GSxpgft**#C-}P5T_f270N%AvE3GnPqz8f|s-~{3AB$Q! zpF9y&eoT9kxhbclsL(NHZn%7l9^X;!nm&vb^iZj8QNidJP=s^$nJeGBODPy^5x!}{ zm8Em#y{cvdHWLmE87pdUY}TGLcz^1erw+>wYm7V5r4)|fShO8rAffh|aQ)5}aEyTM z$2~Fxx{DVmlch56g>MGAknnX#sG;X=sfJ#Y9a2`l30w&fR*}0Il)X`pP8Xlo&Em9% z+P{AL(sstj)X4l%vH!RZfw)?Y+etia5NcV&ex-DsVL+t+HvgOey;W~0PIfle=swQV zuDR=&^f|CUoM%gy3vNA`%NvfZGx?Qzp=%A`F**vp8*Z<5n65^{hwaneNmsQ}M_OKY zsIhG=N-?lr-Xbod#d2^IH``WfXq)9X$-Q54teIVp>%6x;(hd1yt~e>VWU zUiqa%6K53bwmDtlsG}9c^P)YS)Y9BaQmmcF`%gKtn$`za{(l^%xaJj)RBw{%%VL!e zOc1M5w%B1n`~mK?5qWnB?eO#09C*~L3L?~h|KS}U_C9Y%RG^9oR6Z}#v>5t7FA51% zCKRW8iGQfg2_b__&XU(Ps+W=}$O5{uw2aTUoyu07MZ;s?i}y_9n43@i4RU_=OS|27 zreopcyq~(Hs9EIhf_f0j@S-%BW2){Jh=>wh6{F_puT_}xd=^3N^FiQll1re{mh@s` z@pG{uA$_0Cnj~;FKUTc^OFaK$gl$5iu$(-0L3Q%}i>FbDHx{n7;SVjcU$ea6XGdH0Xb%FH zd{-DdCnPPNv7c72UU3mGHUL&2Am_Zv6hXB>5ew$aTKCdM(3jb`Lf6uyy<`Ia{B309 zMPzjnK~>1H$ZJhcz@pjxkJ|QGLdk?#AKKBE%5i@*qwXTi$%7cdjq5d0|1r9pqlyn( z0gGQ!X%z(taNMlIBvv&SkCx6N_B{5tjXN9Q%Vj87zaJr;lEl(AD*^59Ha2ZGOAW0E zeW%81=!_Q=RH8+z7#|m@YdQ`Lavs2J^d=-&67}$h5dscK``MzvP0~kX$!fXt?w6PN zuAfdwG9Zr*`8Ue%Z$uV5?0=>l+o`$p*016fU13)+*I+5N)S zk;OItr1elyjqcg_okyB~_086XiWULSqw|VOcTNPK!vT_m^ze&^$EWj`$DSu!>)7iF zf4KRbJNI4bJd<+kNd2Oy@W`zjdhxJN5CPt#S-G*@P~E<4AoK3{5#`v;&MMVaF@eV> z<@ntojg*DYec+yvlP?q^b>Nr4F;<21`8jms>yr-A(1Mq<9Xl`Q{qvZU5ws73dhjht zOXq9o{qs%_ONuTl^1;uPG}hb;ahx=4mg-+^@9;^Bquk3>XxOYozB-{t`!CF;_sXGX z5`p%b5y1&Jz|IL7MJ4?R=fqShMm6>v{_(84-xI+O7EuoA2hS3g48f;okDoNqeZ3m} za6!}@J5|4>oVdr)zR3?6u*HCuG~?NkIh=~e&tSm&?;oma#VXPa#$3<#E+)e10#-|F z3&o|?^>TVNpm?1%N?7d1bjKLPD1i!B@VIY- z{4+{FzH{r9j(7G)@1=apC~=V9&Z}~osE*9)U2nnvj{LujOE+(Bi=6Ia(-9>!D0Oh1(wTY9n=A!c_lyl6pKNA9SvOv8U z;2^MW@i*Qp?uFlR!W1!+<5K-@;XTI9TMx>lUX)d+fnMdU77Et5EJ}AiZ0;k@Htqw{ z@iaAe#`&qJMOLBCA3f2RCL_lLoRr^ah7{a|%VQ+WB=b#1wx!5!c_w0Xrp*zGVlPJ( z$ir~96^k9)zru?l?5po|KAx_bqY!ko0PbWm`>KWShh1`-^t~s} zr~tu5XVM{JGbDmswAQ>17~D8 z2xmIk_@a;=lPl+@;1}RV=0OImtf~eEbE(&rN6rbJmu1Z`yHZ@e3Y`Pnk>RwUaeovQ z?ZZUnwD)iqzW;>y)?S_p!f{D*U^Ic>>v^01fQ_yJ`}C0t7Cjnz=zRCqjcr89M?Nu( z>n6nkcZF2hF)|x9mF*}Mt4?9Y{4;klLK-TDCIb(3%s~v&xQWO@c?BR-QAk;3G`go< zD{!nNn>f#_gb_7%LeTu@(bap8JB7gq&^->`azWWOu8{zWM|V5OFE%86v|zI5bGWVb zN>IiJH-x?7!Y*15xb>MU**udkETpcaP%Jot$aWqOYmLmm-m;9k)^B8>GI?wdaLV`P zQvLB*VrkfgKVP#!`vBApA;FWFSOv$9e@l~#vle^aD94p#=K5kK9s(Q>EdXKr9`$`Z zzLdGY>q!7`{XAwON{oNTPLKg#6cm@A%r%J{-d@*B%KU5mXG}wt57)%IS(Q!LiQy7y z%FA|cNFy-r^sRMA-x5U8arl<0+=hqP!SNJT@+3DuS;Yt518g}y2WSIA!X&xiP}UKN zb)v84JY^a=cJ+Q($NsxoHxAOwv#86>k0g`kxOh}$bYw2l)#WtGgF>Z8}5B}rHdj9p_b8LJsxSkL8y=>PSp<2AjMW1g|*4wgf zLTnm&IJ2nSAXfHy|FKl&P*uHtWf-!W2luOK3Pr>mAP%_XmYB#jR!>{mpiUnH%R08* zuLCu&PY7q(Wdq7XqNI6vQ&Xo|I|0X;qJe9|UUB#`=HyqXRNj*tpPy#+*FNA3lnI2x z(TK^28Dq9AHg*Yn&gV+h+oJ3*q|Af*)iV=er0y{cw>-Ux72tu?wtVy}JYSSZvX{`8 zj>p1;yYg!6NY8kP;GksU{|XA&K6#SE1e6cpRWag(zM01tf~A2Xr?BEooB)fzdd#EN z0kp6Ig-K2??p#_Wcu4H0;V%@(>aiy(tc-_!^an0D;BZcIoE`o0^C5VPH+SPHXtHSr zjvWGmvO#f~Q8cRVn{%YZnt-!UFj^m0?Eg7-o$s+^h5`a16Qt1DJzNc=IHZrv-N*= zF&!mlAGl5W=SZ4@RiZCLBbZx`bG(GsFixZ;j)1zIzD$6 ze68%E7faxc*3Ohfm*N9FPc`tZ-L6cBL}gX~a}?-Q5R_ae)t)QZQ7M%g1~k%-_`E#r ziXq$Ma+|^Q<=yVK>?X&RLB4$<1q*p_srG9tV;ag{7#J8$mShqb$-HNyfr3H7LCbYE z9(CWL1wAjLX!DsCB+X0>vGZB}3QGEk=w2U0ixrK^Hgm+!izha$fQ9P0iRPF9ONfrefX96V`&qs;Bu0x zo-fB7a6aE9Hob(@e+?PT(zxhNoSNdz8F|^oA##EVal(H`>)fKg2X>@S+S=Eq9&*vz zIcQOn`i|~actIzH{li45DbXx3K3tNOidIMu>M&Rgvr0gofElnp$cz(YG7)YJo>Xx$ zO%}wS>QUCx4uh4{La2Q2&M!Ix!pA*L4GswE{*jOzpP!`AFrpH+$yH5~#i(}(xVG0gub~qHG^YGAFL|eoxUneaJMMqi?80M{dUih3s*WK^W3OFkk~xf}1tshTygsC^dtabRMbo+Jx{h^G{p*0C#^ud2 zDo8&8vt*5ixtZ*C$h5F^RmxfuflIcgJcb8~0PWqWXC^+S;;BG3xPUV6(vIaP-WKgJ zf~^e8HiyyrZ4nT7QFI^cERsN$iqqwMa)x85D>J7q_IPvZuRt)D+uX`$%F;6U^v#Y; zk6>WnlY&+5=A^3Cj(CgL;N^%z=s?Zdm$5z|8u_-TwH3*u+_$pZoiTVCDY+&Dc`>mG z!WyV>nqZdD;neda$5vRL;uMt?L@A-A9vA@&PpfjgAB!<+NLUI-evH9L-aWjH@Axa^ z@A+9Eh1}wA_uMKXMEIRq8g*<}h;NG_nOA@F%5uSQ?gBS$E08LQwZtu*95BVoYCdpn z?#E36i+t5_AIaJcCjJtd4vP98M%5Lq@b_Gu4^uvG;{^VAC?2P^G7aj7$AN3g59#X7 zOcbD~OsQ(lCA|EwM0TtYag!EQZgE$MXG5e1&Lz?xzAC*cAtP2j6y0_ONPpd^}i@n4`fvRgTl)oXM3q-yhV zvR^q4UL8+`up;JmuV4c>Qljc{3VVoJ{l5AFYJpx_Wv{WgU%e92P4dlf0MhVXk#(z$ zo&FQb1^mB8j3rUmV`VZT8@g55v2&I3;~Z)r_4E^5rEbNRtToknAM!7ew0Vw!j1HFQ zh=lNJ1kF@@zg^^*1~`uo3hEf2Xf;hpoq_^TwdM>VjX$it0M0F;ILS!wsT>#$YNO-;{_ z5<7g2&_NDDzr=a***6QZ_;u02opq8zE){tS<5RYD*uXCnf8JhlAPil)DRt#{w%TAs zMp6C4ulf^tw*$#7gn@=7Y9$?SRM9M_15$Uv2ws7cXi>Y|yu5G8?b<)Iev2M(hu;$h z5-~KSUWbv9_7+_FC-r&$8El(kPl|ElPpKqvgj|ucZrwP2Q^fVq?0u`+-o5I{4~eMi z{G_$GfCfJT7HfXMS0|2R^(Cl+YmhVK`<2cy{!e4b_iasFbnG@D5lh znAM%#b;urHS;6Mo=|vJgC2@iU3#GaYY-O-O(q14uqN)EWwyrB|&y(Z&SPoeljwkFj z(x=X3D(PA)zUOau32SVvSi(s%jtKCiCn`A|Z2M4++E(ovjAHv~b0WN4gorVPRg9~= zlJs8%jNt%i5AW!;3?O&Mv><+E>lH}W5s7S*MVoT->}nK8jPKeQ?U{sch2K0M@O zW%S3`iKz21>gyzQo)*rIQ6A2lf6k^>=P@oaI{{BsQ5;rl2f`6<&^z2EMLa)kAEkqH zv=C&%uV{)mIvYw<{wg=d^pGJ=Yn3SvZs06aqy{`J4U`z_dHfs&p8{QrOpDIJBl+g_ zxeUV_2y#h3?)_go{#WbMnmcm2C&9MrJ4|i#P?J0tIIme9jAzuXMCU!>Nz&Q2;yU+V z6i6?{fzLB`T z)}G0JbpTLxxN#6hrswSB_E) z`4Q&O_P)B&_sK1_(BqR?u6-Ij^FDQ?Y4RL0?h#)>KQwe)UPBk^FJf}=_~^?Cg4HB` zDN0EnEf&vfPpt{sHoFav+I&cDS$Dr|C}0+c{l*rL)6;Izt-2abp&4H99s|GupNpnk z&Px#|h4pf!c@8t|`n)8H^hAa~R-Tr9d3EaeKTy!{WNfY@2&eOX;`qrCyl;0Vxga`i zUhL>=%%I($#{_=clqq!_%P7S&OMjJA?bWAMkLBkf9M-3GZeu zqJfwRIxV3T@b>{C{Vi{VXAf92@;w}b-a)#4rB@|_P+}}ggKX05i_uH5!A|k73kpOh z#N}d)Mpa~v!z$vlsup;N$LnVXylFuxItAwzvgJR}ix`VF&SxICZ4l8Twl66&Qp=X( zp(huPFNZG$`r^A8u3Pg?um2VSGKTvC9@?%@Q3QAKyUC*kLDnP~lNX2=I5zxh$V*bK z2Xhd&cauHnbfcPaTsRqOo8|DD1IA6I3+;^j8g@e<>-<&Em0kI=5YfU>T9k3wwXr!dmKX^XJ$J>? z^L3GoD6q_>1d2=gYd<&q;FoEAMLg{FoNC>i=lyuc*C{_~lF$*2{~~OKm!8qVRRdul4}&^?9O*e+{iYFdOyD>3qs&>v?OouJ72!5>r`H zZ%GDkDZ~uW*{43^lNGm6Y|(RD4;35m(Odg^nu_j|{1&nKuy(u5g>2$C_> zW-|GM!GR86u4;lErSIv!;?BV6xnvR8jKiII@7k*GJ)g-Mc-PUhw90hf0;W|g!A6dj zxEATKE4P@D*m(TI^2>Q=$rU0k`ka38jMPbjf%6xzbT|>`QYr;qYSX$V(KJ|i4X9*L z5T>TM@{G0>7N}b}2d3G=x_-Y_=sC7XmNj&}qgz!*<*kn7)h#~p<7It{dsCz$K?dpZ%a(pG4neQa&mI2n%O1P zvK0Yc`w>zvM!5R0eRhhCJIo&|wMo?a)@~JMZQ8q2%oS`othxHp!h8be?3$-R!Wd=k z&HCQAXTVDlU0`dWKA0Wjt<%26j5{ySD0jX5<1QcYwb|-&wY42~84mZNNbBTG8QQMK zTfuv%HIa19sbL4(N2BYQ>*Pw)WxAEaUPrE;xglB`!gDim5eE zR}VD@ROua=u@3_c&gm5rHXlpmd~ilt=nR^G&UWZs&r8JaD!=T1<@{bEk2vunP}N4` zLjG}t(A7!F_gxNXrEjgRtcN0&Cmxm$#d0}xIV^3|TBY@<9&P)+278K8d3I>^0@>3= z6st42*%K9%xCq;YQ_Dj#7DV20y_n^C`qZSH5R$|KjQTUSu$z$RurZS!#NK&^qQRa0x0;i z!i+!nnGMSD;3&@wis2!Ro$f#$0uACP&Oy>^OY0B3mE*go>}PZ75pNH4LKTP0k=sQ! z8t>&4cqFW@X%=U7jcF^Ol|iE_8Q+(=&O)j_*oE5_Wo-D>^V- z>0hDf)G3-{r|?i_@#29GMWL8*7FNgRHY>9!<8k0mDRuj$Xe~c6P&fk=BbGxwn&rhty12f4GviN!m9!X>wI+ZSt|+x>Xa+s7W?gTu^hzlR*E*D=w@ zxmi(zNn^0-y8LhT;UGYSm!O`lUU5RUm!cp( zYu=Nk5z|i|3i+`*E1tJfsWRqJGUp1*F1e|G7KD+RS8Zazx&)XhUgYC$wU$%fcI8jHd*H;3irrM{orfj-Gz53s>c-lxr@zlfD7JEdWRrQ)n}wMY&D(8* z`TXyRAT7Z25ntd9-a&@gM!-`Q5mnEL99w5&ay)^8^*?=y$e4++E}ysUdFjHT*uMr# zEa`yJ1)M;}#Ri8_>TH(U((zwIshh?*zNpV|${zE4|$5U9VacpIexQ zXwi^w>1yLKqbn|uec5KhTgnv_z5jl~F;N0V+%8(d?#JZsmGxzsj@+e|IQUo^Oh!+| zvw1=H1^IH@LAm|O1+Mo~PLID6FCMSD4uFH*r2n$l|H>4EM4o7V?w0_KZJB(gG(5}7 zid0twvx47`6&7=ibBRnohxl1UyR+i|WK^%K4?k~am%(t#cFZ+0+Y3!OUJ`cjb3CaE z-AhhRk$J=3c7qia1x!d^##(w2&$;=Nr&fi-`G|=`E#va<)6y(07IE9Ik@IXu4{qejse)C_aM3d~7PJtMr*k2iYEPa~29 zYL;@DIenx+hhE^WAM_xw`NY zrdng34<&9+{6jj?e%3g)9}T_}X9`v^p;b%NZ#yG+PAplFAfp%y@0OHMw9+dNj?xO+ zAGR*Kftm+4-;Y{0TEA}c)!_s_7`<+;%e4sq4bOz$N5VKX3cj@fu0Q_Hl^w5*v_9Cc{kQ%~>m>Qy462PVQL)!NDGDSjp-m-YkU8^jM>;t9; z1q&(6YWbhe#5;CFXJB;PT}1q<61OhjjsEH9O%`{Fji{CZp>2iB?nXhzw9zREtO@Xh z@<zI|9I zwqb+b4D}d|8dI3~MSD`PGL{{?E-d`&<>KtQ1?Yb9+IZT_0bc!p*M|$}bV*Lv5p}Ai zfn(c0tXsi*(c5jU*Nv;5o?mDOSRW^7ep-(1t62-q#|`6Ra)~a-5*UED#}`D{Symo& zAWQ0=zOf2`hkio0I{Tm)bzV$C-I80Vyl)|DxdXv@TU*y`oxxtMNYg}ANS?Q{#i2J# z%=6S0mTNR}O@Hgq;Sf7?w1*A2Ie}i5(NY*TKXiqEoukj$}j;hPy@`{GC<%`6y zpxSx?J+gW^#97KRDhsm8qaDWS^4wM$t_vz$zqw)HtyO?qPVYR3d>16P0A7kUD($l z^|Gb}krwRVCCg1sViPHMRHzPvyLHnfr_0BIAj^orAqd0ACL&&el9uWf8O*q9+bjWbL9>TgaCg4BYOZ{w`blLzN-R zg?1zZ9V_h5>7EU@j)j?EE%lk~rNHW$bF0x=tw|BfC_%(>yIgpfGZoH0`!b8|;7|Z0 zq-bekj*0KowZGLTtBk$rW+_j)bHH*X4-*-kcNiBwD*q82O@dbLgN<~7K$BTLT_L_@ z8YoGWpB{n#Ho;Q2RZ00pUO4x0@R{x4xLgHY>5LGVFNGK@CIaSxP6d$ ztE5_rE;z8P8n)|`a9E#zFX5A|Vebe~1mXsB#+8xokQR`cky8t+wQwAB+)3m2pQ5{S zro7mAj*sw(73y=7r(jV?W{9h4w@hw`6-Jy-|AIT##XZc;t8>j2h#?~_4=fzARG*si zCX)Z{-J~y}=QDSVrq*mop&%|%05|oH*!R6x4B+cBQRH4V{-HEI0O7|ULza}Osn@JQhY13n9ft|5 zwPQYR!?$W&hMH|w@){Ba?9Eq~;2vzKs>%m*~Jao?&mX(4VxF!cnF!A*3i&AyPw_NYPO_Tr9@~xn8x}(l{>d zg`TJcZ<);d5`rG7*X_OBXaYip&esD;1lPiNhp)`Q?mKOWD>wu265WndwgRw7wqEd; zxoG0Bciw~3F#(elN4y0vW9CgES@oXymiQ@{GR>whW|Jj1eOh~JW@`Rru*Vnb26qb! z12pssV!#FxvrOa*Q;)YL@bpsm^>Mu5MfbwrLtxhLB-fV7pR#prv)L12oqSwV%6+bh z0jzZ*Ox&OsQ-g`aKd>oxUKLpl!8P%RK(rKUbQDt0cxmZX!#Z$uRZ&Nv&{G-c(>E>l zBbZNufbb-OlhIy!JGmKB`)$zdQ@-hc&xRat7VEM5X+$XpVa@JYtm-T$$f76<= z{831$AN^ZT-lndYLa--4d8QtTa@=0=T4Os3s3ck@h81rdo?Ql(Cp!2v#Z|0sa5U7Y40$L%Ik@Pg%9L3Y+Y8c5@_Hl^&T8f;aWyb*Y%F zSE3s~|FyJmLUGcRMjRv5!*LZw<82AjEPQs0&E+Al<;Xaz{I*s9=+TK3j#3S4K z;Z)~+YhVx&ms4@;?Ke{@#Awemriu0~PkwvkXBm`*&JZs$^*jCK!I5>$r_=P$d}1|! zzOuYU0~3gqEcLWm@psumNH-@Ok||ZfyT@Bx(@>9NQNB=@DM)GFIObU#9Q)EVHg%b; zPy(-vwC{p9(|UtK_TA=5@FK{vFp@`;Pb$eBYUDCq9$ov$zc6U5Of}H+X_iTnoXmaT zA9V{|ZeY$v3b_u4hwh87uYQ19Dl!F963$Ej`VE9Mngjv z+4Zv9;HBkz1CSVuRxxhXV|^IbL^+)Z*Bx%*OBDA7V}WDa^1;?@&55_iB7XbklVjFv z&YvvvR3yhRkQNcFIk?|1XDYB6lrpY&k|~9JZeqsq#oIajOfL;jN|OJGxGy=Xy$E<> zU{Ua(nY$wI-7~L=zfW^A{*LpH4`(@(Vg8q3T@Gdv?4gFTRICWrzK~3367H?iH)Y9} zZROB+Shbmc#6_z{Hv|~{+^SdA&8+xR-mlyH6+=82xRpz<9}q0RLJHJAO=HPsjadH_ zPCSUHwF)*4ga_3;XV!&@9B$Z8B>>vLyTS4A(wJae!MY4;`Pf+sO8i;$T-~ zLH-@&(_3<+M#>@NIV$N@Pd9>q>|;%S-Ls!Lu!1%NSxLIahi8-bX@v`(vi_>~j`|G; z?$u(x9)Wl&Z;%d1h!;kC(oO&PugB(`Zk&e5=L`&9cdA$+A3E1s%^uBT)c~uW7z#oO zv#%L{USgvi;Sr~_Fpv%?i7|=sr{a03NVH2m)U$erJX>vB6~=a~;SYze&9&cR!ePaq z!{5nglND<@CP?cqSxt_*N$}nxg*+gFvilw~5uujP%q^AsKY@nse_6&NWn8`4WT_BB zJD)p0MN2u^u@aj|6)+Yd8t~X_Z7hma&y++Ku|1Jjb>=$en3jEXH}~hRKXZ~reTS*5 z{3V+Ks}#@Mv9RIvew_Es5gkHbC1NNsA_=vwfE|G?#YE=fm*dsM>-~+--`k47*0L)m z?(Gzjjh~-{JL+CKXRc0j=W5n1ydjFjnc5jD#y)>TG${fu`Sl74DIGFA6dFv(z zg6F0eYCfSDl7+A|W~~VeF2jF2K*#_4n-`{2{voI6@)69DH)eSY3y%rj4fBovN*xpx zs57|{kZ(xtRu7w)Qvt38mCrKvq9vcVVc5@+C#afN6ay(l2MJ$10f;-xJE#?xeT)-hH|rgt zfeN=Q*0z`F%ltT*a4wvwM}5wmy#397Fh>$}N6P}k#vX(de|%apiKSC*-t{BQk_&=E zew`T9_4A?GoY>uv541O^XBydj8w)3^QPq*O;WptM<3I;Zh1|caqR1nm(Vnl=E%V7#DTAV4#sh1igF6Z-RV3mHOVi_I>x)) z?N%tWy}d=~YlC~@GgIbPXi=W`Ib2xaW29*26B1teX%Yd`738Lp#riHrP|BC)1NXAL zJJtn>yc83&TgeW>nIA|YWvEhRx;UX!EzE4~six7uO~<#7SPSY_eq5#a>6w!+LD>LI z6+zPr2BXI{N=Yz8N`D~w;Z%Th!_BufcbKSx?G4iP8+Yeew82b0O+KyZl>Vs&#U_XA zHoDyn%$ILF;_vxMr&7#wT{~F7Z7N4UZ6`D#j5F>&7ERL}>NA3ut8dYY$;UH~zP3di zIYt5n#Qm_YyWe+i#ETvSb~%19i<$*Hd(b{D*_&zPno-8?sne%}GbuAdA5U5L7~||d zyKjn9C+?8Vi9HdgeSgx^4f(NeCW0Ym@WRpUi9iICx?S1cKG_1Stn+bxdq%Zs`f9mB z?0uT5vHy&Yt76MSvxFXm+nXr$SDWknUqJUb%V99ioR|xY>wz+|RBZoAv!&c@z`z}Q zFnb`Obngz|Z^7s-+CGLsbY}5@I$3c?&Z02DL|*liDs#-|@OO`nGexgDx_G2Z7v&&9 z`gk_PG0!BD*9O5*TRRs~ZNx3~U&9S^u(5B@*L+5ul1_ z)@I?APE=NE6g>0*8`IXD@N>hh#l$B$PRmxH%wJ=9z1hoCD5b(T>NP}+olUI9vwe3M zB{1mVlEnY@GCj zuXX4WmyoZl7w$OfRO0jnK|?Ta?32qZB*A;s8NZF#t|< zNVdXc%7$S)`_@N*d@V%8E&cQM?H|--VGNN77eL#cs`m0oB!lL6WALtt_Wz6C9(}2$qE^>fl|oESc=_1@bZ(94Ku6F!TyVC!IEo5L?nk@8*v&Z zgFe#)(hHtXM4Rq|b^;J&>%URpA+4!Aej!IV? zUZ5e(qTi_Ojm8Js@pqY4HMKUzW_NbBr&KlBh=T9j3Ec*3kV81&8rb%Y$Bus4HnsE2 zGPPu>LYBwylTWT!d`nljrwBR>j=~W7h~b4N)4A!n*yvrCO88)6+h$>=YOQM+naCUk zT)VsnU|s3Y;x*J zm#W1cxO1f}DCmiqrn;sElWZkZC7deNcmrToUTqMC(Dg87_ffxm$#~My6(F0yhxu98RJP1f7M)|=og=vsoyk<#Kr?rhZb z58LtV7#6y%k{$ybhek{cw;=P2ck*1lVk7W>@*4Lplh(;MmX=v~&e~-n%l@yXuZ(J| z`M##OyL+LyyF+ky*HR={@IaA5NU%bI7IzvbF2SKlp;&=n!5vx(Ee=InD!=zW>%ZQ7 z%7@&$GH1@rIkV56eH_@CDpTqR&8bR=kW#s0BvNvU&r;SyQ31H9x%r3+_vjLKbHyr9 zkm5%(L>WPY`LjLaDMJRd?}!)7Cz8jy(HcKO3J(wcSxGiQ@gDB-&TT}0jDmIL13;s$ z40~m0Smhf(Tt5--LJvj=VBfl!Xy`gDjBU(qY!OL`{Mt4Vws%wO%FtYYY2}&+eL7^1 z?QGKeJwx;N*nuoiT^rKLX8IsRy-_Qz-lUIXctJ}Tz>0QH<-!(eUO5MZ{{tY&uZ-Il zf?0TLO;$rb7JFixIT92(us1e>ddZr01v+?a<(BHsL4w)sYaE0P(l%EMUvRT=qmaBa z{XDC!ePdCM1bCvNXP#5j#VX#Wm*Cc8B3|rT{TmC6+kt^rr~)k{dF?v3jtaVJG~ki# zud!4Q3ex=iC44MIOb%w$Y<5z6W3XSDIblV{M)fkYwxoEh`&ZQCrC*dFzdp=Gc(;$n zprtp-O?2JC={Zk|(*Mq%Z+>~HNI%8H);!2VX@q+ScYSi0&ITk7{ePYG{U@7HiEYcW zc`&F8=P$YE>t!{-uSz5^_e+u#mYrvOOSY)Fo?a&TzyxmdMOe5>*=+C!s2%+C&yNvb z%s)}}?s$6t^RUr90O&qv3@5o=K;w}4@!1*QoJ>L#iAE{Kqo}ftpE|q8Yl=Z;Y=V9H zWD%1NRr6gS-2@d9UScR{Z-$&IlQSSnid8_m(O}cZfmWC?A&wB2hCrHEXl-iCN57MP zGhpCo^bf=y14DI!i{FRPy?t*YY2meAsnZs1&RDMp&p{&Ai0lr7)Gh#&A#&79)3*h;L-(=)lHD zdlzTJd}gg8<5bL;-AE%m7^sl0p~*nC*PZiUKWOLjbO*fWG+vO z^mq;t96vkw#Fi_g(^qNppI|_Ydjm$ioaY2qot(=aCEQVo0S_%94#kxMF*(gwE9Mq} zGGRCOWMfGB$Q-ombKj?VsF;caCziMHOSxMGzQ}{q^%+He6|~6N2C8h%9&h$O}6Y6t6ZHhBrt{I zt{$l>hZY_N{Zm^-!EBw?pt|M|!k7GdL!?+F%F`!oceBEw1{kN2*_AX*^{ih908C2@ z^V{u$s|WchOH5sH#YM_JYYZB3!PJJn?$g?EbNCk^4jUSV>{uhUD&npE6G6N%vb=r znAj)5Vb=z(T*=|yy#3eR-n@YjHjZ5-T+kcLy~CO?_#Y zy<$EoQqsT@=^)h`_V+V$ERIUI8R@sr@)?q`hZJz51{QgC(wTaldv!r5#~$ z$O@|}<^9pKE_nYB1^aBpx%8_SZZZ+8-JxBfh~n6GgPb2ORkCio*_Som;mQ$@71O<~ zWjS|oO>lHD02x|rfcKbkUST!JP!hvkW#LC`8@bayQK8L_a>|!+FBWHI8}$UcDI?Ur zr}p<%C_DL^NGXkaNFmE=3E#So6Ck*^z_z|!#?_2a={L^rg5}(HG_Ns zuh|BP;j-M>4Yt$0dCoX_yDlnywiY|PX-{;5AXgSfM#h->Bw&km_d-Jk&Fv~UihvwsSMa-FN{$_`ZM0kqjz{_eAEDp{i&o3|fY z!8x;H1-3AxUpy|&3DTd*jjc0-ZQT&hN1FPV!+<`yNhdj5+?a{6BwHF4ATWXL@W}^f zk}mhfyMW&1E=!2w;lS?$a0}%Yk*-4$-a$sJ>6DuN|AR9Q0tW_NyYy7{R(A_u#=gTCwxvuD*uQ#ycYTMhz28kM(io(j$6s6g-JVUL>}-c9reQD zUcuHu!?MWHGX24e^E1C|U?s$MVI82FxJQF;p5r0Zkx%(QVTnvu_H4HGjyV{XhG91b z!XRFPY?t2*#(ma1c#>aL$q{{{_-7Xv{-M#WyvT-On;n-~QPx(jJKWvZEKa8;RGXBZ zl<64>B2rULv4ldgt_#s2)o@b&*NrT#XBM18K1axi2MOdoDI17)B?V@a7_*|@w|S-M zXdrSI%dUs&px@w^+jy_j$8pq5j2nZ5J#`KC{J~VuNxYoLb}O}M*;WpHR9QZaf|OU_{6cQZLR9H@CJM~%G#Cm0;QZe_ORHapYBO!-z~9Vib6Ls zil{R;pEbY2{kOWmavgxsbm|GcB7;8IaV>W_Rqa*AF#_l$@M+8qtm;k}rpkt#tJuAZ zvUPe*)M0GzE|~LkeR8GAXnBqFJXYP(`gs^0pCr{hi^(**NAPbui5f$NER0#V9 z^klkO#X}q=7m>GIS~7uil0U_b?0~D6_%j{b9p$$3nljSp#QsMFL>d8{gzBkpUb(#{ z-<$j}U+g}E;B3LsUfnCQ@iFv76l%#x)NnCfB|qD-_-zJ_>Ctua5Kg$;BxGjzxS_%% zAtY=A{5J;vxdaZGgV8GKbujKTo*1RhotvG1*O=1JWmbRq-igr}a2kmi`boW*;L1yR z2|ieH@@4!|pz7}*?BgTmjJ$SJ3K&5)8a#^Rlu8|de?A4av77Ssb~UVHUWLFM2hp5p z6c~Sf3a+PY?&nwnGpEn^PT~z2D;B^_l?vi%ALI0n66q*}iOOKS&}{jdAS8d-pJWWy zP!C?KtJ-~g8|b-wpZ_veba*J4l4ZAhVeA#W>8#Y@-C2Zl$j)U9a@iE_x(AXYeek%y zqLX|FO_5znkKI%Fvme?ltjdO|;%8`+&Zdyg1b>;KL707S#o``v_v6Y@(!uUkA~ajR zoKReVPQYO9x?X(FPEN$E$VBD0G$8wmrujVpl5yBJYGwA2a&mFroT801oHY+#goizX zsz<#9A+cuTsJ;{*_U2|7)}466<|db$f|TpR1LI1ADpw>y^1`$GgtO^lXgz8p`U1SQ znx14;{Uq5tj5p(~iy#ej8xtNexFvX*a-*nN0#h!o`fb9lQ96$8p#PxSXfRlO?s*e^ z`21=YD;l+#qM@?p;#Bd+08dir>fbAe6gTJuVIc*Q&ANDx?*Yf2p?`|4#<9Lr?)h*% z1;C(6ykF=^N@uTVA`x7CW5QGVbTzb*i@-guHvAp!FLH`idKma)>`qXG=5+Lw z17<9&X&}yoyeP+67&esvFE$jim(orVO~E@c;CefuF19ci$ac_X9x?PNCEcGHm}TKO z)cGw6G`P6qmJFG5o#WK+Nurs{iT`78a#H@HuD&si(F!?_xp<%lsy4=#siHt@)DE#6 z*CzkOcZ&38{*#_3;PN9^bn`;685FjXVnD@7Ntl6fc%|rEO5m(bX^~{+U)i#lJDW5( zmJFxgHe4nv?&>c@5CU+U%1gP>8tvEqlsrM%Jt33?oo)1hl!BoMac~`z=tHP(GESRU zyAjdiqw-lV+*o7crjOuWi z=IpQ`5t+2@NA7Dj@qRLKn-89W>q2vJ07)M>Pmrk5#xj7qe@exM=6#OhN2 zwIe`;dr8w#$#+ylRFr3Nz3X6&{VYavNRU`W%R!tM>4+E8c(HhD!EaT)bid;04J+XVb{cNvqR`^IrbPiWD2YwUXAI`TgRQP`b6)iwHe58v z&!{{Hoc~xV+ARGXDz+G`0BC4R56^!0H^-GugjmCZj^mis4i~p78bi~` zU<%zW?`cgcrDTLwpX`v@U_5q=LLX&wRo_AU>6AsacooOr zbnZeM6hZ52TY@=)5VmrfM=j?bI#n0E1%hV3uS`3rzPSb*2qA~P4-7`ucGBhNr8fjxUgSU$Gvj6_;L`h6>t}TgbRu5RPa4>a~ZMmxXlRubI}3Zkz8KiW^fN zD>Jz&#}R2-x@*aFgpE$FG#YKsE}c5fAPIwa6W#q)a$rJvWW|4;T31_4lQCL8xFC+= zDyA@5W|6#avGK_4e3+FoYkhS&JLpXIPduEx&4w=wiX+ue}UP6Y>rxWvBE`t8iNskQJEGC=bw?B-o(n zai%!)di9=Kb1Lg4+y`NiiPANX!^EIha+^E4hGQ1`Tic68WyHO*j~a*;PFKh_a^D?L za!jKxcqj=2NJn23g52$%xkl~_qTLs{+Bq1FV08!J6Pw9VdrbL_N>e=CuS{V9(fJSHePo#553)JkeHs27qTEHkwzFTGa@9xY>6i931Vs zTi4I#^yFL^AT^=d3lnl~mz437De6kR9v6_G02qS%7a(=*78w0hKy)fFkYZ3HRF`dDA}{`jg^`{Cvc2Gn)m$H7<5 z;3^Hyss=;w$8~ZK{EL~{Odl*8ZwC;iMZ7c)QjJ#{#5Y7c9?{jL zm>f?cwd}+VWb9LCM?+6oi2u~GEVZn5gIO>}GRAU<498mEsqpS|ZIXY;yVES6p}Uq@ z0juN9XQfK?ABnx>GWBhZmp%3uw}OlFQVXi_vi^%Q?F8*!l8@d0Xgmv#$Zz%u6Uf2b z!)LA1&-AcQTvYP%ZTBXjO@O*G*N#zsrqH3L@p?xfWO2SlW)WuSks9BZQGOOA`BbEH zD`cvvweT0xv|V@-Os-K{L(Z5g_`js9qNdOUd7nFa5xaHJ-Zx(zkHEo;vDWvr8J}Kt z(l@&atY%4SyMt0I27{5rX7)G+X;IOq<@AfXl>#qsj3oU|*$ znFqquH#9g4*j<$o18*p#h3vp{CIeqQPUr)f6eg9=u8xAq@%q}bjJ`Wm`?aVw$h@I+ zz`tk35rJ)bo)B#~RC(!~5CA%pZk~QM7ea$=^r@90h0JG)6=J_4iv$L=Ule`E2d0Bc zx@E1bJg-aHyV(vI5b);Jy9@jePusJqzS%sXVl0O*cXmdE46Z=pBi-Eyr=K+Lr4+gE zUr`h(&nnakLQ9{Thez#JfL_=#(HVUYS%fbBT7V%_aaX#-xqjnyU~gcHAi{^Ps*Qbc z1tjPbvF;9S;9=^Vlty&o;sh~BYhrTYIGZpA@o{PA^71r$wa5Uo?B|JE}7 zbw0kijS#VRj=9uE#b=h^<+qZFSK;#1Kl5??Sc)?}WG$s6Wvm8rYetMA9fUUmcyzzu z#SaqLaM#qK)4~p+^qAxlGl}DM`wVaCPq47M16qfi3;sNTCJY> zT6D5Thrfxz9LQc;lG!i63#eM!1iPC)Km&qSgCi3Wjv-+q}7zkm7CX!d&2h`|y> z%`}S$J7R}_Vc#%b4EZcdiW%}l2ra=qJ|MM#^HXw^CLlsJ@4;&;l?u7Ft;SoD%>*AB zOr2o#H=Og0S09*wfgQuYq&_wzhLaIDf(7ayof1HZeCgxamJ}9)7Q&RQ&mrTMB(b7w zu3`Qng|o67ym>Q~Rsyh$HiI{?+{{F2gm>Z*t_)cxxr{~2386Z-TX;)LQAl)w^nIxI zG~rO=16qir{7g^ScIM4?Y9pU@JY;&hpzmj1syy}EZ#@ZS-|exJ*wVdr$(X+`Qc&}K zcM$h!%cRW4Z{^m0+f>;4_l39L#JFp)Ph_+lu?R*SLg{_@@X;U&l_awSW0DuG&(xP% zFBI1W8{Tf)g)FOqjh;n%`t#)(w1uotQe={97bULv7RN^Wvy5cF*FuMLs zT?dQgsJPpe4X~i)8ndi8;Lw{&KW<#g%TSBbM1O0yR(Ix1w<6T(u%Jb2z^i1&3g7T`G-R>Ouh9IjEngHuy2cHkDGidetYyh?aEMP9AaBZF zso<){Q7O}OE`#YTLqXO20f$bVJuHT}kq>a7G74MGTruxBSPMt95iq!Kj4>>`5rx(k z5#C7QUK5tjN>QYlky^jbpW+PlP0r+UUSncTcnx{dFF$Lx_C8xsmMg``+fVld2jA}N zw>uNzOhKzdRuLmQv@f;}$|N;hxkw}DIGLZk{=ERPI86Abgeawg&EU_uk7B7Dzw>a; zIve+pkI@NO5)*M+Hjj+JxjIU@BB!7B{7y9S!NMY4;a^*!5|&c6pWg3W*(C=Na{AJR zZMM~dN6YR1qt8IxUo<#Jub}$Zcws$dJBQq+-mm{0IEeOyS^<~SMdjC7keJp|=b%I1 zsr?TEumzU)ECE7A?pdGpi8qwI?L#I%e;)j+p}=ZLTBe$$|4gY!FP|B$*^G^XxMfu# zxnF2Ey$T{I;`r-hz7c-@cq!5(E=&}^Y4N$*Vb&Z#uCQ6qR3}=ZTu!sKdS`)oja4gDoPx97-yOzNpXQNZ$`VV?Q-mAlqS4zPpcKom z<|IA`q@{ewXG$Nr%W1Lwg!0BlxqrcEDN>o_KH?44q%gRVl?Gb89Eq)>F=ha?JGhV8 z?VKF&x6@9msE=NBSv7=3kSy>rP#y54d#RJ%YBSYXLlQ){)3Gmfl>8v(pSYL)6>aum z4~gBhl|Y#cD4|T*OfKzaex3%M+Y!WmIE}bBQ$IiYKJMsbF{#Y{#T;3WCtL{oD{-8Y zl-=bmA>;cF`z=or!F&T=c8TbJq_3wRFOwCCPibY|Ii5#go+zM+$glxnZjRWxj(3y7 zHs2gB#PjmVe|G`rDYR0;oALumO?Q`Fys+m{8b%xEbz0+v*(wA zO0I|&OYo5#Xy*frc*o2_rzv%!le zuE)W>@1?4rl+S!;)hL}KDY$kHUI#VM68D{$#~xDmX?;ITqx**WlTE)x_TVwNwKJ77 z+`4Zg-`mxy@V-ih@CCUl*?NkWdy18CE6}az>cF9OBko%-mCrgYY%*WSI`n|~oH&+s z-LT%Psqt22K?e()jqCo*Lps-R-_LcjBmY>8;xb$z^$#}%*d+ha7{E1^=B5?(C33Q7 zYy%vHxY9f_Qtkaza$?NpT$Gka(Xh#cCpoqWzD#l8#-v*eUm5fIZu~!|-L=%yD# zCaI_SJxIEIW-4N5w}G*5@{f*uSHEPv#;PXE{09$|)mZ`gO_sI`LC62_&x|Q5ynM*V z5l`(dVI0M^VMFgB?RbLyqCJSHQuuSLzB(tIhvxX2A7m*;H7*y-g_9|Z(H&LU~9U~4Kx_gueRn+ojf=J&Ny+W@s5e7L^fJd_tB@_1<4lw~gZ` z5W*#bYo7%(52e;Z{o+xr&KPDZ>vk_bTfSr;kr#GY_BLxuT=t#RbbhA#>!TO(ZN;Jl z)M8!nbNA>cfBFjR9VicUvc}p!<`Qs>gK@5Gc^6KtHp#2`b7-pkubAWPugu=Og~eK` zGqWrV(5Isi+zu52J#nFjLxoF#w{+j0) zb@HvKP%pWnwK>{`V#T^kBRD!+-Don^mj*NHg%&Yluu_U~>XYQ<1!C>rWA_VqAy4mwY;50egxy&3l^(?-&ahJh&*G@H9&ClH+rj-x7lAIa1Ro#H<2dV3xwdFU|X8C=pq#wHNJHD& zaItdRiVJOoj)a$!-FY@f2vKK9c%%@xV07$(N`Q{%rN)2m5dPjo1bLUzjxRs~F06deNkM*rct0_F1K zUNcV05)ouLGUDUtlGtaDO7nHW`Q2UjJNz;2OujC3%&6>9o}=q=qs8`od5g7_xx~Ak zDEY$8w9{6xt;bAnte#A+n8@epWftppy7;l6X^oFF|F9xIb$Y^cDhKi80){Mq=ISea zowvdd?*&*+1|zVbtAnUsvyAhq@QUEnSbGKK2RxD#Ot^-CYFw zvjQUR$IU~YVdvT1#M8{wQ4*GEa`ZoAe=Rj!gr8<@`)A)cuE(7kK9afT+>*rGx;ofb zYVSViwY}qKkQNzj`teHj!|OjP6Yndu)*Vm+@eJ{l*@?7(Lb-l1z`^YwOE5ZYIcD?YQY;KRDprl!_h-{)dtF0#!Vf@8lyhhE{hs7TAtS~`L>e4X-9Io+b$MtrMRPrQ zX5FC`jbzwb7EU87@iJU#UQ5f%Xdz&4!0c~rseYGq_Lu7N(CcXYIja79{>cKo8sK1y zaEC+q3?iPPeo8m5u1m(4VgDw6H7=0X@BTf)W|bo5B>~y46s0w3PO@EFpu(kL!;~1X z1uhbK3s_X<-##)$Mx}bz(>xO}C_cmNvyHPaM8W(-*A`jmgT}1}h}YBka)mC<>&_|M z!eY4f!g1HrYfOZTmHOhlnJ1yawDkG>&I>m3%o%*ZLhaW^fz$dqiIm(gFK7=c!gUg)A)!*gqar{1Z*q3M4d}~7xJZ+T$jE`wyuwFAB*p{)v#8< z)GT&_k!hnX%X1ly0c=?W0*+EvZWY^FQA!4Nsj}f*f|2tJ@Y4wQ;o-fCsJ(|zU4rpf zCOUN%V>$uyw$xfxh8E2_%i>pKJ?B;I z|40}B4Hhs*b}|>HBe44U9kgR|0`{$JTs@4{T=yTuqXO)cHDo;w4}8o>2Bv73VWtaLiL zsh<3{S$9^|6ZHMGOj)_#%VyCv*`lHSUq6C*FO0|`8q`ne(Zcd!gkb>x9T$KP@~}(@ zi)uB_fAUkt7&US&iWnm&pY;xVF-az`Ful3#Ytyl$e!_)$5+9lViT8$9@nu5OXMQZE zg1=h&Z_1tY6|aih+`d*7h-NFvGi4QWNeR&t@&ew1{h#Hh89%Z{m*7r*&7s==rmkUB zq^!a}R(v7VRKjY_Q>B-7D!TbJvZ-iE1 zFY(WCq8te?$^U;R`vi+Rf&M+4GU%O3*KEDA9{T<{Ck1t%nUqA;6TN{cg6z{+mv<5= zZr7*J)fH;i^BN7bhqVe5wsY1k3wOuvhdwVO-hhW_LAB8Tn-eM0OZ|#@;XkI5Q<8-% zmDzvdboW8STyLz#Eax=Hg|Yh!XrVM*5&sX*=5&Yv From bbe9774725b2742e18dace6404546b779dab5d85 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Mon, 24 Oct 2016 14:33:36 -0700 Subject: [PATCH 21/57] Changed phrase to Azure Information Protection - the new name --- .../manage-windows-10-in-your-organization-modern-management.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/manage-windows-10-in-your-organization-modern-management.md b/windows/manage/manage-windows-10-in-your-organization-modern-management.md index 97f4cc4e6f..41087f3334 100644 --- a/windows/manage/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/manage/manage-windows-10-in-your-organization-modern-management.md @@ -34,7 +34,7 @@ Windows 10 offers a range of management options, as shown in the following diagr The path to modern IT -As indicated in the diagram, Microsoft continues to provide support for deep manageability and security through technologies like Group Policy, Active Directory, and System Center Configuration Manager. It also delivers a “mobile-first, cloud-first” approach of simplified, modern management using cloud-based device management solutions such as Microsoft Enterprise Mobility + Security (EMS). Future Windows innovations, delivered through Windows as a Service, are complemented by cloud services like Microsoft Intune, Azure Active Directory, Azure Rights Management Service, Office 365, and the Windows Store for Business. +As indicated in the diagram, Microsoft continues to provide support for deep manageability and security through technologies like Group Policy, Active Directory, and System Center Configuration Manager. It also delivers a “mobile-first, cloud-first” approach of simplified, modern management using cloud-based device management solutions such as Microsoft Enterprise Mobility + Security (EMS). Future Windows innovations, delivered through Windows as a Service, are complemented by cloud services like Microsoft Intune, Azure Active Directory, Azure Information Protection, Office 365, and the Windows Store for Business. ## Deployment and Provisioning From 0ff197718350c029f0af12a4126d032743903ab4 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 25 Oct 2016 07:26:01 -0700 Subject: [PATCH 22/57] sync --- devices/surface/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/index.md b/devices/surface/index.md index 4843bb6970..db693a3776 100644 --- a/devices/surface/index.md +++ b/devices/surface/index.md @@ -13,7 +13,7 @@ author: heatherpoulsen # Surface -This library provides guidance to help you deploy Windows on Surface devices, keep those devices up to date, and easily manage and support Surface devices in your organization. +This library provides guidance to help you deploy Windows on Microsoft Surface devices, keep those devices up to date, and easily manage and support Surface devices in your organization. For more information on planning for, deploying, and managing Surface devices in your organization, see the [Surface TechCenter](https://technet.microsoft.com/en-us/windows/surface). From 822e8f51ad2439401e4321acc7d5fb5f25384346 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 25 Oct 2016 08:10:21 -0700 Subject: [PATCH 23/57] Fixed broken formatting --- windows/keep-secure/create-wip-policy-using-sccm.md | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/windows/keep-secure/create-wip-policy-using-sccm.md b/windows/keep-secure/create-wip-policy-using-sccm.md index df5fe1770c..3adc3cf0ae 100644 --- a/windows/keep-secure/create-wip-policy-using-sccm.md +++ b/windows/keep-secure/create-wip-policy-using-sccm.md @@ -382,7 +382,7 @@ There are no default locations included with WIP, you must add each of your netw 2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table. ![Add or edit corporate network definition box, Add your enterprise network locations](images/wip-sccm-add-network-domain.png) - + @@ -401,13 +401,8 @@ There are no default locations included with WIP, you must add each of your netw -<<<<<<< HEAD - - -======= ->>>>>>> refs/remotes/origin/master From 0eb189b5d475ad7c054ca383090570828376e5f1 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 25 Oct 2016 08:58:55 -0700 Subject: [PATCH 24/57] Updated text --- windows/keep-secure/create-wip-policy-using-sccm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/create-wip-policy-using-sccm.md b/windows/keep-secure/create-wip-policy-using-sccm.md index 3adc3cf0ae..3c1d17f2a1 100644 --- a/windows/keep-secure/create-wip-policy-using-sccm.md +++ b/windows/keep-secure/create-wip-policy-using-sccm.md @@ -438,7 +438,7 @@ There are no default locations included with WIP, you must add each of your netw - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. - - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate file icons in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explore views. + - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explore views of File Explorer. 5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. From e26f207a90f3a81652ce76a8cf8360dd6f17718b Mon Sep 17 00:00:00 2001 From: Justinha Date: Tue, 25 Oct 2016 10:33:48 -0700 Subject: [PATCH 25/57] added high pri loc --- .../manage-windows-10-in-your-organization-modern-management.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/manage-windows-10-in-your-organization-modern-management.md b/windows/manage/manage-windows-10-in-your-organization-modern-management.md index 41087f3334..a16db53590 100644 --- a/windows/manage/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/manage/manage-windows-10-in-your-organization-modern-management.md @@ -7,7 +7,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: devices author: jdeckerMS -localizationpriority: medium +localizationpriority: high --- # Manage Windows 10 in your organization - transitioning to modern management From f12ec3edac3f8cfad27c0de7afb58f2c531440e8 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 25 Oct 2016 11:01:00 -0700 Subject: [PATCH 26/57] Updated text --- windows/keep-secure/create-wip-policy-using-sccm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/create-wip-policy-using-sccm.md b/windows/keep-secure/create-wip-policy-using-sccm.md index 3c1d17f2a1..33644e7bec 100644 --- a/windows/keep-secure/create-wip-policy-using-sccm.md +++ b/windows/keep-secure/create-wip-policy-using-sccm.md @@ -430,7 +430,7 @@ There are no default locations included with WIP, you must add each of your netw The **Add or edit corporate network definition** box closes. -4. Decide if you want to Windows to look for additional network settings. +4. Decide if you want to Windows to look for additional network settings and if you want to show the WIP icon on your corporate files while in File Explorer. ![Create Configuration Item wizard, Add whether to search for additional network settings](images/wip-sccm-optsettings.png) From c7f58290d9b029e4b42a29a148ddf67571a829e3 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Tue, 25 Oct 2016 14:01:33 -0700 Subject: [PATCH 27/57] new Surface content --- devices/surface/change-history-for-surface.md | 1 + ...and-system-center-configuration-manager.md | 27 +++++++++++++++++++ devices/surface/index.md | 1 + 3 files changed, 29 insertions(+) create mode 100644 devices/surface/considerations-for-surface-and-system-center-configuration-manager.md diff --git a/devices/surface/change-history-for-surface.md b/devices/surface/change-history-for-surface.md index 6128cfbbfa..dd716e83f7 100644 --- a/devices/surface/change-history-for-surface.md +++ b/devices/surface/change-history-for-surface.md @@ -15,6 +15,7 @@ This topic lists new and updated topics in the Surface documentation library. | New or changed topic | Description | | --- | --- | +| [Considerations for Surface and System Center Configuration Manager](considerations-for-surface-and-system-center-configuration-manager.md) | New | | [Long-term servicing branch for Surface devices](ltsb-for-surface.md) | New | diff --git a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md new file mode 100644 index 0000000000..8abf3c840a --- /dev/null +++ b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md @@ -0,0 +1,27 @@ +--- +title: Considerations for Surface and System Center Configuration Manager (Surface) +description: +keywords: +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: surface, +ms.sitesec: library +author: miladCA +--- + +# Considerations for Surface and System Center Configuration Manager + +Fundamentally, management and deployment of Surface devices with System Center Configuration Manager is the same as the management and deployment of any other PC. Like any other PC, a deployment to Surface devices includes importing drivers, importing a Windows image, preparing a deployment task sequence, and then deploying the task sequence to a collection. After deployment, Surface devices are like any other Windows client – to publish apps, settings, and policies, you use the same process that you would use for any other device. + +You can find more information about how to use Configuration Manager to deploy and manage devices in the [Documentation for System Center Configuration Manager](https://docs.microsoft.com/sccm/index) article in the TechNet Library. + +Although the deployment and management of Surface devices is fundamentally the same as any other PC, there are some scenarios that may require additional considerations or steps. This article provides descriptions and guidance for these scenarios; the solutions documented in this article may apply to other devices and manufacturers as well. + +>[!NOTE] +>For management of Surface devices it is recommended that you use the Current Branch of System Center Configuration Manager. + +## Updating Surface device drivers and firmware + +For devices that receive updates through Windows Update, drivers for Surface components – and even firmware updates – are applied automatically as part of the Windows Update process. For devices with managed updates, such as those updated through Windows Server Update Services (WSUS), the option to install drivers and firmware through Windows Update is not available. For these managed devices, the recommended driver management process is the deployment of driver and firmware updates using the Windows Installer (.msi) files, which are provided through the Microsoft Download Center. You can find a list of these downloads at Download the latest firmware and drivers for Surface devices. + +As .msi files, deployment of driver and firmware updates is performed in the same manner as deployment of an application. Instead of installing an application as would normally happen when an .msi file is run, the Surface driver and firmware .msi will apply the driver and firmware updates to the device. The single .msi file contains the driver and firmware updates required by each component of the Surface device. The updates for firmware are applied the next time the device reboots. You can read more about the .msi installation method for Surface drivers and firmware in Manage Surface driver and firmware updates. For more information about how to deploy applications with Configuration Manager, see Packages and programs in System Center Configuration Manager. diff --git a/devices/surface/index.md b/devices/surface/index.md index db693a3776..3bd0c700bd 100644 --- a/devices/surface/index.md +++ b/devices/surface/index.md @@ -23,6 +23,7 @@ For more information on planning for, deploying, and managing Surface devices in | --- | --- | | [Deploy Surface devices](deploy.md) | Get deployment guidance for your Surface devices including information about MDT, OOBE customization, Ethernet adaptors, and Surface Deployment Accelerator. | | [Surface firmware and driver updates](update.md) | Find out how to download and manage the latest firmware and driver updates for your Surface device. | +| [Considerations for Surface and System Center Configuration Manager](considerations-for-surface-and-system-center-configuration-manager.md) | Get guidance on how to deploy and manage Surface devices with System Center Configuration Manager. | | [Deploy Surface app with Windows Store for Business](deploy-surface-app-with-windows-store-for-business.md) | Find out how to add and download Surface app with Windows Store for Business, as well as install Surface app with PowerShell and MDT. | | [Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices](enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md) | Find out how to enable support for PEAP, EAP-FAST, or Cisco LEAP protocols on your Surface device. | | [Manage Surface UEFI settings](manage-surface-uefi-settings.md) | Use Surface UEFI settings to enable or disable devices, configure security settings, and adjust Surface device boot settings. | From d325fc07187b818e5eca4d2282fce508ad2f66fe Mon Sep 17 00:00:00 2001 From: Tommy N Date: Tue, 25 Oct 2016 16:03:43 -0700 Subject: [PATCH 28/57] Update appv-release-notes-for-appv-for-windows.md --- .../manage/appv-release-notes-for-appv-for-windows.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/windows/manage/appv-release-notes-for-appv-for-windows.md b/windows/manage/appv-release-notes-for-appv-for-windows.md index a80d391a45..0982031249 100644 --- a/windows/manage/appv-release-notes-for-appv-for-windows.md +++ b/windows/manage/appv-release-notes-for-appv-for-windows.md @@ -30,17 +30,19 @@ MSI packages that were generated using an App-V sequencer from previous versions - For the standalone Windows 10 SDK without other tools, see [Standalone Windows 10 SDK](https://developer.microsoft.com/en-US/windows/downloads/windows-10-sdk). -3. From an elevated Windows PowerShell prompt, navigate to the following folder: +3. Copy msidb.exe from the default path of the Windows SDK installation (**C:\Program Files (x86)\Windows Kits\10**) to a different directory. For example: **C:\MyMsiTools\bin** + +4. From an elevated Windows PowerShell prompt, navigate to the following folder: <Windows Kits 10 installation folder>**\Microsoft Application Virtualization\Sequencer\** By default, this path will be:
**C:\Program Files (x86)\Windows Kits\10\Microsoft Application Virtualization\Sequencer** -4. Run the following command: +5. Run the following command: - `Update-AppvPackageMsi -MsiPackage "" -MsSdkPath ""` + `Update-AppvPackageMsi -MsiPackage "" -MsSdkPath ""` - By default, the path to the Windows SDK installation will be:
**C:\Program Files (x86)\Windows Kits\10** + where the path is to the new directory (**C:\MyMsiTools\ for this example**). ## Error occurs during publishing refresh between App-V 5.0 SP3 Management Server and App-V Client on Windows 10 From 5dcb971d015714847c35edc8bf97ca92bb3d00ee Mon Sep 17 00:00:00 2001 From: Gabe Stocco Date: Tue, 25 Oct 2016 16:08:10 -0700 Subject: [PATCH 29/57] Update for Integrated vs Firmware --- windows/keep-secure/tpm-recommendations.md | 80 +++++++++++----------- 1 file changed, 40 insertions(+), 40 deletions(-) diff --git a/windows/keep-secure/tpm-recommendations.md b/windows/keep-secure/tpm-recommendations.md index acf27319d7..20c1c827db 100644 --- a/windows/keep-secure/tpm-recommendations.md +++ b/windows/keep-secure/tpm-recommendations.md @@ -40,7 +40,8 @@ OEMs implement the TPM as a component in a trusted computing platform, such as a The TCG designed the TPM as a low-cost, mass-market security solution that addresses the requirements of different customer segments. There are variations in the security properties of different TPM implementations just as there are variations in customer and regulatory requirements for different sectors. In public-sector procurement, for example, some governments have clearly defined security requirements for TPMs whereas others do not. >**Note:**  Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -  + + ## TPM 1.2 vs. 2.0 comparison From an industry standard, Microsoft has been an industry leader in moving and standardizing on TPM 2.0, which has many key realized benefits across algorithms, crypto, hierarchy, root keys, authorization and NV RAM. @@ -59,32 +60,24 @@ TPM 2.0 products and systems have important security advantages over TPM 1.2, in - TPM 2.0 offers a more **consistent experience** across different implementations. - - TPM 1.2 implementations across both discrete and firmware vary in policy settings. This may result in support issues as lockout policies vary. - - TPM 2.0 standardized policy requirement helps establish a consistent lockout experience across devices, as such, Windows can offer a better user experience end to end. + - TPM 1.2 implementations vary in policy settings. This may result in support issues as lockout policies vary. + - TPM 2.0 lockout policy is configured by Windows, ensuring a consistent dictionary attack protection guarantee. -- While TPM 1.2 parts were discrete silicon components typically soldered on the motherboard, TPM 2.0 is available both as a **discrete (dTPM)** silicon component and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on the system’s main SoC: +- While TPM 1.2 parts are discrete silicon components which are typically soldered on the motherboard, TPM 2.0 is available as a **discrete (dTPM)** silicon component in a sinple semiconductor package, an **integrated** component incorporated in one or more semiconductor packages - alongside other logic units in the same package(s) - and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on a general purpose SoC. - - On Intel chips, it is the Intel Management Engine (ME) or Converged Security Engine (CSE). - - For AMD chips, it is the AMD Security Processor - - For ARM chips, it is a Trustzone Trusted Application (TA). - - In the case of firmware TPM for desktop Windows systems, the chip vendor provides the firmware TPM implementation along with the other chip firmware to OEMs. +## Discrete, Integrated or Firmware TPM? -## Discrete or firmware TPM? +There are three implementation options for TPMs: -Windows uses discrete and firmware TPM in the same way. Windows gains no functional advantage or disadvantage from either option. +- Discrete TPM chip as a separate component in its own semiconductor package +- Integrated TPM solution, using dedicated hardware integrated into one or more semiconductor packages alongside, but logically separate from, other components +- Firmware TPM solution, running the TPM in firmware in a Trusted Execution mode of a general purpose computation unit -From a security standpoint, discrete and firmware share the same characteristics; - -- Both use hardware based secure execution. -- Both use firmware for portions of the TPM functionality. -- Both are equipped with tamper resistance capabilities. -- Both have unique security limitations/risks. - -For more info, see [fTPM: A Firmware-based TPM 2.0 Implementation](http://research.microsoft.com/apps/pubs/?id=258236). +Windows uses any compatible TPM in the same way. Microsoft does not take a position on which way a TPM should be implemented and there is a wide ecosystem of available TPM solutions which should suit all needs. ## Is there any importance for TPM for consumer? -For end consumers, TPM is behind the scenes but still very relevant for Hello, Passport and in the future, many other key features in Windows 10. It offers the best Passport experience, helps encrypt passwords, and builds on our overall Windows 10 experience story for security as a critical pillar. Using Windows on a system with a TPM enables a deeper and broader level of security coverage. +For end consumers, TPM is behind the scenes but is still very relevant. TPM is used for Windows Hello, Windows Passport and in the future, will be a components of many other key security features in Windows. TPM secures the PIN for Passport, helps encrypt passwords, and builds on our overall Windows 10 experience story for security as a critical pillar. Using Windows on a system with a TPM enables a deeper and broader level of security coverage. ## TPM 2.0 Compliance for Windows 10 @@ -92,15 +85,6 @@ For end consumers, TPM is behind the scenes but still very relevant for Hello, P - As of July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7, https://msdn.microsoft.com/library/windows/hardware/dn915086(v=vs.85).aspx) -## Two implementation options: - -- Discrete TPM chip as a separate discrete component -- Firmware TPM solution using Intel PTT (platform trust technology) or AMD - -### Windows 10 Mobile - -- All devices shipping with Windows 10 Mobile must implement TPM 2.0 and ship with the TPM 2.0 enabled. - ### IoT Core - TPM is optional on IoT Core. @@ -226,7 +210,7 @@ The following table defines which Windows features require TPM support. Some fea
Network location type
Enterprise Proxy Serversproxy.contoso.com:80;proxy2.contoso.com:137Specify your externally-facing proxy server addresses, along with the port through which traffic accesses the Internet.

This list must not include any servers listed in the Enterprise Internal Proxy Servers list, because they’re used for WIP-protected traffic.

TThis setting is also required if there’s a chance you could end up behind a proxy server on another network. In this situation, if you don't have a proxy server pre-defined, you might find that enterprise resources are unavailable to your client device, such as when you’re visiting another company and not on the guest network. To make sure this doesn’t happen, the client device also needs to be able to reach the pre-defined proxy server through the VPN network.

If you have multiple resources, you must separate them using the ";" delimiter.

proxy.contoso.com:80;proxy2.contoso.com:443 Specify your externally-facing proxy server addresses, along with the port through which traffic is allowed and protected with WIP.

This list shouldn’t include any servers listed in the Enterprise Internal Proxy Servers list, which are used for WIP-protected traffic.

This setting is also required if you use a proxy in your network. If you don't have a proxy server, you might find that enterprise resources are unavailable when a client is behind a proxy, such as when you’re visiting another company and not on that company’s guest network.

If you have multiple resources, you must separate them using the ";" delimiter.

Enterprise Internal Proxy Servers
  ## Chipset options for TPM 2.0 -There are a variety of TPM manufacturers for both discrete and firmware. +There is a vibrant ecosystem of TPM manufacturers. ### Discrete TPM @@ -250,6 +234,33 @@ There are a variety of TPM manufacturers for both discrete and firmware.
  +### Integrated TPM + +++ + + + + + + + + + + + + +
SupplierChipset
Intel
    +
  • Atom (CloverTrail) +
  • Baytrail
    • +
  • Braswell
    • +
  • 4th generation Core (Haswell)
    • +
  • 5th generation Core (Broadwell)
    • +
  • 6th generation Core (Skylake)
    • +
  • 7th generation Core (Kaby Lake)
    • +
+ ### Firmware TPM @@ -272,17 +283,6 @@ There are a variety of TPM manufacturers for both discrete and firmware. - - - -
Intel
    -
  • Atom (CloverTrail) -
  • Baytrail
    • -
  • 4th generation(Haswell)
    • -
  • 5th generation(Broadwell)
    • -
  • Braswell
    • -
  • Skylake
    • -
Qualcomm
  • MSM8994
    • From efac80e27e667e1ee341c6569a253ddaba46f06c Mon Sep 17 00:00:00 2001 From: coolriggs Date: Tue, 25 Oct 2016 16:28:46 -0700 Subject: [PATCH 30/57] Update tpm-recommendations.md --- windows/keep-secure/tpm-recommendations.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/tpm-recommendations.md b/windows/keep-secure/tpm-recommendations.md index 20c1c827db..277ad8c4ba 100644 --- a/windows/keep-secure/tpm-recommendations.md +++ b/windows/keep-secure/tpm-recommendations.md @@ -77,13 +77,13 @@ Windows uses any compatible TPM in the same way. Microsoft does not take a posi ## Is there any importance for TPM for consumer? -For end consumers, TPM is behind the scenes but is still very relevant. TPM is used for Windows Hello, Windows Passport and in the future, will be a components of many other key security features in Windows. TPM secures the PIN for Passport, helps encrypt passwords, and builds on our overall Windows 10 experience story for security as a critical pillar. Using Windows on a system with a TPM enables a deeper and broader level of security coverage. +For end consumers, TPM is behind the scenes but is still very relevant. TPM is used for Windows Hello, Windows Hello for Business and in the future, will be a components of many other key security features in Windows. TPM secures the PIN, helps encrypt passwords, and builds on our overall Windows 10 experience story for security as a critical pillar. Using Windows on a system with a TPM enables a deeper and broader level of security coverage. ## TPM 2.0 Compliance for Windows 10 ### Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) -- As of July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7, https://msdn.microsoft.com/library/windows/hardware/dn915086(v=vs.85).aspx) +- Since July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7, https://msdn.microsoft.com/library/windows/hardware/dn915086(v=vs.85).aspx) ### IoT Core From e64fc642ee59117f455cb8b29d3c85a52ce304f0 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Tue, 25 Oct 2016 16:50:11 -0700 Subject: [PATCH 31/57] add content --- ...and-system-center-configuration-manager.md | 59 +++++++++++++++++-- 1 file changed, 54 insertions(+), 5 deletions(-) diff --git a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md index 8abf3c840a..473665b594 100644 --- a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md +++ b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md @@ -1,10 +1,10 @@ --- title: Considerations for Surface and System Center Configuration Manager (Surface) -description: -keywords: +description: The management and deployment of Surface devices with Configuration Manager is fundamentally the same as any other PC; this article describes scenarios that may require additional considerations. +keywords: manage, deployment, updates, driver, firmware ms.prod: w10 ms.mktglfcycl: deploy -ms.pagetype: surface, +ms.pagetype: surface, devices ms.sitesec: library author: miladCA --- @@ -22,6 +22,55 @@ Although the deployment and management of Surface devices is fundamentally the s ## Updating Surface device drivers and firmware -For devices that receive updates through Windows Update, drivers for Surface components – and even firmware updates – are applied automatically as part of the Windows Update process. For devices with managed updates, such as those updated through Windows Server Update Services (WSUS), the option to install drivers and firmware through Windows Update is not available. For these managed devices, the recommended driver management process is the deployment of driver and firmware updates using the Windows Installer (.msi) files, which are provided through the Microsoft Download Center. You can find a list of these downloads at Download the latest firmware and drivers for Surface devices. +For devices that receive updates through Windows Update, drivers for Surface components – and even firmware updates – are applied automatically as part of the Windows Update process. For devices with managed updates, such as those updated through Windows Server Update Services (WSUS), the option to install drivers and firmware through Windows Update is not available. For these managed devices, the recommended driver management process is the deployment of driver and firmware updates using the Windows Installer (.msi) files, which are provided through the Microsoft Download Center. You can find a list of these downloads at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/en-us/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). -As .msi files, deployment of driver and firmware updates is performed in the same manner as deployment of an application. Instead of installing an application as would normally happen when an .msi file is run, the Surface driver and firmware .msi will apply the driver and firmware updates to the device. The single .msi file contains the driver and firmware updates required by each component of the Surface device. The updates for firmware are applied the next time the device reboots. You can read more about the .msi installation method for Surface drivers and firmware in Manage Surface driver and firmware updates. For more information about how to deploy applications with Configuration Manager, see Packages and programs in System Center Configuration Manager. +As .msi files, deployment of driver and firmware updates is performed in the same manner as deployment of an application. Instead of installing an application as would normally happen when an .msi file is run, the Surface driver and firmware .msi will apply the driver and firmware updates to the device. The single .msi file contains the driver and firmware updates required by each component of the Surface device. The updates for firmware are applied the next time the device reboots. You can read more about the .msi installation method for Surface drivers and firmware in [Manage Surface driver and firmware updates](https://technet.microsoft.com/en-us/itpro/surface/manage-surface-pro-3-firmware-updates). For more information about how to deploy applications with Configuration Manager, see [Packages and programs in System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/apps/deploy-use/packages-and-programs). + +>[!NOTE] +>Surface device drivers and firmware are signed with SHA-256, which is not natively supported by Windows Server 2008 R2. A workaround is available for Configuration Manager environments running on Windows Server 2008 R2 – for more information see [Can't import drivers into System Center Configuration Manager (KB3025419)](https://support.microsoft.com/en-us/kb/3025419). + +## Surface Ethernet adapters and Configuration Manager deployment + +The default mechanism that Configuration Manager uses to identify devices during deployment is the Media Access Control (MAC) address. Because the MAC address is associated with the Ethernet controller, an Ethernet adapter shared among multiple devices will cause Configuration Manager to identify each of the devices as only a single device. This can cause a Configuration Manager deployment of Windows to not be applied to intended devices. + +To ensure that Surface devices using the same Ethernet adapter are identified as unique devices during deployment, you can instruct Configuration Manager to identify devices using another method. This other method could be the MAC address of the wireless network adapter or the System Universal Unique Identifier (System UUID). You can specify that Configuration Manager use other identification methods with the following options: + +* Add an exclusion for the MAC addresses of Surface Ethernet adapters, which forces Configuration Manager to overlook the MAC address in preference of the System UUID, as documented in the [Reusing the same NIC for multiple PXE initiated deployments in System Center Configuration Manager OSD](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd/) blog post. + +* Prestage devices by System UUID as documented in the [Reusing the same NIC for multiple PXE initiated deployments in System Center Configuration Manger OSD](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd/) blog post. + +* Use a script to identify a newly deployed Surface device by the MAC address of its wireless adapter, as documented in the [How to Use The Same External Ethernet Adapter For Multiple SCCM OSD](https://blogs.technet.microsoft.com/askpfeplat/2014/07/27/how-to-use-the-same-external-ethernet-adapter-for-multiple-sccm-osd/) blog post from the Ask Premier Field Engineering (PFE) Platforms Blog. + +Another consideration for the Surface Ethernet adapter during deployments with Configuration Manager is the driver for the Ethernet controller. Beginning in Windows 10, version 1511, the driver for the Surface Ethernet adapter is included by default in Windows. For organizations that want to deploy the latest version of Windows 10 and use the latest version of WinPE, use of the Surface Ethernet adapter requires no additional actions. + +For versions of Windows prior to Windows 10, version 1511 (including Windows 10 RTM and Windows 8.1), you may still need to install the Surface Ethernet adapter driver and include the driver in your WinPE boot media. With its inclusion in Windows 10, the driver is no longer available for download from the Microsoft Download Center. To download the Surface Ethernet adapter driver, download it from the Microsoft Update Catalog as documented in the [Surface Ethernet Drivers](https://blogs.technet.microsoft.com/askcore/2016/08/18/surface-ethernet-drivers/) blog post from the Ask The Core Team blog. + +## Deploy Surface app with Configuration Manager + +With the release of Windows Store for Business, the Surface app is no longer available as a driver and firmware download. Organizations that want to deploy Surface app to managed Surface devices or during deployment with the use of Configuration Manager, must acquire Surface app through Windows Store for Business and then deploy Surface app with PowerShell. You can find the PowerShell commands for deployment of Surface app, instructions to download Surface app, and prerequisite frameworks from Windows Store for Business in the [Deploy Surface app with Windows Store for Business](https://technet.microsoft.com/en-us/itpro/surface/deploy-surface-app-with-windows-store-for-business) article in the TechNet Library. + +## Use prestaged media with Surface clients + +If your organization uses prestaged media to pre-load deployment resources on to machines prior to deployment with Configuration Manager, the nature of Surface devices as UEFI devices may require you to take additional steps. Specifically, a native UEFI environment requires that you create multiple partitions on the boot disk of the system. If you are following along with the [documentation for prestaged media](https://technet.microsoft.com/en-us/library/79465d90-4831-4872-96c2-2062d80f5583?f=255&MSPPError=-2147217396#BKMK_CreatePrestagedMedia), the instructions provide for only single partition boot disks and therefore will fail when applied to Surface devices. + +Instructions for applying prestaged media to UEFI devices, such as Surface devices, can be found in the [How to apply Task Sequence Prestaged Media on multi-partitioned disks for BIOS or UEFI PCs in System Center Configuration Manager](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2014/04/02/how-to-apply-task-sequence-prestaged-media-on-multi-partitioned-disks-for-bios-or-uefi-pcs-in-system-center-configuration-manager/) blog post. + +## Licensing conflicts with OEM Activation 3.0 + +Surface devices come preinstalled with a licensed copy of Windows. For example, Surface Pro 4 is preinstalled with Windows 10 Professional. The license key for this preinstalled copy of Windows is embedded in the firmware of the device with OEM Activation 3.0 (OA 3.0). When you run Windows installation media on a device with an OA 3.0 key, Windows setup automatically reads the license key and uses it to install and activate Windows. In most situations, this simplifies the reinstallation of Windows, because the user does not have to find or enter a license key. + +When you reimage a device by using Windows Enterprise, this embedded license key does not cause a conflict. This is because the installation media for Windows Enterprise is configured to install only an Enterprise edition of Windows and therefore is incompatible with the license key embedded in the system firmware. If a product key is not specified (such as when you intend to activate with Key Management Services (KMS) or Active Directory Based Activation), a Generic Volume License Key (GVLK) is used until Windows is activated by one of those technologies. + +However, issues can arise when organizations intend to use versions of Windows that are compatible with the firmware embedded key. For example, an organization that wants to install Windows 10 Professional on a Surface 3 device that originally shipped with Windows 10 Home edition may encounter difficulty when Windows setup automatically reads the Home edition key during installation and installs as Home edition rather than Professional. To avoid this conflict, you can use the Ei.cfg or Pid.txt file (see [Windows Setup Edition Configuration and Product ID Files](https://technet.microsoft.com/en-us/library/hh824952.aspx)) to explicitly instruct Windows setup to prompt for a product key, or you can enter a specific product key in the deployment task sequence. If you do not have a specific key, you can use the default product keys for Windows, which you can find in [Customize and Deploy a Windows 10 operating system](https://dpcenter.microsoft.com/en/Windows/Build/cp-Windows-10-build) on the Device Partner Center. + +## Apply an asset tag during deployment + +Surface Book, Surface Pro 4, Surface Pro 3, and Surface 3 devices all support the application of an asset tag in UEFI. This asset tag can be used to identify the device from UEFI even if the operating system fails, and it can also be queried from within the operating system. To read more about the Surface Asset Tag function, see the [Asset Tag Tool for Surface Pro 3](https://blogs.technet.microsoft.com/askcore/2014/10/20/asset-tag-tool-for-surface-pro-3/) blog post. + +To apply an asset tag using the [Surface Asset Tag CLI Utility](https://www.microsoft.com/en-us/download/details.aspx?id=44076) during a Configuration Manager deployment task sequence, use the script and instructions found in the [Set Surface Asset Tag During a Configuration Manager Task Sequence](https://blogs.technet.microsoft.com/jchalfant/set-surface-pro-3-asset-tag-during-a-configuration-manager-task-sequence/) blog post. + +## Configure push-button reset + +When you deploy Windows to a Surface device, the push-button reset functionality of Windows is configured by default to revert the system back to a state where the environment is not yet configured. When the reset function is used, the system discards any installed applications and settings. Although in some situations it can be beneficial to restore the system to a state without applications and settings, in a professional environment this effectively renders the system unusable to the end user. + +Push-button reset can be configured, however, to restore the system configuration to a state where it is ready for use by the end user. Follow the process outlined in [Deploy push-button reset features](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/manufacture/desktop/deploy-push-button-reset-features) to customize the push-button reset experience for your devices. From f9fd1556f2f6b0be4397efa953c974e22b7a68b7 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 26 Oct 2016 07:14:52 -0700 Subject: [PATCH 32/57] Updated icon overlay text for unenlightened, but allowed apps --- windows/keep-secure/create-wip-policy-using-intune.md | 6 +++--- windows/keep-secure/create-wip-policy-using-sccm.md | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index 697b91a142..e03655d531 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -457,11 +457,11 @@ After you've decided where your protected apps can access enterprise data on you - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. - - **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explore views. The options are: + - **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the **Save As** and File Explorer views. The options are: - - **Yes (recommended).** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explore views. + - **Yes (recommended).** Allows the Windows Information Protection icon overlay to appear on corporate files in the **Save As** and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with **Managed** text on the app name in the **Start** menu. - - **No, or not configured.** Stops the Windows Information Protection icon overlay from appearing on corporate files in the Save As and File Explore views. + - **No, or not configured.** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but allowed apps. 2. Click **Save Policy**. diff --git a/windows/keep-secure/create-wip-policy-using-sccm.md b/windows/keep-secure/create-wip-policy-using-sccm.md index 33644e7bec..523318c58c 100644 --- a/windows/keep-secure/create-wip-policy-using-sccm.md +++ b/windows/keep-secure/create-wip-policy-using-sccm.md @@ -438,7 +438,7 @@ There are no default locations included with WIP, you must add each of your netw - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. - - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explore views of File Explorer. + - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the **Save As** and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with **Managed** text on the app name in the **Start** menu. 5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. From eed1c8d7347a24934b208a672403e48514eee429 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 26 Oct 2016 07:18:48 -0700 Subject: [PATCH 33/57] Updated recommended setting and default --- windows/keep-secure/create-wip-policy-using-intune.md | 6 +++--- windows/keep-secure/create-wip-policy-using-sccm.md | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index e03655d531..80a3bee4f1 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -455,13 +455,13 @@ After you've decided where your protected apps can access enterprise data on you - **Yes.** Allows Windows Search to search and index encrypted corporate data and Store apps. - - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. + - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. - **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the **Save As** and File Explorer views. The options are: - - **Yes (recommended).** Allows the Windows Information Protection icon overlay to appear on corporate files in the **Save As** and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with **Managed** text on the app name in the **Start** menu. + - **Yes.** Allows the Windows Information Protection icon overlay to appear on corporate files in the **Save As** and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with **Managed** text on the app name in the **Start** menu. - - **No, or not configured.** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but allowed apps. + - **No, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but allowed apps. Not configured is the default option. 2. Click **Save Policy**. diff --git a/windows/keep-secure/create-wip-policy-using-sccm.md b/windows/keep-secure/create-wip-policy-using-sccm.md index 523318c58c..b99e39c818 100644 --- a/windows/keep-secure/create-wip-policy-using-sccm.md +++ b/windows/keep-secure/create-wip-policy-using-sccm.md @@ -434,11 +434,11 @@ There are no default locations included with WIP, you must add each of your netw ![Create Configuration Item wizard, Add whether to search for additional network settings](images/wip-sccm-optsettings.png) - - **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. + - **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. Not configured is the default option. - - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. + - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. Not configured is the default option. - - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the **Save As** and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with **Managed** text on the app name in the **Start** menu. + - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the **Save As** and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with **Managed** text on the app name in the **Start** menu. Not configured is the default option. 5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. From 9c8a5228d508f03841c578098ac9e85d2d34278b Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 26 Oct 2016 07:23:47 -0700 Subject: [PATCH 34/57] Added Microsoft Remote Desktop --- .../enlightened-microsoft-apps-and-wip.md | 27 ++++++++++--------- 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/windows/keep-secure/enlightened-microsoft-apps-and-wip.md b/windows/keep-secure/enlightened-microsoft-apps-and-wip.md index 9793cfc53f..f6b1ea7f6e 100644 --- a/windows/keep-secure/enlightened-microsoft-apps-and-wip.md +++ b/windows/keep-secure/enlightened-microsoft-apps-and-wip.md @@ -21,7 +21,7 @@ localizationpriority: high Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. ## Enlightened versus unenlightened apps -Apps can be enlightened (policy-aware) or unenlightened (policy-unaware). +Apps can be enlightened (also referred to as WIP-aware) or unenlightened (also referred to as WIP-unaware). - **Enlightened apps** can differentiate between corporate and personal data, correctly determining which to protect, based on your policies. @@ -34,27 +34,29 @@ Apps can be enlightened (policy-aware) or unenlightened (policy-unaware). ## List of enlightened Microsoft apps Microsoft has made a concerted effort to enlighten several of our more popular apps, including the following: -- Microsoft Edge +- Microsoft Edge -- Internet Explorer 11 +- Internet Explorer 11 -- Microsoft People +- Microsoft People -- Mobile Office apps, including Word, Excel, PowerPoint, OneNote, and Outlook Mail and Calendar +- Mobile Office apps, including Word, Excel, PowerPoint, OneNote, and Outlook Mail and Calendar -- Microsoft Photos +- Microsoft Photos -- Groove Music +- Groove Music -- Notepad +- Notepad -- Microsoft Paint +- Microsoft Paint -- Microsoft Movies & TV +- Microsoft Movies & TV -- Microsoft Messaging +- Microsoft Messaging + +- Microsoft Remote Desktop ## Adding enlightened Microsoft apps to the allowed apps list You can add any or all of the enlightened Microsoft apps to your allowed apps list. Included here is the **Publisher name**, **Product or File name**, and **App Type** info for both Microsoft Intune and System Center Configuration Manager. @@ -75,4 +77,5 @@ You can add any or all of the enlightened Microsoft apps to your allowed apps li |IE11 |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Binary Name:** iexplore.exe
    **App Type:** Desktop app | |Microsoft OneDrive |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Binary Name:** onedrive.exe
    **App Type:** Desktop app| |Notepad |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Binary Name:** notepad.exe
    **App Type:** Desktop app | -|Microsoft Paint |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Binary Name:** mspaint.exe
    **App Type:** Desktop app | \ No newline at end of file +|Microsoft Paint |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Binary Name:** mspaint.exe
    **App Type:** Desktop app | +|Microsoft Remote Desktop |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
    **Binary Name:** mstsc.exe
    **App Type:** Desktop app | \ No newline at end of file From 257cfc4cce1ae386b4480d65fef75cc705daf6a6 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 26 Oct 2016 07:39:55 -0700 Subject: [PATCH 35/57] Fixed text --- windows/keep-secure/create-wip-policy-using-intune.md | 2 +- windows/keep-secure/create-wip-policy-using-sccm.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index 80a3bee4f1..bd7e5c648e 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -459,7 +459,7 @@ After you've decided where your protected apps can access enterprise data on you - **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the **Save As** and File Explorer views. The options are: - - **Yes.** Allows the Windows Information Protection icon overlay to appear on corporate files in the **Save As** and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with **Managed** text on the app name in the **Start** menu. + - **Yes.** Allows the Windows Information Protection icon overlay to appear on corporate files in the **Save As** and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. - **No, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but allowed apps. Not configured is the default option. diff --git a/windows/keep-secure/create-wip-policy-using-sccm.md b/windows/keep-secure/create-wip-policy-using-sccm.md index b99e39c818..8318ca21c6 100644 --- a/windows/keep-secure/create-wip-policy-using-sccm.md +++ b/windows/keep-secure/create-wip-policy-using-sccm.md @@ -438,7 +438,7 @@ There are no default locations included with WIP, you must add each of your netw - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. Not configured is the default option. - - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the **Save As** and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with **Managed** text on the app name in the **Start** menu. Not configured is the default option. + - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the **Save As** and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. Not configured is the default option. 5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. From 050459925285597410c784bdf54bb77a030a66e7 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 26 Oct 2016 07:53:33 -0700 Subject: [PATCH 36/57] Fixed text --- windows/keep-secure/create-wip-policy-using-intune.md | 4 ++-- windows/keep-secure/create-wip-policy-using-sccm.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index bd7e5c648e..e3e8483484 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -457,9 +457,9 @@ After you've decided where your protected apps can access enterprise data on you - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. - - **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the **Save As** and File Explorer views. The options are: + - **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explorer views. The options are: - - **Yes.** Allows the Windows Information Protection icon overlay to appear on corporate files in the **Save As** and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. + - **Yes.** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. - **No, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but allowed apps. Not configured is the default option. diff --git a/windows/keep-secure/create-wip-policy-using-sccm.md b/windows/keep-secure/create-wip-policy-using-sccm.md index 8318ca21c6..031da1a038 100644 --- a/windows/keep-secure/create-wip-policy-using-sccm.md +++ b/windows/keep-secure/create-wip-policy-using-sccm.md @@ -438,7 +438,7 @@ There are no default locations included with WIP, you must add each of your netw - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. Not configured is the default option. - - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the **Save As** and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. Not configured is the default option. + - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. Not configured is the default option. 5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. From 3af426c58102dad5f2f8865b1ab08d72a213a7a1 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 26 Oct 2016 07:55:30 -0700 Subject: [PATCH 37/57] Updated with change to add Microsoft Remote Desktop info --- windows/keep-secure/change-history-for-keep-windows-10-secure.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 3e705828e0..ec6211f5b0 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -16,6 +16,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md | New or changed topic | Description | | --- | --- | +|[List of enlightened Microsoft apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) |Added Microsoft Remote Desktop information. | |[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) and [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Updated the text about the icon overlay option. This icon now only appears on corporate files in the Save As and File Explore views | |[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |Added content about using ActiveX controls.| |[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |New | From 5d530fb3adb0f018285bc4873d7d1fc34a37961c Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Wed, 26 Oct 2016 09:29:15 -0700 Subject: [PATCH 38/57] fixing links and formatting --- windows/manage/acquire-apps-windows-store-for-business.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/manage/acquire-apps-windows-store-for-business.md b/windows/manage/acquire-apps-windows-store-for-business.md index f9a6004ba5..156d071c04 100644 --- a/windows/manage/acquire-apps-windows-store-for-business.md +++ b/windows/manage/acquire-apps-windows-store-for-business.md @@ -33,7 +33,7 @@ There are a couple of things we need to know when you pay for apps. You can add You can add payment info on **Account information**. If you don’t have one saved with your account, you’ll be prompted to provide one when you buy an app. ## Acquire apps -To acquire an app +**To acquire an app** 1. Log in to http://businessstore.microsoft.com 2. Click Shop, or use Search to find an app. 3. Click the app you want to purchase. @@ -42,7 +42,7 @@ To acquire an app 6. If you don’t have a payment method saved in Account settings, Store for Business will prompt you for one. 7. Add your credit card or debit card info, and click **Next**. Your card info is saved as a payment option on **Account information**. -You’ll also need to have your business address saved on **Account information**. The address is used to generate tax rates. For more information on taxes for apps, see organization tax information. +You’ll also need to have your business address saved on **Account information**. The address is used to generate tax rates. For more information on taxes for apps, see [organization tax information](https://technet.microsoft.com/itpro/windows/manage/update-windows-store-for-business-account-settings#organization-tax-information). Store for Business adds the app to your inventory. From **Inventory**, you can: - Distribute the app: add to private store, or assign licenses From 4a15c27eb9cc519152b40d7031cf80772b57bb06 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 26 Oct 2016 10:08:53 -0700 Subject: [PATCH 39/57] fix author --- education/windows/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/index.md b/education/windows/index.md index 794b6706ac..98aaf94eef 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu -author: jdeckerMS +author: CelesteDG --- # Windows 10 for Education From f41de8e960b7e3cf40aa8e675893b18695ecc187 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Wed, 26 Oct 2016 16:33:28 -0700 Subject: [PATCH 40/57] add to TOC; minor edits --- devices/surface/TOC.md | 1 + ...for-surface-and-system-center-configuration-manager.md | 8 ++++---- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/devices/surface/TOC.md b/devices/surface/TOC.md index aa9fee3d31..562b31c553 100644 --- a/devices/surface/TOC.md +++ b/devices/surface/TOC.md @@ -13,6 +13,7 @@ ### [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md) ### [Manage Surface Dock firmware updates](manage-surface-dock-firmware-updates.md) ### [Surface Dock Updater](surface-dock-updater.md) +## [Considerations for Surface and System Center Configuration Manager](considerations-for-surface-and--system-configuration-manager.md) ## [Deploy Surface app with Windows Store for Business](deploy-surface-app-with-windows-store-for-business.md) ## [Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices](enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md) ## [Manage Surface UEFI settings](manage-surface-uefi-settings.md) diff --git a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md index 473665b594..0bcd0945db 100644 --- a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md +++ b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md @@ -37,9 +37,9 @@ To ensure that Surface devices using the same Ethernet adapter are identified as * Add an exclusion for the MAC addresses of Surface Ethernet adapters, which forces Configuration Manager to overlook the MAC address in preference of the System UUID, as documented in the [Reusing the same NIC for multiple PXE initiated deployments in System Center Configuration Manager OSD](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd/) blog post. -* Prestage devices by System UUID as documented in the [Reusing the same NIC for multiple PXE initiated deployments in System Center Configuration Manger OSD](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd/) blog post. +* Prestage devices by System UUID as documented in the [Reusing the same NIC for multiple PXE initiated deployments in System Center Configuration Manager OSD](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd/) blog post. -* Use a script to identify a newly deployed Surface device by the MAC address of its wireless adapter, as documented in the [How to Use The Same External Ethernet Adapter For Multiple SCCM OSD](https://blogs.technet.microsoft.com/askpfeplat/2014/07/27/how-to-use-the-same-external-ethernet-adapter-for-multiple-sccm-osd/) blog post from the Ask Premier Field Engineering (PFE) Platforms Blog. +* Use a script to identify a newly deployed Surface device by the MAC address of its wireless adapter, as documented in the [How to Use The Same External Ethernet Adapter For Multiple SCCM OSD](https://blogs.technet.microsoft.com/askpfeplat/2014/07/27/how-to-use-the-same-external-ethernet-adapter-for-multiple-sccm-osd/) blog post. Another consideration for the Surface Ethernet adapter during deployments with Configuration Manager is the driver for the Ethernet controller. Beginning in Windows 10, version 1511, the driver for the Surface Ethernet adapter is included by default in Windows. For organizations that want to deploy the latest version of Windows 10 and use the latest version of WinPE, use of the Surface Ethernet adapter requires no additional actions. @@ -47,7 +47,7 @@ For versions of Windows prior to Windows 10, version 1511 (including Windows 10 ## Deploy Surface app with Configuration Manager -With the release of Windows Store for Business, the Surface app is no longer available as a driver and firmware download. Organizations that want to deploy Surface app to managed Surface devices or during deployment with the use of Configuration Manager, must acquire Surface app through Windows Store for Business and then deploy Surface app with PowerShell. You can find the PowerShell commands for deployment of Surface app, instructions to download Surface app, and prerequisite frameworks from Windows Store for Business in the [Deploy Surface app with Windows Store for Business](https://technet.microsoft.com/en-us/itpro/surface/deploy-surface-app-with-windows-store-for-business) article in the TechNet Library. +With the release of Windows Store for Business, Surface app is no longer available as a driver and firmware download. Organizations that want to deploy Surface app to managed Surface devices or during deployment with the use of Configuration Manager, must acquire Surface app through Windows Store for Business and then deploy Surface app with PowerShell. You can find the PowerShell commands for deployment of Surface app, instructions to download Surface app, and prerequisite frameworks from Windows Store for Business in the [Deploy Surface app with Windows Store for Business](https://technet.microsoft.com/en-us/itpro/surface/deploy-surface-app-with-windows-store-for-business) article in the TechNet Library. ## Use prestaged media with Surface clients @@ -61,7 +61,7 @@ Surface devices come preinstalled with a licensed copy of Windows. For example, When you reimage a device by using Windows Enterprise, this embedded license key does not cause a conflict. This is because the installation media for Windows Enterprise is configured to install only an Enterprise edition of Windows and therefore is incompatible with the license key embedded in the system firmware. If a product key is not specified (such as when you intend to activate with Key Management Services (KMS) or Active Directory Based Activation), a Generic Volume License Key (GVLK) is used until Windows is activated by one of those technologies. -However, issues can arise when organizations intend to use versions of Windows that are compatible with the firmware embedded key. For example, an organization that wants to install Windows 10 Professional on a Surface 3 device that originally shipped with Windows 10 Home edition may encounter difficulty when Windows setup automatically reads the Home edition key during installation and installs as Home edition rather than Professional. To avoid this conflict, you can use the Ei.cfg or Pid.txt file (see [Windows Setup Edition Configuration and Product ID Files](https://technet.microsoft.com/en-us/library/hh824952.aspx)) to explicitly instruct Windows setup to prompt for a product key, or you can enter a specific product key in the deployment task sequence. If you do not have a specific key, you can use the default product keys for Windows, which you can find in [Customize and Deploy a Windows 10 operating system](https://dpcenter.microsoft.com/en/Windows/Build/cp-Windows-10-build) on the Device Partner Center. +However, issues may arise when organizations intend to use versions of Windows that are compatible with the firmware embedded key. For example, an organization that wants to install Windows 10 Professional on a Surface 3 device that originally shipped with Windows 10 Home edition may encounter difficulty when Windows setup automatically reads the Home edition key during installation and installs as Home edition rather than Professional. To avoid this conflict, you can use the Ei.cfg or Pid.txt file (see [Windows Setup Edition Configuration and Product ID Files](https://technet.microsoft.com/en-us/library/hh824952.aspx)) to explicitly instruct Windows setup to prompt for a product key, or you can enter a specific product key in the deployment task sequence. If you do not have a specific key, you can use the default product keys for Windows, which you can find in [Customize and deploy a Windows 10 operating system](https://dpcenter.microsoft.com/en/Windows/Build/cp-Windows-10-build) on the Device Partner Center. ## Apply an asset tag during deployment From 392229e3ea9d5709a38be1a0ca8efdade309b3de Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Wed, 26 Oct 2016 16:43:55 -0700 Subject: [PATCH 41/57] fix link --- devices/surface/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/TOC.md b/devices/surface/TOC.md index 562b31c553..46a9e77b22 100644 --- a/devices/surface/TOC.md +++ b/devices/surface/TOC.md @@ -13,7 +13,7 @@ ### [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md) ### [Manage Surface Dock firmware updates](manage-surface-dock-firmware-updates.md) ### [Surface Dock Updater](surface-dock-updater.md) -## [Considerations for Surface and System Center Configuration Manager](considerations-for-surface-and--system-configuration-manager.md) +## [Considerations for Surface and System Center Configuration Manager](considerations-for-surface-and-system-configuration-manager.md) ## [Deploy Surface app with Windows Store for Business](deploy-surface-app-with-windows-store-for-business.md) ## [Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices](enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md) ## [Manage Surface UEFI settings](manage-surface-uefi-settings.md) From f600720bea51d1b3938418502c3ea45a580db70c Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Wed, 26 Oct 2016 22:29:50 -0700 Subject: [PATCH 42/57] fix link again --- devices/surface/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/TOC.md b/devices/surface/TOC.md index 46a9e77b22..c2eea7a99c 100644 --- a/devices/surface/TOC.md +++ b/devices/surface/TOC.md @@ -13,7 +13,7 @@ ### [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md) ### [Manage Surface Dock firmware updates](manage-surface-dock-firmware-updates.md) ### [Surface Dock Updater](surface-dock-updater.md) -## [Considerations for Surface and System Center Configuration Manager](considerations-for-surface-and-system-configuration-manager.md) +## [Considerations for Surface and System Center Configuration Manager](considerations-for-surface-and-system-center-configuration-manager.md) ## [Deploy Surface app with Windows Store for Business](deploy-surface-app-with-windows-store-for-business.md) ## [Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices](enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md) ## [Manage Surface UEFI settings](manage-surface-uefi-settings.md) From 0dc0b4eca4d729f6c1dcd1ea3e6a7e7ed4ac93e2 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Wed, 26 Oct 2016 22:33:09 -0700 Subject: [PATCH 43/57] fix author --- ...tions-for-surface-and-system-center-configuration-manager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md index 0bcd0945db..447e377d2c 100644 --- a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md +++ b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.pagetype: surface, devices ms.sitesec: library -author: miladCA +author: Scottmca --- # Considerations for Surface and System Center Configuration Manager From 421cda7743fb22146697bb8de4b97686c89c009e Mon Sep 17 00:00:00 2001 From: Tommy N Date: Thu, 27 Oct 2016 11:04:24 -0700 Subject: [PATCH 44/57] Update uev-whats-new-in-uev-for-windows.md --- windows/manage/uev-whats-new-in-uev-for-windows.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/manage/uev-whats-new-in-uev-for-windows.md b/windows/manage/uev-whats-new-in-uev-for-windows.md index a360c496d8..927392a644 100644 --- a/windows/manage/uev-whats-new-in-uev-for-windows.md +++ b/windows/manage/uev-whats-new-in-uev-for-windows.md @@ -76,10 +76,12 @@ Additionally, to enable Windows 10 and UE-V to work together, configure these po While earlier versions of UE-V roamed taskbar settings between Windows 10 devices, UE-V for Windows 10, version 1607 does not synchronize taskbar settings between devices running Windows 10 and devices running previous versions of Windows. -In addition, UE-for Windows does not synchronize settings between the Microsoft Calculator in Windows 10 and the Microsoft Calculator in previous versions of Windows. +In addition, UE-V for Windows has removed support the Windows calculator application. The Windows modern apps settings (DontSyncWindows8AppSettings) group policy is enabled by default and therefore, modern apps will not roam unless this policy is changed to disabled. +Please note, UE-V will roam any AppX apps that use the WinRT settings roaming API, provided that they have been opted in to roam at the time of development by the developer so there is no definitive list. + ## Support Added for Roaming Network Printers Users can now print to their saved network printers from any network device, including their default network printer. From 10ed3b44a35679119bf6fe30157a4ace56450772 Mon Sep 17 00:00:00 2001 From: Tommy N Date: Thu, 27 Oct 2016 11:10:58 -0700 Subject: [PATCH 45/57] Update uev-whats-new-in-uev-for-windows.md --- windows/manage/uev-whats-new-in-uev-for-windows.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/uev-whats-new-in-uev-for-windows.md b/windows/manage/uev-whats-new-in-uev-for-windows.md index 927392a644..983297f22c 100644 --- a/windows/manage/uev-whats-new-in-uev-for-windows.md +++ b/windows/manage/uev-whats-new-in-uev-for-windows.md @@ -76,7 +76,7 @@ Additionally, to enable Windows 10 and UE-V to work together, configure these po While earlier versions of UE-V roamed taskbar settings between Windows 10 devices, UE-V for Windows 10, version 1607 does not synchronize taskbar settings between devices running Windows 10 and devices running previous versions of Windows. -In addition, UE-V for Windows has removed support the Windows calculator application. +In addition, UE-V for Windows has removed support for the Windows calculator application. The Windows modern apps settings (DontSyncWindows8AppSettings) group policy is enabled by default and therefore, modern apps will not roam unless this policy is changed to disabled. From be6cb8dc8f4f372cec5297bb7d87fb144d52236d Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 27 Oct 2016 12:56:20 -0700 Subject: [PATCH 46/57] correction --- windows/manage/waas-servicing-strategy-windows-10-updates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/waas-servicing-strategy-windows-10-updates.md b/windows/manage/waas-servicing-strategy-windows-10-updates.md index 3d0c53d0b5..4df9cd708b 100644 --- a/windows/manage/waas-servicing-strategy-windows-10-updates.md +++ b/windows/manage/waas-servicing-strategy-windows-10-updates.md @@ -36,7 +36,7 @@ Windows 10 spreads the traditional deployment effort of a Windows upgrade, which Each time Microsoft releases a Windows 10 feature update, the IT department should use the following high-level process to help ensure that the broad deployment is successful: 1. **Validate compatibility of business critical apps.** Test your most important business-critical applications for compatibility with the new Windows 10 feature update running on your Windows Insider machines identified in the earlier “Configure test machines” step of the Predeployment strategy section. The list of applications involved in this validation process should be small because most applications can be tested during the pilot phase. For more information about device and application compatibility in Windows 10, see the section Compatibility. -2. **Pilot and react to feedback.** With Windows 10, Microsoft expects application and device compatibility to be high, but it’s still important to have pilot groups within both the IT department and business units to verify application compatibility for the remaining applications in your application portfolio. Because only the most business-critical applications are tested beforehand, this will represent the majority of application compatibility testing in your environment. This should not necessarily be a formal process but rather user validation through the use of a particular application. So, the next step is to deploy the feature update to early-adopting IT users and your pilot groups running in the CB servicing branch that you identified in the “Recruit volunteers” step of the Predeployment strategy section. Be sure to communicate clearly that you’re looking for feedback as soon as possible, and state exactly how users can submit feedback to you. Should an issue arise, have a remediation plan in place to address it. For an example of what a remediation plan for an application compatibility issue arising from a Windows 10 feature update might look like, see the . +2. **Pilot and react to feedback.** With Windows 10, Microsoft expects application and device compatibility to be high, but it’s still important to have pilot groups within both the IT department and business units to verify application compatibility for the remaining applications in your application portfolio. Because only the most business-critical applications are tested beforehand, this will represent the majority of application compatibility testing in your environment. This should not necessarily be a formal process but rather user validation through the use of a particular application. So, the next step is to deploy the feature update to early-adopting IT users and your pilot groups running in the CB servicing branch that you identified in the “Recruit volunteers” step of the Predeployment strategy section. Be sure to communicate clearly that you’re looking for feedback as soon as possible, and state exactly how users can submit feedback to you. Should an issue arise, have a remediation plan in place to address it. 3. **Deploy broadly.** Finally, focus on the large-scale deployment using deployment rings, like the ones discussed in Table 1. Build deployment rings that target groups of computers in your selected update-management product. To reduce risk as much as possible, construct your deployment rings in a way that splits individual departments into multiple rings. This way, if you were to encounter an issue, you don’t prevent any critical business from continuing. By using this method, each deployment ring reduces risk as more and more people have been updated in any particular department. From a554c0eb6e3e66b7059113cca6fb5c2dde98c821 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 27 Oct 2016 13:43:07 -0700 Subject: [PATCH 47/57] enabling PDF build output --- .openpublishing.publish.config.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index e06f28392e..d34abc564c 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -1,6 +1,6 @@ { "build_entry_point": "", - "need_generate_pdf": false, + "need_generate_pdf": true, "need_generate_intellisense": false, "docsets_to_publish": [ { From 39abfb24d5bffad2fecb7f17a610ecf83649d008 Mon Sep 17 00:00:00 2001 From: Lars Iwer Date: Thu, 27 Oct 2016 15:09:46 -0700 Subject: [PATCH 48/57] Updated enablement section Added enablement in VMs Changed other enablement flows --- windows/keep-secure/credential-guard.md | 52 ++++++++++++++++--------- 1 file changed, 34 insertions(+), 18 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index d31167eaf6..a4bc04f352 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -100,11 +100,11 @@ The following tables describes additional hardware and firmware requirements, an ## Manage Credential Guard -Credential Guard uses virtualization-based security features that must be enabled on each PC before you can use it. +Credential Guard can be enabled by using Group Policy, the registry, or the Device Guard and Credential Guard hardware readiness tool. ### Turn on Credential Guard by using Group Policy -You can use Group Policy to enable Credential Guard because it will add the virtualization-based security features for you. +You can use Group Policy to enable Credential Guard. This will add and enable the virtualization-based security features for you if needed. 1. From the Group Policy Management Console, go to **Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard**. 2. Double-click **Turn On Virtualization Based Security**, and then click the **Enabled** option. 3. **Select Platform Security Level** box, choose **Secure Boot** or **Secure Boot and DMA Protection**. @@ -114,13 +114,18 @@ You can use Group Policy to enable Credential Guard because it will add the virt 5. Close the Group Policy Management Console. -### Add Credential Guard to an image +To enforce processing of the group policy, you can run ```gpupdate /force```. -If you would like to add Credential Guard to an image, you can do this by adding the virtualization-based security features and then turning on Credential Guard. +### Turn on Credential Guard by using the registy -### Add the virtualization-based security features +If you don't use Group Policy, you can enable Credential Guard by using the registry. Credential Guard uses virtualization-based security features which have to be enabled first on some operating systems. -First, you must add the virtualization-based security features. You can do this by using either the Control Panel or the Deployment Image Servicing and Management tool (DISM). +#### Add the virtualization-based security features + +Starting with Windows 10 1607 and Windows Server 2016, enabling Windows features to use virtualization-based security is not necessary and this step can be skipped. + +If you are using Windows 10 1507 (RTM) or Windows 10 1511, Windows features have to be enabled to use virtualization-based security. +You can do this by using either the Control Panel or the Deployment Image Servicing and Management tool (DISM). > [!NOTE] > If you enable Credential Guard by using Group Policy, these steps are not required. Group Policy will install the features for you.   @@ -128,7 +133,8 @@ First, you must add the virtualization-based security features. You can do this 1. Open the Programs and Features control panel. 2. Click **Turn Windows feature on or off**. 3. Go to **Hyper-V** -> **Hyper-V Platform**, and then select the **Hyper-V Hypervisor** check box. -4. Click **OK**. +4. Select the **Isolated User Mode** check box at the top level of the feature selection. +5. Click **OK**. **Add the virtualization-based security features to an offline image by using DISM** 1. Open an elevated command prompt. @@ -136,21 +142,17 @@ First, you must add the virtualization-based security features. You can do this ``` syntax dism /image: /Enable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /all ``` +3. Add the Isolated User Mode feature by running the following command: + ``` syntax + dism /image: /Enable-Feature /FeatureName:IsolatedUserMode + ``` > [!NOTE] > You can also add these features to an online image by using either DISM or Configuration Manager. - In Windows 10, version 1607 and Windows Server 2016, Isolated User Mode is included with Hyper-V and does not need to be installed separately. If you're running a version of Windows 10 that's earlier than Windows 10, version 1607, you can run the following command to install Isolated User Mode: -``` syntax -dism /image: /Enable-Feature /FeatureName:IsolatedUserMode -``` -### Turn on Credential Guard - -If you don't use Group Policy, you can enable Credential Guard by using the registry. - -**Turn on Credential Guard by using the registry** +#### Enable virtualization-based security and Credential Guard 1. Open Registry Editor. 2. Enable virtualization-based security: @@ -166,14 +168,28 @@ If you don't use Group Policy, you can enable Credential Guard by using the regi > [!NOTE] > You can also turn on Credential Guard by setting the registry entries in the [FirstLogonCommands](http://msdn.microsoft.com/library/windows/hardware/dn922797.aspx) unattend setting. -**Turn on Credential Guard by using the Device Guard and Credential Guard hardware readiness tool** +### Turn on Credential Guard by using the Device Guard and Credential Guard hardware readiness tool You can also enable Credential Guard by using the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). ``` DG_Readiness_Tool_v2.0.ps1 -Enable -AutoReboot ``` -  + +### Credential Guard deployment in virtual machines +Credential Guard can protect secrets in a Hyper-V virtual machine, just as it would a physical machine. The enablement steps are the same from within the virtual machine. + +Credential Guard protects secrets from non-priviledged access inside the VM. It does not provide additional protection from the host administrator. From the host, you can disable Credential Guard for a virtual machine: + +``` PowerShell +Set-VMSecurity -VMName -VirtualizationBasedSecurityOptOut $true +``` + +Requirements for running Credential Guard in Hyper-V virtual machines +- The Hyper-V host must have an IOMMU, and run at least Windows Server 2016 or Windows 10 version 1607. +- The Hyper-V virtual machine must be Generation 2, have an enabled virtual TPM, and running at least Windows Server 2016 or Windows 10. + + ### Remove Credential Guard If you have to remove Credential Guard on a PC, you need to do the following: From 1bb4cebcd3aaae5a5e8a3609c40d0a6419b6e1cd Mon Sep 17 00:00:00 2001 From: Lars Iwer Date: Thu, 27 Oct 2016 15:12:43 -0700 Subject: [PATCH 49/57] Fixed line breaks --- windows/keep-secure/credential-guard.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index a4bc04f352..839e59170d 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -105,6 +105,7 @@ Credential Guard can be enabled by using Group Policy, the registry, or the Devi ### Turn on Credential Guard by using Group Policy You can use Group Policy to enable Credential Guard. This will add and enable the virtualization-based security features for you if needed. + 1. From the Group Policy Management Console, go to **Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard**. 2. Double-click **Turn On Virtualization Based Security**, and then click the **Enabled** option. 3. **Select Platform Security Level** box, choose **Secure Boot** or **Secure Boot and DMA Protection**. @@ -130,6 +131,7 @@ You can do this by using either the Control Panel or the Deployment Image Servic > If you enable Credential Guard by using Group Policy, these steps are not required. Group Policy will install the features for you.   **Add the virtualization-based security features by using Programs and Features** + 1. Open the Programs and Features control panel. 2. Click **Turn Windows feature on or off**. 3. Go to **Hyper-V** -> **Hyper-V Platform**, and then select the **Hyper-V Hypervisor** check box. @@ -137,6 +139,7 @@ You can do this by using either the Control Panel or the Deployment Image Servic 5. Click **OK**. **Add the virtualization-based security features to an offline image by using DISM** + 1. Open an elevated command prompt. 2. Add the Hyper-V Hypervisor by running the following command: ``` syntax @@ -177,6 +180,7 @@ DG_Readiness_Tool_v2.0.ps1 -Enable -AutoReboot ``` ### Credential Guard deployment in virtual machines + Credential Guard can protect secrets in a Hyper-V virtual machine, just as it would a physical machine. The enablement steps are the same from within the virtual machine. Credential Guard protects secrets from non-priviledged access inside the VM. It does not provide additional protection from the host administrator. From the host, you can disable Credential Guard for a virtual machine: From 73bd48d04a23210777cd80733a3b9d0dd3f34302 Mon Sep 17 00:00:00 2001 From: Lars Iwer Date: Thu, 27 Oct 2016 15:14:40 -0700 Subject: [PATCH 50/57] Fixed line break --- windows/keep-secure/credential-guard.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 839e59170d..87c9c02668 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -129,6 +129,7 @@ If you are using Windows 10 1507 (RTM) or Windows 10 1511, Windows features have You can do this by using either the Control Panel or the Deployment Image Servicing and Management tool (DISM). > [!NOTE] > If you enable Credential Guard by using Group Policy, these steps are not required. Group Policy will install the features for you. +   **Add the virtualization-based security features by using Programs and Features** From cada0122709374d5418f3aa465075feb0f6a4e9e Mon Sep 17 00:00:00 2001 From: Lars Iwer Date: Thu, 27 Oct 2016 15:16:14 -0700 Subject: [PATCH 51/57] Updated headings --- windows/keep-secure/credential-guard.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 87c9c02668..b4f2af8443 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -100,9 +100,10 @@ The following tables describes additional hardware and firmware requirements, an ## Manage Credential Guard +### Enable Credential Guard Credential Guard can be enabled by using Group Policy, the registry, or the Device Guard and Credential Guard hardware readiness tool. -### Turn on Credential Guard by using Group Policy +#### Turn on Credential Guard by using Group Policy You can use Group Policy to enable Credential Guard. This will add and enable the virtualization-based security features for you if needed. @@ -117,11 +118,11 @@ You can use Group Policy to enable Credential Guard. This will add and enable th To enforce processing of the group policy, you can run ```gpupdate /force```. -### Turn on Credential Guard by using the registy +#### Turn on Credential Guard by using the registy If you don't use Group Policy, you can enable Credential Guard by using the registry. Credential Guard uses virtualization-based security features which have to be enabled first on some operating systems. -#### Add the virtualization-based security features +##### Add the virtualization-based security features Starting with Windows 10 1607 and Windows Server 2016, enabling Windows features to use virtualization-based security is not necessary and this step can be skipped. @@ -156,7 +157,7 @@ You can do this by using either the Control Panel or the Deployment Image Servic In Windows 10, version 1607 and Windows Server 2016, Isolated User Mode is included with Hyper-V and does not need to be installed separately. If you're running a version of Windows 10 that's earlier than Windows 10, version 1607, you can run the following command to install Isolated User Mode: -#### Enable virtualization-based security and Credential Guard +##### Enable virtualization-based security and Credential Guard 1. Open Registry Editor. 2. Enable virtualization-based security: @@ -172,7 +173,7 @@ In Windows 10, version 1607 and Windows Server 2016, Isolated User Mode is inclu > [!NOTE] > You can also turn on Credential Guard by setting the registry entries in the [FirstLogonCommands](http://msdn.microsoft.com/library/windows/hardware/dn922797.aspx) unattend setting. -### Turn on Credential Guard by using the Device Guard and Credential Guard hardware readiness tool +#### Turn on Credential Guard by using the Device Guard and Credential Guard hardware readiness tool You can also enable Credential Guard by using the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). @@ -180,7 +181,7 @@ You can also enable Credential Guard by using the [Device Guard and Credential G DG_Readiness_Tool_v2.0.ps1 -Enable -AutoReboot ``` -### Credential Guard deployment in virtual machines +#### Credential Guard deployment in virtual machines Credential Guard can protect secrets in a Hyper-V virtual machine, just as it would a physical machine. The enablement steps are the same from within the virtual machine. From 1562c29654b0d8605737d4dbea71c4a9280cd9fe Mon Sep 17 00:00:00 2001 From: Lars Iwer Date: Thu, 27 Oct 2016 15:19:29 -0700 Subject: [PATCH 52/57] Fixed typo --- windows/keep-secure/credential-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index b4f2af8443..77bb8859bc 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -183,7 +183,7 @@ DG_Readiness_Tool_v2.0.ps1 -Enable -AutoReboot #### Credential Guard deployment in virtual machines -Credential Guard can protect secrets in a Hyper-V virtual machine, just as it would a physical machine. The enablement steps are the same from within the virtual machine. +Credential Guard can protect secrets in a Hyper-V virtual machine, just as it would on a physical machine. The enablement steps are the same from within the virtual machine. Credential Guard protects secrets from non-priviledged access inside the VM. It does not provide additional protection from the host administrator. From the host, you can disable Credential Guard for a virtual machine: From 425fda5f9b1a87a8c0f5eb73dbfc85d101cb7436 Mon Sep 17 00:00:00 2001 From: isaiahng Date: Thu, 27 Oct 2016 15:21:21 -0700 Subject: [PATCH 53/57] Update MDM article Added list of supported Win10 MDM settings, validated by vendor for Surface Hub. --- ...anage-settings-with-mdm-for-surface-hub.md | 105 ++++++++++++++++-- 1 file changed, 95 insertions(+), 10 deletions(-) diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index 77fe621aae..f0697f4a34 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -23,16 +23,16 @@ Surface Hub has been validated with Microsoft’s first-party MDM providers: You can also manage Surface Hubs using any third-party MDM provider that can communicate with Windows 10 using the MDM protocol. ## Enroll a Surface Hub into MDM -You can enroll your Surface Hubs using automatic, bulk, or manual enrollment. +You can enroll your Surface Hubs using bulk or manual enrollment. > [!NOTE] > You can join your Surface Hub to Azure Active Directory (Azure AD) to manage admin groups on the device. However, Surface Hub does not currently support automatic enrollment to Microsoft Intune through Azure AD join. If your organization automatically enrolls Azure AD joined devices into Intune, you must disable this policy for Surface Hub before joining the device to Azure AD. - -**To disable automatic enrollment for Microsoft Intune** -1. In the [Azure classic portal](https://manage.windowsazure.com/), navigate to the **Active Directory** node and select your directory. -2. Click the **Applications** tab, then click **Microsoft Intune**. -3. Under **Manage devices for these users**, click **Groups**. -4. Click **Select Groups**, then select the groups of users you want to automatically enroll into Intune. Do not include accounts that are used to enroll Surface Hubs into Intune. 5. Click the checkmark button, then click **Save**. +> +> **To disable automatic enrollment for Microsoft Intune** +> 1. In the [Azure classic portal](https://manage.windowsazure.com/), navigate to the **Active Directory** node and select your directory. +> 2. Click the **Applications** tab, then click **Microsoft Intune**. +> 3. Under **Manage devices for these users**, click **Groups**. +> 4. Click **Select Groups**, then select the groups of users you want to automatically enroll into Intune. Do not include accounts that are used to enroll Surface Hubs into Intune. 5. Click the checkmark button, then click **Save**. ### Bulk enrollment **To configure bulk enrollment** @@ -41,8 +41,6 @@ You can enroll your Surface Hubs using automatic, bulk, or manual enrollment. - If you have an on-premises System Center Configuration Manager infrastructure, see [How to bulk enroll devices with On-premises Mobile Device Management in System Center Configuration Manager](https://technet.microsoft.com/library/mt627898.aspx). ### Manual enrollment -You can manually enroll with an MDM using the **Settings** app on your Surface Hub. - **To configure manual enrollment** 1. From your Surface Hub, open **Settings**. 2. Type the device admin credentials when prompted. @@ -52,7 +50,7 @@ You can manually enroll with an MDM using the **Settings** app on your Surface H ## Manage Surface Hub settings with MDM -You can use MDM to manage some [Surface Hub CSP settings](#supported-surface-hub-csp-settings). Depending on the MDM provider that you use, you may set these settings using a built-in user interface, or by deploying custom SyncML. Microsoft Intune and System Center Configuration Manager provide built-in experiences to help create policy templates for Surface Hub. Refer to documentation from your MDM provider to learn how to create and deploy SyncML. +You can use MDM to manage some [Surface Hub CSP settings](#supported-surface-hub-csp-settings), and some [Windows 10 settings](#supported-windows-10-settings). Depending on the MDM provider that you use, you may set these settings using a built-in user interface, or by deploying custom SyncML. Microsoft Intune and System Center Configuration Manager provide built-in experiences to help create policy templates for Surface Hub. Refer to documentation from your MDM provider to learn how to create and deploy SyncML. ### Supported Surface Hub CSP settings @@ -73,7 +71,94 @@ For more information, see [SurfaceHub configuration service provider](https://ms | Friendly name for wireless projection | Properties/FriendlyName | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | | Device account, including password rotation | DeviceAccount/*``*
    See [SurfaceHub CSP](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). | No | No | Yes | +### Supported Windows 10 settings +In addition to Surface Hub specific settings, there are numerous settings common to all Windows 10 devices. These settings are defined in the [Configuration service provider reference](https://msdn.microsoft.com/library/windows/hardware/dn920025.aspx). + +The following tables include info on Windows 10 settings that have been validated with Surface Hub. There is a table with settings for these areas: security, browser, Windows Updates, Windows Defender, remote reboot, certificates, and logs. Each table also tells if the setting is supported with Microsoft Intune, System Center Configuration Manager, or SyncML. + +#### Security settings +| Setting | Details | CSP reference | Supported with
    Intune? | Supported with
    Configuration Manager? | Supported with
    SyncML? | +| -------- | -------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- | +| Allow Bluetooth | Keep this enabled to support Bluetooth peripherals. | [Connectivity/AllowBluetooth](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Connectivity_AllowBluetooth) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Bluetooth policies | Use to set the Bluetooth device name, and block advertising, discovery, and automatic pairing. | Bluetooth/*``*
    See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Allow camera | Keep this enabled for Skype for Business. | [Camera/AllowCamera](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Camera_AllowCamera) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Allow location | Keep this enabled to support apps such as Maps. | [System/AllowLocation](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowLocation) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Allow telemetry | Keep this enabled to help Microsoft improve Surface Hub. | [System/AllowTelemetry](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowTelemetry) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | + +#### Browser settings + +| Setting | Details | CSP reference | Supported with
    Intune? | Supported with
    Configuration Manager? | Supported with
    SyncML? | +| -------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- | +| Homepages | Use to configure the default homepages in Microsoft Edge. | [Browser/Homepages](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_Homepages) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Allow cookies | Surface Hub automatically deletes cookies at the end of a session. Use this to block cookies within a session. | [Browser/AllowCookies](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowCookies) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Allow developer tools | Use to stop users from using F12 Developer Tools. | [Browser/AllowDeveloperTools](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDeveloperTools) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Allow Do Not Track | Use to enable Do Not Track headers. | [Browser/AllowDoNotTrack](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDoNotTrack) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Allow pop-ups | Use to block pop-up browser windows. | [Browser/AllowPopups](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowPopups) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Allow search suggestions | Use to block search suggestions in the address bar. | [Browser/AllowSearchSuggestionsinAddressBar](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSearchSuggestionsinAddressBar) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Allow SmartScreen | Keep this enabled to turn on SmartScreen. | [Browser/AllowSmartScreen](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSmartScreen) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Prevent ignoring SmartScreen Filter warnings for websites | For extra security, use to stop users from ignoring SmartScreen Filter warnings and block them from accessing potentially malicious websites. | [Browser/PreventSmartScreenPromptOverride](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverride) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Prevent ignoring SmartScreen Filter warnings for files | For extra security, use to stop users from ignoring SmartScreen Filter warnings and block them from downloading unverified files from Microsoft Edge. | [Browser/PreventSmartScreenPromptOverrideForFiles](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverrideForFiles) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | + +#### Windows Update settings + +| Setting | Details | CSP reference | Supported with
    Intune? | Supported with
    Configuration Manager? | Supported with
    SyncML? | +| ----------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- | +| Use Current Branch or Current Branch for Business | Use to configure Windows Update for Business – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/BranchReadinessLevel](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_BranchReadinessLevel) | Yes. Use a custom policy. | Yes. Use a custom setting. | Yes | +| Defer feature updates| See above. | [Update/ DeferFeatureUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferFeatureUpdatesPeriodInDays) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Defer quality updates | See above. | [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferQualityUpdatesPeriodInDays) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Pause feature updates | See above. | [Update/PauseFeatureUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Pause quality updates | See above. | [Update/PauseQualityUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes| +| Configure device to use WSUS| Use to connect your Surface Hub to WSUS instead of Windows Update – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/UpdateServiceUrl](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Delivery optimization | Use peer-to-peer content sharing to reduce bandwidth issues during updates. See [Configure Delivery Optimization for Windows 10](https://technet.microsoft.com/itpro/windows/manage/waas-delivery-optimization) for details. | DeliveryOptimization/*``*
    See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | + +#### Windows Defender settings + +| Setting | Details | CSP reference | Supported with
    Intune? | Supported with
    Configuration Manager? | Supported with
    SyncML? | +| ----------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- | +| Defender policies | Use to configure various Defender settings, including a scheduled scan time. | Defender/*``*
    See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Defender status | Use to initiate a Defender scan, force a signature update, query any threats detected. | [Defender CSP](https://msdn.microsoft.com/library/windows/hardware/mt187856.aspx) | No. | No. | Yes | + +#### Remote reboot + +| Setting | Details | CSP reference | Supported with
    Intune? | Supported with
    Configuration Manager? | Supported with
    SyncML? | +| ----------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- | +| Reboot the device immediately | Use in conjunction with OMS to minimize support costs – see [Monitor your Microsoft Surface Hub](monitor-surface-hub.md). | ./Vendor/MSFT/Reboot/RebootNow
    See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | No | No | Yes | +| Reboot the device at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/Single
    See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | +| Reboot the device daily at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/DailyRecurrent
    See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes.
    Use a custom policy. | Yes.
    Use a custom setting. | Yes | + +#### Install certificates + +| Setting | Details | CSP reference | Supported with
    Intune? | Supported with
    Configuration Manager? | Supported with
    SyncML? | +| ----------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- | +| Install trusted CA certificates | Use to deploy trusted root and intermediate CA certificates. | [RootCATrustedCertificates CSP](https://msdn.microsoft.com/library/windows/hardware/dn904970.aspx) | Yes.
    See [Configure Intune certificate profiles](https://docs.microsoft.com/en-us/intune/deploy-use/configure-intune-certificate-profiles). | Yes.
    See [How to create certificate profiles in System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/create-certificate-profiles). | Yes | + + +#### Collect logs + +| Setting | Details | CSP reference | Supported with
    Intune? | Supported with
    Configuration Manager? | Supported with
    SyncML? | +| ----------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- | +| Collect ETW logs | Use to remotely collect ETW logs from Surface Hub. | [DiagnosticLog CSP](https://msdn.microsoft.com/library/windows/hardware/mt219118.aspx) | No | No | Yes | + + +### Generate OMA URIs for settings +You need to use a setting’s OMA URI to create a custom policy in Intune, or a custom setting in System Center Configuration Manager. + +**To generate the OMA URI for any setting in the CSP documentation** +1. In the CSP documentation, identify the root node of the CSP. Generally, this looks like `./Vendor/MSFT/`
    +*For example, the root node of the [SurfaceHub CSP](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx) is `./Vendor/MSFT/SurfaceHub`.* +2. Identify the node path for the setting you want to use.
    +*For example, the node path for the setting to enable wireless projection is `InBoxApps/WirelessProjection/Enabled`.* +3. Append the node path to the root node to generate the OMA URI.
    +*For example, the OMA URI for the setting to enable wireless projection is `./Vendor/MSFT/SurfaceHub/InBoxApps/WirelessProjection/Enabled`.* + +The data type is also stated in the CSP documentation. The most common data types are: +- char (String) +- int (Integer) +- bool (Boolean) ## Example: Manage Surface Hub settings with Micosoft Intune From 404d9ad4fe80e65e46ea5aa04e0f58fe80f71f9c Mon Sep 17 00:00:00 2001 From: Lars Iwer Date: Thu, 27 Oct 2016 16:04:20 -0700 Subject: [PATCH 54/57] Fixed typos --- windows/keep-secure/credential-guard.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 77bb8859bc..5e20aa7fff 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -118,7 +118,7 @@ You can use Group Policy to enable Credential Guard. This will add and enable th To enforce processing of the group policy, you can run ```gpupdate /force```. -#### Turn on Credential Guard by using the registy +#### Turn on Credential Guard by using the registry If you don't use Group Policy, you can enable Credential Guard by using the registry. Credential Guard uses virtualization-based security features which have to be enabled first on some operating systems. @@ -155,8 +155,6 @@ You can do this by using either the Control Panel or the Deployment Image Servic > [!NOTE] > You can also add these features to an online image by using either DISM or Configuration Manager. -In Windows 10, version 1607 and Windows Server 2016, Isolated User Mode is included with Hyper-V and does not need to be installed separately. If you're running a version of Windows 10 that's earlier than Windows 10, version 1607, you can run the following command to install Isolated User Mode: - ##### Enable virtualization-based security and Credential Guard 1. Open Registry Editor. From 89c8614e67473fb81e9cd2dd1a584cecfa1c2aa3 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 28 Oct 2016 06:48:01 -0700 Subject: [PATCH 55/57] update --- .../manage-settings-with-mdm-for-surface-hub.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index f0697f4a34..275688b9a0 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -32,7 +32,8 @@ You can enroll your Surface Hubs using bulk or manual enrollment. > 1. In the [Azure classic portal](https://manage.windowsazure.com/), navigate to the **Active Directory** node and select your directory. > 2. Click the **Applications** tab, then click **Microsoft Intune**. > 3. Under **Manage devices for these users**, click **Groups**. -> 4. Click **Select Groups**, then select the groups of users you want to automatically enroll into Intune. Do not include accounts that are used to enroll Surface Hubs into Intune. 5. Click the checkmark button, then click **Save**. +> 4. Click **Select Groups**, then select the groups of users you want to automatically enroll into Intune. Do not include accounts that are used to enroll Surface Hubs into Intune. +> 5. Click the checkmark button, then click **Save**. ### Bulk enrollment **To configure bulk enrollment** @@ -54,7 +55,7 @@ You can use MDM to manage some [Surface Hub CSP settings](#supported-surface-hub ### Supported Surface Hub CSP settings -You can configure the Surface Hub settings in the following table using MDM. The table also tells if the setting is supported with Microsoft Intune, System Center Configuration Manager, or SyncML. +You can configure the Surface Hub settings in the following table using MDM. The table identifies if the setting is supported with Microsoft Intune, System Center Configuration Manager, or SyncML. For more information, see [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). @@ -73,9 +74,9 @@ For more information, see [SurfaceHub configuration service provider](https://ms ### Supported Windows 10 settings -In addition to Surface Hub specific settings, there are numerous settings common to all Windows 10 devices. These settings are defined in the [Configuration service provider reference](https://msdn.microsoft.com/library/windows/hardware/dn920025.aspx). +In addition to Surface Hub-specific settings, there are numerous settings common to all Windows 10 devices. These settings are defined in the [Configuration service provider reference](https://msdn.microsoft.com/library/windows/hardware/dn920025.aspx). -The following tables include info on Windows 10 settings that have been validated with Surface Hub. There is a table with settings for these areas: security, browser, Windows Updates, Windows Defender, remote reboot, certificates, and logs. Each table also tells if the setting is supported with Microsoft Intune, System Center Configuration Manager, or SyncML. +The following tables include info on Windows 10 settings that have been validated with Surface Hub. There is a table with settings for these areas: security, browser, Windows Updates, Windows Defender, remote reboot, certificates, and logs. Each table identifies if the setting is supported with Microsoft Intune, System Center Configuration Manager, or SyncML. #### Security settings | Setting | Details | CSP reference | Supported with
    Intune? | Supported with
    Configuration Manager? | Supported with
    SyncML? | From 5b74488e59654d50bcba7abf8f7cf6357bf7a4d9 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Fri, 28 Oct 2016 10:34:09 -0700 Subject: [PATCH 56/57] typo slmgr --- .../activate-using-active-directory-based-activation-client.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deploy/activate-using-active-directory-based-activation-client.md b/windows/deploy/activate-using-active-directory-based-activation-client.md index a3dce6ef96..82c95ff35b 100644 --- a/windows/deploy/activate-using-active-directory-based-activation-client.md +++ b/windows/deploy/activate-using-active-directory-based-activation-client.md @@ -91,7 +91,7 @@ To verify your Active Directory-based activation configuration, complete the fol 6. Scroll down to the **Windows activation** section, and verify that this client has been activated. **Note**
    - If you are using both KMS and Active Directory-based activation, it may be difficult to see whether a client has been activated by KMS or by Active Directory-based activation. Consider disabling KMS during the test, or make sure that you are using a client computer that has not already been activated by KMS. The **slmrg.vbs /dlv** command also indicates whether KMS has been used. + If you are using both KMS and Active Directory-based activation, it may be difficult to see whether a client has been activated by KMS or by Active Directory-based activation. Consider disabling KMS during the test, or make sure that you are using a client computer that has not already been activated by KMS. The **slmgr.vbs /dlv** command also indicates whether KMS has been used. ## See also - [Volume Activation for Windows 10](volume-activation-windows-10.md) From 4a02ada79bd09ce7510165965c7b6700da51fde2 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 28 Oct 2016 12:00:24 -0700 Subject: [PATCH 57/57] link --- windows/manage/waas-manage-updates-configuration-manager.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/manage/waas-manage-updates-configuration-manager.md b/windows/manage/waas-manage-updates-configuration-manager.md index af90f73616..1333b461a4 100644 --- a/windows/manage/waas-manage-updates-configuration-manager.md +++ b/windows/manage/waas-manage-updates-configuration-manager.md @@ -381,7 +381,9 @@ or Manage Windows 10 updates using System Center Configuration Manager (this top

+## See also +[Manage Windows as a service using System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/manage-windows-as-a-service)