deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-14 22:37:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'refs/remotes/origin/master' into vs-7542905

Browse Source
This commit is contained in:
LizRoss 2016-06-24 09:19:19 -07:00
commit c0ed0ea8a4
6 changed files with 52 additions and 52 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
devices/surface/manage-surface-dock-firmware-updates.md
View File

@ -43,7 +43,7 @@ The Surface Dock firmware update process shown in Figure 1 follows these steps:
8. When the Surface Dock is disconnected for a second time, the Surface dock installs the firmware update to the DisplayPort chipset. This process takes up to 3 minutes to apply. 8. When the Surface Dock is disconnected for a second time, the Surface dock installs the firmware update to the DisplayPort chipset. This process takes up to 3 minutes to apply.
![figure 1](images/manage-surface-dock-fig1-updateprocess.png) ![Surface Dock firmware update process](images/manage-surface-dock-fig1-updateprocess.png "Surface Dock firmware update process")
*1- Driver installation can be performed by Windows Update, manual installation, or automatically downloaded with Microsoft Surface Dock Updater* *1- Driver installation can be performed by Windows Update, manual installation, or automatically downloaded with Microsoft Surface Dock Updater*

32
devices/surface/manage-surface-uefi-settings.md
View File

@ -39,9 +39,9 @@ You will also find detailed information about the firmware of your Surface devic
- Touch Firmware - Touch Firmware
*Figure 1. System information and firmware version information* ![System information and firmware version information](images/manage-surface-uefi-figure-1.png "System information and firmware version information")
![figure 1](images/manage-surface-uefi-figure-1.png) *Figure 1. System information and firmware version information*
You can find up-to-date information about the latest firmware version for your Surface device in the [Surface Update History](https://www.microsoft.com/surface/en-us/support/install-update-activate/surface-update-history) for your device. You can find up-to-date information about the latest firmware version for your Surface device in the [Surface Update History](https://www.microsoft.com/surface/en-us/support/install-update-activate/surface-update-history) for your device.
@ -59,21 +59,21 @@ On the **Security** page of Surface UEFI settings, you can set a password to pro
The password must be at least 6 characters and is case sensitive. The password must be at least 6 characters and is case sensitive.
*Figure 2. Add a password to protect Surface UEFI settings* ![Add a password to protect Surface UEFI settings](images/manage-surface-uefi-fig2.png "Add a password to protect Surface UEFI settings")
![figure 2](images/manage-surface-uefi-fig2.png) *Figure 2. Add a password to protect Surface UEFI settings*
On the **Security** page you can also change the configuration of Secure Boot on your Surface device. Secure Boot technology prevents unauthorized boot code from booting on your Surface device, which protects against bootkit and rootkit-type malware infections. You can disable Secure Boot to allow your Surface device to boot third-party operating systems or bootable media. You can also configure Secure Boot to work with third-party certificates, as shown in Figure 3. Read more about [Secure Boot](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/secure-boot-overview) in the TechNet Library. On the **Security** page you can also change the configuration of Secure Boot on your Surface device. Secure Boot technology prevents unauthorized boot code from booting on your Surface device, which protects against bootkit and rootkit-type malware infections. You can disable Secure Boot to allow your Surface device to boot third-party operating systems or bootable media. You can also configure Secure Boot to work with third-party certificates, as shown in Figure 3. Read more about [Secure Boot](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/secure-boot-overview) in the TechNet Library.
*Figure 3. Configure Secure Boot* ![Configure Secure Boot](images/manage-surface-uefi-fig3.png "Configure Secure Boot")
![figure 3](images/manage-surface-uefi-fig3.png) *Figure 3. Configure Secure Boot*
You can also enable or disable the Trusted Platform Module (TPM) device on the **Security** page, as shown in Figure 4. The TPM is used to authenticate encryption for your device’s data with BitLocker. Read more about [BitLocker](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/bitlocker-overview) in the TechNet Library. You can also enable or disable the Trusted Platform Module (TPM) device on the **Security** page, as shown in Figure 4. The TPM is used to authenticate encryption for your device’s data with BitLocker. Read more about [BitLocker](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/bitlocker-overview) in the TechNet Library.
*Figure 4. Configure Surface UEFI security settings* ![Configure Surface UEFI security settings](images/manage-surface-uefi-fig4.png "Configure Surface UEFI security settings")
![figure 4](images/manage-surface-uefi-fig4.png) *Figure 4. Configure Surface UEFI security settings*
##Devices ##Devices
@ -95,9 +95,9 @@ On the **Devices** page you can enable or disable specific devices and component
Each device is listed with a slider button that you can move to **On** (enabled) or **Off** (disabled) position, as shown in Figure 5. Each device is listed with a slider button that you can move to **On** (enabled) or **Off** (disabled) position, as shown in Figure 5.
*Figure 5. Enable and disable specific devices* ![Enable and disable specific devices](images/manage-surface-uefi-fig5.png "Enable and disable specific devices")
![figure 5](images/manage-surface-uefi-fig5.png) *Figure 5. Enable and disable specific devices*
##Boot configuration ##Boot configuration
@ -115,9 +115,9 @@ You can boot from a specific device immediately, or you can swipe left on that d
For the specified boot order to take effect, you must set the **Enable Alternate Boot Sequence** option to **On**, as shown in Figure 6. For the specified boot order to take effect, you must set the **Enable Alternate Boot Sequence** option to **On**, as shown in Figure 6.
*Figure 6. Configure the boot order for your Surface device* ![Configure the boot order for your Surface device](images/manage-surface-uefi-fig6.png "Configure the boot order for your Surface device")
![figure 6](images/manage-surface-uefi-fig6.png) *Figure 6. Configure the boot order for your Surface device*
You can also turn on and off IPv6 support for PXE with the **Enable IPv6 for PXE Network Boot** option, for example when performing a Windows deployment using PXE where the PXE server is configured for IPv4 only. You can also turn on and off IPv6 support for PXE with the **Enable IPv6 for PXE Network Boot** option, for example when performing a Windows deployment using PXE where the PXE server is configured for IPv4 only.
@ -125,14 +125,14 @@ You can also turn on and off IPv6 support for PXE with the **Enable IPv6 for PXE
The **About** page displays regulatory information, such as compliance with FCC rules, as shown in Figure 7. The **About** page displays regulatory information, such as compliance with FCC rules, as shown in Figure 7.
*Figure 7. Regulatory information is displayed on the About page* ![Regulatory information displayed on the About page](images/manage-surface-uefi-fig7.png "Regulatory information displayed on the About page")
![figure 7](images/manage-surface-uefi-fig7.png) *Figure 7. Regulatory information displayed on the About page*
##Exit ##Exit
Use the **Restart Now** button on the **Exit** page to exit UEFI settings, as shown in Figure 8. Use the **Restart Now** button on the **Exit** page to exit UEFI settings, as shown in Figure 8.
*Figure 8. Click Restart Now to exit Surface UEFI and restart the device* ![Exit Surface UEFI and restart the device](images/manage-surface-uefi-fig8.png "Exit Surface UEFI and restart the device")
![figure 8](images/manage-surface-uefi-fig8.png) *Figure 8. Click Restart Now to exit Surface UEFI and restart the device*

20
devices/surface/microsoft-surface-data-eraser.md
View File

@ -65,24 +65,24 @@ After the creation tool is installed, follow these steps to create a Microsoft S
3. Click **Start** to acknowledge that you have a USB stick of at least 4 GB connected, as shown in Figure 1. 3. Click **Start** to acknowledge that you have a USB stick of at least 4 GB connected, as shown in Figure 1.
![figure 1](images/dataeraser-start-tool.png) ![Start the Microsoft Surface Data Eraser tool](images/dataeraser-start-tool.png "Start the Microsoft Surface Data Eraser tool")
Figure 1. Start the Microsoft Surface Data Eraser tool *Figure 1. Start the Microsoft Surface Data Eraser tool*
4. Select the USB drive of your choice from the **USB Thumb Drive Selection** page as shown in Figure 2, and then click **Start** to begin the USB creation process. The drive you select will be formatted and any existing data on this drive will be lost. 4. Select the USB drive of your choice from the **USB Thumb Drive Selection** page as shown in Figure 2, and then click **Start** to begin the USB creation process. The drive you select will be formatted and any existing data on this drive will be lost.
>**Note:**  If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB. >**Note:**  If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB.
   
![figure 2](images/dataeraser-usb-selection.png) ![USB thumb drive selection](images/dataeraser-usb-selection.png "USB thumb drive selection")
Figure 2. USB thumb drive selection *Figure 2. USB thumb drive selection*
5. After the creation process is finished, the USB drive has been formatted and all binaries are copied to the USB drive. Click **Success**. 5. After the creation process is finished, the USB drive has been formatted and all binaries are copied to the USB drive. Click **Success**.
6. When the **Congratulations** screen is displayed, you can eject and remove the thumb drive. This thumb drive is now ready to be inserted into a Surface device, booted from, and wipe any data on the device. Click **Complete** to finish the USB creation process, as shown in Figure 3. 6. When the **Congratulations** screen is displayed, you can eject and remove the thumb drive. This thumb drive is now ready to be inserted into a Surface device, booted from, and wipe any data on the device. Click **Complete** to finish the USB creation process, as shown in Figure 3.
![figure 3](images/dataeraser-complete-process.png) ![Surface Data Eraser USB creation process](images/dataeraser-complete-process.png "Surface Data Eraser USB creation process")
Figure 3. Complete the Microsoft Surface Data Eraser USB creation process *Figure 3. Complete the Microsoft Surface Data Eraser USB creation process*
7. Click **X** to close Microsoft Surface Data Eraser. 7. Click **X** to close Microsoft Surface Data Eraser.
@ -105,9 +105,9 @@ After you create a Microsoft Surface Data Eraser USB stick, you can boot a suppo
3. When the Surface device boots, a **SoftwareLicenseTerms** text file is displayed. 3. When the Surface device boots, a **SoftwareLicenseTerms** text file is displayed.
![](images/data-eraser-3.png) ![Booting the Microsoft Surface Data Eraser USB stick](images/data-eraser-3.png "Booting the Microsoft Surface Data Eraser USB stick")
Figure 4. Booting the Microsoft Surface Data Eraser USB stick *Figure 4. Booting the Microsoft Surface Data Eraser USB stick*
4. Read the software license terms, and then close the notepad file. 4. Read the software license terms, and then close the notepad file.
@ -123,9 +123,9 @@ After you create a Microsoft Surface Data Eraser USB stick, you can boot a suppo
7. If you typed **S** to begin the data erase process, the partition that will be erased is displayed, as shown in Figure 5. If this is correct, press **Y** to continue, or **N** to shut down the device. 7. If you typed **S** to begin the data erase process, the partition that will be erased is displayed, as shown in Figure 5. If this is correct, press **Y** to continue, or **N** to shut down the device.
![](images/sda-fig5-erase.png) ![Partition to be erased is displayed](images/sda-fig5-erase.png "Partition to be erased is displayed")
Figure 5. Partition to be erased is displayed in Microsoft Surface Data Eraser *Figure 5. Partition to be erased is displayed in Microsoft Surface Data Eraser*
8. If you pressed **Y** in step 7, due to the destructive nature of the data erasure process, an additional dialog box is displayed to confirm your choice. 8. If you pressed **Y** in step 7, due to the destructive nature of the data erasure process, an additional dialog box is displayed to confirm your choice.

10
devices/surface/step-by-step-surface-deployment-accelerator.md
View File

@ -60,7 +60,7 @@ The following steps show you how to create a deployment share for Windows 10 th
>**Note:**  As of SDA version 1.96.0405, SDA will install only the components of the Windows ADK that are required for deployment, as follows: >**Note:**  As of SDA version 1.96.0405, SDA will install only the components of the Windows ADK that are required for deployment, as follows:
* Deployment tools * Deployment tools
* User State Migration Tool (USMT) * User State Migration Tool (USMT)
* Windows Preinstallation Environment (WinPE)</br> * Windows Preinstallation Environment (WinPE)</br></br>
>**Note:**&nbsp;&nbsp;As of SDA version 1.96.0405, SDA will install and use MDT 2013 Update 2. Earlier versions of SDA are compatible only with MDT 2013 Update 1. >**Note:**&nbsp;&nbsp;As of SDA version 1.96.0405, SDA will install and use MDT 2013 Update 2. Earlier versions of SDA are compatible only with MDT 2013 Update 1.
@ -116,7 +116,7 @@ The following steps show you how to create a deployment share for Windows 10 th
![The installatin progress window](images/sdasteps-fig5-installwindow.png "The installatin progress window") ![The installatin progress window](images/sdasteps-fig5-installwindow.png "The installatin progress window")
*Figure 5. The **Installation Progress** window* *Figure 5. The Installation Progress window*
8. When the SDA process completes the creation of your deployment share, a **Success** window is displayed. Click **Finish** to close the window. At this point your deployment share is now ready to perform a Windows deployment to Surface devices. 8. When the SDA process completes the creation of your deployment share, a **Success** window is displayed. Click **Finish** to close the window. At this point your deployment share is now ready to perform a Windows deployment to Surface devices.
@ -250,7 +250,7 @@ After you have prepared the USB drive for boot, the next step is to generate off
![Select the Update Media Content option](images/sdasteps-fig12-updatemedia.png "Select the Update Media Content option") ![Select the Update Media Content option](images/sdasteps-fig12-updatemedia.png "Select the Update Media Content option")
*Figure 12. Select the **Update Media Content** option* *Figure 12. Select the Update Media Content option*
22. The **Update Media Content** window is displayed and shows the progress as the media files are created. When the process completes, click **Finish.** 22. The **Update Media Content** window is displayed and shows the progress as the media files are created. When the process completes, click **Finish.**
@ -358,7 +358,7 @@ To run the Deploy Microsoft Surface task sequence:
![Select the task sequence](images/sdasteps-fig15-deploy.png "Select the task sequence") ![Select the task sequence](images/sdasteps-fig15-deploy.png "Select the task sequence")
*Figure 15. Select the **1 – Deploy Microsoft Surface** task sequence* *Figure 15. Select the 1 – Deploy Microsoft Surface task sequence*
2. On the **Computer Details** page, type a name for the Surface device in the **Computer Name** box. In the **Join a domain** section, type your domain name and credentials as shown in Figure 16, and then click **Next**. 2. On the **Computer Details** page, type a name for the Surface device in the **Computer Name** box. In the **Join a domain** section, type your domain name and credentials as shown in Figure 16, and then click **Next**.
@ -378,7 +378,7 @@ To run the Deploy Microsoft Surface task sequence:
![Installation progress window](images/sdasteps-fig17-installprogresswindow.png "Installation progress window") ![Installation progress window](images/sdasteps-fig17-installprogresswindow.png "Installation progress window")
*Figure 17. The **Installation Progress** window* *Figure 17. The Installation Progress window*
8. When the deployment task sequence completes, a **Success** window is displayed. Click **Finish** to complete the deployment and begin using your Surface device. 8. When the deployment task sequence completes, a **Success** window is displayed. Click **Finish** to complete the deployment and begin using your Surface device.

32
devices/surface/surface-dock-updater.md
View File

@ -34,15 +34,15 @@ To update a Surface Dock with Microsoft Surface Dock Updater, follow these steps
- If the tool determines that the firmware of your Surface Dock is up to date, a **You have the latest firmware for this Surface Dock** message is displayed, as shown in Figure 1. - If the tool determines that the firmware of your Surface Dock is up to date, a **You have the latest firmware for this Surface Dock** message is displayed, as shown in Figure 1.
![figure 1](images/surfacedockupdater-fig1-uptodate-568pix.png) ![Screen that shows your Surface Dock firmware is up to date](images/surfacedockupdater-fig1-uptodate-568pix.png "Screen that shows your Surface Dock firmware is up to date")
Figure 1. Your Surface Dock firmware is up to date. *Figure 1. Your Surface Dock firmware is up to date*
- If Microsoft Surface Dock Updater determines that the firmware of your Surface Dock is not up to date, a **This Surface Dock is not running the latest firmware** message is displayed, as shown in Figure 2. - If Microsoft Surface Dock Updater determines that the firmware of your Surface Dock is not up to date, a **This Surface Dock is not running the latest firmware** message is displayed, as shown in Figure 2.
![figure 2](images/surfacedockupdater-fig2a-needsupdating.png) ![Screen that shows your Surface Dock firmware needs to be updated](images/surfacedockupdater-fig2a-needsupdating.png "Screen that shows your Surface Dock firmware needs to be updated")
Figure 2. Your Surface Dock firmware needs to be updated *Figure 2. Your Surface Dock firmware needs to be updated*
3. To begin the firmware update process, click **Update** on the **Surface Dock Firmware** page. 3. To begin the firmware update process, click **Update** on the **Surface Dock Firmware** page.
@ -50,27 +50,27 @@ To update a Surface Dock with Microsoft Surface Dock Updater, follow these steps
5. As the firmware update is uploaded to the Surface Dock, a **Progress** page is displayed, as shown in Figure 3. Do not disconnect the Surface Dock while firmware is being uploaded. 5. As the firmware update is uploaded to the Surface Dock, a **Progress** page is displayed, as shown in Figure 3. Do not disconnect the Surface Dock while firmware is being uploaded.
![figure 3](images/surfacedockupdater-fig3-progress.png) ![Progress of firmware update upload](images/surfacedockupdater-fig3-progress.png "Progress of firmware update upload")
Figure 3. Progress of firmware update upload to Surface Dock *Figure 3. Progress of firmware update upload to Surface Dock*
6. After the firmware update has successfully uploaded to the Surface Dock, you are prompted to disconnect and then reconnect the Surface Dock from the Surface device, as shown in Figure 4. The main chipset firmware update will be applied while the Surface Dock is disconnected. 6. After the firmware update has successfully uploaded to the Surface Dock, you are prompted to disconnect and then reconnect the Surface Dock from the Surface device, as shown in Figure 4. The main chipset firmware update will be applied while the Surface Dock is disconnected.
![figure 4](images/surfacedockupdater-fig4-disconnect.png) ![Disconnect and reconnect Surface Dock when prompted](images/surfacedockupdater-fig4-disconnect.png "Disconnect and reconnect Surface Dock when prompted")
Figure 4. Disconnect and reconnect Surface Dock when prompted *Figure 4. Disconnect and reconnect Surface Dock when prompted*
7. When the main chipset firmware update is verified, the DisplayPort chipset firmware update will be uploaded to the Surface Dock. Upon completion, a **Success** page is displayed and you will again be prompted to disconnect the Surface Dock, as shown in Figure 5. 7. When the main chipset firmware update is verified, the DisplayPort chipset firmware update will be uploaded to the Surface Dock. Upon completion, a **Success** page is displayed and you will again be prompted to disconnect the Surface Dock, as shown in Figure 5.
![figure 5](images/surfacedockupdater-fig5-success.png) ![Screen showing successful upload](images/surfacedockupdater-fig5-success.png "Screen showing successful upload")
Figure 5. Successful upload of Surface Dock firmware *Figure 5. Successful upload of Surface Dock firmware*
8. After you disconnect the Surface Dock the DisplayPort firmware update will be installed. This process occurs on the Surface Dock hardware while it is disconnected. The Surface Dock must remain powered for up to 3 minutes after it has been disconnected for the firmware update to successfully install. An **Update in Progress** page is displayed (as shown in Figure 6), with a countdown timer to show the estimated time remaining to complete the firmware update installation. 8. After you disconnect the Surface Dock the DisplayPort firmware update will be installed. This process occurs on the Surface Dock hardware while it is disconnected. The Surface Dock must remain powered for up to 3 minutes after it has been disconnected for the firmware update to successfully install. An **Update in Progress** page is displayed (as shown in Figure 6), with a countdown timer to show the estimated time remaining to complete the firmware update installation.
![figure 6](images/surfacedockupdater-fig6-countdown.png) ![Countdown timer to complete firmware installation](images/surfacedockupdater-fig6-countdown.png "Countdown timer to complete firmware installation")
Figure 6. Countdown timer to complete firmware installation on Surface Dock *Figure 6. Countdown timer to complete firmware installation on Surface Dock*
9. If you want to update multiple Surface Docks in one sitting, you can click the **Update another Surface Dock** button to begin the process on the next Surface Dock. 9. If you want to update multiple Surface Docks in one sitting, you can click the **Update another Surface Dock** button to begin the process on the next Surface Dock.
@ -83,9 +83,9 @@ To update a Surface Dock with Microsoft Surface Dock Updater, follow these steps
If the Surface Dock firmware update process encounters an installation error with either firmware update, the **Encountered an unexpected error** page may be displayed, as shown in Figure 7. If the Surface Dock firmware update process encounters an installation error with either firmware update, the **Encountered an unexpected error** page may be displayed, as shown in Figure 7.
![figure 7](images/surfacedockupdater-fig7-error.png) ![Firmware update installation error](images/surfacedockupdater-fig7-error.png "Firmware update installation error")
Figure 7. Firmware update installation has encountered an error *Figure 7. Firmware update installation has encountered an error*
Microsoft Surface Dock Updater logs its progress into the Event Log, as shown in Figure 8. If you need to troubleshoot an update through this tool, you will find Surface Dock events recorded with the following event IDs: Microsoft Surface Dock Updater logs its progress into the Event Log, as shown in Figure 8. If you need to troubleshoot an update through this tool, you will find Surface Dock events recorded with the following event IDs:
@ -97,9 +97,9 @@ Microsoft Surface Dock Updater logs its progress into the Event Log, as shown in
| 12105 | Error | | 12105 | Error |
Figure 8. Surface Dock Updater events in Event Viewer ![Surface Dock Updater events in Event Viewer](images/surfacedockupdater-fig8-737test.png "Surface Dock Updater events in Event Viewer")
![figure 8](images/surfacedockupdater-fig8-737test.png) *Figure 8. Surface Dock Updater events in Event Viewer*
## Related topics ## Related topics

8
windows/keep-secure/device-guard-deployment-guide.md
View File

@ -752,7 +752,7 @@ To modify the policy rule options of an existing code integrity policy, use the
You can set several rule options within a code integrity policy. Table 2 lists each rule and its high-level meaning. You can set several rule options within a code integrity policy. Table 2 lists each rule and its high-level meaning.
Table 2. Code integrity policy - policy rule options #### Table 2. Code integrity policy - policy rule options
| Rule option | Description | | Rule option | Description |
|------------ | ----------- | |------------ | ----------- |
@ -769,15 +769,15 @@ Table 2. Code integrity policy - policy rule options
| **10 Enabled:Boot Audit on Failure** | Used when the code integrity policy is in enforcement mode. When a driver fails during startup, the code integrity policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | | **10 Enabled:Boot Audit on Failure** | Used when the code integrity policy is in enforcement mode. When a driver fails during startup, the code integrity policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. |
File rule levels allow administrators to specify the level at which they want to trust their applications. This level of trust could be as low as the hash of each binary and as high as a PCA certificate. File rule levels are specified both when you create a new code integrity policy from a scan and when you create a policy from audit events. In addition, to combine rule levels found in multiple policies, you can merge the policies. When merged, code integrity policies combine their file rules. Each file rule level has its benefit and disadvantage. Use Table 3 to select the appropriate protection level for your available administrative resources and Device Guard deployment scenario. File rule levels allow administrators to specify the level at which they want to trust their applications. This level of trust could be as low as the hash of each binary and as high as a PCA certificate. File rule levels are specified both when you create a new code integrity policy from a scan and when you create a policy from audit events. In addition, to combine rule levels found in multiple policies, you can merge the policies. When merged, code integrity policies combine their file rules. Each file rule level has its benefit and disadvantage. Use Table 3 to select the appropriate protection level for your available administrative resources and Device Guard deployment scenario.
Table 3. Code integrity policy - file rule levels #### Table 3. Code integrity policy - file rule levels
| Rule level | Description | | Rule level | Description |
|----------- | ----------- | |----------- | ----------- |
| **Hash** | Specifies individual hash values for each discovered binary. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. | | **Hash** | Specifies individual hash values for each discovered binary. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. |
| **FileName** | Specifies individual binary file names. Although the hash values for an application are modified when updated, the file names are typically not. This offers less specific security than the hash level but does not typically require a policy update when any binary is modified. | | **FileName** | Specifies individual binary file names. Although the hash values for an application are modified when updated, the file names are typically not. This offers less specific security than the hash level but does not typically require a policy update when any binary is modified. |
| **SignedVersion** | This combines the publisher rule with a file version number. This option allows anything from the specified publisher, with a file version at or above the specified version number, to run. | | **SignedVersion** | This combines the publisher rule with a version number. This option allows anything from the specified publisher, with a version at or above the specified version number, to run. |
| **Publisher** | This is a combination of the PCA certificate and the common name (CN) on the leaf certificate. In the scenario that a PCA certificate is used to sign multiple companies’ applications (such as VeriSign), this rule level allows organizations to trust the PCA certificate but only for the company whose name is on the leaf certificate (for example, Intel for device drivers). This level trusts a certificate with a long validity period but only when combined with a trusted leaf certificate. | | **Publisher** | This is a combination of the PCA certificate and the common name (CN) on the leaf certificate. In the scenario that a PCA certificate is used to sign multiple companies’ applications (such as VeriSign), this rule level allows organizations to trust the PCA certificate but only for the company whose name is on the leaf certificate (for example, Intel for device drivers). This level trusts a certificate with a long validity period but only when combined with a trusted leaf certificate. |
| **FilePublisher** | This is a combination of the publisher file rule level and the SignedVersion rule level. Any signed file from the trusted publisher that is the specified version or newer is trusted. | | **FilePublisher** | This is a combination of “FileName” plus “Publisher” (PCA certificate with CN of leaf) plus a minimum version number. This option trusts specific files from the specified publisher, with a version at or above the specified version number. |
| **LeafCertificate** | Adds trusted signers at the individual signing certificate level. The benefit of using this level versus the individual hash level is that new versions of the product will have different hash values but typically the same signing certificate. Using this level, no policy update would be needed to run the new version of the application. However, leaf certificates have much shorter validity periods than PCA certificates, so additional administrative overhead is associated with updating the code integrity policy when these certificates expire. | | **LeafCertificate** | Adds trusted signers at the individual signing certificate level. The benefit of using this level versus the individual hash level is that new versions of the product will have different hash values but typically the same signing certificate. Using this level, no policy update would be needed to run the new version of the application. However, leaf certificates have much shorter validity periods than PCA certificates, so additional administrative overhead is associated with updating the code integrity policy when these certificates expire. |
| **PcaCertificate** | Adds the highest certificate in the provided certificate chain to signers. This is typically one certificate below the root certificate, because the scan does not validate anything above the presented signature by going online or checking local root stores. | | **PcaCertificate** | Adds the highest certificate in the provided certificate chain to signers. This is typically one certificate below the root certificate, because the scan does not validate anything above the presented signature by going online or checking local root stores. |
| **RootCertificate** | Currently unsupported. | | **RootCertificate** | Currently unsupported. |