diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index e06f28392e..4658a2f02b 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -31,7 +31,7 @@ "build_output_subfolder": "devices/hololens", "locale": "en-us", "version": 0, - "open_to_public_contributors": false, + "open_to_public_contributors": true, "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", @@ -93,6 +93,20 @@ "type_mapping": { "Conceptual": "Content" } + }, + { + "docset_name": "smb", + "build_source_folder": "smb", + "build_output_subfolder": "smb", + "locale": "en-us", + "version": 0, + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "op" } ], "notification_subscribers": [ @@ -104,5 +118,6 @@ "git_repository_url_open_to_public_contributors": "https://github.com/Microsoft/windows-itpro-docs", "git_repository_branch_open_to_public_contributors": "master", "skip_source_output_uploading": false, - "dependent_repositories": [] + "dependent_repositories": [], + "need_generate_pdf_url_template": false } \ No newline at end of file diff --git a/browsers/edge/Index.md b/browsers/edge/Index.md index e261955400..d2f29d473e 100644 --- a/browsers/edge/Index.md +++ b/browsers/edge/Index.md @@ -58,6 +58,7 @@ You'll need to keep running them using IE11. If you don't have IE11 installed an ## Related topics +- [Total Economic Impact of Microsoft Edge: Infographic](https://www.microsoft.com/en-us/download/details.aspx?id=53892) - [Download Internet Explorer 11](https://go.microsoft.com/fwlink/p/?linkid=290956) - [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760644) - [Internet Explorer 11 - FAQ for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760645) diff --git a/browsers/edge/change-history-for-microsoft-edge.md b/browsers/edge/change-history-for-microsoft-edge.md index dc88de7152..f188b5e0ee 100644 --- a/browsers/edge/change-history-for-microsoft-edge.md +++ b/browsers/edge/change-history-for-microsoft-edge.md @@ -4,6 +4,7 @@ description: This topic lists new and updated topics in the Microsoft Edge docum ms.prod: edge ms.mktglfcycl: explore ms.sitesec: library +localizationpriority: high --- # Change history for Microsoft Edge diff --git a/devices/surface/TOC.md b/devices/surface/TOC.md index c2eea7a99c..ee3fbbd2b8 100644 --- a/devices/surface/TOC.md +++ b/devices/surface/TOC.md @@ -21,6 +21,7 @@ ## [Surface Enterprise Management Mode](surface-enterprise-management-mode.md) ### [Enroll and configure Surface devices with SEMM](enroll-and-configure-surface-devices-with-semm.md) ### [Unenroll Surface devices from SEMM](unenroll-surface-devices-from-semm.md) +### [Use System Center Configuration Manager to manage devices with SEMM](use-system-center-configuration-manager-to-manage-devices-with-semm.md) ## [Surface Diagnostic Toolkit](surface-diagnostic-toolkit.md) ## [Surface Data Eraser](microsoft-surface-data-eraser.md) ## [Change history for Surface documentation](change-history-for-surface.md) diff --git a/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md b/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md index 6caa1ce23a..359032994a 100644 --- a/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md +++ b/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md @@ -21,7 +21,7 @@ To address more granular control over the security of Surface devices, the v3.11 ## Manually install the UEFI update -Before you can configure the advanced security features of your Surface device, you must first install the v3.11.760.0 UEFI update. This update is installed automatically if you receive your updates from Windows Update. For more information about how to configure Windows to update automatically by using Windows Update, see [How to configure and use Automatic Updates in Windows]( https://go.microsoft.com/fwlink/p/?LinkID=618030). +Before you can configure the advanced security features of your Surface device, you must first install the v3.11.760.0 UEFI update. This update is installed automatically if you receive your updates from Windows Update. For more information about how to configure Windows to update automatically by using Windows Update, see [How to configure and use Automatic Updates in Windows](https://support.microsoft.com/en-us/kb/306525). To update the UEFI on Surface Pro 3, you can download and install the Surface UEFI updates as part of the Surface Pro 3 Firmware and Driver Pack. These firmware and driver packs are available from the [Surface Pro 3 page](https://www.microsoft.com/download/details.aspx?id=38826) on the Microsoft Download Center. You can find out more about the firmware and driver packs at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). The firmware and driver packs are available as both self-contained Windows Installer (.msi) and archive (.zip) formats. You can find out more about these two formats and how you can use them to update your drivers at [Manage Surface driver and firmware updates](https://technet.microsoft.com/itpro/surface/manage-surface-pro-3-firmware-updates). @@ -56,7 +56,7 @@ As an IT professional with administrative privileges, you can automate the confi - The sample scripts below leverage the previously mentioned extension and therefore assume that the tool has been installed on the device being managed. - The scripts must be run with administrative privilege. -- The Windows PowerShell command [**Set-ExecutionPolicy Unrestricted**](https://go.microsoft.com/fwlink/p/?LinkID=618039) must be called prior to running sample scripts if they are not digitally signed. +- The Windows PowerShell command [**Set-ExecutionPolicy Unrestricted**](https://technet.microsoft.com/library/ee176961.aspx) must be called prior to running sample scripts if they are not digitally signed. **Sample scripts** diff --git a/devices/surface/change-history-for-surface.md b/devices/surface/change-history-for-surface.md index dd716e83f7..3297316928 100644 --- a/devices/surface/change-history-for-surface.md +++ b/devices/surface/change-history-for-surface.md @@ -11,6 +11,14 @@ author: jdeckerMS This topic lists new and updated topics in the Surface documentation library. +## November 2016 + +|New or changed topic | Description | +| --- | --- | +|[Use System Center Configuration Manager to manage devices with SEMM](use-system-center-configuration-manager-to-manage-devices-with-semm.md) | New | + + + ## October 2016 | New or changed topic | Description | diff --git a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md index 447e377d2c..caf7719cc4 100644 --- a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md +++ b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md @@ -22,12 +22,12 @@ Although the deployment and management of Surface devices is fundamentally the s ## Updating Surface device drivers and firmware -For devices that receive updates through Windows Update, drivers for Surface components – and even firmware updates – are applied automatically as part of the Windows Update process. For devices with managed updates, such as those updated through Windows Server Update Services (WSUS), the option to install drivers and firmware through Windows Update is not available. For these managed devices, the recommended driver management process is the deployment of driver and firmware updates using the Windows Installer (.msi) files, which are provided through the Microsoft Download Center. You can find a list of these downloads at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/en-us/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). +For devices that receive updates through Windows Update, drivers for Surface components – and even firmware updates – are applied automatically as part of the Windows Update process. For devices with managed updates, such as those updated through Windows Server Update Services (WSUS), the option to install drivers and firmware through Windows Update is not available. For these managed devices, the recommended driver management process is the deployment of driver and firmware updates using the Windows Installer (.msi) files, which are provided through the Microsoft Download Center. You can find a list of these downloads at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). -As .msi files, deployment of driver and firmware updates is performed in the same manner as deployment of an application. Instead of installing an application as would normally happen when an .msi file is run, the Surface driver and firmware .msi will apply the driver and firmware updates to the device. The single .msi file contains the driver and firmware updates required by each component of the Surface device. The updates for firmware are applied the next time the device reboots. You can read more about the .msi installation method for Surface drivers and firmware in [Manage Surface driver and firmware updates](https://technet.microsoft.com/en-us/itpro/surface/manage-surface-pro-3-firmware-updates). For more information about how to deploy applications with Configuration Manager, see [Packages and programs in System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/apps/deploy-use/packages-and-programs). +As .msi files, deployment of driver and firmware updates is performed in the same manner as deployment of an application. Instead of installing an application as would normally happen when an .msi file is run, the Surface driver and firmware .msi will apply the driver and firmware updates to the device. The single .msi file contains the driver and firmware updates required by each component of the Surface device. The updates for firmware are applied the next time the device reboots. You can read more about the .msi installation method for Surface drivers and firmware in [Manage Surface driver and firmware updates](https://technet.microsoft.com/itpro/surface/manage-surface-pro-3-firmware-updates). For more information about how to deploy applications with Configuration Manager, see [Packages and programs in System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/packages-and-programs). >[!NOTE] ->Surface device drivers and firmware are signed with SHA-256, which is not natively supported by Windows Server 2008 R2. A workaround is available for Configuration Manager environments running on Windows Server 2008 R2 – for more information see [Can't import drivers into System Center Configuration Manager (KB3025419)](https://support.microsoft.com/en-us/kb/3025419). +>Surface device drivers and firmware are signed with SHA-256, which is not natively supported by Windows Server 2008 R2. A workaround is available for Configuration Manager environments running on Windows Server 2008 R2 – for more information see [Can't import drivers into System Center Configuration Manager (KB3025419)](https://support.microsoft.com/kb/3025419). ## Surface Ethernet adapters and Configuration Manager deployment @@ -47,11 +47,11 @@ For versions of Windows prior to Windows 10, version 1511 (including Windows 10 ## Deploy Surface app with Configuration Manager -With the release of Windows Store for Business, Surface app is no longer available as a driver and firmware download. Organizations that want to deploy Surface app to managed Surface devices or during deployment with the use of Configuration Manager, must acquire Surface app through Windows Store for Business and then deploy Surface app with PowerShell. You can find the PowerShell commands for deployment of Surface app, instructions to download Surface app, and prerequisite frameworks from Windows Store for Business in the [Deploy Surface app with Windows Store for Business](https://technet.microsoft.com/en-us/itpro/surface/deploy-surface-app-with-windows-store-for-business) article in the TechNet Library. +With the release of Windows Store for Business, Surface app is no longer available as a driver and firmware download. Organizations that want to deploy Surface app to managed Surface devices or during deployment with the use of Configuration Manager, must acquire Surface app through Windows Store for Business and then deploy Surface app with PowerShell. You can find the PowerShell commands for deployment of Surface app, instructions to download Surface app, and prerequisite frameworks from Windows Store for Business in the [Deploy Surface app with Windows Store for Business](https://technet.microsoft.com/itpro/surface/deploy-surface-app-with-windows-store-for-business) article in the TechNet Library. ## Use prestaged media with Surface clients -If your organization uses prestaged media to pre-load deployment resources on to machines prior to deployment with Configuration Manager, the nature of Surface devices as UEFI devices may require you to take additional steps. Specifically, a native UEFI environment requires that you create multiple partitions on the boot disk of the system. If you are following along with the [documentation for prestaged media](https://technet.microsoft.com/en-us/library/79465d90-4831-4872-96c2-2062d80f5583?f=255&MSPPError=-2147217396#BKMK_CreatePrestagedMedia), the instructions provide for only single partition boot disks and therefore will fail when applied to Surface devices. +If your organization uses prestaged media to pre-load deployment resources on to machines prior to deployment with Configuration Manager, the nature of Surface devices as UEFI devices may require you to take additional steps. Specifically, a native UEFI environment requires that you create multiple partitions on the boot disk of the system. If you are following along with the [documentation for prestaged media](https://technet.microsoft.com/library/79465d90-4831-4872-96c2-2062d80f5583?f=255&MSPPError=-2147217396#BKMK_CreatePrestagedMedia), the instructions provide for only single partition boot disks and therefore will fail when applied to Surface devices. Instructions for applying prestaged media to UEFI devices, such as Surface devices, can be found in the [How to apply Task Sequence Prestaged Media on multi-partitioned disks for BIOS or UEFI PCs in System Center Configuration Manager](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2014/04/02/how-to-apply-task-sequence-prestaged-media-on-multi-partitioned-disks-for-bios-or-uefi-pcs-in-system-center-configuration-manager/) blog post. @@ -61,16 +61,16 @@ Surface devices come preinstalled with a licensed copy of Windows. For example, When you reimage a device by using Windows Enterprise, this embedded license key does not cause a conflict. This is because the installation media for Windows Enterprise is configured to install only an Enterprise edition of Windows and therefore is incompatible with the license key embedded in the system firmware. If a product key is not specified (such as when you intend to activate with Key Management Services (KMS) or Active Directory Based Activation), a Generic Volume License Key (GVLK) is used until Windows is activated by one of those technologies. -However, issues may arise when organizations intend to use versions of Windows that are compatible with the firmware embedded key. For example, an organization that wants to install Windows 10 Professional on a Surface 3 device that originally shipped with Windows 10 Home edition may encounter difficulty when Windows setup automatically reads the Home edition key during installation and installs as Home edition rather than Professional. To avoid this conflict, you can use the Ei.cfg or Pid.txt file (see [Windows Setup Edition Configuration and Product ID Files](https://technet.microsoft.com/en-us/library/hh824952.aspx)) to explicitly instruct Windows setup to prompt for a product key, or you can enter a specific product key in the deployment task sequence. If you do not have a specific key, you can use the default product keys for Windows, which you can find in [Customize and deploy a Windows 10 operating system](https://dpcenter.microsoft.com/en/Windows/Build/cp-Windows-10-build) on the Device Partner Center. +However, issues may arise when organizations intend to use versions of Windows that are compatible with the firmware embedded key. For example, an organization that wants to install Windows 10 Professional on a Surface 3 device that originally shipped with Windows 10 Home edition may encounter difficulty when Windows setup automatically reads the Home edition key during installation and installs as Home edition rather than Professional. To avoid this conflict, you can use the Ei.cfg or Pid.txt file (see [Windows Setup Edition Configuration and Product ID Files](https://technet.microsoft.com/library/hh824952.aspx)) to explicitly instruct Windows setup to prompt for a product key, or you can enter a specific product key in the deployment task sequence. If you do not have a specific key, you can use the default product keys for Windows, which you can find in [Customize and deploy a Windows 10 operating system](https://dpcenter.microsoft.com/en/Windows/Build/cp-Windows-10-build) on the Device Partner Center. ## Apply an asset tag during deployment Surface Book, Surface Pro 4, Surface Pro 3, and Surface 3 devices all support the application of an asset tag in UEFI. This asset tag can be used to identify the device from UEFI even if the operating system fails, and it can also be queried from within the operating system. To read more about the Surface Asset Tag function, see the [Asset Tag Tool for Surface Pro 3](https://blogs.technet.microsoft.com/askcore/2014/10/20/asset-tag-tool-for-surface-pro-3/) blog post. -To apply an asset tag using the [Surface Asset Tag CLI Utility](https://www.microsoft.com/en-us/download/details.aspx?id=44076) during a Configuration Manager deployment task sequence, use the script and instructions found in the [Set Surface Asset Tag During a Configuration Manager Task Sequence](https://blogs.technet.microsoft.com/jchalfant/set-surface-pro-3-asset-tag-during-a-configuration-manager-task-sequence/) blog post. +To apply an asset tag using the [Surface Asset Tag CLI Utility](https://www.microsoft.com/download/details.aspx?id=44076) during a Configuration Manager deployment task sequence, use the script and instructions found in the [Set Surface Asset Tag During a Configuration Manager Task Sequence](https://blogs.technet.microsoft.com/jchalfant/set-surface-pro-3-asset-tag-during-a-configuration-manager-task-sequence/) blog post. ## Configure push-button reset When you deploy Windows to a Surface device, the push-button reset functionality of Windows is configured by default to revert the system back to a state where the environment is not yet configured. When the reset function is used, the system discards any installed applications and settings. Although in some situations it can be beneficial to restore the system to a state without applications and settings, in a professional environment this effectively renders the system unusable to the end user. -Push-button reset can be configured, however, to restore the system configuration to a state where it is ready for use by the end user. Follow the process outlined in [Deploy push-button reset features](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/manufacture/desktop/deploy-push-button-reset-features) to customize the push-button reset experience for your devices. +Push-button reset can be configured, however, to restore the system configuration to a state where it is ready for use by the end user. Follow the process outlined in [Deploy push-button reset features](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/deploy-push-button-reset-features) to customize the push-button reset experience for your devices. diff --git a/devices/surface/customize-the-oobe-for-surface-deployments.md b/devices/surface/customize-the-oobe-for-surface-deployments.md index 8532617b50..df861406ec 100644 --- a/devices/surface/customize-the-oobe-for-surface-deployments.md +++ b/devices/surface/customize-the-oobe-for-surface-deployments.md @@ -22,7 +22,7 @@ It is common practice in a Windows deployment to customize the user experience f In some scenarios, you may want to provide complete automation to ensure that at the end of a deployment, computers are ready for use without any interaction from the user. In other scenarios, you may want to leave key elements of the experience for users to perform necessary actions or select between important choices. For administrators deploying to Surface devices, each of these scenarios presents a unique challenge to overcome. -This article provides a summary of the scenarios where a deployment might require additional steps. It also provides the required information to ensure that the desired experience is achieved on any newly deployed Surface device. This article is intended for administrators who are familiar with the deployment process, as well as concepts such as answer files and [reference images](https://go.microsoft.com/fwlink/p/?LinkID=618042). +This article provides a summary of the scenarios where a deployment might require additional steps. It also provides the required information to ensure that the desired experience is achieved on any newly deployed Surface device. This article is intended for administrators who are familiar with the deployment process, as well as concepts such as answer files and [reference images](https://technet.microsoft.com/itpro/windows/deploy/create-a-windows-10-reference-image). >**Note:**  Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see:
- [Deploy Windows 10 with the Microsoft Deployment Toolkit](http://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit) @@ -36,7 +36,7 @@ This article provides a summary of the scenarios where a deployment might requir When a wireless network adapter is present during OOBE, the **Join a wireless network** page is displayed, which prompts a user to connect to a wireless network. This page is not automatically hidden by deployment technologies, including MDT 2013, and therefore will be displayed even when a deployment is configured for complete automation. -To ensure that an automated deployment is not stopped by this page, the page must be hidden by configuring an additional setting in the answer file, **HideWirelessSetupInOOBE**. You can find additional information about the **HideWirelessSetupInOOBE** setting in [Unattended Windows Setup Reference](https://go.microsoft.com/fwlink/p/?LinkID=618044). +To ensure that an automated deployment is not stopped by this page, the page must be hidden by configuring an additional setting in the answer file, **HideWirelessSetupInOOBE**. You can find additional information about the **HideWirelessSetupInOOBE** setting in [Unattended Windows Setup Reference](https://technet.microsoft.com/library/ff716213.aspx). ## Scenario 2: Surface Pen pairing in OOBE @@ -54,7 +54,7 @@ To provide the factory Surface Pen pairing experience in OOBE, you must copy fou   -The step-by-step process for adding these required files to an image is described in [Deploying Surface Pro 3 Pen and OneNote Tips](https://go.microsoft.com/fwlink/p/?LinkID=618045). This blog post also includes tips to ensure that the necessary updates for the Surface Pen Quick Note-Taking Experience are installed, which allows users to send notes to OneNote with a single click. +The step-by-step process for adding these required files to an image is described in [Deploying Surface Pro 3 Pen and OneNote Tips](https://blogs.technet.microsoft.com/askcore/2014/07/15/deploying-surface-pro-3-pen-and-onenote-tips/). This blog post also includes tips to ensure that the necessary updates for the Surface Pen Quick Note-Taking Experience are installed, which allows users to send notes to OneNote with a single click.   diff --git a/devices/surface/deploy-surface-app-with-windows-store-for-business.md b/devices/surface/deploy-surface-app-with-windows-store-for-business.md index c2263b5065..6183f55206 100644 --- a/devices/surface/deploy-surface-app-with-windows-store-for-business.md +++ b/devices/surface/deploy-surface-app-with-windows-store-for-business.md @@ -27,13 +27,13 @@ If your organization is preparing images that will be deployed to your Surface d ####Surface app overview -The Surface app is available as a free download from the [Windows Store](https://www.microsoft.com/en-us/store/apps/Surface/9WZDNCRFJB8P). Users can download and install it from the Windows Store, but if your organization uses Windows Store for Business instead, you will need to add it to your store’s inventory and possibly include the app as part of your Windows deployment process. These processes are discussed throughout this article. For more information about Windows Store for Business, see [Windows Store for Business](https://technet.microsoft.com/en-us/windows/store-for-business) in the Windows TechCenter. +The Surface app is available as a free download from the [Windows Store](https://www.microsoft.com/store/apps/Surface/9WZDNCRFJB8P). Users can download and install it from the Windows Store, but if your organization uses Windows Store for Business instead, you will need to add it to your store’s inventory and possibly include the app as part of your Windows deployment process. These processes are discussed throughout this article. For more information about Windows Store for Business, see [Windows Store for Business](https://technet.microsoft.com/windows/store-for-business) in the Windows TechCenter. ##Add Surface app to a Windows Store for Business account Before users can install or deploy an app from a company’s Windows Store for Business account, the desired app(s) must first be made available and licensed to the users of a business. -1. If you have not already done so, create a [Windows Store for Business account](https://www.microsoft.com/en-us/business-store). +1. If you have not already done so, create a [Windows Store for Business account](https://www.microsoft.com/business-store). 2. Log on to the portal. @@ -144,4 +144,4 @@ After import, the Surface app will be available for selection in the **Applicati 2. Add a new **Install Application** task in the **State Restore** section of deployment. 3. Select **Install a single application** and specify the **Surface App** as the **Application to be installed**. -For more information about including apps into your Windows deployments, see [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit). +For more information about including apps into your Windows deployments, see [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit). diff --git a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md index 2df6fdcd7f..8a5ff4b34e 100644 --- a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md +++ b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md @@ -33,14 +33,14 @@ Installation files for administrative tools, drivers for accessories, and update Recent additions to the downloads for Surface devices provide you with options to install Windows 10 on your Surface devices and update LTE devices with the latest Windows 10 drivers and firmware. ->**Note:**  A battery charge of 40% or greater is required before you install firmware to a Surface device. See [Microsoft Support article KB2909710](https://go.microsoft.com/fwlink/p/?LinkId=618106) for more information. +>**Note:**  A battery charge of 40% or greater is required before you install firmware to a Surface device. See [Microsoft Support article KB2909710](https://support.microsoft.com/en-us/kb/2909710) for more information.   ## Surface Book -Download the following updates [for Surface Book from the Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=691691). +Download the following updates [for Surface Book from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49497). - SurfaceBook\_Win10\_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10 @@ -49,7 +49,7 @@ Download the following updates [for Surface Book from the Microsoft Download Cen ## Surface Pro 4 -Download the following updates for [Surface Pro 4 from the Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=691692). +Download the following updates for [Surface Pro 4 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49498). - SurfacePro4\_Win10\_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10 @@ -58,7 +58,7 @@ Download the following updates for [Surface Pro 4 from the Microsoft Download Ce ## Surface Pro 3 -Download the following updates [for Surface Pro 3 from the Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=690288). +Download the following updates [for Surface Pro 3 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=38826). - SurfacePro3\_Win10\_xxxxxx.msi – Cumulative firmware and driver update package for Windows 10 @@ -85,7 +85,7 @@ Download the following updates [for Surface Pro 3 from the Microsoft Download Ce ## Surface 3 -Download the following updates [for Surface 3 from the Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=690289). +Download the following updates [for Surface 3 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49040). - Surface3\_Win10\_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10 @@ -102,7 +102,7 @@ Download the following updates [for Surface 3 from the Microsoft Download Center ## Surface 3 LTE -Download the following updates [for AT&T 4G LTE versions of Surface 3 from the Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=690290). +Download the following updates [for AT&T 4G LTE versions of Surface 3 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49039). - Surface3\_US1\_Win10\_xxxxxx.msi – Surface 3 LTE AT&T - Cumulative firmware and driver update for locked carrier dependent AT&T devices in the US, running Windows 10 @@ -118,7 +118,7 @@ Download the following updates [for AT&T 4G LTE versions of Surface 3 from the M - Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1 -Download the following updates [for non-AT&T 4G LTE versions of Surface 3 from the Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=690291). +Download the following updates [for non-AT&T 4G LTE versions of Surface 3 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49037). - Surface3\_NAG\_Win10\_xxxxxx.msi – Surface 3 LTE North America - Cumulative firmware and driver update for unlocked carrier independent devices in the US, running Windows 10 @@ -134,7 +134,7 @@ Download the following updates [for non-AT&T 4G LTE versions of Surface 3 from t - Wintab-xxxxx-64-bit.zip – Tablet driver update for all supported x64-based versions of Windows 8.1 -Download the following updates [for 4G LTE Surface 3 versions for regions outside North America from the Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=690292). +Download the following updates [for 4G LTE Surface 3 versions for regions outside North America from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49041). - Surface3\_ROW\_Win10\_xxxxxx.msi – Surface 3 LTE rest of the world cumulative - Cumulative firmware and driver update for carrier independent devices outside of the US, as well as for Japan, running Windows 10 @@ -153,7 +153,7 @@ Download the following updates [for 4G LTE Surface 3 versions for regions outsid ## Surface Pro 2 -Download the following updates [for Surface Pro 2 from the Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=690293). +Download the following updates [for Surface Pro 2 from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49042). - SurfacePro2\_Win10\_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10 @@ -168,7 +168,7 @@ Download the following updates [for Surface Pro 2 from the Microsoft Download Ce ## Surface Pro -Download the following updates [for Surface Pro from the Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=690294). +Download the following updates [for Surface Pro from the Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=49038). - SurfacePro\_Win10\_xxxxxx.zip – Cumulative firmware and driver update package for Windows 10 @@ -185,7 +185,7 @@ Download the following updates [for Surface Pro from the Microsoft Download Cent There are no downloadable firmware or driver updates available for Surface RT. Updates can only be applied using Windows Update. -If you have additional questions on the driver pack and updates, please contact [Microsoft Surface support for business](https://go.microsoft.com/fwlink/p/?LinkId=618107). +If you have additional questions on the driver pack and updates, please contact [Microsoft Surface support for business](https://www.microsoft.com/surface/support/business).   diff --git a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md index a29f37c0ef..f16b7e5abd 100644 --- a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md +++ b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md @@ -29,31 +29,31 @@ By automating each aspect of the deployment process, you not only greatly decrea ## Deployment tools -The deployment process described in this article leverages a number of Microsoft deployment tools and technologies. Some of these tools and technologies are included in Windows client and Windows Server, such as Hyper-V and Windows Deployment Services (WDS), while others are available as free downloads from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/windows.aspx). +The deployment process described in this article leverages a number of Microsoft deployment tools and technologies. Some of these tools and technologies are included in Windows client and Windows Server, such as Hyper-V and Windows Deployment Services (WDS), while others are available as free downloads from the [Microsoft Download Center](https://www.microsoft.com/download/windows.aspx). #### Microsoft Deployment Toolkit The Microsoft Deployment Toolkit (MDT) is the primary component of a Windows deployment. It serves as a unified interface for most of the Microsoft deployment tools and technologies, such as the Windows Assessment and Deployment Kit (Windows ADK), Windows System Image Manager (Windows SIM), Deployment Image Servicing and Management (DISM), User State Migration Tool (USMT), and many other tools and technologies. Each of these is discussed throughout this article. The unified interface, called the *Deployment Workbench*, facilitates automation of the deployment process through a series of stored deployment procedures, known as a *task sequence*. Along with these task sequences and the many scripts and tools that MDT provides, the resources for a Windows deployment (driver files, application installation files, and image files) are stored in a network share known as the *deployment share*. -You can download and find out more about MDT at [Microsoft Deployment Toolkit](https://technet.microsoft.com/en-us/windows/dn475741). +You can download and find out more about MDT at [Microsoft Deployment Toolkit](https://technet.microsoft.com/windows/dn475741). #### Windows Assessment and Deployment Kit Although MDT is the tool you will interact with most during the deployment process, the deployment tools found in the Windows ADK perform most of the deployment tasks during the deployment process. The resources for deployment are held within the MDT deployment share, but it is the collection of tools included in Windows ADK that access the image files, stage drivers and Windows updates, run the deployment experience, provide instructions to Windows Setup, and back up and restore user data. -You can download and find out more about the Windows ADK at [Download the Windows ADK](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit#windowsadk). +You can download and find out more about the Windows ADK at [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#windowsadk). #### Windows 10 installation media Before you can perform a deployment with MDT, you must first supply a set of operating system installation files and an operating system image. These files and image can be found on the physical installation media (DVD) for Windows 10. You can also find these files in the disk image (ISO file) for Windows 10, which you can download from the [Volume Licensing Service Center (VLSC)](https://www.microsoft.com/Licensing/servicecenter/default.aspx). ->**Note:**  The installation media generated from the [Get Windows 10](https://www.microsoft.com/en-us/software-download/windows10/) page differs from physical media or media downloaded from the VLSC, in that it contains an image file in Electronic Software Download (ESD) format rather than in the Windows Imaging (WIM) format. Installation media with an image file in WIM format is required for use with MDT. Installation media from the Get Windows 10 page cannot be used for Windows deployment with MDT. +>**Note:**  The installation media generated from the [Get Windows 10](https://www.microsoft.com/software-download/windows10/) page differs from physical media or media downloaded from the VLSC, in that it contains an image file in Electronic Software Download (ESD) format rather than in the Windows Imaging (WIM) format. Installation media with an image file in WIM format is required for use with MDT. Installation media from the Get Windows 10 page cannot be used for Windows deployment with MDT. #### Windows Server Although MDT can be installed on a Windows client, to take full advantage of Windows Deployment Services’ ability to network boot, a full Windows Server environment is recommended. To provide network boot for UEFI devices like Surface with WDS, you will need Windows Server 2008 R2 or later. ->**Note:**  To evaluate the deployment process for Surface devices or to test the deployment process described in this article with the upcoming release of Windows Server 2016, you can download evaluation and preview versions from the [TechNet Evaluation Center](https://www.microsoft.com/en-us/evalcenter). +>**Note:**  To evaluate the deployment process for Surface devices or to test the deployment process described in this article with the upcoming release of Windows Server 2016, you can download evaluation and preview versions from the [TechNet Evaluation Center](https://www.microsoft.com/evalcenter). #### Windows Deployment Services @@ -67,13 +67,13 @@ The process of creating a reference image should always be performed in a virtua Because customizations are performed by MDT at the time of deployment, the goal of reference image creation is not to perform customization but to increase performance during deployment by reducing the number of actions that need to occur on each deployed device. The biggest action that can slow down an MDT deployment is the installation of Windows updates. When MDT performs this step during the deployment process, it downloads the updates on each deployed device and installs them. By installing Windows updates in your reference image, the updates are already installed when the image is deployed to the device and the MDT update process only needs to install updates that are new since the image was created or are applicable to products other than Windows (for example, Microsoft Office updates). ->**Note:**  Hyper-V is available not only on Windows Server, but also on Windows clients, including Professional and Enterprise editions of Windows 8, Windows 8.1, and Windows 10. Find out more at [Client Hyper-V on Windows 10](https://msdn.microsoft.com/virtualization/hyperv_on_windows/windows_welcome) and [Client Hyper-V on Windows 8 and Windows 8.1](https://technet.microsoft.com/library/hh857623) in the TechNet Library. Hyper-V is also available as a standalone product, Microsoft Hyper-V Server, at no cost. You can download [Microsoft Hyper-V Server 2012 R2](https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-2012-r2) or [Microsoft Hyper-V Server 2016 Technical Preview](https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-technical-preview) from the TechNet Evaluation Center. +>**Note:**  Hyper-V is available not only on Windows Server, but also on Windows clients, including Professional and Enterprise editions of Windows 8, Windows 8.1, and Windows 10. Find out more at [Client Hyper-V on Windows 10](https://msdn.microsoft.com/virtualization/hyperv_on_windows/windows_welcome) and [Client Hyper-V on Windows 8 and Windows 8.1](https://technet.microsoft.com/library/hh857623) in the TechNet Library. Hyper-V is also available as a standalone product, Microsoft Hyper-V Server, at no cost. You can download [Microsoft Hyper-V Server 2012 R2](https://www.microsoft.com/evalcenter/evaluate-hyper-v-server-2012-r2) or [Microsoft Hyper-V Server 2016 Technical Preview](https://www.microsoft.com/evalcenter/evaluate-hyper-v-server-technical-preview) from the TechNet Evaluation Center. #### Surface firmware and drivers For your deployed Windows environment to function correctly on your Surface devices, you will need to install the drivers used by Windows to communicate with the components of your device. These drivers are available for download in the Microsoft Download Center for each Surface device. You can find the correct Microsoft Download Center page for your device at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). -When you browse to the specific Microsoft Download Center page for your device, you will notice that there are two files available for download. One file is a Windows Installer (.msi) file. This file is used to update drivers on devices that are already running Windows or that have device management solutions. The other file is an archive (.zip) file. This file contains the individual driver files that are used during deployment, or for manual installation with Device Manager. The file that you will need to download is the .zip archive file. You can read more about the difference between the firmware and driver pack file types at [Manage Surface driver and firmware updates](https://technet.microsoft.com/en-us/itpro/surface/manage-surface-pro-3-firmware-updates). +When you browse to the specific Microsoft Download Center page for your device, you will notice that there are two files available for download. One file is a Windows Installer (.msi) file. This file is used to update drivers on devices that are already running Windows or that have device management solutions. The other file is an archive (.zip) file. This file contains the individual driver files that are used during deployment, or for manual installation with Device Manager. The file that you will need to download is the .zip archive file. You can read more about the difference between the firmware and driver pack file types at [Manage Surface driver and firmware updates](https://technet.microsoft.com/itpro/surface/manage-surface-pro-3-firmware-updates). In addition to the driver files that help Windows communicate with the hardware components of the Surface device, the .zip file you download will also contain firmware updates. These firmware updates will update the instructions used by the device hardware to communicate between components and Windows. The firmware of Surface device components is updated by installation of specific driver files and thus is installed along with the other drivers during deployment. The firmware of an out-of-date Surface device is thus updated when the device reboots during and after the Windows deployment process. @@ -88,7 +88,7 @@ In addition to the drivers that are used by Windows to communicate with the Surf #### Microsoft Surface Deployment Accelerator -If you want to deploy only to Surface devices or you want an accelerated method to perform deployment to Surface devices, you can use the Microsoft Surface Deployment Accelerator to generate an MDT deployment share complete with Surface device drivers, Surface apps, and pre-configured task sequences to create a reference image and perform deployment to Surface devices. Microsoft Surface Deployment Accelerator can automatically import boot images into WDS and prepare WDS for network boot (PXE). You can download the Microsoft Surface Deployment Accelerator from the [Surface Tools for IT](https://www.microsoft.com/en-us/download/details.aspx?id=46703) page in the Microsoft Download Center. +If you want to deploy only to Surface devices or you want an accelerated method to perform deployment to Surface devices, you can use the Microsoft Surface Deployment Accelerator to generate an MDT deployment share complete with Surface device drivers, Surface apps, and pre-configured task sequences to create a reference image and perform deployment to Surface devices. Microsoft Surface Deployment Accelerator can automatically import boot images into WDS and prepare WDS for network boot (PXE). You can download the Microsoft Surface Deployment Accelerator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. ### Install the deployment tools @@ -120,7 +120,7 @@ Using the Windows Deployment Services Configuration Wizard, configure WDS to fit #### Install Windows Assessment and Deployment Kit -To install Windows ADK, run the Adksetup.exe file that you downloaded from [Download the Windows ADK](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit#adkwin10). Windows ADK must be installed before MDT. You should always download and use the most recent version of Windows ADK. A new version is usually released corresponding with each new version of Windows. +To install Windows ADK, run the Adksetup.exe file that you downloaded from [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#adkwin10). Windows ADK must be installed before MDT. You should always download and use the most recent version of Windows ADK. A new version is usually released corresponding with each new version of Windows. >**Note:**  You can also use the Adksetup.exe file to download the Windows ADK installation files locally for use on other devices. @@ -409,7 +409,7 @@ Now that your updated reference image is imported, it is time to prepare your de Before you can deploy your updated reference image to Surface devices, or any physical environment, you need to supply MDT with the drivers that Windows will use to communicate with that physical environment. For Surface devices you can download all of the drivers required by Windows in a single archive (.zip) file in a format that is ready for deployment. In addition to the drivers that are used by Windows to communicate with the hardware and components, Surface firmware and driver packs also include updates for the firmware of those components. By installing the Surface firmware and driver pack, you will also bring your device’s firmware up to date. If you have not done so already, download the drivers for your Surface device listed at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). -Many devices require that you import drivers specifically for WinPE in order for the MDT boot media to communicate with the deployment share and to boot properly on that device. Even Surface Pro 3 required that network drivers be imported specifically for WinPE for deployment of Windows 8.1. Fortunately, for Windows 10 deployments to Surface devices, all of the required drivers for operation of WinPE are contained within the out-of-box drivers that are built into Windows 10. It is still a good idea to prepare your environment with folder structure and selection profiles that allow you to specify drivers for use in WinPE. You can read more about that folder structure in **Step 5: Prepare the drivers repository** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt/#sec05). +Many devices require that you import drivers specifically for WinPE in order for the MDT boot media to communicate with the deployment share and to boot properly on that device. Even Surface Pro 3 required that network drivers be imported specifically for WinPE for deployment of Windows 8.1. Fortunately, for Windows 10 deployments to Surface devices, all of the required drivers for operation of WinPE are contained within the out-of-box drivers that are built into Windows 10. It is still a good idea to prepare your environment with folder structure and selection profiles that allow you to specify drivers for use in WinPE. You can read more about that folder structure in **Step 5: Prepare the drivers repository** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt/#sec05). To import the Surface drivers (in this example, Surface Pro 4) into MDT, follow these steps: @@ -445,7 +445,7 @@ To import the Surface drivers (in this example, Surface Pro 4) into MDT, follow ### Import applications -You can import any number of applications into MDT for installation on your devices during the deployment process. You can configure your applications and task sequences to prompt you during deployment to pick and choose which applications are installed, or you can use your task sequence to explicitly define which applications are installed. For more information, see **Step 4: Add an application** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt/#sec04). +You can import any number of applications into MDT for installation on your devices during the deployment process. You can configure your applications and task sequences to prompt you during deployment to pick and choose which applications are installed, or you can use your task sequence to explicitly define which applications are installed. For more information, see **Step 4: Add an application** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt/#sec04). #### Import Microsoft Office 365 Installer @@ -499,9 +499,9 @@ Now that the installation and configuration files are prepared, the application #### Import Surface app installer -The Surface app is a Windows Store app that provides the user with greater control over specific Surface device functions and capabilities (for example, control over the sensitivity of the Surface Pen). It is a highly recommended app for Surface devices to provide end users with the best experience and greatest control over their device. Find out more about the Surface app at [Install and use the Surface app](https://www.microsoft.com/surface/en-us/support/apps-and-windows-store/surface-app?os=windows-10). +The Surface app is a Windows Store app that provides the user with greater control over specific Surface device functions and capabilities (for example, control over the sensitivity of the Surface Pen). It is a highly recommended app for Surface devices to provide end users with the best experience and greatest control over their device. Find out more about the Surface app at [Install and use the Surface app](https://www.microsoft.com/surface/support/apps-and-windows-store/surface-app?os=windows-10). -To perform a deployment of the Surface app, you will need to download the app files through Windows Store for Business. You can find detailed instructions on how to download the Surface app through Windows Store for Business at [Deploy Surface app with Windows Store for Business](https://technet.microsoft.com/en-us/itpro/surface/deploy-surface-app-with-windows-store-for-business). +To perform a deployment of the Surface app, you will need to download the app files through Windows Store for Business. You can find detailed instructions on how to download the Surface app through Windows Store for Business at [Deploy Surface app with Windows Store for Business](https://technet.microsoft.com/itpro/surface/deploy-surface-app-with-windows-store-for-business). After you have downloaded the installation files for Surface app, including the AppxBundle and license files, you can import these files into the deployment share through the same process as a desktop application like Microsoft Office. Both the AppxBundle and license files must be together in the same folder for the import process to complete successfully. Use the following command on the **Command Details** page to install the Surface app: ``` diff --git a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md b/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md index dfda75ad0f..5013bcb538 100644 --- a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md +++ b/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md @@ -16,14 +16,14 @@ author: miladCA Find out how to enable support for PEAP, EAP-FAST, or Cisco LEAP protocols on your Surface device. -If you use PEAP, EAP-FAST, or Cisco LEAP in your enterprise network, you probably already know that these three wireless authentication protocols are not supported by Surface devices out of the box. Some users may discover this when they attempt to connect to your wireless network; others may discover it when they are unable to gain access to resources inside the network, like file shares and internal sites. For more information, see [Extensible Authentication Protocol](https://go.microsoft.com/fwlink/p/?LinkId=716899). +If you use PEAP, EAP-FAST, or Cisco LEAP in your enterprise network, you probably already know that these three wireless authentication protocols are not supported by Surface devices out of the box. Some users may discover this when they attempt to connect to your wireless network; others may discover it when they are unable to gain access to resources inside the network, like file shares and internal sites. For more information, see [Extensible Authentication Protocol](https://technet.microsoft.com/network/bb643147). You can add support for each protocol by executing a small MSI package from a USB stick or from a file share. For organizations that want to enable EAP support on their Surface devices, the MSI package format supports deployment with many management and deployment tools, like the Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. ## Download PEAP, EAP-FAST, or Cisco LEAP installation files -You can download the MSI installation files for PEAP, EAP-FAST, or Cisco LEAP in a single zip archive file from the Microsoft Download Center. To download this file, go to the [Surface Tools for IT](https://go.microsoft.com/fwlink/p/?LinkId=618121) page on the Microsoft Download Center, click **Download**, and then select the **Cisco EAP-Supplicant Installer.zip** file. +You can download the MSI installation files for PEAP, EAP-FAST, or Cisco LEAP in a single zip archive file from the Microsoft Download Center. To download this file, go to the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page on the Microsoft Download Center, click **Download**, and then select the **Cisco EAP-Supplicant Installer.zip** file. ## Deploy PEAP, EAP-FAST, or Cisco LEAP with MDT @@ -79,7 +79,7 @@ To specify the protocol(s) explicitly, follow these steps: For organizations that manage Surface devices with Configuration Manager, it is even easier to deploy PEAP, EAP-FAST, or Cisco LEAP support to Surface devices. Simply import each MSI file as an application from the Software Library and configure a deployment to your Surface device collection. -For more information on how to deploy applications with Configuration Manager see [How to Create Applications in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=761079) and [How to Deploy Applications in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=761080). +For more information on how to deploy applications with Configuration Manager see [How to Create Applications in Configuration Manager](https://technet.microsoft.com/library/gg682159.aspx) and [How to Deploy Applications in Configuration Manager](https://technet.microsoft.com/library/gg682082.aspx).   diff --git a/devices/surface/enroll-and-configure-surface-devices-with-semm.md b/devices/surface/enroll-and-configure-surface-devices-with-semm.md index 08696c682d..1140eb46c7 100644 --- a/devices/surface/enroll-and-configure-surface-devices-with-semm.md +++ b/devices/surface/enroll-and-configure-surface-devices-with-semm.md @@ -13,17 +13,17 @@ author: jobotto With Microsoft Surface Enterprise Management Mode (SEMM), you can securely configure the settings of Surface UEFI on a Surface device and manage those settings on Surface devices in your organization. When a Surface device is managed by SEMM, that device is considered to be *enrolled* (sometimes referred to as activated). This article shows you how to create a Surface UEFI configuration package that will not only control the settings of Surface UEFI, but will also enroll a Surface device in SEMM. -For a more high-level overview of SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/en-us/itpro/surface/surface-enterprise-management-mode). +For a more high-level overview of SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode). #### Download and install Microsoft Surface UEFI Configurator -The tool used to create SEMM packages is Microsoft Surface UEFI Configurator. You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/en-us/download/details.aspx?id=46703) page in the Microsoft Download Center. +The tool used to create SEMM packages is Microsoft Surface UEFI Configurator. You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. Run the Microsoft Surface UEFI Configurator Windows Installer (.msi) file to start the installation of the tool. When the installer completes, find Microsoft Surface UEFI Configurator in the All Apps section of your Start menu. >**Note**:  Microsoft Surface UEFI Configurator is supported only on Windows 10. ## Create a Surface UEFI configuration package -The Surface UEFI configuration package performs both the role of applying a new configuration of Surface UEFI settings to a Surface device managed with SEMM and the role of enrolling Surface devices in SEMM. The creation of a configuration package requires you to have a signing certificate to be used with SEMM to secure the configuration of UEFI settings on each Surface device. For more information about the requirements for the SEMM certificate, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/en-us/itpro/surface/surface-enterprise-management-mode). +The Surface UEFI configuration package performs both the role of applying a new configuration of Surface UEFI settings to a Surface device managed with SEMM and the role of enrolling Surface devices in SEMM. The creation of a configuration package requires you to have a signing certificate to be used with SEMM to secure the configuration of UEFI settings on each Surface device. For more information about the requirements for the SEMM certificate, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode). To create a Surface UEFI configuration package, follow these steps: @@ -58,7 +58,7 @@ To create a Surface UEFI configuration package, follow these steps: *Figure 4. Disable or enable individual Surface components* 11. Click **Next**. -12. To enable or disable advanced options in Surface UEFI or the display of Surface UEFI pages, on the **Choose the advanced settings for your devices** page, click the slider beside the desired setting to configure that option to **On** or **Off** (shown in Figure 5). In the **UEFI Front Page** section, you can use the sliders for **Security**, **Devices**, and **Boot** to control what pages are available to users who boot into Surface UEFI. (For more information about Surface UEFI settings, see [Manage Surface UEFI settings](https://technet.microsoft.com/en-us/itpro/surface/manage-surface-uefi-settings).) Click **Build** when you have finished selecting options to generate and save the package. +12. To enable or disable advanced options in Surface UEFI or the display of Surface UEFI pages, on the **Choose the advanced settings for your devices** page, click the slider beside the desired setting to configure that option to **On** or **Off** (shown in Figure 5). In the **UEFI Front Page** section, you can use the sliders for **Security**, **Devices**, and **Boot** to control what pages are available to users who boot into Surface UEFI. (For more information about Surface UEFI settings, see [Manage Surface UEFI settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings).) Click **Build** when you have finished selecting options to generate and save the package. ![Control advanced Surface UEFI settings and Surface UEFI pages](images\surface-semm-enroll-fig5.png "Control advanced Surface UEFI settings and Surface UEFI pages") diff --git a/devices/surface/ethernet-adapters-and-surface-device-deployment.md b/devices/surface/ethernet-adapters-and-surface-device-deployment.md index 1babe7d7c6..78b995935a 100644 --- a/devices/surface/ethernet-adapters-and-surface-device-deployment.md +++ b/devices/surface/ethernet-adapters-and-surface-device-deployment.md @@ -25,7 +25,7 @@ Before you can address the concerns of how you will boot to your deployment envi The primary concern when selecting an Ethernet adapter is how that adapter will boot your Surface device from the network. If you are pre-staging clients with Windows Deployment Services (WDS) or if you are using System Center Configuration Manager, you may also want to consider whether the removable Ethernet adapters will be dedicated to a specific Surface device or shared among multiple devices. See the [Manage MAC addresses with removable Ethernet adapters](#manage-mac-addresses) section of this article for more information on potential conflicts with shared adapters. -Booting from the network (PXE boot) is only supported when you use an Ethernet adapter or docking station from Microsoft. To boot from the network, the chipset in the Ethernet adapter or dock must be detected and configured as a boot device in the firmware of the Surface device. Microsoft Ethernet adapters, such as the Surface Ethernet Adapter and the [Surface Dock](https://go.microsoft.com/fwlink/p/?LinkId=722364) use a chipset that is compatible with the Surface firmware. +Booting from the network (PXE boot) is only supported when you use an Ethernet adapter or docking station from Microsoft. To boot from the network, the chipset in the Ethernet adapter or dock must be detected and configured as a boot device in the firmware of the Surface device. Microsoft Ethernet adapters, such as the Surface Ethernet Adapter and the [Surface Dock](https://www.microsoft.com/surface/accessories/surface-dock) use a chipset that is compatible with the Surface firmware. The following Ethernet devices are supported for network boot with Surface devices: @@ -67,7 +67,7 @@ Another consideration for administrators performing Windows deployment over the The simplest solution to avoid MAC address conflicts is to provide a dedicated removable Ethernet adapter for each Surface device. This can make sense in many scenarios where the Ethernet adapter or the additional functionality of the docking station will be used regularly. However, not all scenarios call for the additional connectivity of a docking station or support for wired networks. -Another potential solution to avoid conflict when adapters are shared is to use the [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=618117) to perform deployment to Surface devices. MDT does not use the MAC address to identify individual computers and thus is not subject to this limitation. However, MDT does use Windows Deployment Services to provide PXE boot functionality, and is subject to the limitations regarding pre-staged clients which is covered later in this section. +Another potential solution to avoid conflict when adapters are shared is to use the [Microsoft Deployment Toolkit (MDT)](https://technet.microsoft.com/windows/dn475741) to perform deployment to Surface devices. MDT does not use the MAC address to identify individual computers and thus is not subject to this limitation. However, MDT does use Windows Deployment Services to provide PXE boot functionality, and is subject to the limitations regarding pre-staged clients which is covered later in this section. When you use a shared adapter for deployment, the solution for affected deployment technologies is to use another means to identify unique systems. For Configuration Manager and WDS, both of which can be affected by this issue, the solution is to use the System Universal Unique Identifier (System UUID) that is embedded in the computer firmware by the computer manufacturer. For Surface devices, you can see this entry in the computer firmware under **Device Information**. @@ -78,9 +78,9 @@ To access the firmware of a Surface device, follow these steps: 3. Press and release the **Power** button. 4. After the device begins to boot, release the **Volume Up** button. -When deploying with WDS, the MAC address is only used to identify a computer when the deployment server is configured to respond only to known, pre-staged clients. When pre-staging a client, an administrator creates a computer account in Active Directory and defines that computer by the MAC address or the System UUID. To avoid the identity conflicts caused by shared Ethernet adapters, you should use [System UUID to define pre-staged clients](https://go.microsoft.com/fwlink/p/?LinkId=618118). Alternatively, you can configure WDS to respond to unknown clients that do not require definition by either MAC address or System UUID by selecting the **Respond to all client computers (known and unknown)** option on the [**PXE Response** tab](https://go.microsoft.com/fwlink/p/?LinkId=618119) in **Windows Deployment Server Properties**. +When deploying with WDS, the MAC address is only used to identify a computer when the deployment server is configured to respond only to known, pre-staged clients. When pre-staging a client, an administrator creates a computer account in Active Directory and defines that computer by the MAC address or the System UUID. To avoid the identity conflicts caused by shared Ethernet adapters, you should use [System UUID to define pre-staged clients](https://technet.microsoft.com/library/cc742034). Alternatively, you can configure WDS to respond to unknown clients that do not require definition by either MAC address or System UUID by selecting the **Respond to all client computers (known and unknown)** option on the [**PXE Response** tab](https://technet.microsoft.com/library/cc732360) in **Windows Deployment Server Properties**. -The potential for conflicts with shared Ethernet adapters is much higher with Configuration Manager. Where WDS only uses MAC addresses to define individual systems when configured to do so, Configuration Manager uses the MAC address to define individual systems whenever performing a deployment to new or unknown computers. This can result in improperly configured devices or even the inability to deploy more than one system with a shared Ethernet adapter. There are several potential solutions for this situation that are described in detail in the [How to Use The Same External Ethernet Adapter For Multiple SCCM OSD](https://go.microsoft.com/fwlink/p/?LinkId=618120) blog post on the Ask Premier Field Engineering (PFE) Platforms TechNet blog. +The potential for conflicts with shared Ethernet adapters is much higher with Configuration Manager. Where WDS only uses MAC addresses to define individual systems when configured to do so, Configuration Manager uses the MAC address to define individual systems whenever performing a deployment to new or unknown computers. This can result in improperly configured devices or even the inability to deploy more than one system with a shared Ethernet adapter. There are several potential solutions for this situation that are described in detail in the [How to Use The Same External Ethernet Adapter For Multiple SCCM OSD](https://blogs.technet.microsoft.com/askpfeplat/2014/07/27/how-to-use-the-same-external-ethernet-adapter-for-multiple-sccm-osd/) blog post on the Ask Premier Field Engineering (PFE) Platforms TechNet blog.   diff --git a/devices/surface/images/config-mgr-semm-fig1.png b/devices/surface/images/config-mgr-semm-fig1.png new file mode 100644 index 0000000000..7ff888c2e2 Binary files /dev/null and b/devices/surface/images/config-mgr-semm-fig1.png differ diff --git a/devices/surface/images/config-mgr-semm-fig2.png b/devices/surface/images/config-mgr-semm-fig2.png new file mode 100644 index 0000000000..33836c09eb Binary files /dev/null and b/devices/surface/images/config-mgr-semm-fig2.png differ diff --git a/devices/surface/images/config-mgr-semm-fig3.png b/devices/surface/images/config-mgr-semm-fig3.png new file mode 100644 index 0000000000..c844b60531 Binary files /dev/null and b/devices/surface/images/config-mgr-semm-fig3.png differ diff --git a/devices/surface/manage-surface-dock-firmware-updates.md b/devices/surface/manage-surface-dock-firmware-updates.md index f2d71be1b0..1335d5a808 100644 --- a/devices/surface/manage-surface-dock-firmware-updates.md +++ b/devices/surface/manage-surface-dock-firmware-updates.md @@ -22,7 +22,7 @@ Like the firmware for Surface devices, firmware for Surface Dock is also contain >**Note:**  You can learn more about the firmware update process for Surface devices and how firmware is updated through driver installation at the following links:
- [How to manage and update Surface drivers and firmware](https://technet.microsoft.com/mt697551) from Microsoft Mechanics -- [Windows Update Makes Surface Better](https://go.microsoft.com/fwlink/p/?LinkId=785354) on the Microsoft Devices Blog +- [Windows Update Makes Surface Better](https://blogs.windows.com/devices/2014/04/15/windows-update-makes-surface-better/#0MqzmYgshCDaJpvK.97) on the Microsoft Devices Blog   @@ -79,7 +79,7 @@ Windows Update is the method that most users will use. The drivers for the Surfa This method is used mostly in environments where Surface device drivers and firmware are managed separately from Windows Update. See [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md) for more information about the different methods to manage Surface device driver and firmware updates. Updating the Surface Dock firmware through this method involves downloading and deploying an MSI package to the Surface device that contains the updated Surface Dock drivers and firmware. This is the same method recommended for updating all other Surface drivers and firmware. The two-phase firmware update process occurs in the background each time the Surface Dock is disconnected, just like it does with the Windows Update method. -For more information about how to deploy MSI packages see [Create and deploy an application with System Center Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=785355). +For more information about how to deploy MSI packages see [Create and deploy an application with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/get-started/create-and-deploy-an-application). >**Note:**  When drivers are installed through Windows Update or the MSI package, registry keys are added that indicate the version of firmware installed on the Surface Dock and contained within the Surface Dock driver. These registry keys can be found in:

**HLKM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\WUDF\\Services\\SurfaceDockFwUpdate\\Parameters** @@ -103,7 +103,7 @@ Firmware status is displayed for both the main chipset (displayed as **Component The manual method using the Microsoft Surface Dock Updater tool to update the Surface Dock is used mostly in environments where IT prepares Surface Docks prior to delivery to the end user, or for troubleshooting of a Surface Dock. Microsoft Surface Dock Updater is a tool that you can run from any Surface device that is compatible with the Surface Dock, and will walk you through the process of performing the Surface Dock firmware update in the least possible amount of time. You can also use this tool to verify the firmware status of a connected Surface Dock. -For more information about how to use the Microsoft Surface Dock Updater tool, please see [Microsoft Surface Dock Updater](surface-dock-updater.md). You can download the Microsoft Surface Dock Updater tool from the [Surface Tools for IT page](https://go.microsoft.com/fwlink/p/?LinkId=618121) on the Microsoft Download Center. +For more information about how to use the Microsoft Surface Dock Updater tool, please see [Microsoft Surface Dock Updater](surface-dock-updater.md). You can download the Microsoft Surface Dock Updater tool from the [Surface Tools for IT page](https://www.microsoft.com/download/details.aspx?id=46703) on the Microsoft Download Center.   diff --git a/devices/surface/manage-surface-pro-3-firmware-updates.md b/devices/surface/manage-surface-pro-3-firmware-updates.md index 521f6e38a2..eb0fea2fee 100644 --- a/devices/surface/manage-surface-pro-3-firmware-updates.md +++ b/devices/surface/manage-surface-pro-3-firmware-updates.md @@ -31,26 +31,26 @@ The simplest solution to ensure that firmware on Surface devices in your organiz Although this solution ensures that firmware will be updated as new releases are made available to Windows Update, it does present potential drawbacks. Each Surface device that receives Windows Updates directly will separately download each update rather than accessing a central location, which increases demand on Internet connectivity and bandwidth. Updates are also provided automatically to devices, without being subjected to testing or review by administrators. -For details about Group Policy for client configuration of WSUS or Windows Update, see [Step 5: Configure Group Policy Settings for Automatic Updates](https://go.microsoft.com/fwlink/p/?LinkId=618172). +For details about Group Policy for client configuration of WSUS or Windows Update, see [Step 5: Configure Group Policy Settings for Automatic Updates](https://technet.microsoft.com/library/dn595129). **Windows Installer Package** -The firmware and driver downloads for Surface devices now include Windows Installer files for firmware and driver updates. These Windows Installer packages can be deployed with utilities that support application deployment, including the Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. This solution allows for centralized deployment and for administrators to test and review firmware updates before they are deployed. For more information about the Windows Installer package delivery method for firmware and driver updates, including details on what drivers are updated by the package and why certain drivers and firmware are not updated by the Windows Installer package, see the [Surface Pro 3 MSI Now Available](https://go.microsoft.com/fwlink/p/?LinkId=618173) blog post. +The firmware and driver downloads for Surface devices now include Windows Installer files for firmware and driver updates. These Windows Installer packages can be deployed with utilities that support application deployment, including the Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. This solution allows for centralized deployment and for administrators to test and review firmware updates before they are deployed. For more information about the Windows Installer package delivery method for firmware and driver updates, including details on what drivers are updated by the package and why certain drivers and firmware are not updated by the Windows Installer package, see the [Surface Pro 3 MSI Now Available](https://blogs.technet.microsoft.com/surface/2015/03/04/surface-pro-3-msi-now-available/) blog post. -For instructions on how to deploy with System Center Configuration Manager, refer to [How to Deploy Applications in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=618175). For deployment of applications with MDT, see [Step 4: Add an application in the Deploy a Windows 8.1 Image Using MDT 2013](https://go.microsoft.com/fwlink/p/?LinkId=618176). Note that you can deploy applications separately from an operating system deployment through MDT by using a Post OS Installation task sequence. +For instructions on how to deploy with System Center Configuration Manager, refer to [How to Deploy Applications in Configuration Manager](https://technet.microsoft.com/library/gg682082). For deployment of applications with MDT, see [Step 4: Add an application in the Deploy a Windows 8.1 Image Using MDT 2013](https://technet.microsoft.com/library/dn744279#sec04). Note that you can deploy applications separately from an operating system deployment through MDT by using a Post OS Installation task sequence. **Provisioning packages** -New in Windows 10, provisioning packages (PPKG files) provide a simple method to apply a configuration to a destination device. You can find out more about provisioning packages, including instructions for how to create your own, in [Provisioning packages](https://go.microsoft.com/fwlink/p/?LinkId=761075). For easy application of a complete set of drivers and firmware to devices running Windows 10, a provisioning package is supplied for Surface Pro 3 devices. This file contains all of the instructions and required assets to update a Surface Pro 3 device with Windows 10 to the latest drivers and firmware. +New in Windows 10, provisioning packages (PPKG files) provide a simple method to apply a configuration to a destination device. You can find out more about provisioning packages, including instructions for how to create your own, in [Provisioning packages](https://technet.microsoft.com/itpro/windows/deploy/provisioning-packages). For easy application of a complete set of drivers and firmware to devices running Windows 10, a provisioning package is supplied for Surface Pro 3 devices. This file contains all of the instructions and required assets to update a Surface Pro 3 device with Windows 10 to the latest drivers and firmware. **Windows PowerShell** -Another method you can use to update the firmware when Windows Updates are managed in the organization is to install the firmware from the firmware and driver pack by using PowerShell. This method allows for a similar deployment experience to the Windows Installer package and can similarly be deployed as a package by using System Center Configuration Manager. You can find the PowerShell script and details on how to perform the firmware deployment in the [Deploying Drivers and Firmware to Surface Pro](https://go.microsoft.com/fwlink/p/?LinkId=618177) blog post. +Another method you can use to update the firmware when Windows Updates are managed in the organization is to install the firmware from the firmware and driver pack by using PowerShell. This method allows for a similar deployment experience to the Windows Installer package and can similarly be deployed as a package by using System Center Configuration Manager. You can find the PowerShell script and details on how to perform the firmware deployment in the [Deploying Drivers and Firmware to Surface Pro](https://blogs.technet.microsoft.com/deploymentguys/2013/05/16/deploying-drivers-and-firmware-to-surface-pro/) blog post. ## Operating system deployment considerations -The deployment of firmware updates during an operating system deployment is a straightforward process. The firmware and driver pack can be imported into either System Center Configuration Manager or MDT, and are used to deploy a fully updated environment, complete with firmware, to a target Surface device. For a complete step-by-step guide for deployment to Surface Pro 3 using either Configuration Manager or MDT, download the [Deployment and Administration Guide for Surface Pro 3](https://go.microsoft.com/fwlink/p/?LinkId=618178) from the Microsoft Download Center. +The deployment of firmware updates during an operating system deployment is a straightforward process. The firmware and driver pack can be imported into either System Center Configuration Manager or MDT, and are used to deploy a fully updated environment, complete with firmware, to a target Surface device. For a complete step-by-step guide for deployment to Surface Pro 3 using either Configuration Manager or MDT, download the [Deployment and Administration Guide for Surface Pro 3](https://www.microsoft.com/download/details.aspx?id=45292) from the Microsoft Download Center. The individual driver files are also made available in the Microsoft Download Center if you are using deployment tools. The driver files are available in the ZIP archive file in the list of available downloads for your device. @@ -60,7 +60,7 @@ A best practice for deployment with any solution that uses the Windows Preinstal **Update Surface Pro 3 firmware offline through USB** -In some early versions of Surface Pro 3 firmware, PXE boot performance can be quite slow. This has been resolved with updated firmware, but for organizations where firmware will be updated through operating system deployment, this issue is encountered before the updates can be deployed to the device. In this scenario, you can deploy updated firmware through a USB drive to ensure that when the operating system deployment is initiated, the network boot is quick, and deployment can complete in a timely fashion. To create a USB drive to update Surface Pro 3 firmware, see [How to Update the Surface Pro 3 Firmware Offline using a USB Drive](https://go.microsoft.com/fwlink/p/?LinkId=618189) on the Ask Premier Field Engineering (PFE) Platforms TechNet Blog. +In some early versions of Surface Pro 3 firmware, PXE boot performance can be quite slow. This has been resolved with updated firmware, but for organizations where firmware will be updated through operating system deployment, this issue is encountered before the updates can be deployed to the device. In this scenario, you can deploy updated firmware through a USB drive to ensure that when the operating system deployment is initiated, the network boot is quick, and deployment can complete in a timely fashion. To create a USB drive to update Surface Pro 3 firmware, see [How to Update the Surface Pro 3 Firmware Offline using a USB Drive](https://blogs.technet.microsoft.com/askpfeplat/2014/10/19/how-to-update-the-surface-pro-3-firmware-offline-using-a-usb-drive/) on the Ask Premier Field Engineering (PFE) Platforms TechNet Blog.   diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md index d885af5dd9..b1f6626197 100644 --- a/devices/surface/microsoft-surface-data-eraser.md +++ b/devices/surface/microsoft-surface-data-eraser.md @@ -16,7 +16,7 @@ author: miladCA Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices. -[Microsoft Surface Data Eraser](https://go.microsoft.com/fwlink/p/?LinkId=691148) is a tool that boots from a USB stick and allows you to perform a secure wipe of all data from a compatible Surface device. A Microsoft Surface Data Eraser USB stick requires only the ability to boot from USB. The USB tool is easy to create by using the provided wizard, the Microsoft Surface Data Eraser Wrapper, and is easy to use with a simple graphic interface, no command line needed. To learn more about the data wiping capabilities and practices Microsoft uses during the service process for Surface, see [Protecting your data if you send your Surface in for service](https://go.microsoft.com/fwlink/p/?LinkId=691222). +[Microsoft Surface Data Eraser](https://www.microsoft.com/download/details.aspx?id=46703) is a tool that boots from a USB stick and allows you to perform a secure wipe of all data from a compatible Surface device. A Microsoft Surface Data Eraser USB stick requires only the ability to boot from USB. The USB tool is easy to create by using the provided wizard, the Microsoft Surface Data Eraser Wrapper, and is easy to use with a simple graphic interface, no command line needed. To learn more about the data wiping capabilities and practices Microsoft uses during the service process for Surface, see [Protecting your data if you send your Surface in for service](https://www.microsoft.com/surface/support/security-sign-in-and-accounts/data-wiping-policy). Compatible Surface devices include: diff --git a/devices/surface/microsoft-surface-deployment-accelerator.md b/devices/surface/microsoft-surface-deployment-accelerator.md index 9c4d792a9d..4358e9b005 100644 --- a/devices/surface/microsoft-surface-deployment-accelerator.md +++ b/devices/surface/microsoft-surface-deployment-accelerator.md @@ -20,13 +20,13 @@ SDA includes a wizard that automates the creation and configuration of a Microso SDA is built on the powerful suite of deployment tools available from Microsoft including the Windows Assessment and Deployment Kit (ADK), the Microsoft Deployment Toolkit (MDT), and Windows Deployment Services (WDS). The resulting deployment share encompasses the recommended best practices for managing drivers during deployment and automating image creation and can serve as a starting point upon which you build your own customized deployment solution. -You can find more information about how to deploy to Surface devices, including step-by-step walkthroughs of customized deployment solution implementation, on the Deploy page of the [Surface TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=691693). +You can find more information about how to deploy to Surface devices, including step-by-step walkthroughs of customized deployment solution implementation, on the Deploy page of the [Surface TechCenter](https://technet.microsoft.com/windows/dn913725). **Download Microsoft Surface Deployment Accelerator** You can download the installation files for SDA from the Microsoft Download Center. To download the installation files: -1. Go to the [Surface Tools for IT](https://go.microsoft.com/fwlink/p/?LinkId=618121) page on the Microsoft Download Center. +1. Go to the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page on the Microsoft Download Center. 2. Click the **Download** button, select the **Surface\_Deployment\_Accelerator\_xxxx.msi** file, and then click **Next**. @@ -60,7 +60,7 @@ As you progress through the SDA wizard, you will be asked some basic questions a When the SDA completes, you can use the deployment share to deploy over the network immediately. Simply boot your Surface device from the network using a Surface Ethernet Adapter and select the Surface deployment share you created with the SDA wizard. Select the **1- Deploy Microsoft Surface** task sequence and the wizard will walk you through an automated deployment of Windows to your Surface device. -You can modify the task sequence in the MDT Deployment Workbench to [include your own apps](https://go.microsoft.com/fwlink/p/?linkid=691700), or to [pause the automated installation routine](https://go.microsoft.com/fwlink/p/?linkid=691701). While the installation is paused, you can make changes to customize your reference image. After the image is captured, you can configure a deployment task sequence and distribute this custom configuration by using the same network boot capabilities as before. +You can modify the task sequence in the MDT Deployment Workbench to [include your own apps](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt#sec04), or to [pause the automated installation routine](https://blogs.technet.microsoft.com/mniehaus/2009/06/26/mdt-2010-new-feature-3-suspend-and-resume-a-lite-touch-task-sequence/). While the installation is paused, you can make changes to customize your reference image. After the image is captured, you can configure a deployment task sequence and distribute this custom configuration by using the same network boot capabilities as before. >**Note:**  With SDA v1.9.0258, Surface Pro 3, Surface Pro 4, and Surface Book are supported for Windows 10 deployment, and Surface Pro 3 is supported for Windows 8.1 deployment. diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md index 2024ee1ca9..914ae3a4d1 100644 --- a/devices/surface/step-by-step-surface-deployment-accelerator.md +++ b/devices/surface/step-by-step-surface-deployment-accelerator.md @@ -21,7 +21,7 @@ This article shows you how to install Microsoft Surface Deployment Accelerator ( For information about prerequisites and instructions for how to download and install SDA, see [Microsoft Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md). -1. Download SDA, which is included in [Surface Tools for IT](https://go.microsoft.com/fwlink/p/?LinkId=618121) on the Microsoft Download Center. +1. Download SDA, which is included in [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) on the Microsoft Download Center. 2. Run the SDA installation file, named **Surface\_Deployment\_Accelerator\_*xxxx*.msi**, where *xxxx* is the current version number. @@ -77,7 +77,7 @@ The following steps show you how to create a deployment share for Windows 10 th - **Windows 10 Deployment Services** - - Select the **Import boot media into the local Windows Deployment Service** check box if you would like to boot your Surface devices from the network to perform the Windows deployment. Windows Deployment Services must be installed and configured to respond to PXE boot requests. See [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://go.microsoft.com/fwlink/p/?LinkId=761072) for more information about how to configure Windows Deployment Services for PXE boot. + - Select the **Import boot media into the local Windows Deployment Service** check box if you would like to boot your Surface devices from the network to perform the Windows deployment. Windows Deployment Services must be installed and configured to respond to PXE boot requests. See [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/library/jj648426.aspx) for more information about how to configure Windows Deployment Services for PXE boot. - **Windows 10 Source Files** diff --git a/devices/surface/surface-diagnostic-toolkit.md b/devices/surface/surface-diagnostic-toolkit.md index fcf3eb8f6b..ee50c340e7 100644 --- a/devices/surface/surface-diagnostic-toolkit.md +++ b/devices/surface/surface-diagnostic-toolkit.md @@ -16,7 +16,7 @@ author: miladCA Find out how you can use the Microsoft Surface Diagnostic Toolkit to test the hardware of your Surface device. -The [Microsoft Surface Diagnostic Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=618121) is a small, portable diagnostic tool that runs through a suite of tests to diagnose the hardware of Surface devices. The Microsoft Surface Diagnostic Toolkit executable file is less than 3 MB, which allows it to be distributed through email. It does not require installation, so it can be run directly from a USB stick or over the network. The Microsoft Surface Diagnostic Toolkit walks you through several tests of individual components including the touchscreen, cameras, and sensors. +The [Microsoft Surface Diagnostic Toolkit](https://www.microsoft.com/download/details.aspx?id=46703) is a small, portable diagnostic tool that runs through a suite of tests to diagnose the hardware of Surface devices. The Microsoft Surface Diagnostic Toolkit executable file is less than 3 MB, which allows it to be distributed through email. It does not require installation, so it can be run directly from a USB stick or over the network. The Microsoft Surface Diagnostic Toolkit walks you through several tests of individual components including the touchscreen, cameras, and sensors. >**Note:**  A Surface device must boot into Windows to run the Microsoft Surface Diagnostic Toolkit. The Microsoft Surface Diagnostic Toolkit will run only on the following Surface devices: @@ -123,7 +123,7 @@ This test checks for any outstanding Windows updates and will prompt you to inst #### Device information -This test reads the Device ID and serial number in addition to basic system information such as device model, operating system version, processor, memory, and storage. The Device ID is recorded in the name of the log file and can be used to identify a log file for a specific device. Several system log files are also collected, including update and rollback logs, and output from several Windows built-in tools, such as [DirectX Diagnostics](https://go.microsoft.com/fwlink/p/?LinkId=746476) and [System Information](https://go.microsoft.com/fwlink/p/?LinkId=746477), power configuration, disk health, and event logs. See the following list for a full set of collected log files: +This test reads the Device ID and serial number in addition to basic system information such as device model, operating system version, processor, memory, and storage. The Device ID is recorded in the name of the log file and can be used to identify a log file for a specific device. Several system log files are also collected, including update and rollback logs, and output from several Windows built-in tools, such as [DirectX Diagnostics](https://support.microsoft.com/en-us/products/windows?os=windows-10) and [System Information](https://technet.microsoft.com/library/cc731397), power configuration, disk health, and event logs. See the following list for a full set of collected log files: - Output of **Get-WindowsUpdateLog** if the operating system is Windows 10 @@ -350,11 +350,11 @@ The Windows System Assessment Tool (WinSAT) runs a series of benchmarks against #### Performance Monitor test -Performance and diagnostic trace logs are recorded from Performance Monitor for 30 seconds and collected in the .zip file output of the Microsoft Surface Diagnostic Toolkit by this test. You can analyze these trace logs with the [Windows Performance Analyzer](https://go.microsoft.com/fwlink/p/?LinkId=746486) to identify causes of application crashes, performance issues, or other undesirable behavior in Windows. +Performance and diagnostic trace logs are recorded from Performance Monitor for 30 seconds and collected in the .zip file output of the Microsoft Surface Diagnostic Toolkit by this test. You can analyze these trace logs with the [Windows Performance Analyzer](https://msdn.microsoft.com/windows/hardware/commercialize/test/wpt/windows-performance-analyzer) to identify causes of application crashes, performance issues, or other undesirable behavior in Windows. #### Crash dump collection -If your Surface device has encountered an error that caused the device to fail or produce a blue screen error, this stage of the Microsoft Surface Diagnostic Toolkit records the information from the automatically recorded crash dump files in the diagnostic log. You can use these crash dump files to identify a faulty driver, hardware component, or application through analysis. Use the [Windows Debugging Tool](https://go.microsoft.com/fwlink/p/?LinkId=746488) to analyze these files. If you are not familiar with the analysis of crash dump files, you can describe your issue and post a link to your crash dump files (uploaded to OneDrive or another file sharing service) in the [Windows TechNet Forums](https://go.microsoft.com/fwlink/p/?LinkId=746489). +If your Surface device has encountered an error that caused the device to fail or produce a blue screen error, this stage of the Microsoft Surface Diagnostic Toolkit records the information from the automatically recorded crash dump files in the diagnostic log. You can use these crash dump files to identify a faulty driver, hardware component, or application through analysis. Use the [Windows Debugging Tool](https://msdn.microsoft.com/library/windows/hardware/ff539316) to analyze these files. If you are not familiar with the analysis of crash dump files, you can describe your issue and post a link to your crash dump files (uploaded to OneDrive or another file sharing service) in the [Windows TechNet Forums](https://social.technet.microsoft.com/Forums/home?category=w8itpro). #### Connected standby text diff --git a/devices/surface/surface-dock-updater.md b/devices/surface/surface-dock-updater.md index 91d4411699..ff07fba283 100644 --- a/devices/surface/surface-dock-updater.md +++ b/devices/surface/surface-dock-updater.md @@ -16,7 +16,7 @@ author: jobotto This article provides a detailed walkthrough of Microsoft Surface Dock Updater. -The [Microsoft Surface Dock Updater](https://go.microsoft.com/fwlink/p/?LinkId=618121) tool allows you to check the firmware status of a Surface Dock and to manually update the firmware of Surface Dock devices. It is most often used to update Surface Docks prior to deployment of those Surface Docks to end users or as a troubleshooting tool. Microsoft Surface Dock Updater walks you through the process of updating the firmware on one or more Surface Docks, including the required connect and disconnect steps to perform the complete firmware installation. +The [Microsoft Surface Dock Updater](https://www.microsoft.com/download/details.aspx?id=46703) tool allows you to check the firmware status of a Surface Dock and to manually update the firmware of Surface Dock devices. It is most often used to update Surface Docks prior to deployment of those Surface Docks to end users or as a troubleshooting tool. Microsoft Surface Dock Updater walks you through the process of updating the firmware on one or more Surface Docks, including the required connect and disconnect steps to perform the complete firmware installation. When you run the Microsoft Surface Dock Updater installer you will be prompted to accept an End User License Agreement (EULA). @@ -25,7 +25,7 @@ When you run the Microsoft Surface Dock Updater installer you will be prompted t ## Update a Surface Dock with Microsoft Surface Dock Updater -After you install the [Microsoft Surface Dock Updater](https://go.microsoft.com/fwlink/p/?LinkId=618121) tool, you can find Microsoft Surface Dock Updater under **All Apps** in your Start menu. Click **Microsoft Surface Dock Updater** to start the application. +After you install the [Microsoft Surface Dock Updater](https://www.microsoft.com/download/details.aspx?id=46703) tool, you can find Microsoft Surface Dock Updater under **All Apps** in your Start menu. Click **Microsoft Surface Dock Updater** to start the application. To update a Surface Dock with Microsoft Surface Dock Updater, follow these steps: diff --git a/devices/surface/surface-enterprise-management-mode.md b/devices/surface/surface-enterprise-management-mode.md index 3361d3002c..6632c20987 100644 --- a/devices/surface/surface-enterprise-management-mode.md +++ b/devices/surface/surface-enterprise-management-mode.md @@ -101,7 +101,7 @@ These characters are the last two characters of the certificate thumbprint and s *Figure 6. Enrollment confirmation in SEMM with the SEMM certificate thumbprint* -To enroll a Surface device in SEMM or to apply the UEFI configuration from a configuration package, all you need to do is run the .msi file on the intended Surface device. You can use application deployment or operating system deployment technologies such as [System Center Configuration Manager](https://technet.microsoft.com/library/mt346023) or the [Microsoft Deployment Toolkit](https://technet.microsoft.com/en-us/windows/dn475741). When you enroll a device in SEMM you must be present to confirm the enrollment on the device. User interaction is not required when you apply a configuration to devices that are already enrolled in SEMM. +To enroll a Surface device in SEMM or to apply the UEFI configuration from a configuration package, all you need to do is run the .msi file on the intended Surface device. You can use application deployment or operating system deployment technologies such as [System Center Configuration Manager](https://technet.microsoft.com/library/mt346023) or the [Microsoft Deployment Toolkit](https://technet.microsoft.com/windows/dn475741). When you enroll a device in SEMM you must be present to confirm the enrollment on the device. User interaction is not required when you apply a configuration to devices that are already enrolled in SEMM. ### Reset package diff --git a/devices/surface/unenroll-surface-devices-from-semm.md b/devices/surface/unenroll-surface-devices-from-semm.md index 5e31091376..0c8868a35f 100644 --- a/devices/surface/unenroll-surface-devices-from-semm.md +++ b/devices/surface/unenroll-surface-devices-from-semm.md @@ -15,7 +15,7 @@ When a Surface device is enrolled in Surface Enterprise Management Mode (SEMM), >**Warning:**  To unenroll a device from SEMM and restore user control of Surface UEFI settings, you must have the SEMM certificate that was used to enroll the device in SEMM. If this certificate becomes lost or corrupted, it is not possible to unenroll from SEMM. Back up and protect your SEMM certificate accordingly. -For more information about SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/en-us/itpro/surface/surface-enterprise-management-mode). +For more information about SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode). ## Unenroll a Surface device from SEMM with a Surface UEFI reset package diff --git a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md index d44af98e0d..77a3fe6998 100644 --- a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md +++ b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md @@ -36,8 +36,8 @@ Introduced with Windows 10 and MDT 2013 Update 1, you can use the upgrade instal Performing an upgrade deployment of Windows 10 requires the same tools and resources that are required for a traditional reimaging deployment. You can read about the tools required, including detailed explanations and installation instructions, in [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md). To proceed with the upgrade deployment described in this article, you will need the following tools installed and configured: -* [Microsoft Deployment Toolkit (MDT)](https://technet.microsoft.com/en-us/windows/dn475741) -* [Windows Assessment and Deployment Kit (Windows ADK)](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit#windowsadk), which includes: +* [Microsoft Deployment Toolkit (MDT)](https://technet.microsoft.com/windows/dn475741) +* [Windows Assessment and Deployment Kit (Windows ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#windowsadk), which includes: * Deployment Image Servicing and Management (DISM) * Windows Preinstallation Environment (Windows PE) * Windows System Image Manager (Windows SIM) @@ -45,8 +45,8 @@ Performing an upgrade deployment of Windows 10 requires the same tools and resou You will also need to have available the following resources: * Windows 10 installation files, such as the installation media downloaded from the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx) - >**Note:**  Installation media for use with MDT must contain a Windows image in Windows Imaging Format (.wim). Installation media produced by the [Get Windows 10](https://www.microsoft.com/en-us/software-download/windows10/) page does not use a .wim file, instead using an Electronic Software Download (.esd) file, which is not compatible with MDT. -* [Surface firmware and drivers](https://technet.microsoft.com/en-us/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) for Windows 10 + >**Note:**  Installation media for use with MDT must contain a Windows image in Windows Imaging Format (.wim). Installation media produced by the [Get Windows 10](https://www.microsoft.com/software-download/windows10/) page does not use a .wim file, instead using an Electronic Software Download (.esd) file, which is not compatible with MDT. +* [Surface firmware and drivers](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) for Windows 10 * Application installation files for any applications you want to install, such as the Surface app ## Prepare the upgrade deployment @@ -60,7 +60,7 @@ Windows 10 installation files only need to be imported if you have not already d ### Import Surface drivers In the import process example shown in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) article, drivers for Surface Pro 4 were imported for Windows 10. To perform an upgrade deployment of Windows 10 to Surface Pro 3, drivers for Surface Pro 3 must also be imported. To import the Surface drivers for Surface Pro 3, follow these steps: -1. Download the Surface Pro 3 firmware and driver pack for Windows 10 archive file (.zip), SurfacePro3_Win10_xxxxxx.zip, from the [Surface Pro 3 download page](https://www.microsoft.com/en-US/download/details.aspx?id=38826) in the Microsoft Download Center. +1. Download the Surface Pro 3 firmware and driver pack for Windows 10 archive file (.zip), SurfacePro3_Win10_xxxxxx.zip, from the [Surface Pro 3 download page](https://www.microsoft.com/download/details.aspx?id=38826) in the Microsoft Download Center. 2. Extract the contents of the Surface Pro 3 firmware and driver pack archive file to a temporary folder. Keep the driver files separate from other drivers or files. 3. Open the Deployment Workbench and expand the Deployment Shares node and your deployment share. 4. If you have not already created a folder structure by operating system version, you should do so next. Under the **Windows 10 x64** folder, create a new folder for Surface Pro 3 drivers named **Surface Pro 3**. Your Out-of-Box Drivers folder should resemble the following structure: @@ -91,7 +91,7 @@ In the import process example shown in the [Deploy Windows 10 to Surface devices Installation of applications in an upgrade deployment is not always necessary because the applications from the previous environment will remain on the device. (For example, in the [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) article, the deployment includes Office 365 which is not required in an upgrade deployment where the user is already using Office 365 on the device.) -There are still some circumstances where you will want to deploy an application, even during an upgrade deployment. For example, you may have Surface Pro 3 devices on which you would like to add the Surface app. To deploy the Surface app in an upgrade scenario use the same process as you would for a traditional deployment. See the [Deploy Surface app with Windows Store for Business](https://technet.microsoft.com/en-us/itpro/surface/deploy-surface-app-with-windows-store-for-business) article for instructions on how to add the Surface app to an MDT task sequence. +There are still some circumstances where you will want to deploy an application, even during an upgrade deployment. For example, you may have Surface Pro 3 devices on which you would like to add the Surface app. To deploy the Surface app in an upgrade scenario use the same process as you would for a traditional deployment. See the [Deploy Surface app with Windows Store for Business](https://technet.microsoft.com/itpro/surface/deploy-surface-app-with-windows-store-for-business) article for instructions on how to add the Surface app to an MDT task sequence. ### Create the upgrade task sequence diff --git a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md new file mode 100644 index 0000000000..f44e7cf414 --- /dev/null +++ b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md @@ -0,0 +1,415 @@ +--- +title: Use System Center Configuration Manager to manage devices with SEMM (Surface) +description: Find out how to use Microsoft Surface UEFI Manager to perform SEMM management with System Center Configuration Manager. +keywords: enroll, update, scripts, settings +ms.prod: w10 +ms.mktglfcycl: manage +ms.pagetype: surface, devices +ms.sitesec: library +author: KiranDavane +--- + +# Use System Center Configuration Manager to manage devices with SEMM + +The Surface Enterprise Management Mode (SEMM) feature of Surface UEFI devices allows administrators to both manage and secure the configuration of Surface UEFI settings. For most organizations, this process is accomplished by creating Windows Installer (.msi) packages with the Microsoft Surface UEFI Configurator tool. These packages are then run or deployed to the client Surface devices to enroll the devices in SEMM and to update the Surface UEFI settings configuration. + +For organizations with System Center Configuration Manager, there is an alternative to using the Microsoft Surface UEFI Configurator .msi process to deploy and administer SEMM. Microsoft Surface UEFI Manager is a lightweight installer that makes required assemblies for SEMM management available on a device. By installing these assemblies with Microsoft Surface UEFI Manager on a managed client, SEMM can be administered by Configuration Manager with PowerShell scripts, deployed as applications. With this process, SEMM management is performed within Configuration Manager, which eliminates the need for the external Microsoft Surface UEFI Configurator tool. + +>[!Note] +>Although the process described in this article may work with earlier versions of System Center Configuration Manager or with other third-party management solutions, management of SEMM with Microsoft Surface UEFI Manager and PowerShell is supported only with the Current Branch of System Center Configuration Manager. + +#### Prerequisites + +Before you begin the process outlined in this article, it is expected that you are familiar with the following technologies and tools: + +* [Surface UEFI](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings) +* [Surface Enterprise Management Mode (SEMM)](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode) +* [PowerShell scripting](https://technet.microsoft.com/scriptcenter/dd742419) +* [System Center Configuration Manager application deployment](https://docs.microsoft.com/sccm/apps/deploy-use/deploy-applications) +* Certificate management + +>[!Note] +>You will also need access to the certificate that you intend to use to secure SEMM. For details about the requirements for this certificate, see [Surface Enterprise Management Mode certificate requirements](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode#surface-enterprise-management-mode-certificate-requirements). + +>It is very important that this certificate be kept in a safe location and properly backed up. If this certificate becomes lost or unusable, it is not possible to reset Surface UEFI, change managed Surface UEFI settings, or remove SEMM from an enrolled Surface device. + +#### Download Microsoft Surface UEFI Manager + +Management of SEMM with Configuration Manager requires the installation of Microsoft Surface UEFI Manager on each client Surface device. You can download Microsoft Surface UEFI Manager (SurfaceUEFIManager.msi) from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page on the Microsoft Download Center. + +#### Download SEMM scripts for Configuration Manager + +After Microsoft Surface UEFI Manager is installed on the client Surface device, SEMM is deployed and managed with PowerShell scripts. You can download samples of the [SEMM management scripts](https://gallery.technet.microsoft.com/Sample-PowerShell-for-5eb5f03c) from the TechNet Gallery Script Center. + +## Deploy Microsoft Surface UEFI Manager + +Deployment of Microsoft Surface UEFI Manager is a typical application deployment. The Microsoft Surface UEFI Manager installer file is a standard Windows Installer file that you can install with the [standard quiet option](https://msdn.microsoft.com/library/windows/desktop/aa367988). + +The command to install Microsoft Surface UEFI Manager is: + +`msiexec /i “SurfaceUEFIManagerSetup.msi” /q` + +The command to uninstall Microsoft Surface UEFI Manager is: + +`msiexec /x {541DA890-1AEB-446D-B3FD-D5B3BB18F9AF} /q` + +To create a new application and deploy it to a collection that contains your Surface devices, perform the following steps: + +1. Open Configuration Manager Console from the Start screen or Start menu. +2. Click **Software Library** in the bottom left corner of the window. +3. Expand the Application Management node of the Software Library, and then click **Applications**. +4. Click the **Create Application** button under the **Home** tab at the top of the window. This starts the Create Application Wizard. +5. The Create Application Wizard presents a series of steps: + + * **General** – The **Automatically detect information about this application from installation files** option is selected by default. In the **Type** field, **Windows Installer (*.msi file)** is also selected by default. Click **Browse** to navigate to and select **SurfaceUEFIManagerSetup.msi**, and then click **Next**. + + >[!Note] + >The location of SurfaceUEFIManagerSetup.msi must be on a network share and located in a folder that contains no other files. A local file location cannot be used. + + * **Import Information** – The Create Application Wizard will parse the .msi file and read the **Application Name** and **Product Code**. SurfaceUEFIManagerSetup.msi should be listed as the only file under the line **Content Files**, as shown in Figure 1. Click **Next** to proceed. + + + ![Information from Surface UEFI Manager setup is automatically parsed](images/config-mgr-semm-fig1.png "Information from Surface UEFI Manager setup is automatically parsed") + + *Figure 1. Information from Microsoft Surface UEFI Manager setup is automatically parsed* + + * **General Information** – You can modify the name of the application and information about the publisher and version, or add comments on this page. The installation command for Microsoft Surface UEFI Manager is displayed in the Installation Program field. The default installation behavior of Install for system will allow Microsoft Surface UEFI Manager to install the required assemblies for SEMM even if a user is not logged on to the Surface device. Click Next to proceed. + * **Summary** – The information that was parsed in the **Import Information** step and your selections from the **General Information** step is displayed on this page. Click **Next** to confirm your selections and create the application. + * **Progress** – Displays a progress bar and status as the application is imported and added to the Software Library. + * **Completion** – Confirmation of the successful application creation is displayed when the application creation process is complete. Click **Close** to finish the Create Application Wizard. + +After the application is created in Configuration Manager, you can distribute it to your distribution points and deploy it to the collections including your Surface devices. This application will not install or enable SEMM on the Surface device – it only provides the assemblies required for SEMM to be enabled via PowerShell script. + +If you do not want to install the Microsoft Surface UEFI Manager assemblies on devices that will not be managed with SEMM, you can configure Microsoft Surface UEFI Manager as a dependency of the SEMM Configuration Manager scripts. This scenario is covered in the [Deploy SEMM Configuration Manager Scripts](#deploy-semm-configuration-manager-scripts) section later in this article. + +## Create or modify the SEMM Configuration Manager scripts + +After the required assemblies have been installed on the devices, the process of enrolling the devices in SEMM and configuring Surface UEFI is done with PowerShell scripts and deployed as a script application with Configuration Manager. These scripts can be modified to fit the needs of your organization and environment. For example, you can create multiple configurations for managed Surface devices in different departments or roles. You can download samples of the scripts for SEMM and Configuration Manager at the link in the [Prerequisites](#prerequisites) section at the beginning of this article. + +There are two primary scripts you will need to perform a SEMM deployment with Configuration Manager: + +* **ConfigureSEMM.ps1** – Use this script to create configuration packages for your Surface devices with your desired Surface UEFI settings, to apply the specified settings to a Surface device, to enroll the device in SEMM, and to set a registry key used to identify the enrollment of the device in SEMM. +* **ResetSEMM.ps1** – Use this script to reset SEMM on a Surface device, which unenrolls it from SEMM and removes the control over Surface UEFI settings. + +The sample scripts include examples of how to set Surface UEFI settings and how to control permissions to those settings. These settings can be modified to secure Surface UEFI and set Surface UEFI settings according to the needs of your environment. The following sections of this article explain the ConfigureSEMM.ps1 script and explore the modifications you need to make to the script to fit your requirements. + +>[!NOTE] +>The SEMM Configuration Manager scripts and the exported SEMM certificate file (.pfx) should be placed in the same folder with no other files before they are added to Configuration Manager. + +### Specify certificate and package names + +The first region of the script that you need to modify is the portion that specifies and loads the SEMM certificate, and also indicates the names for the SEMM configuration package and SEMM reset package. The certificate and package names are specified on lines 56 through 67 in the ConfigureSEMM.ps1 script: + + ``` + 56 $WorkingDirPath = split-path -parent $MyInvocation.MyCommand.Definition + 57 $packageRoot = "$WorkingDirPath\Config" + 58 + 59 if (-not (Test-Path $packageRoot)) { New-Item -ItemType Directory -Force -Path $packageRoot } + 60 Copy-Item "$WorkingDirPath\FabrikamOwnerSigner.pfx" $packageRoot + 61 + 62 $privateOwnerKey = Join-Path -Path $packageRoot -ChildPath "FabrikamOwnerSigner.pfx" + 63 $ownerPackageName = Join-Path -Path $packageRoot -ChildPath "FabrikamSignerProvisioningPackage.pkg" + 64 $resetPackageName = Join-Path -Path $packageRoot -ChildPath "FabrikamUniversalResetPackage.pkg" + 65 + 66 # If your PFX file requires a password then it can be set here, otherwise use a blank string. + 67 $password = "1234" + ``` + +Replace the **FabrikamOwnerSigner.pfx** value for the **$privateOwnerKey** variable with the name of your SEMM Certificate file on both lines 60 and 62. The script will create a working directory (named Config) in the folder where your scripts are located, and will then copy the certificate file to this working directory. + +Replace the **FabrikamSignerProvisioningPackage.pkg** and **FabrikamUniversalResetPackage.pkg** values on lines 63 and 64 to define the **$ownerPackageName** and **$resetPackageName** variables with your desired names for the SEMM configuration and reset packages. These packages will also be created in the Config directory and hold the configuration for Surface UEFI settings and permissions generated by the script. + +On line 67, replace the value of the **$password** variable, from 1234, to the password for your certificate file. If a password is not required, delete the **1234** text. + +>[!Note] +>The last two characters of the certificate thumbprint are required to enroll a device in SEMM. This script will display these digits to the user, which allows the user or technician to record these digits before the system reboots to enroll the device in SEMM. The script uses the following code, found on lines 144-149, to accomplish this: + +``` +144 # Device owners will need the last two characters of the thumbprint to accept SEMM ownership. +145 # For convenience we get the thumbprint here and present to the user. +146 $pw = ConvertTo-SecureString $password -AsPlainText -Force +147 $certPrint = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 +148 $certPrint.Import($privateOwnerKey, $pw, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::DefaultKeySet) +149 Write-Host "Thumbprint =" $certPrint.Thumbprint +``` + +Administrators with access to the certificate file (.pfx) can read the thumbprint at any time by opening the .pfx file in CertMgr. To view the thumbprint with CertMgr, follow this process: + +1. Right-click the .pfx file, and then click **Open**. +2. Expand the folder in the navigation pane. +3. Click **Certificates**. +4. Right-click your certificate in the main pane, and then click **Open**. +5. Click the **Details** tab. +6. **All** or **Properties Only** must be selected in the **Show** drop-down menu. +7. Select the field **Thumbprint**. + +>[!NOTE] +>The SEMM certificate name and password must also be entered in this section of the ResetSEMM.ps1 script to enable Configuration Manager to remove SEMM from the device with the uninstall action. + +### Configure permissions + +The first region of the script where you will specify the configuration for Surface UEFI is the **Configure Permissions** region. This region begins at line 202 in the sample script with the comment **# Configure Permissions** and continues to line 238. The following code fragment first sets permissions to all Surface UEFI settings so that they may be modified by SEMM only, then adds explicit permissions to allow the local user to modify the Surface UEFI password, TPM, and front and rear cameras: + +``` +202 # Configure Permissions +203 foreach ($uefiV2 IN $surfaceDevices.Values) { +204 # Here we define which "identities" will be allowed to modify which settings +205 # PermissionSignerOwner = The primary SEMM enterprise owner identity +206 # PermissionLocal = The user when booting to the UEFI pre-boot GUI +207 # PermissionSignerUser, PermissionSignerUser1, PermissionSignerUser2 = +208 # Additional user identities created so that the signer owner +209 # can delegate permission control for some settings. +210 $ownerOnly = [Microsoft.Surface.IUefiSetting]::PermissionSignerOwner +211 $ownerAndLocalUser = ([Microsoft.Surface.IUefiSetting]::PermissionSignerOwner -bor [Microsoft.Surface.IUefiSetting]::PermissionLocal) +212 +213 # Make all permissions owner only by default +214 foreach ($setting IN $uefiV2.Settings.Values) { +215 $setting.ConfiguredPermissionFlags = $ownerOnly +216 } +217 # Allow the local user to change their own password +218 $uefiV2.SettingsById[501].ConfiguredPermissionFlags = $ownerAndLocalUser +219 +220 # Allow the local user to change the state of the TPM +221 $uefiV2.Settings["Trusted Platform Module (TPM)"].ConfiguredPermissionFlags = $ownerAndLocalUser +222 +223 # Allow the local user to change the state of the Front and Rear cameras +224 $uefiV2.SettingsById[302].ConfiguredPermissionFlags = $ownerAndLocalUser +225 $uefiV2.SettingsById[304].ConfiguredPermissionFlags = $ownerAndLocalUser +226 +227 +228 # Create a unique package name based on family and LSV. +229 # We will choose a name that can be parsed by later scripts. +230 $packageName = $uefiV2.SurfaceUefiFamily + "^Permissions^" + $lsv + ".pkg" +231 $fullPackageName = Join-Path -Path $packageRoot -ChildPath $packageName +232 +233 # Build and sign the Permission package then save it to a file. +234 $permissionPackageStream = $uefiV2.BuildAndSignPermissionPackage($privateOwnerKey, $password, "", $null, $lsv) +235 $permissionPackage = New-Object System.IO.Filestream($fullPackageName, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write) +236 $permissionPackageStream.CopyTo($permissionPackage) +237 $permissionPackage.Close() +238 } +``` + +Each **$uefiV2** variable identifies a Surface UEFI setting by setting name or ID, and then configures the permissions to one of the following values: + +* **$ownerOnly** – Permission to modify this setting is granted only to SEMM. +* **$ownerAndLocalUser** – Permission to modify this setting is granted to a local user booting to Surface UEFI, as well as to SEMM. + +You can find information about the available settings names and IDs for Surface UEFI in the [Settings Names and IDs](#settings-names-and-ids) section of this article. + +### Configure settings + +The second region of the script where you will specify the configuration for Surface UEFI is the **Configure Settings** region of the ConfigureSEMM.ps1 script, which configures whether each setting is enabled or disabled. The sample script includes instructions to set all settings to their default values. The script then provides explicit instructions to disable IPv6 for PXE Boot and to leave the Surface UEFI Administrator password unchanged. You can find this region beginning with the **# Configure Settings** comment at line 282 through line 312 in the sample script. The region appears as follows: + +``` +282 # Configure Settings +283 foreach ($uefiV2 IN $surfaceDevices.Values) { +284 # In this demo, we will start by setting every setting to the default factory setting. +285 # You may want to start by doing this in your scripts +286 # so that every setting gets set to a known state. +287 foreach ($setting IN $uefiV2.Settings.Values) { +288 $setting.ConfiguredValue = $setting.DefaultValue +289 } +290 +291 # If you want to set something to a different value from the default, +292 # here are examples of how to accomplish this. +293 $uefiV2.Settings["IPv6 for PXE Boot"].ConfiguredValue = "Disabled" +294 +295 # If you want to leave the setting unmodified, set it to $null +296 # PowerShell has issues setting things to $null so ClearConfiguredValue() +297 # is supplied to do this explicitly. +298 # Here is an example of leaving the UEFI administrator password as-is, +299 # even after we initially set it to factory default above. +300 $uefiV2.SettingsById[501].ClearConfiguredValue() +301 +302 # Create a unique package name based on family and LSV. +303 # We will choose a name that can be parsed by later scripts. +304 $packageName = $uefiV2.SurfaceUefiFamily + "^Settings^" + $lsv + ".pkg" +305 $fullPackageName = Join-Path -Path $packageRoot -ChildPath $packageName +306 +307 # Build and sign the Settings package then save it to a file. +308 $settingsPackageStream = $uefiV2.BuildAndSignSecuredSettingsPackage($privateOwnerKey, $password, "", $null, $lsv) +309 $settingsPackage = New-Object System.IO.Filestream($fullPackageName, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write) +310 $settingsPackageStream.CopyTo($settingsPackage) +311 $settingsPackage.Close() +312 } +``` + +Like the permissions set in the **Configure Permissions** section of the script, the configuration of each Surface UEFI setting is performed by defining the **$uefiV2** variable. For each line defining the **$uefiV2** variable, a Surface UEFI setting is identified by setting name or ID and the configured value is set to **Enabled** or **Disabled**. + +If you do not want to alter the configuration of a Surface UEFI setting, for example to ensure that the Surface UEFI administrator password is not cleared by the action of resetting all Surface UEFI settings to their default, you can use **ClearConfiguredValue()** to enforce that this setting will not be altered. In the sample script, this is used on line 300 to prevent the clearing of the Surface UEFI Administrator password, identified in the sample script by its setting ID, **501**. + +You can find information about the available settings names and IDs for Surface UEFI in the [Settings Names and IDs](#settings-names-and-ids) section later in this article. + +### Settings registry key + +To identify enrolled systems for Configuration Manager, the ConfigureSEMM.ps1 script writes a registry key that can be used to identify enrolled systems as having been installed with the SEMM configuration script. This key can be found at the following location: + +`HKLM\SOFTWARE\Microsoft\Surface\SEMM\Enabled_Version1000` + +The following code fragment, found on lines 352-363, is used to write this registry key: + +``` +352 $SurfaceRegKey = "HKLM:\SOFTWARE\Microsoft\Surface\SEMM" +353 New-RegKey $SurfaceRegKey +354 $SurfaceRegValue = Get-ItemProperty $SurfaceRegKey Enabled_Version1000 -ErrorAction SilentlyContinue +355 +356 If ($SurfaceRegValue -eq $null) +357 { +358 New-ItemProperty -Path $SurfaceRegKey -Name Enabled_Version1000 -PropertyType String -Value 1 | Out-Null +359 } +360 Else +361 { +362 Set-ItemProperty -Path $SurfaceRegKey -Name Enabled_Version1000 -Value 1 +363 } +``` + +### Settings names and IDs + +To configure Surface UEFI settings or permissions for Surface UEFI settings, you must refer to each setting by either its setting name or setting ID. With each new update for Surface UEFI, new settings may be added. The best way to get a complete list of the settings available on a Surface device, along with the settings name and settings IDs, is to use the ShowSettingsOptions.ps1 script from [SEMM management scripts for Configuration Manager](https://gallery.technet.microsoft.com/Sample-PowerShell-for-5eb5f03c) in the TechNet Gallery Script Center. + +The computer where ShowSettingsOptions.ps1 is run must have Microsoft Surface UEFI Manager installed, but the script does not require a Surface device. + +The following tables show the available settings for Surface Pro 4 and Surface Book: + +*Table 1. Surface UEFI settings for Surface Pro 4* + +| Setting ID | Setting Name | Description | Default Setting | +| --- | --- | --- | --- | +|501| Password | UEFI System Password | | +|200| Secure Boot Keys | Secure Boot signing keys to enable for EFI applications | MsPlus3rdParty | +|300| Trusted Platform Module (TPM) | TPM device enabled or disabled | Enabled | +|301| Docking USB Port | Docking USB Port enabled or disabled | Enabled | +|302| Front Camera | Front Camera enabled or disabled | Enabled | +|303| Bluetooth | Bluetooth radio enabled or disabled | Enabled | +|304| Rear Camera | Rear Camera enabled or disabled | Enabled | +|305| IR Camera | InfraRed Camera enabled or disabled | Enabled | +|308| Wi-Fi and Bluetooth | Wi-Fi and Bluetooth enabled or disabled | Enabled | +|310| Type Cover | Surface Type Cover connector | Enabled | +|320| On-board Audio | On-board audio enabled or disabled | Enabled | +|330| Micro SD Card | Micro SD Card enabled or disabled | Enabled | +|370| USB Port 1 | Side USB Port (1) | UsbPortEnabled | +|400| IPv6 for PXE Boot | Enable IPv6 PXE boot before IPv4 PXE boot |Disabled | +|401| Alternate Boot | Alternate Boot allows users to override the boot order by holding the volume down button when powering up the device | Enabled | +|402| Boot Order Lock | Boot Order variable lock enabled or disabled | Disabled | +|403| USB Boot | Enable booting from USB devices | Enabled | +|500| TPM clear EFI protocol | Enable EFI protocol for invoking TPM clear | Disabled | +|600| Security | UEFI Security Page Display enabled or disabled | Enabled | +|601| Devices | UEFI Devices Page Display enabled or disabled | Enabled | +|602| Boot | UEFI Boot Manager Page Display enabled or disabled | Enabled | + +*Table 2. Surface UEFI settings for Surface Book* + +| Setting ID | Setting Name | Description | Default Setting | +| --- | --- | --- | --- | +| 501 | Password | UEFI System Password | | +| 200 | Secure Boot Keys | Secure Boot signing keys to enable for EFI applications | MsPlus3rdParty | +| 300 | Trusted Platform Module (TPM) | TPM device enabled or disabled | Enabled | +| 301 | Docking USB Port | Docking USB Port enabled or disabled | Enabled | +| 302 | Front Camera | Front Camera enabled or disabled | Enabled | +| 303 | Bluetooth | Bluetooth radio enabled or disabled | Enabled | +| 304 | Rear Camera | Rear Camera enabled or disabled | Enabled | +| 305 | IR Camera | InfraRed Camera enabled or disabled | Enabled | +| 308 | Wi-Fi and Bluetooth | Wi-Fi and Bluetooth enabled or disabled | Enabled | +| 320 | On-board Audio | On-board audio enabled or disabled | Enabled | +| 400 | IPv6 for PXE Boot Enable | IPv6 PXE boot before IPv4 PXE boot | Disabled | +| 401 | Alternate Boot | Alternate Boot allows users to override the boot order by holding the volume down button when powering up the device | Enabled | +| 402 | Boot Order Lock | Boot Order variable lock enabled or disabled | Disabled | +| 403 | USB Boot | Enable booting from USB devices | Enabled | +| 500 | TPM clear EFI protocol | Enable EFI protocol for invoking TPM clear | Disabled | +| 600 | Security | UEFI Security Page Display enabled or disabled | Enabled | +| 601 | Devices | UEFI Devices Page Display enabled or disabled | Enabled | +| 602 | Boot | UEFI Boot Manager Page Display enabled or disabled | Enabled | + +## Deploy SEMM Configuration Manager scripts + +After your scripts are prepared to configure and enable SEMM on the client device, the next step is to add these scripts as an application in Configuration Manager. Before you open Configuration Manager, ensure that the following files are in a shared folder that does not include other files: + +* ConfigureSEMM.ps1 +* ResetSEMM.ps1 +* Your SEMM certificate (for example SEMMCertificate.pfx) + +The SEMM Configuration Manager scripts will be added to Configuration Manager as a script application. The command to install SEMM with ConfigureSEMM.ps1 is: + +`Powershell.exe -file “.\ConfigureSEMM.ps1”` + +The command to uninstall SEMM with ResetSEMM.ps1 is: + +`Powershell.exe -file “.\ResetSEMM.ps1”` + +To add the SEMM Configuration Manager scripts to Configuration Manager as an application, use the following process: + +1. Start the Create Application Wizard using Step 1 through Step 5 from the [Deploy Microsoft Surface UEFI Manager](#deploy-microsoft-surface-uefi-manager) section earlier in this article. + +2. Proceed through The Create Application Wizard as follows: + + - **General** – Select **Manually specify the application information**, and then click **Next**. + + - **General Information** – Enter a name for the application (for example SEMM) and any other information you want such as publisher, version, or comments on this page. Click **Next** to proceed. + + - **Application Catalog** – The fields on this page can be left with their default values. Click **Next**. + + - **Deployment Types** – Click **Add** to start the Create Deployment Type Wizard. + + - Proceed through the steps of the Create Deployment Type Wizard, as follows: + + * **General** – Click **Script Installer** from the **Type** drop-down menu. The **Manually specify the deployment type information** option will automatically be selected. Click **Next** to proceed. + * **General Information** – Enter a name for the deployment type (for example SEMM Configuration Scripts), and then click **Next** to continue. + * **Content** – Click **Browse** next to the **Content Location** field, and then click the folder where your SEMM Configuration Manager scripts are located. In the **Installation Program** field, type the [installation command](#deploy-semm-configuration-manager-scripts) found earlier in this article. In the **Uninstall Program** field, enter the [uninstallation command](#deploy-semm-configuration-manager-scripts) found earlier in this article (shown in Figure 2). Click **Next** to move to the next page. + + ![Set the SEMM Configuration Manager scripts as the install and uninstall commands](images/config-mgr-semm-fig2.png "Set the SEMM Configuration Manager scripts as the install and uninstall commands") + + *Figure 2. Set the SEMM Configuration Manager scripts as the install and uninstall commands* + + * **Detection Method** – Click **Add Clause** to add the SEMM Configuration Manager script registry key detection rule. The **Detection Rule** window is displayed, as shown in Figure 3. Use the following settings: + + - Click **Registry** from the **Setting Type** drop-down menu. + - Click **HKEY_LOCAL_MACHINE** from the **Hive** drop-down menu. + - Enter **SOFTWARE\Microsoft\Surface\SEMM** in the **Key** field. + - Enter **Enabled_Version1000** in the **Value** field. + - Click **String** from the **Data Type** drop-down menu. + - Click the **This registry setting must satisfy the following rule to indicate the presence of this application** button. + - Enter **1** in the **Value** field. + - Click **OK** to close the **Detection Rule** window. + + ![Use a registry key to identify devices enrolled in SEMM](images/config-mgr-semm-fig3.png "Use a registry key to identify devices enrolled in SEMM") + + *Figure 3. Use a registry key to identify devices enrolled in SEMM* + + * Click **Next** to proceed to the next page. + + * **User Experience** – Click **Install for system** from the **Installation Behavior** drop-down menu. If you want your users to record and enter the certificate thumbprint themselves, leave the logon requirement set to **Only when a user is logged on**. If you want your administrators to enter the thumbprint for users and the users do not need to see the thumbprint, click **Whether or not a user is logged on** from the **Logon Requirement** drop-down menu. + + * **Requirements** – The ConfigureSEMM.ps1 script automatically verifies that the device is a Surface device before attempting to enable SEMM. However, if you intend to deploy this script application to a collection with devices other than those to be managed with SEMM, you could add requirements here to ensure this application would run only on Surface devices or devices you intend to manage with SEMM. Click **Next** to continue. + + * **Dependencies** – Click **Add** to open the **Add Dependency** window. + + * Click **Add** to open the **Specify Required Application** window. + + - Enter a name for the SEMM dependencies in the **Dependency Group Name** field (for example, *SEMM Assemblies*). + + - Click **Microsoft Surface UEFI Manager** from the list of **Available Applications** and the MSI deployment type, and then click **OK** to close the **Specify Required Application** window. + + * Keep the **Auto Install** check box selected if you want Microsoft Surface UEFI Manager installed automatically on devices when you attempt to enable SEMM with the Configuration Manager scripts. Click **OK** to close the **Add Dependency** window. + + * Click **Next** to proceed. + + * **Summary** – The information you have entered throughout the Create Deployment Type wizard is displayed on this page. Click **Next** to confirm your selections. + + * **Progress** – A progress bar and status as the deployment type is added for the SEMM script application is displayed on this page. + + * **Completion** – Confirmation of the deployment type creation is displayed when the process is complete. Click **Close** to finish the Create Deployment Type Wizard. + + * **Summary** – The information that you entered throughout the Create Application Wizard is displayed. Click **Next** to create the application. + + * **Progress** – A progress bar and status as the application is added to the Software Library is displayed on this page. + + * **Completion** – Confirmation of the successful application creation is displayed when the application creation process is complete. Click **Close** to finish the Create Application Wizard. + +After the script application is available in the Software Library of Configuration Manager, you can distribute and deploy SEMM using the scripts you prepared to devices or collections. If you have configured the Microsoft Surface UEFI Manager assemblies as a dependency that will be automatically installed, you can deploy SEMM in a single step. If you have not configured the assemblies as a dependency, they must be installed on the devices you intend to manage before you enable SEMM. + +When you deploy SEMM using this script application and with a configuration that is visible to the end user, the PowerShell script will start and the thumbprint for the certificate will be displayed by the PowerShell window. You can have your users record this thumbprint and enter it when prompted by Surface UEFI after the device reboots. + +Alternatively, you can configure the application installation to reboot automatically and to install invisibly to the user – in this scenario, a technician will be required to enter the thumbprint on each device as it reboots. Any technician with access to the certificate file can read the thumbprint by viewing the certificate with CertMgr. Instructions for viewing the thumbprint with CertMgr are in the [Create or modify the SEMM Configuration Manager scripts](#create-or-modify-the-semm-configuration-manager-scripts) section of this article. + +Removal of SEMM from a device deployed with Configuration Manager using these scripts is as easy as uninstalling the application with Configuration Manager. This action starts the ResetSEMM.ps1 script and properly unenrolls the device with the same certificate file that was used during the deployment of SEMM. diff --git a/devices/surface/using-the-sda-deployment-share.md b/devices/surface/using-the-sda-deployment-share.md index 043150076c..1cd440c9aa 100644 --- a/devices/surface/using-the-sda-deployment-share.md +++ b/devices/surface/using-the-sda-deployment-share.md @@ -11,9 +11,9 @@ author: Scottmca # Using the Microsoft Surface Deployment Accelerator deployment share -With Microsoft Surface Deployment Accelerator (SDA), you can quickly and easily set up a deployment solution that is ready to deploy Windows to Surface devices. The prepared environment is built on powerful deployment technologies available from Microsoft, such as the [Microsoft Deployment Toolkit (MDT)](https://technet.microsoft.com/en-us/windows/dn475741), and is capable of immediately performing a deployment after configuration. See [Step-by-Step: Surface Deployment Accelerator](https://technet.microsoft.com/en-us/itpro/surface/step-by-step-surface-deployment-accelerator) for a comprehensive walkthrough of using the SDA wizard to set up a deployment share and perform a deployment. +With Microsoft Surface Deployment Accelerator (SDA), you can quickly and easily set up a deployment solution that is ready to deploy Windows to Surface devices. The prepared environment is built on powerful deployment technologies available from Microsoft, such as the [Microsoft Deployment Toolkit (MDT)](https://technet.microsoft.com/windows/dn475741), and is capable of immediately performing a deployment after configuration. See [Step-by-Step: Surface Deployment Accelerator](https://technet.microsoft.com/itpro/surface/step-by-step-surface-deployment-accelerator) for a comprehensive walkthrough of using the SDA wizard to set up a deployment share and perform a deployment. -For more information about SDA and information on how to download SDA, see [Microsoft Surface Deployment Accelerator (SDA)](https://technet.microsoft.com/en-us/itpro/surface/microsoft-surface-deployment-accelerator). +For more information about SDA and information on how to download SDA, see [Microsoft Surface Deployment Accelerator (SDA)](https://technet.microsoft.com/itpro/surface/microsoft-surface-deployment-accelerator). Using SDA provides these primary benefits: @@ -21,7 +21,7 @@ Using SDA provides these primary benefits: * With SDA, you prepare a deployment environment built on the industry leading deployment solution of MDT. With MDT you can scale from a relatively basic deployment of a few Surface devices to a solution capable of deploying to thousands of devices including all of the different makes and models in your organization and all of the applications required by each device and user. -This article explores four scenarios where you can use SDA to meet the needs of your organization. See [Deploy Windows 10](https://technet.microsoft.com/en-us/itpro/windows/deploy/index) to explore the capabilities of MDT and the Windows deployment technologies available from Microsoft in greater detail. +This article explores four scenarios where you can use SDA to meet the needs of your organization. See [Deploy Windows 10](https://technet.microsoft.com/itpro/windows/deploy/index) to explore the capabilities of MDT and the Windows deployment technologies available from Microsoft in greater detail. ## Perform a Proof of Concept deployment @@ -41,7 +41,7 @@ Some recommendations for a successful PoC with SDA are: * Use offline files with SDA to further reduce installation times. -* For help with your PoC, contact [Surface Support](https://www.microsoft.com/surface/en-us/support/contact-us-business). +* For help with your PoC, contact [Surface Support](https://www.microsoft.com/surface/support/contact-us-business). ## Perform a pilot deployment @@ -52,7 +52,7 @@ A pilot deployment differs from a PoC. Where a PoC is usually a closed demonstra For example, you are tasked with deploying Surface devices to mobile workers and you want to test the organization’s MDT deployment process by providing a small number of devices to executives. You can use SDA to create an isolated Surface deployment environment and then copy the task sequence, applications, and drivers needed from the production deployment share. This not only enables you to quickly create a Surface deployment, but it also minimizes the risk to the production deployment process used for other types of devices. -For small organizations, the pilot deployment environment of SDA may suffice as a complete deployment solution. Even if you do not have an existing deployment environment, you can import drivers and applications (covered later in this article) to provide a complete deployment solution based on MDT. Even without previous knowledge of MDT or Windows deployment, you can follow the [Step-by-Step: Surface Deployment Accelerator](https://technet.microsoft.com/en-us/itpro/surface/step-by-step-surface-deployment-accelerator) article to get started with a deployment to Surface devices. +For small organizations, the pilot deployment environment of SDA may suffice as a complete deployment solution. Even if you do not have an existing deployment environment, you can import drivers and applications (covered later in this article) to provide a complete deployment solution based on MDT. Even without previous knowledge of MDT or Windows deployment, you can follow the [Step-by-Step: Surface Deployment Accelerator](https://technet.microsoft.com/itpro/surface/step-by-step-surface-deployment-accelerator) article to get started with a deployment to Surface devices. ## Import additional drivers @@ -97,7 +97,7 @@ To import drivers for a peripheral device: After the drivers are imported for the Surface model, the deployment task sequence will automatically select the drivers during the deployment process and include them in the Windows environment. When you connect your device, such as the barcode scanner in the example, Windows should automatically detect the device and you should be able to use it immediately. >[!NOTE] ->You can even import drivers for other computer makes and models to support other devices. See **Step 5: Prepare the drivers repository** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/en-us/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt) for more information about how to import drivers for other makes and models. +>You can even import drivers for other computer makes and models to support other devices. See **Step 5: Prepare the drivers repository** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt) for more information about how to import drivers for other makes and models. ## Import additional applications diff --git a/education/windows/images/windows-10-for-education-banner.png b/education/windows/images/windows-10-for-education-banner.png new file mode 100644 index 0000000000..cf33adc9b6 Binary files /dev/null and b/education/windows/images/windows-10-for-education-banner.png differ diff --git a/education/windows/index.md b/education/windows/index.md index 98aaf94eef..d64f4ca4cc 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -9,11 +9,11 @@ ms.pagetype: edu author: CelesteDG --- +![Windows 10 Education and Windows 10 Pro Education](images/windows-10-for-education-banner.png) + # Windows 10 for Education -[Windows 10 Education and Windows 10 Pro Education](https://www.microsoft.com/en-us/education/products/windows/default.aspx) empowers staff, administrators, teachers, and students to do great things. - ## ![Learn more about Windows](images/education.png) Learn
diff --git a/mdop/appv-v5/TOC.md b/mdop/appv-v5/TOC.md index 2836e9c7ab..db147e8a98 100644 --- a/mdop/appv-v5/TOC.md +++ b/mdop/appv-v5/TOC.md @@ -40,6 +40,7 @@ ##### [About App-V 5.1 Reporting](about-app-v-51-reporting.md) ##### [How to install the Reporting Server on a Standalone Computer and Connect it to the Database 5.1](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md) #### [App-V 5.1 Deployment Checklist](app-v-51-deployment-checklist.md) +#### [Deploying Microsoft Office 2016 by Using App-V 5.1](deploying-microsoft-office-2016-by-using-app-v51.md) #### [Deploying Microsoft Office 2013 by Using App-V 5.1](deploying-microsoft-office-2013-by-using-app-v51.md) #### [Deploying Microsoft Office 2010 by Using App-V 5.1](deploying-microsoft-office-2010-by-using-app-v51.md) ### [Operations for App-V 5.1](operations-for-app-v-51.md) @@ -155,6 +156,7 @@ ##### [About App-V 5.0 Reporting](about-app-v-50-reporting.md) ##### [How to install the Reporting Server on a Standalone Computer and Connect it to the Database](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md) #### [App-V 5.0 Deployment Checklist](app-v-50-deployment-checklist.md) +#### [Deploying Microsoft Office 2016 by Using App-V](deploying-microsoft-office-2016-by-using-app-v.md) #### [Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v.md) #### [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v.md) ### [Operations for App-V 5.0](operations-for-app-v-50.md) diff --git a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md new file mode 100644 index 0000000000..326877092e --- /dev/null +++ b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md @@ -0,0 +1,876 @@ +--- +title: Deploying Microsoft Office 2016 by Using App-V +description: Deploying Microsoft Office 2016 by Using App-V +author: jamiejdt +ms.assetid: cc675cde-cb8d-4b7c-a700-6104b78f1d89 +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Deploying Microsoft Office 2016 by Using App-V + + +Use the information in this article to use Microsoft Application Virtualization 5.0, or later versions, to deliver Microsoft Office 2016 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v.md). For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v.md). + +This topic contains the following sections: + +- [What to know before you start](#bkmk-before-you-start) + +- [Creating an Office 2016 package for App-V with the Office Deployment Tool](#bkmk-create-office-pkg) + +- [Publishing the Office package for App-V 5.0](#bkmk-pub-pkg-office) + +- [Customizing and managing Office App-V packages](#bkmk-custmz-manage-office-pkgs) + +## What to know before you start + + +Before you deploy Office 2016 by using App-V, review the following planning information. + +### Supported Office versions and Office coexistence + +Use the following table to get information about supported versions of Office and about running coexisting versions of Office. + + ++++ + + + + + + + + + + + + + + + + +
Information to reviewDescription

[Supported versions of Microsoft Office](planning-for-using-app-v-with-office.md#bkmk-office-vers-supp-appv)

    +
  • Supported versions of Office

  • +
  • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)

  • +
  • Office licensing options

  • +

[Planning for Using App-V with coexsiting versions of Office](planning-for-using-app-v-with-office.md#bkmk-plan-coexisting)

Considerations for installing different versions of Office on the same computer

+ +  + +### Packaging, publishing, and deployment requirements + +Before you deploy Office by using App-V, review the following requirements. + + ++++ + + + + + + + + + + + + + + + + + + + + +
TaskRequirement

Packaging

    +
  • All of the Office applications that you want to deploy to users must be in a single package.

  • +
  • In App-V 5.0 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.

  • +
  • If you are deploying Microsoft Visio 2016 and Microsoft Project 2016 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2016 and Project 2016 with Office](#bkmk-deploy-visio-project).

  • +

Publishing

    +
  • You can publish only one Office package to each client computer.

  • +
  • You must publish the Office package globally. You cannot publish to the user.

  • +

Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:

+
    +
  • Office 365 ProPlus

  • +
  • Visio Pro for Office 365

  • +
  • Project Pro for Office 365

  • +

You must enable [shared computer activation](http://technet.microsoft.com/library/dn782860.aspx).

+

You don’t use shared computer activation if you’re deploying a volume licensed product, such as:

+
    +
  • Office Professional Plus 2016

  • +
  • Visio Professional 2016

  • +
  • Project Professional 2016

  • +
+ +  + +### Excluding Office applications from a package + +The following table describes the recommended methods for excluding specific Office applications from a package. + + ++++ + + + + + + + + + + + + + + + + +
TaskDetails

Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.

    +
  • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.

  • +
  • For more information, see [ExcludeApp element](http://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).

  • +

Modify the DeploymentConfig.xml file

    +
  • Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.

  • +
  • For more information, see [Disabling Office 2016 applications](#bkmk-disable-office-apps).

  • +
+ +  + +## Creating an Office 2016 package for App-V with the Office Deployment Tool + + +Complete the following steps to create an Office 2016 package for App-V 5.0 or later. + +**Important**   +In App-V 5.0 and later, you must the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages. + + +### Review prerequisites for using the Office Deployment Tool + +The computer on which you are installing the Office Deployment Tool must have: + + ++++ + + + + + + + + + + + + + + + + +
PrerequisiteDescription

Prerequisite software

.Net Framework 4

Supported operating systems

    +
  • 64-bit version of Windows 10

  • +
  • 64-bit version of Windows 8 or 8.1

  • +
  • 64-bit version of Windows 7

  • +
+ + +**Note**   +In this topic, the term “Office 2016 App-V package” refers to subscription licensing and volume licensing. +  + +### Create Office 2016 App-V Packages Using Office Deployment Tool + +You create Office 2016 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2016 App-V package with Volume Licensing or Subscription Licensing. + +Create Office 2016 App-V packages on 64-bit Windows computers. Once created, the Office 2016 App-V package will run on 32-bit and 64-bit Windows 7, Windows 8.1, and Windows 10 computers. + +### Download the Office Deployment Tool + +Office 2016 App-V Packages are created using the Office Deployment Tool, which generates an Office 2016 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation: + +1. Download the [Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117). + +2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. + + Example: \\\\Server\\Office2016 + +3. Check that a setup.exe and a configuration.xml file exist and are in the location you specified. + +### Download Office 2016 applications + +After you download the Office Deployment Tool, you can use it to get the latest Office 2016 applications. After getting the Office applications, you create the Office 2016 App-V package. + +The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included. + +1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications: + + 1. Open the sample XML file in Notepad or your favorite text editor. + + 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the configuration.xml file: + + ``` syntax + + + + + + + + + + + ``` + + **Note**   + The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. To “uncomment” these lines, remove the "" from the end of the line. + + The above XML configuration file specifies that Office 2016 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2016, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2016 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
InputDescriptionExample

Add element

Specifies the products and languages to include in the package.

N/A

OfficeClientEdition (attribute of Add element)

Specifies the edition of Office 2016 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.

OfficeClientEdition="32"

+

OfficeClientEdition="64"

Product element

Specifies the application. Project 2016 and Visio 2016 must be specified here as an added product to be included in the applications.

Product ID ="O365ProPlusRetail "

+

Product ID ="VisioProRetail"

+

Product ID ="ProjectProRetail"

+

Product ID ="ProPlusVolume"

+

Product ID ="VisioProVolume"

+

Product ID = "ProjectProVolume"

Language element

Specifies the language supported in the applications

Language ID="en-us"

Version (attribute of Add element)

Optional. Specifies a build to use for the package

+

Defaults to latest advertised build (as defined in v32.CAB at the Office source).

15.1.2.3

SourcePath (attribute of Add element)

Specifies the location in which the applications will be saved to.

Sourcepath = "\\Server\Office2016”

Branch (attribute of Add element)

Optional. Specifies the update branch for the product that you want to download or install.

For more information about update branches, see Overview of update branches for Office 365 ProPlus.

Branch = "Business"

+ + After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2016 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml. + +2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2016 applications that will later be converted into an App-V package. Below is an example command with description of details: + + ``` syntax + \\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml + ``` + + In the example: + + + + + + + + + + + + + + + + + + + + + + + + +

\\server\Office2016

is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

Setup.exe

is the Office Deployment Tool.

/download

downloads the Office 2016 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2016 App-V package with Volume Licensing.

\\server\Office2016\Customconfig.xml

passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \\Server\Office2016.

+ +   + +### Convert the Office applications into an App-V package + +After you download the Office 2016 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2016 App-V package. Complete the steps that correspond to your licensing model. + +**Summary of what you’ll need to do:** + +- Create the Office 2016 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8 or 8.1, and Windows 10 computers. + +- Create an Office App-V package for either Subscription Licensing package or Volume Licensing by using the Office Deployment Tool, and then modify the CustomConfig.xml configuration file. + + The following table summarizes the values you need to enter in the CustomConfig.xml file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make. + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +
Product IDVolume LicensingSubscription Licensing

Office 2016

ProPlusVolume

O365ProPlusRetail

Office 2016 with Visio 2016

ProPlusVolume

+

VisioProVolume

O365ProPlusRetail

+

VisioProRetail

Office 2016 with Visio 2016 and Project 2016

ProPlusVolume

+

VisioProVolume

+

ProjectProVolume

O365ProPlusRetail

+

VisioProRetail

+

ProjectProRetail

+ +  + +**How to convert the Office applications into an App-V package** + +1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ParameterWhat to change the value to

SourcePath

Point to the Office applications downloaded earlier.

ProductID

Specify the type of licensing, as shown in the following examples:

+
    +
  • Subscription Licensing

    +
    <Configuration>
    +       <Add SourcePath= "\\server\Office 2016" OfficeClientEdition="32" >
    +        <Product ID="O365ProPlusRetail">
    +          <Language ID="en-us" />
    +        </Product>
    +        <Product ID="VisioProRetail">
    +          <Language ID="en-us" />
    +        </Product>
    +      </Add>  
    +    </Configuration> 
    +

    In this example, the following changes were made to create a package with Subscription licensing:

    + + + + + + + + + + + + + + + + + + + +

    SourcePath

    is the path, which was changed to point to the Office applications that were downloaded earlier.

    Product ID

    for Office was changed to O365ProPlusRetail.

    Product ID

    for Visio was changed to VisioProRetail.

    +

     

    +

  • +
  • Volume Licensing

    +
    <Configuration>
    +       <Add SourcePath= "\\Server\Office2016" OfficeClientEdition="32" >
    +        <Product ID="ProPlusVolume">
    +          <Language ID="en-us" />
    +        </Product>
    +        <Product ID="VisioProVolume">
    +          <Language ID="en-us" />
    +        </Product>
    +      </Add>  
    +    </Configuration>
    +

    In this example, the following changes were made to create a package with Volume licensing:

    + + + + + + + + + + + + + + + + + + + +

    SourcePath

    is the path, which was changed to point to the Office applications that were downloaded earlier.

    Product ID

    for Office was changed to ProPlusVolume.

    Product ID

    for Visio was changed to VisioProVolume.

    +

     

    +

  • +

ExcludeApp (optional)

Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.

PACKAGEGUID (optional)

By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.

+

An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.

+
+ Note   +

Even if you use unique package IDs, you can still deploy only one App-V package to a single device.

+
+
+   +
+ +   + +2. Use the /packager command to convert the Office applications to an Office 2016 App-V package. + + For example: + + ``` syntax + \\server\Office2016\setup.exe /packager \\server\Office2016\Customconfig.xml \\server\share\Office2016AppV + ``` + + In the example: + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

\\server\Office2016

is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

Setup.exe

is the Office Deployment Tool.

/packager

creates the Office 2016 App-V package with Volume Licensing as specified in the customConfig.xml file.

\\server\Office2016\Customconfig.xml

passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.

\\server\share\Office 2016AppV

specifies the location of the newly created Office App-V package.

+ +   + + After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved: + + - **App-V Packages** – contains an Office 2016 App-V package and two deployment configuration files. + + - **WorkingDir** + + **Note**   + To troubleshoot any issues, see the log files in the %temp% directory (default). + +   + +3. Verify that the Office 2016 App-V package works correctly: + + 1. Publish the Office 2016 App-V package, which you created globally, to a test computer, and verify that the Office 2016 shortcuts appear. + + 2. Start a few Office 2016 applications, such as Excel or Word, to ensure that your package is working as expected. + +## Publishing the Office package for App-V 5.0 + + +Use the following information to publish an Office package. + +### Methods for publishing Office App-V packages + +Deploy the App-V package for Office 2016 by using the same methods you use for any other package: + +- System Center Configuration Manager + +- App-V Server + +- Stand-alone through PowerShell commands + +### Publishing prerequisites and requirements + + ++++ + + + + + + + + + + + + + + + + +
Prerequisite or requirementDetails

Enable PowerShell scripting on the App-V clients

To publish Office 2016 packages, you must run a script.

+

Package scripts are disabled by default on App-V clients. To enable scripting, run the following PowerShell command:

+
Set-AppvClientConfiguration –EnablePackageScripts 1

Publish the Office 2016 package globally

Extension points in the Office App-V package require installation at the computer level.

+

When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2016 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages.

+ +  + +### How to publish an Office package + +Run the following command to publish an Office package globally: + +- `Add-AppvClientPackage | Publish-AppvClientPackage –global` + +- From the Web Management Console on the App-V Server, you can add permissions to a group of computers instead of to a user group to enable packages to be published globally to the computers in the corresponding group. + +## Customizing and managing Office App-V packages + + +To manage your Office App-V packages, use the same operations as you would for any other package, but there are a few exceptions, as outlined in the following sections. + +- [Enabling Office plug-ins by using connection groups](#bkmk-enable-office-plugins) + +- [Disabling Office 2016 applications](#bkmk-disable-office-apps) + +- [Disabling Office 2016 shortcuts](#bkmk-disable-shortcuts) + +- [Managing Office 2016 package upgrades](#bkmk-manage-office-pkg-upgrd) + +- [Managing Office 2016 licensing upgrades](#bkmk-manage-office-lic-upgrd) + +- [Deploying Visio 2016 and Project 2016 with Office](#bkmk-deploy-visio-project) + +### Enabling Office plug-ins by using connection groups + +Use the steps in this section to enable Office plug-ins with your Office package. To use Office plug-ins, you must use the App-V Sequencer to create a separate package that contains just the plug-ins. You cannot use the Office Deployment Tool to create the plug-ins package. You then create a connection group that contains the Office package and the plug-ins package, as described in the following steps. + +**To enable plug-ins for Office App-V packages** + +1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a PowerShell cmdlet. + +2. Sequence your plug-ins using the App-V 5.0 Sequencer. Ensure that Office 2016 is installed on the computer being used to sequence the plug-in. It is recommended you use Office 365 ProPlus(non-virtual) on the sequencing computer when you sequence Office 2016 plug-ins. + +3. Create an App-V 5.0 package that includes the desired plug-ins. + +4. Add a Connection Group through App-V server, System Center Configuration Manager, or a PowerShell cmdlet. + +5. Add the Office 2016 App-V package and the plug-ins package you sequenced to the Connection Group you created. + + **Important**   + The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2016 App-V package first, and then add the plug-in App-V package. + +   + +6. Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2016 App-V package. + +7. Verify that the Deployment Configuration File of the plug-in package has the same settings that the Office 2016 App-V package has. + + Since the Office 2016 App-V package is integrated with the operating system, the plug-in package settings should match. You can search the Deployment Configuration File for “COM Mode” and ensure that your plug-ins package has that value set as “Integrated” and that both "InProcessEnabled" and "OutOfProcessEnabled" match the settings of the Office 2016 App-V package you published. + +8. Open the Deployment Configuration File and set the value for **Objects Enabled** to **false**. + +9. If you made any changes to the Deployment Configuration file after sequencing, ensure that the plug-in package is published with the file. + +10. Ensure that the Connection Group you created is enabled onto your desired computer. The Connection Group created will likely “pend” if the Office 2016 App-V package is in use when the Connection Group is enabled. If that happens, you have to reboot to successfully enable the Connection Group. + +11. After you successfully publish both packages and enable the Connection Group, start the target Office 2016 application and verify that the plug-in you published and added to the connection group works as expected. + +### Disabling Office 2016 applications + +You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2016 App-V package has been published, you will save the changes, add the Office 2016 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications. + +**Note**   +To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. +  + +**To disable an Office 2016 application** + +1. Open a Deployment Configuration File with a text editor such as **Notepad** and search for “Applications." + +2. Search for the Office application you want to disable, for example, Access 2016. + +3. Change the value of "Enabled" from "true" to "false." + +4. Save the Deployment Configuration File. + +5. Add the Office 2016 App-V Package with the new Deployment Configuration File. + + ``` syntax + + + Lync 2016 + + + + + + + Access 2016 + + + + + ``` + +6. Re-add the Office 2016 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications. + +### Disabling Office 2016 shortcuts + +You may want to disable shortcuts for certain Office applications instead of unpublishing or removing the package. The following example shows how to disable shortcuts for Microsoft Access. + +**To disable shortcuts for Office 2016 applications** + +1. Open a Deployment Configuration File in Notepad and search for “Shortcuts”. + +2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut. + + ``` syntax + Shortcuts + + --> + + + + + [{Common Programs}]\Microsoft Office 2016\Access 2016.lnk + [{AppvPackageRoot}])office16\MSACCESS.EXE + [{Windows}]\Installer\{90150000-000F-0000-0000-000000FF1CE)\accicons.exe.Ø.ico + + + Microsoft.Office.MSACCESS.EXE.15 + true + Build a professional app quickly to manage data. + l + [{AppVPackageRoot}]\officel6\MSACCESS.EXE + + ``` + +3. Save the Deployment Configuration File. + +4. Republish Office 2016 App-V Package with new Deployment Configuration File. + +Many additional settings can be changed through modifying the Deployment Configuration for App-V packages, for example, file type associations, Virtual File System, and more. For additional information on how to use Deployment Configuration Files to change App-V package settings, refer to the additional resources section at the end of this document. + +### Managing Office 2016 package upgrades + +To upgrade an Office 2016 package, use the Office Deployment Tool. To upgrade a previously deployed Office 2016 package, perform the following steps. + +**How to upgrade a previously deployed Office 2016 package** + +1. Create a new Office 2016 package through the Office Deployment Tool that uses the most recent Office 2016 application software. The most recent Office 2016 bits can always be obtained through the download stage of creating an Office 2016 App-V Package. The newly created Office 2016 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage. + + **Note**   + Office App-V packages have two Version IDs: + + - An Office 2016 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool. + + - A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2016 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2016 package. + +   + +2. Globally publish the newly created Office 2016 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2016 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast. + +3. Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted. + +### Managing Office 2016 licensing upgrades + +If a new Office 2016 App-V Package has a different license than the Office 2016 App-V Package currently deployed. For instance, the Office 2016 package deployed is a subscription based Office 2016 and the new Office 2016 package is Volume Licensing based, the following instructions must be followed to ensure smooth licensing upgrade: + +**How to upgrade an Office 2016 License** + +1. Unpublish the already deployed Office 2016 Subscription Licensing App-V package. + +2. Remove the unpublished Office 2016 Subscription Licensing App-V package. + +3. Restart the computer. + +4. Add the new Office 2016 App-V Package Volume Licensing. + +5. Publish the added Office 2016 App-V Package with Volume Licensing. + +An Office 2016 App-V Package with your chosen licensing will be successfully deployed. + +### Deploying Visio 2016 and Project 2016 with Office + +The following table describes the requirements and options for deploying Visio 2016 and Project 2016 with Office. + + ++++ + + + + + + + + + + + + + + + + +
TaskDetails

How do I package and publish Visio 2016 and Project 2016 with Office?

You must include Visio 2016 and Project 2016 in the same package with Office.

+

If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow [Deploying Microsoft Office 2010 by Using App-V](../appv-v5/deploying-microsoft-office-2010-by-using-app-v.md).

How can I deploy Visio 2016 and Project 2016 to specific users?

Use one of the following methods:

+ ++++ + + + + + + + + + + + + + + + + +
If you want to......then use this method

Create two different packages and deploy each one to a different group of users

Create and deploy the following packages:

+
    +
  • A package that contains only Office - deploy to computers whose users need only Office.

  • +
  • A package that contains Office, Visio, and Project - deploy to computers whose users need all three applications.

  • +

If you want only one package for the whole organization, or if you have users who share computers:

Follows these steps:

+
    +
  1. Create a package that contains Office, Visio, and Project.

  2. +
  3. Deploy the package to all users.

  4. +
  5. Use [Microsoft AppLocker](http://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.

  6. +
+

 

+ +  + +## Additional resources + + +**Office 2016 App-V 5.0 Packages 5.0 Additional Resources** + +[Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117) + +[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://go.microsoft.com/fwlink/p/?LinkId=330680) + +**Office 2013 and Office 2010 App-V Packages** + +[Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v.md) + +[Deploying Microsoft Office 2011 by Using App-V](deploying-microsoft-office-2010-by-using-app-v.md) + +**Connection Groups** + +[Deploying Connection Groups in Microsoft App-V v5](https://go.microsoft.com/fwlink/p/?LinkId=330683) + +[Managing Connection Groups](managing-connection-groups.md) + +**Dynamic Configuration** + +[About App-V 5.0 Dynamic Configuration](about-app-v-50-dynamic-configuration.md) + +## Got a suggestion for App-V? + + +Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). diff --git a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md new file mode 100644 index 0000000000..efb700aace --- /dev/null +++ b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md @@ -0,0 +1,884 @@ +--- +title: Deploying Microsoft Office 2016 by Using App-V +description: Deploying Microsoft Office 2016 by Using App-V +author: jamiejdt +ms.assetid: e0f4876-da99-4b89-977e-2fb6e89ea3d3 +ms.pagetype: mdop, appcompat, virtualization +ms.mktglfcycl: deploy +ms.sitesec: library +ms.prod: w10 +--- + + +# Deploying Microsoft Office 2016 by Using App-V + + +Use the information in this article to use Microsoft Application Virtualization (App-V) 5.1, or later versions, to deliver Microsoft Office 2016 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2013, see [Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v51.md). For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v51.md). + +This topic contains the following sections: + +- [What to know before you start](#bkmk-before-you-start) + +- [Creating an Office 2016 package for App-V with the Office Deployment Tool](#bkmk-create-office-pkg) + +- [Publishing the Office package for App-V 5.1](#bkmk-pub-pkg-office) + +- [Customizing and managing Office App-V packages](#bkmk-custmz-manage-office-pkgs) + +## What to know before you start + + +Before you deploy Office 2016 by using App-V, review the following planning information. + +### Supported Office versions and Office coexistence + +Use the following table to get information about supported versions of Office and about running coexisting versions of Office. + + ++++ + + + + + + + + + + + + + + + + +
Information to reviewDescription

[Planning for Using App-V with Office](planning-for-using-app-v-with-office51.md#bkmk-office-vers-supp-appv)

    +
  • Supported versions of Office

  • +
  • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)

  • +
  • Office licensing options

  • +

[Planning for Using App-V with Office](planning-for-using-app-v-with-office51.md#bkmk-plan-coexisting)

Considerations for installing different versions of Office on the same computer

+ +  +### Packaging, publishing, and deployment requirements + +Before you deploy Office by using App-V, review the following requirements. + + ++++ + + + + + + + + + + + + + + + + + + + + +
TaskRequirement

Packaging

    +
  • All of the Office applications that you want to deploy to users must be in a single package.

  • +
  • In App-V 5.1 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.

  • +
  • If you are deploying Microsoft Visio 2016 and Microsoft Project 2016 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2016 and Project 2016 with Office](#bkmk-deploy-visio-project).

  • +

Publishing

    +
  • You can publish only one Office package to each client computer.

  • +
  • You must publish the Office package globally. You cannot publish to the user.

  • +

Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:

+
    +
  • Office 365 ProPlus

  • +
  • Visio Pro for Office 365

  • +
  • Project Pro for Office 365

  • +

You must enable [shared computer activation](http://technet.microsoft.com/library/dn782860.aspx).

+

You don’t use shared computer activation if you’re deploying a volume licensed product, such as:

+
    +
  • Office Professional Plus 2016

  • +
  • Visio Professional 2016

  • +
  • Project Professional 2016

  • +
+ +  + +### Excluding Office applications from a package + +The following table describes the recommended methods for excluding specific Office applications from a package. + + ++++ + + + + + + + + + + + + + + + + +
TaskDetails

Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.

    +
  • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.

  • +
  • For more information, see [ExcludeApp element](http://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).

  • +

Modify the DeploymentConfig.xml file

    +
  • Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.

  • +
  • For more information, see [Disabling Office 2016 applications](#bkmk-disable-office-apps).

  • +
+ +  + +## Creating an Office 2016 package for App-V with the Office Deployment Tool + + +Complete the following steps to create an Office 2016 package for App-V 5.1 or later. + +**Important**   +In App-V 5.1 and later, you must the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages. + +  + +### Review prerequisites for using the Office Deployment Tool + +The computer on which you are installing the Office Deployment Tool must have: + + ++++ + + + + + + + + + + + + + + + + +
PrerequisiteDescription

Prerequisite software

.Net Framework 4

Supported operating systems

    +
  • 64-bit version of Windows 10

  • +
  • 64-bit version of Windows 8 or later

  • +
  • 64-bit version of Windows 7

  • +
+ +  + +**Note**   +In this topic, the term “Office 2016 App-V package” refers to subscription licensing and volume licensing. + +  + +### Create Office 2013 App-V Packages Using Office Deployment Tool + +You create Office 2016 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2016 App-V package with Volume Licensing or Subscription Licensing. + +Create Office 2016 App-V packages on 64-bit Windows computers. Once created, the Office 2016 App-V package will run on 32-bit and 64-bit Windows 7, Windows 8.1, and Windows 10 computers. + +### Download the Office Deployment Tool + +Office 2016 App-V Packages are created using the Office Deployment Tool, which generates an Office 2016 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation: + +1. Download the [Office 2-16 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117). + + > [!NOTE] + > You must use the Office 2016 Deployment Tool to create Office 2016 App-V Packages. + +2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. + + Example: \\\\Server\\Office2016 + +3. Check that a setup.exe and a configuration.xml file exist and are in the location you specified. + +### Download Office 2016 applications + +After you download the Office Deployment Tool, you can use it to get the latest Office 2016 applications. After getting the Office applications, you create the Office 2016 App-V package. + +The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included. + +1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications: + + 1. Open the sample XML file in Notepad or your favorite text editor. + + 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the configuration.xml file: + + ``` syntax + + + + + + + + + + + ``` + + **Note**   + The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. To “uncomment” these lines, remove the "" from the end of the line. + +   + + The above XML configuration file specifies that Office 2016 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office2016, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2016 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
InputDescriptionExample

Add element

Specifies the products and languages to include in the package.

N/A

OfficeClientEdition (attribute of Add element)

Specifies the edition of Office 2016 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.

OfficeClientEdition="32"

+

OfficeClientEdition="64"

Product element

Specifies the application. Project 2016 and Visio 2016 must be specified here as an added product to be included in the applications.

Product ID ="O365ProPlusRetail"

+

Product ID ="VisioProRetail"

+

Product ID ="ProjectProRetail"

+

Product ID ="ProPlusVolume"

+

Product ID ="VisioProVolume"

+

Product ID = "ProjectProVolume"

Language element

Specifies the language supported in the applications

Language ID="en-us"

Version (attribute of Add element)

Optional. Specifies a build to use for the package

+

Defaults to latest advertised build (as defined in v32.CAB at the Office source).

16.1.2.3

SourcePath (attribute of Add element)

Specifies the location in which the applications will be saved to.

Sourcepath = "\\Server\Office2016"

Branch (attribute of Add element)

Optional. Specifies the update branch for the product that you want to download or install.

For more information about update branches, see Overview of update branches for Office 365 ProPlus.

Branch = "Business"

+ +   + + After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2016 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml. + +2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2016 applications that will later be converted into an App-V package. Below is an example command with description of details: + + ``` syntax + \\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml + ``` + + In the example: + + + + + + + + + + + + + + + + + + + + + + + + +

\\server\Office2016

is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

Setup.exe

is the Office Deployment Tool.

/download

downloads the Office 2016 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2016 App-V package with Volume Licensing.

\\server\Office2016\Customconfig.xml

passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \\Server\Office2016.

+ +   + +### Convert the Office applications into an App-V package + +After you download the Office 2016 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2016 App-V package. Complete the steps that correspond to your licensing model. + +**Summary of what you’ll need to do:** + +- Create the Office 2016 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8 or 8.1, and Windows 10 computers. + +- Create an Office App-V package for either Subscription Licensing package or Volume Licensing by using the Office Deployment Tool, and then modify the CustomConfig.xml configuration file. + + The following table summarizes the values you need to enter in the CustomConfig.xml file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make. + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +
Product IDVolume LicensingSubscription Licensing

Office 2016

ProPlusVolume

O365ProPlusRetail

Office 2016 with Visio 2016

ProPlusVolume

+

VisioProVolume

O365ProPlusRetail

+

VisioProRetail

Office 2016 with Visio 2016 and Project 2016

ProPlusVolume

+

VisioProVolume

+

ProjectProVolume

O365ProPlusRetail

+

VisioProRetail

+

ProjectProRetail

+ +  + +**How to convert the Office applications into an App-V package** + +1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ParameterWhat to change the value to

SourcePath

Point to the Office applications downloaded earlier.

ProductID

Specify the type of licensing, as shown in the following examples:

+
    +
  • Subscription Licensing

    +
    <Configuration>
    +       <Add SourcePath= "\\server\Office 2016" OfficeClientEdition="32" >
    +        <Product ID="O365ProPlusRetail">
    +          <Language ID="en-us" />
    +        </Product>
    +        <Product ID="VisioProRetail">
    +          <Language ID="en-us" />
    +        </Product>
    +      </Add>  
    +    </Configuration> 
    +

    In this example, the following changes were made to create a package with Subscription licensing:

    + + + + + + + + + + + + + + + + + + + +

    SourcePath

    is the path, which was changed to point to the Office applications that were downloaded earlier.

    Product ID

    for Office was changed to O365ProPlusRetail.

    Product ID

    for Visio was changed to VisioProRetail.

    +

     

    +

  • +
  • Volume Licensing

    +
    <Configuration>
    +       <Add SourcePath= "\\Server\Office2016" OfficeClientEdition="32" >
    +        <Product ID="ProPlusVolume">
    +          <Language ID="en-us" />
    +        </Product>
    +        <Product ID="VisioProVolume">
    +          <Language ID="en-us" />
    +        </Product>
    +      </Add>  
    +    </Configuration>
    +

    In this example, the following changes were made to create a package with Volume licensing:

    + + + + + + + + + + + + + + + + + + + +

    SourcePath

    is the path, which was changed to point to the Office applications that were downloaded earlier.

    Product ID

    for Office was changed to ProPlusVolume.

    Product ID

    for Visio was changed to VisioProVolume.

    +

     

    +

  • +

ExcludeApp (optional)

Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access.

PACKAGEGUID (optional)

By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.

+

An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.

+
+ Note   +

Even if you use unique package IDs, you can still deploy only one App-V package to a single device.

+
+
+   +
+ +   + +2. Use the /packager command to convert the Office applications to an Office 2016 App-V package. + + For example: + + ``` syntax + \\server\Office2016\setup.exe /packager \\server\Office2016\Customconfig.xml \\server\share\Office2016AppV + ``` + + In the example: + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

\\server\Office2016

is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

Setup.exe

is the Office Deployment Tool.

/packager

creates the Office 2016 App-V package with Volume Licensing as specified in the customConfig.xml file.

\\server\Office2016\Customconfig.xml

passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.

\\server\share\Office 2016AppV

specifies the location of the newly created Office App-V package.

+ + After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved: + + - **App-V Packages** – contains an Office 2016 App-V package and two deployment configuration files. + + - **WorkingDir** + + **Note**   + To troubleshoot any issues, see the log files in the %temp% directory (default). + +   + +3. Verify that the Office 2016 App-V package works correctly: + + 1. Publish the Office 2016 App-V package, which you created globally, to a test computer, and verify that the Office 2016 shortcuts appear. + + 2. Start a few Office 2016 applications, such as Excel or Word, to ensure that your package is working as expected. + +## Publishing the Office package for App-V 5.1 + + +Use the following information to publish an Office package. + +### Methods for publishing Office App-V packages + +Deploy the App-V package for Office 2016 by using the same methods you use for any other package: + +- System Center Configuration Manager + +- App-V Server + +- Stand-alone through PowerShell commands + +### Publishing prerequisites and requirements + + ++++ + + + + + + + + + + + + + + + + +
Prerequisite or requirementDetails

Enable PowerShell scripting on the App-V clients

To publish Office 2016 packages, you must run a script.

+

Package scripts are disabled by default on App-V clients. To enable scripting, run the following PowerShell command:

+
Set-AppvClientConfiguration –EnablePackageScripts 1

Publish the Office 2016 package globally

Extension points in the Office App-V package require installation at the computer level.

+

When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2016 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages.

+ +  + +### How to publish an Office package + +Run the following command to publish an Office package globally: + +- `Add-AppvClientPackage | Publish-AppvClientPackage –global` + +- From the Web Management Console on the App-V Server, you can add permissions to a group of computers instead of to a user group to enable packages to be published globally to the computers in the corresponding group. + +## Customizing and managing Office App-V packages + + +To manage your Office App-V packages, use the same operations as you would for any other package, but there are a few exceptions, as outlined in the following sections. + +- [Enabling Office plug-ins by using connection groups](#bkmk-enable-office-plugins) + +- [Disabling Office 2016 applications](#bkmk-disable-office-apps) + +- [Disabling Office 2016 shortcuts](#bkmk-disable-shortcuts) + +- [Managing Office 2016 package upgrades](#bkmk-manage-office-pkg-upgrd) + +- [Managing Office 2016 licensing upgrades](#bkmk-manage-office-lic-upgrd) + +- [Deploying Visio 2016 and Project 2016 with Office](#bkmk-deploy-visio-project) + +### Enabling Office plug-ins by using connection groups + +Use the steps in this section to enable Office plug-ins with your Office package. To use Office plug-ins, you must use the App-V Sequencer to create a separate package that contains just the plug-ins. You cannot use the Office Deployment Tool to create the plug-ins package. You then create a connection group that contains the Office package and the plug-ins package, as described in the following steps. + +**To enable plug-ins for Office App-V packages** + +1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a PowerShell cmdlet. + +2. Sequence your plug-ins using the App-V 5.1 Sequencer. Ensure that Office 2016 is installed on the computer being used to sequence the plug-in. It is recommended you use Office 365 ProPlus(non-virtual) on the sequencing computer when you sequence Office 2016 plug-ins. + +3. Create an App-V 5.1 package that includes the desired plug-ins. + +4. Add a Connection Group through App-V server, System Center Configuration Manager, or a PowerShell cmdlet. + +5. Add the Office 2016 App-V package and the plug-ins package you sequenced to the Connection Group you created. + + **Important**   + The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2016 App-V package first, and then add the plug-in App-V package. + +   + +6. Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2016 App-V package. + +7. Verify that the Deployment Configuration File of the plug-in package has the same settings that the Office 2016 App-V package has. + + Since the Office 2016 App-V package is integrated with the operating system, the plug-in package settings should match. You can search the Deployment Configuration File for “COM Mode” and ensure that your plug-ins package has that value set as “Integrated” and that both "InProcessEnabled" and "OutOfProcessEnabled" match the settings of the Office 2016 App-V package you published. + +8. Open the Deployment Configuration File and set the value for **Objects Enabled** to **false**. + +9. If you made any changes to the Deployment Configuration file after sequencing, ensure that the plug-in package is published with the file. + +10. Ensure that the Connection Group you created is enabled onto your desired computer. The Connection Group created will likely “pend” if the Office 2016 App-V package is in use when the Connection Group is enabled. If that happens, you have to reboot to successfully enable the Connection Group. + +11. After you successfully publish both packages and enable the Connection Group, start the target Office 2016 application and verify that the plug-in you published and added to the connection group works as expected. + +### Disabling Office 2016 applications + +You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2016 App-V package has been published, you will save the changes, add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications. + +**Note**   +To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. + +  + +**To disable an Office 2016 application** + +1. Open a Deployment Configuration File with a text editor such as **Notepad** and search for “Applications." + +2. Search for the Office application you want to disable, for example, Access 2016. + +3. Change the value of "Enabled" from "true" to "false." + +4. Save the Deployment Configuration File. + +5. Add the Office 2016 App-V Package with the new Deployment Configuration File. + + ``` syntax + + + Lync 2016 + + + + + + + Access 2016 + + + + + ``` + +6. Re-add the Office 2016 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications. + +### Disabling Office 2016 shortcuts + +You may want to disable shortcuts for certain Office applications instead of unpublishing or removing the package. The following example shows how to disable shortcuts for Microsoft Access. + +**To disable shortcuts for Office 2016 applications** + +1. Open a Deployment Configuration File in Notepad and search for “Shortcuts”. + +2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut. + + ``` syntax + Shortcuts + + --> + + + + + [{Common Programs}]\Microsoft Office 2016\Access 2016.lnk + [{AppvPackageRoot}])office15\MSACCESS.EXE + [{Windows}]\Installer\{90150000-000F-0000-0000-000000FF1CE)\accicons.exe.Ø.ico + + + Microsoft.Office.MSACCESS.EXE.16 + true + Build a professional app quickly to manage data. + l + [{AppVPackageRoot}]\officel6\MSACCESS.EXE + + ``` + +3. Save the Deployment Configuration File. + +4. Republish Office 2016 App-V Package with new Deployment Configuration File. + +Many additional settings can be changed through modifying the Deployment Configuration for App-V packages, for example, file type associations, Virtual File System, and more. For additional information on how to use Deployment Configuration Files to change App-V package settings, refer to the additional resources section at the end of this document. + +### Managing Office 2016 package upgrades + +To upgrade an Office 2016 package, use the Office Deployment Tool. To upgrade a previously deployed Office 2016 package, perform the following steps. + +**How to upgrade a previously deployed Office 2016 package** + +1. Create a new Office 2016 package through the Office Deployment Tool that uses the most recent Office 2016 application software. The most recent Office 2016 bits can always be obtained through the download stage of creating an Office 2016 App-V Package. The newly created Office 2016 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage. + + **Note**   + Office App-V packages have two Version IDs: + + - An Office 2016 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool. + + - A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2016 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2016 package. + +   + +2. Globally publish the newly created Office 2016 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2016 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast. + +3. Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted. + +### Managing Office 2016 licensing upgrades + +If a new Office 2016 App-V Package has a different license than the Office 2016 App-V Package currently deployed. For instance, the Office 2013 package deployed is a subscription based Office 2016 and the new Office 2016 package is Volume Licensing based, the following instructions must be followed to ensure smooth licensing upgrade: + +**How to upgrade an Office 2016 License** + +1. Unpublish the already deployed Office 2016 Subscription Licensing App-V package. + +2. Remove the unpublished Office 2016 Subscription Licensing App-V package. + +3. Restart the computer. + +4. Add the new Office 2016 App-V Package Volume Licensing. + +5. Publish the added Office 2016 App-V Package with Volume Licensing. + +An Office 2016 App-V Package with your chosen licensing will be successfully deployed. + +### Deploying Visio 2016 and Project 2016 with Office + +The following table describes the requirements and options for deploying Visio 2016 and Project 2016 with Office. + + ++++ + + + + + + + + + + + + + + + + +
TaskDetails

How do I package and publish Visio 2016 and Project 2016 with Office?

You must include Visio 2016 and Project 2016 in the same package with Office.

+

If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow the packaging, publishing, and deployment requirements described in this topic.

How can I deploy Visio 2016 and Project 2016 to specific users?

Use one of the following methods:

+ ++++ + + + + + + + + + + + + + + + + +
If you want to......then use this method

Create two different packages and deploy each one to a different group of users

Create and deploy the following packages:

+
    +
  • A package that contains only Office - deploy to computers whose users need only Office.

  • +
  • A package that contains Office, Visio, and Project - deploy to computers whose users need all three applications.

  • +

If you want only one package for the whole organization, or if you have users who share computers:

Follows these steps:

+
    +
  1. Create a package that contains Office, Visio, and Project.

  2. +
  3. Deploy the package to all users.

  4. +
  5. Use [Microsoft AppLocker](http://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.

  6. +
+

 

+ +  + +## Additional resources + + +**Office 2016 App-V Packages Additional Resources** + +[Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117) + +[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://go.microsoft.com/fwlink/p/?LinkId=330680) + +**Office 2013 and Office 2010 App-V Packages** + +[Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v51.md) + +[Deploying Microsoft Office 2011 by Using App-V](deploying-microsoft-office-2010-by-using-app-v51.md) + +**Connection Groups** + +[Deploying Connection Groups in Microsoft App-V v5](https://go.microsoft.com/fwlink/p/?LinkId=330683) + +[Managing Connection Groups](managing-connection-groups51.md) + +**Dynamic Configuration** + +[About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md) + +## Got a suggestion for App-V? + + +Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). diff --git a/smb/TOC.md b/smb/TOC.md new file mode 100644 index 0000000000..4c2433fafc --- /dev/null +++ b/smb/TOC.md @@ -0,0 +1 @@ +# [SMB](index.md) diff --git a/smb/docfx.json b/smb/docfx.json new file mode 100644 index 0000000000..033a3552a9 --- /dev/null +++ b/smb/docfx.json @@ -0,0 +1,35 @@ +{ + "build": { + "content": [ + { + "files": [ + "**/*.md" + ], + "exclude": [ + "**/obj/**", + "smb/**", + "**/includes/**" + ] + } + ], + "resource": [ + { + "files": [ + "**/*.png", + "**/*.jpg" + ], + "exclude": [ + "**/obj/**", + "smb/**", + "**/includes/**" + ] + } + ], + "overwrite": [], + "externalReference": [], + "globalMetadata": {}, + "fileMetadata": {}, + "template": [], + "dest": "smb" + } +} \ No newline at end of file diff --git a/smb/index.md b/smb/index.md new file mode 100644 index 0000000000..eaeb8132cd --- /dev/null +++ b/smb/index.md @@ -0,0 +1,4 @@ +--- +title: SMB placeholder +description: SMB placeholder +--- diff --git a/windows/deploy/resolve-windows-10-upgrade-errors.md b/windows/deploy/resolve-windows-10-upgrade-errors.md index dc86e81da7..b49144c4ca 100644 --- a/windows/deploy/resolve-windows-10-upgrade-errors.md +++ b/windows/deploy/resolve-windows-10-upgrade-errors.md @@ -16,13 +16,11 @@ localizationpriority: high **Applies to** - Windows 10 -This topic provides a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. - -If you are not an IT administrator, you can try the [quick fixes](#quick-fixes) listed in this topic. If the quick fixes do not resolve your issue, see [Get help with Windows 10 upgrade and installation errors](https://support.microsoft.com/en-us/help/10587/windows-10-get-help-with-upgrade-installation-errors) for more information. +>**Important**: This topic contains technical instructions for IT administrators. If you are not an IT administrator, see [Get help with Windows 10 upgrade and installation errors](https://support.microsoft.com/en-us/help/10587/windows-10-get-help-with-upgrade-installation-errors) for more information. ## In this topic -The following sections and procedures are provided in this guide: +This topic contains a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. The following sections and procedures are provided in this guide: - [The Windows 10 upgrade process](#the-windows-10-upgrade-process): An explanation of phases used during the upgrade process.
- [Quick fixes](#quick-fixes): Steps you can take to eliminate many Windows upgrade errors.
diff --git a/windows/deploy/upgrade-analytics-get-started.md b/windows/deploy/upgrade-analytics-get-started.md index 1d08d1f5cb..8aaa283d61 100644 --- a/windows/deploy/upgrade-analytics-get-started.md +++ b/windows/deploy/upgrade-analytics-get-started.md @@ -97,9 +97,12 @@ The compatibility update KB scans your computers and enables application usage t IMPORTANT: Restart user computers after you install the compatibility update KBs for the first time. +If you are planning to enable IE Site Discovery, you will need to install a few additional KBs. + | **Site discovery** | **KB** | |----------------------|-----------------------------------------------------------------------------| -| [Review site discovery](upgrade-analytics-review-site-discovery.md) | Install the latest [Windows Monthly Rollup](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=security%20monthly%20quality%20rollup). This functionality has been included in Internet Explorer 11 starting with the July 2016 Cumulative Update. | +| [Review site discovery](upgrade-analytics-review-site-discovery.md) | [KB3080149](http://www.catalog.update.microsoft.com/Search.aspx?q=3080149)
Updates the Diagnostic and Telemetry tracking service to existing devices. This update is only necessary on Windows 7 and Windows 8.1 devices.
For more information about this KB, see

Install the latest [Windows Monthly Rollup](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=security%20monthly%20quality%20rollup). This functionality has been included in Internet Explorer 11 starting with the July 2016 Cumulative Update. | + ### Automate data collection diff --git a/windows/deploy/upgrade-analytics-resolve-issues.md b/windows/deploy/upgrade-analytics-resolve-issues.md index 078290d9b3..6a61a18a33 100644 --- a/windows/deploy/upgrade-analytics-resolve-issues.md +++ b/windows/deploy/upgrade-analytics-resolve-issues.md @@ -18,7 +18,7 @@ Upgrade decisions include: | Not reviewed | When you start to investigate an application or a driver to determine upgrade readiness, change their upgrade decision to **Review in progress.**


| Some applications are automatically assigned upgrade decisions based on information known to Microsoft.

All drivers are marked not reviewed by default.

| | Review in progress | When you start to investigate an application or a driver to determine upgrade readiness, change their upgrade decision to **Review in progress**.

Until you’ve determined that applications and drivers will migrate successfully or you’ve resolved blocking issues, leave the upgrade decision status as **Review in progress**.

| Once you’ve fixed any issues and validated that the application or driver will migrate successfully, change the upgrade decision to **Ready to upgrade**.
| | Ready to upgrade | Mark applications and drivers **Ready to upgrade** once you’ve resolved all blocking issues and you’re confident that they will upgrade successfully, or if you’ve decided to upgrade them as-is. | Applications with no known issues or with low installation rates are marked **Ready to upgrade** by default.

Be sure to review low install count applications for any business critical or important applications that are not yet upgrade-ready, despite their low installation rates.

All drivers are marked **Not reviewed** by default.
| -| Won’t upgrade | By default, no applications or drivers are marked **Won’t upgrade** because only you can make that determination.

Use **Won’t upgrade** for computers you don’t want to upgrade.
| If, during your investigation into an application or driver, you determine that they should not be upgraded, mark them **Won’t upgrade**.

| +| Won’t upgrade | By default, no applications or drivers are marked **Won’t upgrade** because only you can make that determination.

Use **Won’t upgrade** for applications and drivers you don’t want to upgrade.
| If, during your investigation into an application or driver, you determine that they should not or cannot be upgraded, mark them **Won’t upgrade**.

| The blades in the **Resolve issues** section are: diff --git a/windows/deploy/windows-10-upgrade-paths.md b/windows/deploy/windows-10-upgrade-paths.md index e555794d61..0c5b8ff890 100644 --- a/windows/deploy/windows-10-upgrade-paths.md +++ b/windows/deploy/windows-10-upgrade-paths.md @@ -19,7 +19,7 @@ author: greg-lindsay This topic provides a summary of available upgrade paths to Windows 10. You can upgrade to Windows 10 from Windows 7 or a later operating system. This includes upgrading from one release of Windows 10 to later release of Windows 10. Migrating from one edition of Windows 10 to a different edition of the same release is also supported. For more information about migrating to a different edition of Windows 10, see [Windows 10 edition upgrade](windows-10-edition-upgrades.md). ->**Windows 10 LTSB**: The upgrade paths displayed below do not apply to Windows 10 LTSB. In-place upgrade from Windows 7 or Windows 8.1 to Windows 10 LTSB is not supported. +>**Windows 10 LTSB**: The upgrade paths displayed below do not apply to Windows 10 LTSB. In-place upgrade from Windows 7 or Windows 8.1 to Windows 10 LTSB is not supported. (Note that Windows 10 LTSB 2015 did not block this upgrade path. This was corrected in the Windows 10 LTSB 2016 release, which will now only allow data-only and clean install options.) >**Windows N/KN**: Windows "N" and "KN" editions follow the same upgrade paths shown below. If the pre-upgrade and post-upgrade editions are not the same type (e.g. Windows 8.1 Pro N to Windows 10 Pro), personal data will be kept but applications and settings will be removed during the upgrade process. diff --git a/windows/keep-secure/event-4713.md b/windows/keep-secure/event-4713.md index 482ad0768e..c35ede099f 100644 --- a/windows/keep-secure/event-4713.md +++ b/windows/keep-secure/event-4713.md @@ -21,7 +21,7 @@ author: Mir0sh ***Event Description:*** -This event generates when [Kerberos policy](https://technet.microsoft.com/en-us/library/cc782061(v=ws.10).aspx) was changed. +This event generates when [Kerberos](https://msdn.microsoft.com/library/windows/desktop/aa378747.aspx) policy was changed. This event is generated only on domain controllers. diff --git a/windows/keep-secure/images/remote-credential-guard-gp.png b/windows/keep-secure/images/remote-credential-guard-gp.png index 98c97825fa..a65253b04e 100644 Binary files a/windows/keep-secure/images/remote-credential-guard-gp.png and b/windows/keep-secure/images/remote-credential-guard-gp.png differ diff --git a/windows/keep-secure/remote-credential-guard.md b/windows/keep-secure/remote-credential-guard.md index 2a813caee1..a8f2f46557 100644 --- a/windows/keep-secure/remote-credential-guard.md +++ b/windows/keep-secure/remote-credential-guard.md @@ -21,10 +21,30 @@ You can use Remote Credential Guard in the following ways: - Helpdesk employees in your organization must connect to domain-joined devices that could be compromised. With Remote Credential Guard, the helpdesk employee can use RDP to connect to the target device without compromising their credentials to malware. -Use the following diagrams to help understand how Remote Credential Guard works and what it helps protect against. +## Comparing Remote Credential Guard with a server protected with Credential Guard + +Use the following diagrams to help understand how Remote Credential Guard works, what it helps protect against, and how it compares with using a server protected with Credential Guard. As the diagram shows, Remote Credential Guard blocks NTLM (allowing only Kerberos), prevents Pass the Hash, and prevents usage of a credential after disconnection. ![Remote Credential Guard](images/remote-credential-guard.png) +## Comparing Remote Credential Guard with other options for Remote Desktop connections + +Use the following table to compare different security options for Remote Desktop connections. + +> [!NOTE] +> This table compares different options than are shown in the previous diagram. + +| Remote Desktop with Credential Delegation | Remote Credential Guard | Restricted Admin mode | +|---|---|---| +| Protection: Provides **less protection** than other modes in this table. | Protection: Provides **moderate protection**, compared to other modes in this table. | Protection: Provides **the most protection** of the modes in this table. However, it also requires you to be in the local “Administrators” group on the remote computer. | +| Version support: The remote computer can be running **any operating system that supports credential delegation**, which was introduced in Windows Vista. | Version support: The remote computer must be running **at least Windows 10, version 1607, or Windows Server 2016**. | Version support: The remote computer must be running **at least patched Windows 7 or patched Windows Server 2008 R2**.

For more information about patches (software updates) related to Restricted Admin mode, see [Microsoft Security Advisory 2871997](https://technet.microsoft.com/library/security/2871997.aspx). | +| NA | Helps prevent:

- **Pass the Hash**
- Usage of a **credential after disconnection** | Prevents:

- **Pass the Hash**
- Usage of **domain identity during connection** | +| Credentials supported from the remote desktop client device:

- **Signed on** credentials
- **Supplied** credentials
- **Saved** credentials | Credentials supported from the remote desktop client device:

- **Signed on** credentials only | Credentials supported from the remote desktop client device:

- **Signed on** credentials
- **Supplied** credentials
- **Saved** credentials | +| Access: **Users allowed**, that is, members of remote desktop users group of remote host. | Access: **Users allowed**, that is, members of remote desktop users group of remote host. | Access: **Administrators only**, that is, only members in administrators group of remote host. | +| Network identity: Remote desktop session **connects to other resources as signed on user**. | Network identity: Remote desktop session **connects to other resources as signed on user**. | Network identity: Remote desktop session **connects to other resources as remote host’s identity**. | +| Multi-hop: From the remote desktop, you **can connect through Remote Desktop to another computer**. | Multi-hop: From the remote desktop, you **can connect through Remote Desktop to another computer**. | No multi-hop: From the remote desktop, you **cannot connect through Remote Desktop to another computer**. | +| Supported authentication protocol: **Any negotiable protocol**. | Supported authentication protocol: **Kerberos only**. | Supported authentication protocol: **Any negotiable protocol**. | + ## Hardware and software requirements The Remote Desktop client and server must meet the following requirements in order to use Remote Credential Guard: @@ -58,7 +78,11 @@ You can use Remote Credential Guard on the client device by setting a Group Poli ### Turn on Remote Credential Guard by using Group Policy 1. From the Group Policy Management Console, go to **Computer Configuration** -> **Administrative Templates** -> **System** -> **Credentials Delegation**. + 2. Double-click **Restrict delegation of credentials to remote servers**. + + ![Remote Credential Guard Group Policy](images/remote-credential-guard-gp.png) + 3. Under **Use the following restricted mode**: - If you want to require either [Restricted Admin mode](http://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) or Remote Credential Guard, choose **Prefer Remote Credential Guard**. In this configuration, Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Remote Credential Guard cannot be used. @@ -66,10 +90,10 @@ You can use Remote Credential Guard on the client device by setting a Group Poli - If you want to require Remote Credential Guard, choose **Require Remote Credential Guard**. With this setting, a Remote Desktop connection will succeed only if the remote computer meets the [Hardware and software requirements](#hardware-and-software-requirements) listed earlier in this topic. + - If you want to require Restricted Admin mode, choose **Require Restricted Admin**. For information about Restricted Admin mode, see the table in [Comparing Remote Credential Guard with other options for Remote Desktop connections](#comparing-remote-credential-guard-with-other-options-for-remote-desktop-connections), earlier in this topic. + 4. Click **OK**. - ![Remote Credential Guard Group Policy](images/remote-credential-guard-gp.png) - 5. Close the Group Policy Management Console. 6. From a command prompt, run **gpupdate.exe /force** to ensure that the Group Policy object is applied. @@ -96,7 +120,7 @@ mstsc.exe /remoteGuard - Remote Desktop Gateway is not compatible with Remote Credential Guard. -- You cannot used saved credentials or credentials that are different than yours. You must use the credentials of the user who is logged into the device. +- You cannot use saved credentials or credentials that are different than yours. You must use the credentials of the user who is logged into the device. - Both the client and the server must be joined to the same domain or the domains must have a trust relationship. diff --git a/windows/keep-secure/tpm-recommendations.md b/windows/keep-secure/tpm-recommendations.md index 277ad8c4ba..0b34d5a9a8 100644 --- a/windows/keep-secure/tpm-recommendations.md +++ b/windows/keep-secure/tpm-recommendations.md @@ -63,7 +63,7 @@ TPM 2.0 products and systems have important security advantages over TPM 1.2, in - TPM 1.2 implementations vary in policy settings. This may result in support issues as lockout policies vary. - TPM 2.0 lockout policy is configured by Windows, ensuring a consistent dictionary attack protection guarantee. -- While TPM 1.2 parts are discrete silicon components which are typically soldered on the motherboard, TPM 2.0 is available as a **discrete (dTPM)** silicon component in a sinple semiconductor package, an **integrated** component incorporated in one or more semiconductor packages - alongside other logic units in the same package(s) - and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on a general purpose SoC. +- While TPM 1.2 parts are discrete silicon components which are typically soldered on the motherboard, TPM 2.0 is available as a **discrete (dTPM)** silicon component in a single semiconductor package, an **integrated** component incorporated in one or more semiconductor packages - alongside other logic units in the same package(s) - and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on a general purpose SoC. ## Discrete, Integrated or Firmware TPM? diff --git a/windows/keep-secure/vpn-routing.md b/windows/keep-secure/vpn-routing.md index 5065c6aaa5..3372161696 100644 --- a/windows/keep-secure/vpn-routing.md +++ b/windows/keep-secure/vpn-routing.md @@ -23,7 +23,7 @@ In a split tunnel configuration, routes can be specified to go over VPN and all Routes can be configured using the VPNv2/*ProfileName*/RouteList setting in the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). -For each route item in the list the following can be specified: +For each route item in the list, the following can be specified: - **Address**: VPNv2/*ProfileName*/RouteList/*routeRowId*/Address - **Prefix size**: VPNv2/*ProfileName*/RouteList/*routeRowId*/Prefix @@ -37,11 +37,11 @@ Routes can also be added at connect time through the server for UWP VPN apps. In a force tunnel configuration, all traffic will go over VPN. This is the default configuration and takes effect if no routes are specified. -The only implication of this setting is the manipulation of routing entries. In the case of a force Tunnel VPN V4 and V6 default routes (for example. 0.0.0.0/0) are added to the routing table with a lower Metric than ones for other interfaces. This sends traffic through the VPN as long as there isn’t a specific route on the Physical Interface itself. +The only implication of this setting is the manipulation of routing entries. In the case of a force tunnel, VPN V4 and V6 default routes (for example. 0.0.0.0/0) are added to the routing table with a lower metric than ones for other interfaces. This sends traffic through the VPN as long as there isn’t a specific route on the physical interface itself. For built-in VPN, this decision is controlled using the MDM setting **VPNv2/ProfileName/NativeProfile/RoutingPolicyType**. -For a UWP VPN plug-in, this property is directly controlled by the app. If the VPN plug-in passes only 2 include routes (default route for both v4 and v6), the Windows VPN Platform marks the VPN as force tunnel. +For a UWP VPN plug-in, this property is directly controlled by the app. If the VPN plug-in indicates the default route for IPv4 and IPv6 as the only two Inclusion routes, the VPN platform marks the connection as Force Tunneled. ## Configure routing diff --git a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index c6e5606348..ca86b2cd46 100644 --- a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -835,7 +835,7 @@ Apply the Speech/AllowSpeechModelUpdate MDM policy from the [Policy CSP](https:/ -or- -- Create a REG\_DWORD registry setting called **AllowSpeechModelUpdate** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\Current\\Device\\Speech**, with a value of 0 (zero). +- Create a REG\_DWORD registry setting called **ModelDownloadAllowed** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Preferences**, with a value of 0 (zero). ### 16.7 Account info @@ -1359,4 +1359,4 @@ You can turn off automatic updates by doing one of the following. This is not re To learn more, see [Device update management](http://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](http://technet.microsoft.com/library/cc720539.aspx). -To help make it easier to deploy settings to restrict connections from Windows 10 to Microsoft, you can apply the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887). This baseline was created in the same way as the [Windows security baselines](../keep-secure/windows-security-baselines.md) that are often used to efficiently configure Windows to a known secure state. Running the Windows Restricted Traffic Limited Functionality Baseline on devices in your organization will allow you to quickly configure all of the settings covered in this document. However, some of the settings reduce the functionality and security configuration of your device and are therefore not recommended. Make sure should you've chosen the right settings configuration for your environment before applying. \ No newline at end of file +To help make it easier to deploy settings to restrict connections from Windows 10 to Microsoft, you can apply the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887). This baseline was created in the same way as the [Windows security baselines](../keep-secure/windows-security-baselines.md) that are often used to efficiently configure Windows to a known secure state. Running the Windows Restricted Traffic Limited Functionality Baseline on devices in your organization will allow you to quickly configure all of the settings covered in this document. However, some of the settings reduce the functionality and security configuration of your device and are therefore not recommended. Make sure should you've chosen the right settings configuration for your environment before applying. diff --git a/windows/manage/waas-configure-wufb.md b/windows/manage/waas-configure-wufb.md index 5cabd0a38e..1ef0609987 100644 --- a/windows/manage/waas-configure-wufb.md +++ b/windows/manage/waas-configure-wufb.md @@ -134,9 +134,9 @@ You can also pause a system from receiving Quality Updates for a period of up to | MDM for version 1511:
../Vendor/MSFT/Policy/Config/Update/
**DeferUpgrade** | \Microsoft\PolicyManager\default\Update\Pause | -You can check what date Quality Updates were paused at by checking the registry key **PausedQualityDate** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings**. +You can check the date that Quality Updates were paused at by checking the registry key **PausedQualityDate** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings**. -The local group policy editor (GPEdit.msc) will not reflect if your Quality Update Pause period has expired. Although the device will resume Quality Updates after 60 days automatically, the pause checkbox will remain checked in the policy editor. To see if a device has auto-resumed taking Quality Updates, you can check the status registry key **PausedQualityStatus** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings**. +The local group policy editor (GPEdit.msc) will not reflect if your Quality Update Pause period has expired. Although the device will resume Quality Updates after 35 days automatically, the pause checkbox will remain checked in the policy editor. To see if a device has auto-resumed taking Quality Updates, you can check the status registry key **PausedQualityStatus** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings**. | Value | Status| | --- | --- | diff --git a/windows/whats-new/contribute-to-a-topic.md b/windows/whats-new/contribute-to-a-topic.md index df040f8573..2f75b278ca 100644 --- a/windows/whats-new/contribute-to-a-topic.md +++ b/windows/whats-new/contribute-to-a-topic.md @@ -1,6 +1,6 @@ --- title: Edit an existing topic using the Contribute link -description: Instructions about how to edit an existing topic by using the Contribute link. +description: Instructions about how to edit an existing topic by using the Contribute link on TechNet. keywords: contribute, edit a topic ms.prod: w10 ms.mktglfcycl: explore