mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-22 10:17:23 +00:00
Merged PR 5275: 1/12 AM Publish
This commit is contained in:
Alma Jenks
commit
c2f29de488
@ -61,7 +61,7 @@ Since Credential Manager cannot decrypt saved Windows Credentials, they are dele
|
||||
### Domain-joined device’s automatically provisioned public key
|
||||
Beginning with Windows 10 and Windows Server 2016, domain-devices automatically provision a bound public key, for more information about automatic public key provisioning, see [Domain-joined Device Public Key Authentication](https://docs.microsoft.com/windows-server/security/kerberos/domain-joined-device-public-key-authentication).
|
||||
|
||||
Since Credential Guard cannot decrypt the protected private key, Windows uses the domain-joined computer's password for authentication to the domain. Unless additional policies are deployed, there should not be a loss of functionality. If a device is configured to only use public key, then it cannot authenticate with password until that policy disabled. For more information on Configuring device to only use public key, see [Domain-joined Device Public Key Authentication](https://docs.microsoft.com/windows-server/security/kerberos/domain-joined-device-public-key-authentication).
|
||||
Since Credential Guard cannot decrypt the protected private key, Windows uses the domain-joined computer's password for authentication to the domain. Unless additional policies are deployed, there should not be a loss of functionality. If a device is configured to only use public key, then it cannot authenticate with password until that policy is disabled. For more information on Configuring devices to only use public key, see [Domain-joined Device Public Key Authentication](https://docs.microsoft.com/windows-server/security/kerberos/domain-joined-device-public-key-authentication).
|
||||
|
||||
Also if any access control checks including authentication policies require devices to have either the KEY TRUST IDENTITY (S-1-18-4) or FRESH PUBLIC KEY IDENTITY (S-1-18-3) well-known SIDs, then those access checks fail. For more information about authentication policies, see [Authentication Policies and Authentication Policy Silos](https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/authentication-policies-and-authentication-policy-silos). For more information about well-known SIDs, see [[MS-DTYP] Section 2.4.2.4 Well-known SID Structures](https://msdn.microsoft.com/en-us/library/cc980032.aspx).
|
||||
|
||||
|
||||
@ -187,6 +187,7 @@
|
||||
#### [Camera](policy-csp-camera.md)
|
||||
#### [Cellular](policy-csp-cellular.md)
|
||||
#### [Connectivity](policy-csp-connectivity.md)
|
||||
#### [ControlPolicyConflict](policy-csp-controlpolicyconflict.md)
|
||||
#### [CredentialProviders](policy-csp-credentialproviders.md)
|
||||
#### [CredentialsUI](policy-csp-credentialsui.md)
|
||||
#### [Cryptography](policy-csp-cryptography.md)
|
||||
|
||||
@ -617,6 +617,14 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ControlPolicyConflict policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="policy-csp-controlpolicyconflict.md#controlpolicyconflict-mdmwinsovergp" id="controlpolicyconflict-mdmwinsovergp">ControlPolicyConflict/MDMWinsOverGP</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### CredentialProviders policies
|
||||
|
||||
<dl>
|
||||
|
||||
@ -0,0 +1,101 @@
|
||||
---
|
||||
title: Policy CSP - ControlPolicyConflict
|
||||
description: Policy CSP - ControlPolicyConflict
|
||||
ms.author: maricia
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nickbrower
|
||||
ms.date: 01/11/2018
|
||||
---
|
||||
|
||||
# Policy CSP - ControlPolicyConflict
|
||||
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--StartPolicies-->
|
||||
## ControlPolicyConflict policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#controlpolicyconflict-mdmwinsovergp">ControlPolicyConflict/MDMWinsOverGP</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<hr/>
|
||||
<!--StartPolicy-->
|
||||
<a href="" id="controlpolicyconflict-mdmwinsovergp"></a>**ControlPolicyConflict/MDMWinsOverGP**
|
||||
|
||||
<!--StartSKU-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>4</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--EndSKU-->
|
||||
<!--StartScope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--EndScope-->
|
||||
<!--StartDescription-->
|
||||
Added in Windows 10, next major update. This policy allows the IT admin to control which policy will be used whenever both the MDM policy and its equivalent Group Policy are set on the device.
|
||||
|
||||
This policy is used to ensure that MDM policy wins over GP when same setting is set by both GP and MDM channel. This policy doesn’t support Delete command. This policy doesn’t support setting the value to be 0 again after it was previously set 1. The default value is 0. In next major update, the MDM policies in Policy CSP will behave as described if this policy value is set 1.
|
||||
|
||||
The policy should be set at every sync to ensure the device removes any settings that conflict with MDM just as it does on the very first set of the policy. This ensures that:
|
||||
|
||||
- GP settings that correspond to MDM applied settings are not conflicting
|
||||
- The current Policy Manager policies are refreshed from what MDM has set
|
||||
- Any values set by scripts/user outside of GP that conflict with MDM are removed
|
||||
|
||||
<!--EndDescription-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default)
|
||||
- 1 - The MDM policy is used and the GP policy is blocked.
|
||||
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
<!--/Example-->
|
||||
<!--Validation-->
|
||||
|
||||
<!--/Validation-->
|
||||
<!--EndPolicy-->
|
||||
<hr/>
|
||||
|
||||
Footnote:
|
||||
|
||||
- 1 - Added in Windows 10, version 1607.
|
||||
- 2 - Added in Windows 10, version 1703.
|
||||
- 3 - Added in Windows 10, version 1709.
|
||||
|
||||
<!--EndPolicies-->
|
||||
|
||||
@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: greg-lindsay
|
||||
ms.date: 10/16/2017
|
||||
ms.date: 01/11/2018
|
||||
ms.localizationpriority: high
|
||||
---
|
||||
|
||||
@ -571,7 +571,7 @@ For more information, see [How to perform a clean boot in Windows](https://suppo
|
||||
<tr><td style='padding:0in 4pt 0in 4pt;border:dotted #FFFFFF 0.0pt;'><b>Code</b>
|
||||
<tr><td style='padding:0in 4pt 0in 4pt;border:dotted #FFFFFF 0.0pt;'>
|
||||
|
||||
800040005 - 0x20007
|
||||
80040005 - 0x20007
|
||||
|
||||
</table>
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user