-  +  - Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected. >**Important** Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account. -  +  - Click **Finish** to create the account. -  +  2. After you've created the account, run a directory synchronization. When it's complete, go to the users page in your Office 365 admin center and verify that the account created in the previous steps has merged to online. @@ -223,17 +223,17 @@ Use this procedure if you use Exchange online. - In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**. - Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**. -  +  - Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected. >**Important** Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account. -  +  - Click **Finish** to create the account. -  +  6. Directory synchronization. diff --git a/devices/surface-hub/images/sh-settings-reset-device.png b/devices/surface-hub/images/sh-settings-reset-device.png new file mode 100644 index 0000000000..bdb16e8e20 Binary files /dev/null and b/devices/surface-hub/images/sh-settings-reset-device.png differ diff --git a/devices/surface-hub/images/sh-settings-update-security.png b/devices/surface-hub/images/sh-settings-update-security.png new file mode 100644 index 0000000000..44bb2202f0 Binary files /dev/null and b/devices/surface-hub/images/sh-settings-update-security.png differ diff --git a/devices/surface-hub/images/sh-settings.png b/devices/surface-hub/images/sh-settings.png new file mode 100644 index 0000000000..12783739ed Binary files /dev/null and b/devices/surface-hub/images/sh-settings.png differ diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index 061bfada43..5fe5d1931c 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -30,7 +30,7 @@ If you joined your Surface Hub to an Azure Active Directory (Azure AD) subscript Alternatively, the device can be enrolled like any other Windows device by going to **Settings** > **Accounts** > **Work access**. - + ### Manage a device through MDM diff --git a/devices/surface-hub/prepare-your-environment-for-surface-hub.md b/devices/surface-hub/prepare-your-environment-for-surface-hub.md index 8656c33064..d4af065b4b 100644 --- a/devices/surface-hub/prepare-your-environment-for-surface-hub.md +++ b/devices/surface-hub/prepare-your-environment-for-surface-hub.md @@ -29,7 +29,7 @@ In order to function properly, the Surface Hub must have access to a wired or wi - Can receive an IP address using DHCP - Open ports: - HTTPS: 443 - - HTTP: 8080 + - HTTP: 80 A wired connection is preferred. @@ -79,7 +79,7 @@ In order to ensure that your environment is ready for the Surface Hub, verify th - It must have these ports open: - HTTPS: 443 - - HTTP: 8080 + - HTTP: 80 If your network runs through a proxy, you'll need the proxy address or script information as well. diff --git a/devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md b/devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md index f3ecf5f2d4..0d7c350af6 100644 --- a/devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md +++ b/devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md @@ -58,9 +58,7 @@ In order to create and deploy provisioning packages, all of the following are re ### Install the Windows Imaging and Configuration Designer 1. The Windows Imaging and Configuration Designer (ICD) is installed as part of the Windows 10 ADK. The installer for the ADK can be downloaded from the [Microsoft Download Center](http://go.microsoft.com/fwlink/?LinkId=718147). - >**Note** The ADK must be installed on a separate PC, not on the Surface Hub. - - + >**Note** The ADK must be installed on a separate PC, not on the Surface Hub. 2. Run the installer, and set your preferences for installation. When asked what features you want to install, you will see a checklist like the one in the following figure. Note that **Windows Performance Toolkit** and **Windows Assessment Toolkit** should be unchecked, as they are not needed to run the ICD. @@ -73,7 +71,7 @@ In order to create and deploy provisioning packages, all of the following are re All four of these features are required to run the ICD and create a package for the Surfact Hub. -  +  3. Continue with the installer until the ADK is installed. This may take a while, because the installer downloads remote content. @@ -83,29 +81,29 @@ This example will demonstrate how to create a provisioning package to install a 1. On the PC that had the Windows 10 ADK installed, open ICD and choose the **New provisioning package** tile from the main menu. -  +  2. When the **New project** dialog box opens, type whatever name you like in the **Name** box. The **Location** and **Description** boxes can also be filled at your discretion, though we recommend using the **Description** box to help you distinguish among multiple packages. Click **Next**. -  +  Select the settings that are **Common to all Windows editions**, and click **Next**. -  +  When asked to import a provisioning package, just click **Finish.** -  +  3. ICD's main screen will be displayed. This is where you create the provisioning package. In the **Available customizations** pane, expand **Runtime settings** and then expand **Certificates**. Click **Root certificates**. -  +  In the center pane, you’ll be asked to specify a **CertificateName** for the Root certificate. You can set this to whatever you want. For the example, we've used the same name as the project. Click **Add**, and an entry will be added in the left pane. 4. In the **Available customizations** pane on the left, a new category has appeared for **CertificatePath** underneath the **CertificateName** you provided. There’s also a red exclamation icon indicating that there is a required field that needs to be set. Click **CeritficatePath**. -  +  5. In the center pane, you’ll be asked to specify the path for the certificate. Enter the name of the .cer file that you want to deploy, either by typing or clicking **Browse**. It must be a root certificate. The provisioning package created will copy the .cer file into the package it creates. @@ -238,15 +236,15 @@ The following two methods for deploying provisioning packages apply to any kind 3. Navigate to **System > Work Access**. Under the header **Related settings**, click on **Add or remove a management package**. 4. Here, click the button for **Add a package**. -  +  5. Click **Removable media** from the dropdown list. You will see a list of available provisioning packages on the **Settings** page. -  +  6. Choose your package and click **Add**. -  +  7. You may have to re-enter the admin credentials if User Access Control (UAC) asks for them. 8. You’ll see a confirmation dialog box. Click **Yes, add it**. The certificate will be installed. diff --git a/devices/surface-hub/use-room-control-system-with-surface-hub.md b/devices/surface-hub/use-room-control-system-with-surface-hub.md index 590099c5ec..79edc9e9a3 100644 --- a/devices/surface-hub/use-room-control-system-with-surface-hub.md +++ b/devices/surface-hub/use-room-control-system-with-surface-hub.md @@ -68,7 +68,7 @@ You can use a standard RJ-11 (6P6C) connector to connect the Surface Hub serial This diagram shows the correct pinout used for an RJ-11 (6P6C) to DB9 cable. - + ## Command sets diff --git a/devices/surface-hub/wireless-network-management-for-surface-hub.md b/devices/surface-hub/wireless-network-management-for-surface-hub.md index c68b67eb32..a84ca0aa97 100644 --- a/devices/surface-hub/wireless-network-management-for-surface-hub.md +++ b/devices/surface-hub/wireless-network-management-for-surface-hub.md @@ -25,33 +25,33 @@ If a wired network connection is not available, the Surface Hub can use a wirele 1. On the Surface Hub, open **Settings** and enter your admin credentials. 2. Click **System**, and then click **Network & Internet**. Under **Wi-Fi**, choose an access point. If you want Surface Hub to automatically connect to this access point, click **Connect automatically**. Click **Connect**. -  +  3. If the network is secured, you'll be asked to enter the security key. Click **Next** to connect. -  +  ### Review wireless settings 1. On the Surface Hub, open **Settings** and enter your admin credentials. 2. Click **System**, click **Network & Internet**, then **Wi-Fi**, and then click **Advanced options**. -  +  3. The system will show you the properties for the wireless network connection. -  +  ### Review wired settings 1. On the Surface Hub, open **Settings** and enter your admin credentials. 2. Click **System**, click **Network & Internet**, then click on the network under Ethernet. -  +  3. The system will show you the properties for the wired network connection. -  +  ## Related topics diff --git a/devices/surface/TOC.md b/devices/surface/TOC.md index 260fedc51d..5000472050 100644 --- a/devices/surface/TOC.md +++ b/devices/surface/TOC.md @@ -15,4 +15,6 @@ ## [Surface Diagnostic Toolkit](surface-diagnostic-toolkit.md) ## [Surface Dock Updater](surface-dock-updater.md) ## [Surface Enterprise Management Mode](surface-enterprise-management-mode.md) +### [Enroll and configure Surface devices with SEMM](enroll-and-configure-surface-devices-with-semm.md) +### [Unenroll Surface devices from SEMM](unenroll-surface-devices-from-semm.md) diff --git a/devices/surface/deploy-surface-app-with-windows-store-for-business.md b/devices/surface/deploy-surface-app-with-windows-store-for-business.md index 01fc609a8f..4c35222e31 100644 --- a/devices/surface/deploy-surface-app-with-windows-store-for-business.md +++ b/devices/surface/deploy-surface-app-with-windows-store-for-business.md @@ -81,6 +81,8 @@ Figure 5 shows the required frameworks for the Surface app. *Figure 5. Required frameworks for the Surface app* +>**Note:** The version numbers of the Surface app and required frameworks will change as the apps are updated. Check for the latest version of Surface app and each framework in Windows Store for Business. Always use the Surface app and recommended framework versions as provided by Windows Store for Business. Using outdated frameworks or the incorrect versions may result in errors or application crashes. + To download the required frameworks for the Surface app, follow these steps: 1. Click the **Download** button under **Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. 2. Click the **Download** button under **Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. diff --git a/devices/surface/enroll-and-configure-surface-devices-with-semm.md b/devices/surface/enroll-and-configure-surface-devices-with-semm.md new file mode 100644 index 0000000000..08696c682d --- /dev/null +++ b/devices/surface/enroll-and-configure-surface-devices-with-semm.md @@ -0,0 +1,135 @@ +--- +title: Enroll and configure Surface devices with SEMM (Surface) +description: Learn how to create a Surface UEFI configuration package to control the settings of Surface UEFI, as well as enroll a Surface device in SEMM. +keywords: surface enterprise management +ms.prod: w10 +ms.mktglfcycl: manage +ms.pagetype: surface, devices, security +ms.sitesec: library +author: jobotto +--- + +# Enroll and configure Surface devices with SEMM + +With Microsoft Surface Enterprise Management Mode (SEMM), you can securely configure the settings of Surface UEFI on a Surface device and manage those settings on Surface devices in your organization. When a Surface device is managed by SEMM, that device is considered to be *enrolled* (sometimes referred to as activated). This article shows you how to create a Surface UEFI configuration package that will not only control the settings of Surface UEFI, but will also enroll a Surface device in SEMM. + +For a more high-level overview of SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/en-us/itpro/surface/surface-enterprise-management-mode). + +#### Download and install Microsoft Surface UEFI Configurator +The tool used to create SEMM packages is Microsoft Surface UEFI Configurator. You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/en-us/download/details.aspx?id=46703) page in the Microsoft Download Center. +Run the Microsoft Surface UEFI Configurator Windows Installer (.msi) file to start the installation of the tool. When the installer completes, find Microsoft Surface UEFI Configurator in the All Apps section of your Start menu. + +>**Note**: Microsoft Surface UEFI Configurator is supported only on Windows 10. + +## Create a Surface UEFI configuration package + +The Surface UEFI configuration package performs both the role of applying a new configuration of Surface UEFI settings to a Surface device managed with SEMM and the role of enrolling Surface devices in SEMM. The creation of a configuration package requires you to have a signing certificate to be used with SEMM to secure the configuration of UEFI settings on each Surface device. For more information about the requirements for the SEMM certificate, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/en-us/itpro/surface/surface-enterprise-management-mode). + +To create a Surface UEFI configuration package, follow these steps: + +1. Open Microsoft Surface UEFI Configurator from the Start menu. +2. Click **Start**. +3. Click **Configuration Package**, as shown in Figure 1. + +  + + *Figure 1. Select Configuration Package to create a package for SEMM enrollment and configuration* + +4. Click **Certificate Protection** to add your exported certificate file with private key (.pfx), as shown in Figure 2. Browse to the location of your certificate file, select the file, and then click **OK**. + +  + + *Figure 2. Add the SEMM certificate and Surface UEFI password to a Surface UEFI configuration package* + +5. When you are prompted to confirm the certificate password, enter and confirm the password for your certificate file, and then click **OK**. +6. Click **Password Protection** to add a password to Surface UEFI. This password will be required whenever you boot to UEFI. If this password is not entered, only the **PC information**, **About**, **Enterprise management**, and **Exit** pages will be displayed. This step is optional. +7. When you are prompted, enter and confirm your chosen password for Surface UEFI, and then click **OK**. If you want to clear an existing Surface UEFI password, leave the password field blank. +8. If you do not want the Surface UEFI package to apply to a particular device, on the **Choose which Surface type you want to target** page, click the slider beneath the corresponding Surface Book or Surface Pro 4 image so that it is in the **Off** position. (As shown in Figure 3.) + +  + + *Figure 3. Choose the devices for package compatibility* + +9. Click **Next**. +10. If you want to deactivate a component on managed Surface devices, on the **Choose which components you want to activate or deactivate** page, click the slider next to any device or group of devices you want to deactivate so that the slider is in the **Off** position. (Shown in Figure 4.) The default configuration for each device is **On**. Click the **Reset** button if you want to return all sliders to the default position. + +  + + *Figure 4. Disable or enable individual Surface components* + +11. Click **Next**. +12. To enable or disable advanced options in Surface UEFI or the display of Surface UEFI pages, on the **Choose the advanced settings for your devices** page, click the slider beside the desired setting to configure that option to **On** or **Off** (shown in Figure 5). In the **UEFI Front Page** section, you can use the sliders for **Security**, **Devices**, and **Boot** to control what pages are available to users who boot into Surface UEFI. (For more information about Surface UEFI settings, see [Manage Surface UEFI settings](https://technet.microsoft.com/en-us/itpro/surface/manage-surface-uefi-settings).) Click **Build** when you have finished selecting options to generate and save the package. + +  + + *Figure 5. Control advanced Surface UEFI settings and Surface UEFI pages with SEMM* + +13. In the **Save As** dialog box, specify a name for the Surface UEFI configuration package, browse to the location where you would like to save the file, and then click **Save**. +14. When the package is created and saved, the **Successful** page is displayed. + +>**Note**: Record the certificate thumbprint characters that are displayed on this page, as shown in Figure 6. You will need these characters to confirm enrollment of new Surface devices in SEMM. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator. + + + +*Figure 6. The last two characters of the certificate thumbprint are displayed on the Successful page* + +Now that you have created your Surface UEFI configuration package, you can enroll or configure Surface devices. + +>**Note**: When a Surface UEFI configuration package is created, a log file is created on the desktop with details of the configuration package settings and options. + +## Enroll a Surface device in SEMM +When the Surface UEFI configuration package is executed, the SEMM certificate and Surface UEFI configuration files are staged in the firmware storage of the Surface device. When the Surface device reboots, Surface UEFI processes these files and begins the process of applying the Surface UEFI configuration or enrolling the Surface device in SEMM, as shown in Figure 7. + + + +*Figure 7. The SEMM process for configuration of Surface UEFI or enrollment of a Surface device* + +Before you begin the process to enroll a Surface device in SEMM, ensure that you have the last two characters of the certificate thumbprint on hand. You will need these characters to confirm the device’s enrollment (see Figure 6). + +To enroll a Surface device in SEMM with a Surface UEFI configuration package, follow these steps: + +1. Run the Surface UEFI configuration package .msi file on the Surface device you want to enroll in SEMM. This will provision the Surface UEFI configuration file in the device’s firmware. +2. Select the **I accept the terms in the License Agreement** check box to accept the End User License Agreement (EULA), and then click **Install** to begin the installation process. +3. Click **Finish** to complete the Surface UEFI configuration package installation and restart the Surface device when you are prompted to do so. +4. Surface UEFI will load the configuration file and determine that SEMM is not enabled on the device. Surface UEFI will then begin the SEMM enrollment process, as follows: + * Surface UEFI will verify that the SEMM configuration file contains a SEMM certificate. + * Surface UEFI will prompt you to enter to enter the last two characters of the certificate thumbprint to confirm enrollment of the Surface device in SEMM, as shown in Figure 8. + +  + + *Figure 8. Enrollment in SEMM requires the last two characters of the certificate thumbprint* + + * Surface UEFI will store the SEMM certificate in firmware and apply the configuration settings that are specified in the Surface UEFI configuration file. + +5. The Surface device is now enrolled in SEMM and will boot to Windows. + +You can verify that a Surface device has been successfully enrolled in SEMM by looking for **Microsoft Surface Configuration Package** in **Programs and Features** (as shown in Figure 9), or in the events stored in the **Microsoft Surface UEFI Configurator** log, found under **Applications and Services Logs** in Event Viewer (as shown in Figure 10). + + + +*Figure 9. Verify the enrollment of a Surface device in SEMM in Programs and Features* + + + +*Figure 10. Verify the enrollment of a Surface device in SEMM in Event Viewer* + +You can also verify that the device is enrolled in SEMM in Surface UEFI – while the device is enrolled, Surface UEFI will contain the **Enterprise management** page (as shown in Figure 11). + + + +*Figure 11. The Surface UEFI Enterprise management page* + + +## Configure Surface UEFI settings with SEMM + +After a device is enrolled in SEMM, you can run Surface UEFI configuration packages signed with the same SEMM certificate to apply new Surface UEFI settings. These settings are applied automatically the next time the device boots, without any interaction from the user. You can use application deployment solutions like System Center Configuration Manager to deploy Surface UEFI configuration packages to Surface devices to change or manage the settings in Surface UEFI. + +For more information about how to deploy Windows Installer (.msi) files with Configuration Manager, see [Deploy and manage applications with System Center Configuration Manager](https://technet.microsoft.com/library/mt627959). + +If you have secured Surface UEFI with a password, users without the password who attempt to boot to Surface UEFI will only have the **PC information**, **About**, **Enterprise management**, and **Exit** pages displayed to them. + +If you have not secured Surface UEFI with a password or a user enters the password correctly, settings that are configured with SEMM will be dimmed (unavailable) and the text Some settings are managed by your organization will be displayed at the top of the page, as shown in Figure 12. + + + +*Figure 12. Settings managed by SEMM will be disabled in Surface UEFI* \ No newline at end of file diff --git a/devices/surface/images/surface-enroll-semm-fig1.png b/devices/surface/images/surface-enroll-semm-fig1.png new file mode 100644 index 0000000000..0db814ae84 Binary files /dev/null and b/devices/surface/images/surface-enroll-semm-fig1.png differ diff --git a/devices/surface/images/surface-semm-enroll-fig1.png b/devices/surface/images/surface-semm-enroll-fig1.png new file mode 100644 index 0000000000..0db814ae84 Binary files /dev/null and b/devices/surface/images/surface-semm-enroll-fig1.png differ diff --git a/devices/surface/images/surface-semm-enroll-fig10.png b/devices/surface/images/surface-semm-enroll-fig10.png new file mode 100644 index 0000000000..e61cf3d70a Binary files /dev/null and b/devices/surface/images/surface-semm-enroll-fig10.png differ diff --git a/devices/surface/images/surface-semm-enroll-fig11.png b/devices/surface/images/surface-semm-enroll-fig11.png new file mode 100644 index 0000000000..91c03fef5e Binary files /dev/null and b/devices/surface/images/surface-semm-enroll-fig11.png differ diff --git a/devices/surface/images/surface-semm-enroll-fig12.png b/devices/surface/images/surface-semm-enroll-fig12.png new file mode 100644 index 0000000000..d6c0505c16 Binary files /dev/null and b/devices/surface/images/surface-semm-enroll-fig12.png differ diff --git a/devices/surface/images/surface-semm-enroll-fig3.png b/devices/surface/images/surface-semm-enroll-fig3.png new file mode 100644 index 0000000000..2d66b485f9 Binary files /dev/null and b/devices/surface/images/surface-semm-enroll-fig3.png differ diff --git a/devices/surface/images/surface-semm-enroll-fig4.png b/devices/surface/images/surface-semm-enroll-fig4.png new file mode 100644 index 0000000000..39b0c797e7 Binary files /dev/null and b/devices/surface/images/surface-semm-enroll-fig4.png differ diff --git a/devices/surface/images/surface-semm-enroll-fig5.png b/devices/surface/images/surface-semm-enroll-fig5.png new file mode 100644 index 0000000000..b3d3db34c7 Binary files /dev/null and b/devices/surface/images/surface-semm-enroll-fig5.png differ diff --git a/devices/surface/images/surface-semm-enroll-fig6.png b/devices/surface/images/surface-semm-enroll-fig6.png new file mode 100644 index 0000000000..95b1c1b24b Binary files /dev/null and b/devices/surface/images/surface-semm-enroll-fig6.png differ diff --git a/devices/surface/images/surface-semm-enroll-fig7.png b/devices/surface/images/surface-semm-enroll-fig7.png new file mode 100644 index 0000000000..26a640ac0c Binary files /dev/null and b/devices/surface/images/surface-semm-enroll-fig7.png differ diff --git a/devices/surface/images/surface-semm-enroll-fig8.png b/devices/surface/images/surface-semm-enroll-fig8.png new file mode 100644 index 0000000000..a1421da21c Binary files /dev/null and b/devices/surface/images/surface-semm-enroll-fig8.png differ diff --git a/devices/surface/images/surface-semm-enroll-fig9.png b/devices/surface/images/surface-semm-enroll-fig9.png new file mode 100644 index 0000000000..9229ee255d Binary files /dev/null and b/devices/surface/images/surface-semm-enroll-fig9.png differ diff --git a/devices/surface/images/surface-semm-enrollment-fig2.png b/devices/surface/images/surface-semm-enrollment-fig2.png new file mode 100644 index 0000000000..1a5649b01e Binary files /dev/null and b/devices/surface/images/surface-semm-enrollment-fig2.png differ diff --git a/devices/surface/images/surface-semm-unenroll-fig1.png b/devices/surface/images/surface-semm-unenroll-fig1.png new file mode 100644 index 0000000000..b0247d3871 Binary files /dev/null and b/devices/surface/images/surface-semm-unenroll-fig1.png differ diff --git a/devices/surface/images/surface-semm-unenroll-fig10.png b/devices/surface/images/surface-semm-unenroll-fig10.png new file mode 100644 index 0000000000..968bf44d8c Binary files /dev/null and b/devices/surface/images/surface-semm-unenroll-fig10.png differ diff --git a/devices/surface/images/surface-semm-unenroll-fig11.png b/devices/surface/images/surface-semm-unenroll-fig11.png new file mode 100644 index 0000000000..c5e86d2b65 Binary files /dev/null and b/devices/surface/images/surface-semm-unenroll-fig11.png differ diff --git a/devices/surface/images/surface-semm-unenroll-fig12.png b/devices/surface/images/surface-semm-unenroll-fig12.png new file mode 100644 index 0000000000..d9a3e0617b Binary files /dev/null and b/devices/surface/images/surface-semm-unenroll-fig12.png differ diff --git a/devices/surface/images/surface-semm-unenroll-fig13.png b/devices/surface/images/surface-semm-unenroll-fig13.png new file mode 100644 index 0000000000..cfe16c3a99 Binary files /dev/null and b/devices/surface/images/surface-semm-unenroll-fig13.png differ diff --git a/devices/surface/images/surface-semm-unenroll-fig14.png b/devices/surface/images/surface-semm-unenroll-fig14.png new file mode 100644 index 0000000000..5c95097c8d Binary files /dev/null and b/devices/surface/images/surface-semm-unenroll-fig14.png differ diff --git a/devices/surface/images/surface-semm-unenroll-fig2.png b/devices/surface/images/surface-semm-unenroll-fig2.png new file mode 100644 index 0000000000..5affd8cef6 Binary files /dev/null and b/devices/surface/images/surface-semm-unenroll-fig2.png differ diff --git a/devices/surface/images/surface-semm-unenroll-fig3.png b/devices/surface/images/surface-semm-unenroll-fig3.png new file mode 100644 index 0000000000..45c1ae38ed Binary files /dev/null and b/devices/surface/images/surface-semm-unenroll-fig3.png differ diff --git a/devices/surface/images/surface-semm-unenroll-fig4.png b/devices/surface/images/surface-semm-unenroll-fig4.png new file mode 100644 index 0000000000..c4ecf92b1b Binary files /dev/null and b/devices/surface/images/surface-semm-unenroll-fig4.png differ diff --git a/devices/surface/images/surface-semm-unenroll-fig5.png b/devices/surface/images/surface-semm-unenroll-fig5.png new file mode 100644 index 0000000000..9229ee255d Binary files /dev/null and b/devices/surface/images/surface-semm-unenroll-fig5.png differ diff --git a/devices/surface/images/surface-semm-unenroll-fig6.png b/devices/surface/images/surface-semm-unenroll-fig6.png new file mode 100644 index 0000000000..91c03fef5e Binary files /dev/null and b/devices/surface/images/surface-semm-unenroll-fig6.png differ diff --git a/devices/surface/images/surface-semm-unenroll-fig7.png b/devices/surface/images/surface-semm-unenroll-fig7.png new file mode 100644 index 0000000000..0dcbace491 Binary files /dev/null and b/devices/surface/images/surface-semm-unenroll-fig7.png differ diff --git a/devices/surface/images/surface-semm-unenroll-fig8.png b/devices/surface/images/surface-semm-unenroll-fig8.png new file mode 100644 index 0000000000..77e7e05407 Binary files /dev/null and b/devices/surface/images/surface-semm-unenroll-fig8.png differ diff --git a/devices/surface/images/surface-semm-unenroll-fig9.png b/devices/surface/images/surface-semm-unenroll-fig9.png new file mode 100644 index 0000000000..b40ccb2449 Binary files /dev/null and b/devices/surface/images/surface-semm-unenroll-fig9.png differ diff --git a/devices/surface/unenroll-surface-devices-from-semm.md b/devices/surface/unenroll-surface-devices-from-semm.md new file mode 100644 index 0000000000..5e31091376 --- /dev/null +++ b/devices/surface/unenroll-surface-devices-from-semm.md @@ -0,0 +1,148 @@ +--- +title: Unenroll Surface devices from SEMM (Surface) +description: Learn how to unenroll a device from SEMM by using a Surface UEFI reset package or the Recovery Request option. +keywords: surface enterprise management +ms.prod: w10 +ms.mktglfcycl: manage +ms.pagetype: surface, devices, security +ms.sitesec: library +author: jobotto +--- + +# Unenroll Surface devices from SEMM + +When a Surface device is enrolled in Surface Enterprise Management Mode (SEMM), a certificate is stored in the firmware of that device. The presence of that certificate and the enrollment in SEMM prevent any unauthorized changes to Surface UEFI settings or options while the device is enrolled in SEMM. To restore control of Surface UEFI settings to the user, the Surface device must be unenrolled from SEMM, a process sometimes described as reset or recovery. There are two methods you can use to unenroll a device from SEMM—a Surface UEFI reset package and a Recovery Request. + +>**Warning:** To unenroll a device from SEMM and restore user control of Surface UEFI settings, you must have the SEMM certificate that was used to enroll the device in SEMM. If this certificate becomes lost or corrupted, it is not possible to unenroll from SEMM. Back up and protect your SEMM certificate accordingly. + +For more information about SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/en-us/itpro/surface/surface-enterprise-management-mode). + +## Unenroll a Surface device from SEMM with a Surface UEFI reset package + +The Surface UEFI reset package is the primary method you use to unenroll a Surface device from SEMM. Like a Surface UEFI configuration package, the reset package is a Windows Installer (.msi) file that configures SEMM on the device. Unlike the configuration package, the reset package will reset the Surface UEFI configuration on a Surface device to its default settings, remove the SEMM certificate, and unenroll the device from SEMM. + +Reset packages are created specifically for an individual Surface device. To begin the process of creating a reset package, you will need the serial number of the device you want to unenroll, as well as the SEMM certificate used to enroll the device. You can find the serial number of your Surface device on the **PC information** page of Surface UEFI, as shown in Figure 1. This page is displayed even if Surface UEFI is password protected and the incorrect password is entered. + + + +*Figure 1. The serial number of the Surface device is displayed on the Surface UEFI PC information page* + +>**Note:** To boot to Surface UEFI, press **Volume Up** and **Power** simultaneously while the device is off. Hold **Volume Up** until the Surface logo is displayed and the device begins to boot. + +To create a Surface UEFI reset package, follow these steps: + +1. Open Microsoft Surface UEFI Configurator from the Start menu. +2. Click **Start**. +3. Click **Reset Package**, as shown in Figure 2. + +  + + *Figure 2. Click Reset Package to create a package to unenroll a Surface device from SEMM* + +4. Click **Certificate Protection** to add your SEMM certificate file with private key (.pfx), as shown in Figure 3. Browse to the location of your certificate file, select the file, and then click **OK**. + +  + + *Figure 3. Add the SEMM certificate to a Surface UEFI reset package* + +5. Click **Next**. +6. Type the serial number of the device you want to unenroll from SEMM (as shown in Figure 4), and then click **Build** to generate the Surface UEFI reset package. + +  + + *Figure 4. Use the serial number of your Surface device to create a Surface UEFI reset package* + +7. In the **Save As** dialog box, specify a name for the Surface UEFI reset package, browse to the location where you would like to save the file, and then click **Save**. +8. When the package generation has completed, the **Successful** page is displayed. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator. + +Run the Surface UEFI reset package Windows Installer (.msi) file on the Surface device to unenroll the device from SEMM. The reset package will require a reboot to perform the unenroll operation. After the device has been unenrolled, you can verify the successful removal by ensuring that the **Microsoft Surface Configuration Package** item in **Programs and Features** (shown in Figure 5) is no longer present. + + + +*Figure 5. The presence of the Microsoft Surface Configuration Package item in Programs and Features indicates that the device is enrolled in SEMM* + +## Unenroll a Surface device from SEMM with a Recovery Request + +In some scenarios, a Surface UEFI reset package may not be a viable option to unenroll a Surface device from SEMM (for example, where Windows has become unusable). In these scenarios you can unenroll the device by using a Recovery Request generated from within Surface UEFI. The Recovery Request process can be initiated even on devices where you do not have the Surface UEFI password. + +The Recovery Request process is initiated from Surface UEFI on the Surface device, approved with Microsoft Surface UEFI Configurator on another computer, and then completed in Surface UEFI. Like the reset package, approving a Recovery Request with Microsoft Surface UEFI Configurator requires access to the SEMM certificate that was used to enroll the Surface device. + +To initiate a Recovery Request, follow these steps: + +1. Boot the Surface device that is to be unenrolled from SEMM to Surface UEFI. +2. Type the Surface UEFI password if you are prompted to do so. +3. Click the **Enterprise management** page, as shown in Figure 6. + +  + + *Figure 6. The Enterprise management page is displayed in Surface UEFI on devices enrolled in SEMM* + +4. Click or press **Get Started**. +5. Click or press **Next** to begin the Recovery Request process. + >**Note:** A Recovery Request expires two hours after it is created. If a Recovery Request is not completed in this time, you will have to restart the Recovery Request process. +6. Select **SEMM Certificate** from the list of certificates displayed on the **Choose a SEMM reset key** page (shown in Figure 7), and then click or press **Next**. + +  + + *Figure 7. Choose SEMM Certificate for your Recovery Request (Reset Request)* + +7. On the **Enter SEMM reset verification code** page you can click the **QR Code** or **Text** buttons to display your Recovery Request (Reset Request) as shown in Figure 8, or the **USB** button to save your Recovery Request (Reset Request) as a file to a USB drive, as shown in Figure 9. + +  + + *Figure 8. A Recovery Request (Reset Request) displayed as a QR Code* + +  + + *Figure 9. Save a Recovery Request (Reset Request) to a USB drive* + + * To use a QR Code Recovery Request (Reset Request), use a QR reader app on a mobile device to read the code. The QR reader app will translate the QR code into an alphanumeric string. You can then email or message that string to the administrator that will produce the reset verification code with Microsoft Surface UEFI Configurator. + * To use a Recovery Request (Reset Request) saved to a USB drive as a file, use the USB drive to transfer the file to the computer where Microsoft Surface UEFI Configurator will be used to produce the Reset Verification Code. The file can also be copied from the USB drive on another device to be emailed or transferred over the network. + * To use the Recovery Request (Reset Request) as text, simply type the text directly into Microsoft Surface UEFI Configurator. + +8. Open Microsoft Surface UEFI Configurator from the Start menu on another computer. +>**Note:** Microsoft Surface UEFI Configurator must run in an environment that is able to authenticate the certificate chain for the SEMM certificate. +9. Click **Start**. +10. Click **Recovery Request**, as shown in Figure 10. + +  + + *Figure 10. Click Recovery Request to begin the process to approve a Recovery Request* + +11. Click **Certificate Protection** to authenticate the Recovery Request with the SEMM certificate. +12. Browse to and select your SEMM certificate file, and then click **OK**. +13. When you are prompted to enter the certificate password as shown in Figure 11, type and confirm the password for the certificate file, and then click **OK**. + +  + + *Figure 11. Type the password for the SEMM certificate* + +14. Click **Next**. +15. Enter the Recovery Request (Reset Request), and then click **Generate** to create a reset verification code (as shown in Figure 12). + +  + + *Figure 12. Enter the Recovery Request (Reset Request)* + + * If you displayed the Recovery Request (Reset Request) as text on the Surface device being reset, use the keyboard to type the Recovery Request (Reset Request) in the provided field. + * If you displayed the Recovery Request (Reset Request) as a QR Code and then used a messaging or email application to send the code to the computer with Microsoft Surface UEFI Configurator, copy and paste the code into the provided field. + * If you saved the Recovery Request (Reset Request) as a file to a USB drive, click the **Import** button, browse to and select the Recovery Request (Reset Request) file, and then click **OK**. + +16. The reset verification code is displayed in Microsoft Surface UEFI Configurator, as shown in Figure 13. + +  + + *Figure 13. The reset verification code displayed in Microsoft Surface UEFI Configurator* + + * Click the **Share** button to send the reset verification code by email. + +17. Enter the reset verification code in the provided field on the Surface device (shown in Figure 8), and then click or press **Verify** to reset the device and unenroll the device from SEMM. +18. Click or press **Restart now** on the **SEMM reset successful** page to complete the unenrollment from SEMM, as shown in Figure 14. + +  + + *Figure 14. Successful unenrollment from SEMM* + +19. Click **End** in Microsoft Surface UEFI Configurator to complete the Recovery Request (Reset Request) process and close Microsoft Surface UEFI Configurator. + + diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md index 7ab6d68a18..d0d6052781 100644 --- a/education/windows/take-a-test-multiple-pcs.md +++ b/education/windows/take-a-test-multiple-pcs.md @@ -20,10 +20,10 @@ author: jdeckerMS Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test: - A Microsoft Edge browser window opens, showing just the test and nothing else. +- The clipboard is cleared. - Students aren’t able to go to other websites. - Students can’t open or access other apps. - Students can't share, print, or record their screens. -- Students can’t copy or paste. - Students can’t change settings, extend their display, see notifications, get updates, or use autofill features. - Cortana is turned off. diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index a1fa849959..fece24bac1 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -20,10 +20,10 @@ author: jdeckerMS The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test: - A Microsoft Edge browser window opens, showing just the test and nothing else. +- The clipboard is cleared. - Students aren’t able to go to other websites. - Students can’t open or access other apps. - Students can't share, print, or record their screens. -- Students can’t copy or paste. - Students can’t change settings, extend their display, see notifications, get updates, or use autofill features. - Cortana is turned off. diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md index 9e881238b6..c0de33cc5b 100644 --- a/education/windows/take-tests-in-windows-10.md +++ b/education/windows/take-tests-in-windows-10.md @@ -20,10 +20,10 @@ author: jdeckerMS Many schools use online testing for formative and summative assessments. It's critical that students use a secure browser that prevents them from using other computer or Internet resources during the test. The **Take a Test** app in Windows 10, Version 1607, creates the right environment for taking a test: - **Take a Test** shows just the test and nothing else. +- **Take a Test** clears the clipboard. - Students aren’t able to go to other websites. - Students can’t open or access other apps. - Students can't share, print, or record their screens. -- Students can’t copy or paste. - Students can’t change settings, extend their display, see notifications, get updates, or use autofill features. - Cortana is turned off. diff --git a/windows/deploy/TOC.md b/windows/deploy/TOC.md index a6d2e9d108..b6c4d77abb 100644 --- a/windows/deploy/TOC.md +++ b/windows/deploy/TOC.md @@ -1,4 +1,5 @@ # [Deploy Windows 10](index.md) +## [Deploy Windows 10 in a test lab](windows-10-poc.md) ## [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) ## [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md) ### [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) diff --git a/windows/deploy/images/PoC.png b/windows/deploy/images/PoC.png new file mode 100644 index 0000000000..de73506071 Binary files /dev/null and b/windows/deploy/images/PoC.png differ diff --git a/windows/deploy/index.md b/windows/deploy/index.md index d4254111b1..a67f501d11 100644 --- a/windows/deploy/index.md +++ b/windows/deploy/index.md @@ -16,6 +16,7 @@ Learn about deploying Windows 10 for IT professionals. |Topic |Description | |------|------------| |[Change history for Deploy Windows 10](change-history-for-deploy-windows-10.md) |This topic lists new and updated topics in the Deploy Windows 10 documentation for [Windows 10 and Windows 10 Mobile](../index.md). | +|[Deploy Windows 10 in a test lab](windows-10-poc.md) |This guide provides instructions for setting up a proof of concept (PoC) lab using Hyper-V and a minimum amount of resources. | |[Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) |To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the key capabilities and limitations of each, is a key task. | |[Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md) |This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT), and MDT 2013 Update 2 specifically. | |[Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) |If you have Microsoft System Center 2012 R2 Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. This topic will show you how to set up Configuration Manager for operating system deployment and how to integrate Configuration Manager with the Microsoft Deployment Toolkit (MDT) or, more specifically, MDT 2013 Update 2. | diff --git a/windows/deploy/windows-10-poc-mdt.md b/windows/deploy/windows-10-poc-mdt.md new file mode 100644 index 0000000000..04cb2496e2 --- /dev/null +++ b/windows/deploy/windows-10-poc-mdt.md @@ -0,0 +1,28 @@ +--- +title: Placeholder (Windows 10) +description: Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +author: greg-lindsay +--- + +# Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit + +**Applies to** + +- Windows 10 + +## In this guide + +## Related Topics + + + + + + + + + diff --git a/windows/deploy/windows-10-poc-sccm.md b/windows/deploy/windows-10-poc-sccm.md new file mode 100644 index 0000000000..3e43d7c402 --- /dev/null +++ b/windows/deploy/windows-10-poc-sccm.md @@ -0,0 +1,28 @@ +--- +title: Placeholder (Windows 10) +description: Deploy Windows 10 in a test lab using System Center Configuration Manager +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +author: greg-lindsay +--- + +# Deploy Windows 10 in a test lab using System Center Configuration Manager + +**Applies to** + +- Windows 10 + +## In this guide + +## Related Topics + + + + + + + + + diff --git a/windows/deploy/windows-10-poc.md b/windows/deploy/windows-10-poc.md index fd3ebe6339..c24209c3e2 100644 --- a/windows/deploy/windows-10-poc.md +++ b/windows/deploy/windows-10-poc.md @@ -8,73 +8,178 @@ ms.pagetype: deploy author: greg-lindsay --- -# Deploy Windows 10 in a test lab +# Step by step guide: Demonstrate Windows 10 deployment in a test lab + **Applies to** - Windows 10 -## Setting up a proof of concept deployment lab +## In this guide -This following topics provide instructions for setting up a proof of concept (PoC) lab where you can deploy Windows 10 in a private environment using a minimum amount of resources. The lab utilizes the Microsoft Hyper-V platform to run virtual machines that provide all the services and tools required to deploy Windows 10 on a network. +This guide provides instructions for configuring a test lab to be used as a proof of concept (PoC) environment where you can deploy Windows 10. The PoC enviroment is configured using Hyper-V and a minimum amount of resources. Additional guides leverage the PoC environment and provide detailed steps for deploying Windows 10 under common scenarios with current deployment tools. The following topics are available in this guide: -
Create a runtime provisioning package to apply settings, profiles, and file assets to a device running Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile, or Windows 10 Mobile Enterprise.
[Windows 10 servicing options for updates and upgrades](introduction-to-windows-10-servicing.md)
[Windows 10 servicing options](introduction-to-windows-10-servicing.md)
This article describes the new servicing options available in Windows 10, Windows 10 Mobile, and Windows 10 IoT Core (IoT Core) and how they enable enterprises to keep their devices current with the latest feature upgrades. It also covers related topics, such as how enterprises can make better use of Windows Update, and what the new servicing options mean for support lifecycles.
| **Term** | +**Description** | +
| Upgrade | +A new Windows 10 release that contains additional features and capabilities, released two to three times per year. | +
| Update | +Packages of security fixes, reliability fixes, and other bug fixes that are released periodically, typically once a month on Update Tuesday (sometimes referred to as Patch Tuesday). With Windows 10, these are cumulative in nature. | +
| Branch | +The windows servicing branch is one of four choices: Windows Insider, Current Branch, Current Branch for Business, or Long-Term Servicing Branch. Branches are determined by the frequency with which the computer is configured to receive feature updates. | +
| Ring | +A ring is a groups of PCs that are all on the same branch and have the same update settings. Rings can be used internally by organizations to better control the upgrade rollout process. | +
| For a PC that uses… | +Changing to… | +You need to: | +
|---|---|---|
| Windows Insider Program | +Current Branch | +Wait for the final Current Branch release. | +
| + | Current Branch for Business | +Not directly possible, because Windows Insider Program machines are automatically upgraded to the Current Branch release at the end of the development cycle. | +
| + | Long-Term Servicing Branch | +Not directly possible (requires wipe-and-load). | +
| Current Branch | +Insider | +Use the Settings app to enroll the device in the Windows Insider Program. | +
| + | Current Branch for Business | +Select the Defer upgrade setting, or move the PC to a target group or flight that will not receive the next upgrade until it is business ready. Note that this change will not have any immediate impact; it only prevents the installation of the next Current Branch release. | +
| + | Long-Term Servicing Branch | +Not directly possible (requires wipe-and-load). | +
| Current Branch for Business | +Insider | +Use the Settings app to enroll the device in the Windows Insider Program. | +
| + | Current Branch | +Disable the Defer upgrade setting, or move the PC to a target group or flight that will receive the latest Current Branch release. | +
| + | Long-Term Servicing Branch | +Not directly possible (requires wipe-and-load). | +
| Long-Term Servicing Branch | +Insider | +Use media to upgrade to the latest Windows Insider Program build. | +
| + | Current Branch | +Use media to upgrade to a later Current Branch build. (Note that the Current Branch build must be a later build.) | +
| + | Current Branch for Business | +Use media to upgrade to a later Current Branch for Business build (Current Branch build plus fixes). Note that it must be a later build. | +
| For a PC that uses… | -Changing to… | -You need to: | -
|---|---|---|
| Windows Insider Program | -Current Branch | -Wait for the final Current Branch release. | -
| - | Current Branch for Business | -Not directly possible, because Windows Insider Program machines are automatically upgraded to the Current Branch release at the end of the development cycle. | -
| - | Long-Term Servicing Branch | -Not directly possible (requires wipe-and-load). | -
| Current Branch | -Insider | -Use the Settings app to enroll the device in the Windows Insider Program. | -
| - | Current Branch for Business | -Select the Defer upgrade setting, or move the PC to a target group or flight that will not receive the next upgrade until it is business ready. Note that this change will not have any immediate impact; it only prevents the installation of the next Current Branch release. | -
| - | Long-Term Servicing Branch | -Not directly possible (requires wipe-and-load). | -
| Current Branch for Business | -Insider | -Use the Settings app to enroll the device in the Windows Insider Program. | -
| - | Current Branch | -Disable the Defer upgrade setting, or move the PC to a target group or flight that will receive the latest Current Branch release. | -
| - | Long-Term Servicing Branch | -Not directly possible (requires wipe-and-load). | -
| Long-Term Servicing Branch | -Insider | -Use media to upgrade to the latest Windows Insider Program build. | -
| - | Current Branch | -Use media to upgrade to a later Current Branch build. (Note that the Current Branch build must be a later build.) | -
| - | Current Branch for Business | -Use media to upgrade to a later Current Branch for Business build (Current Branch build plus fixes). Note that it must be a later build. | -